Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
30-06-2024 20:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5a7859e80fe07dbbfc602996e364a89e5062965904a5dcfac157c6b5d6ad0b8a.exe
Resource
win7-20240221-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
5a7859e80fe07dbbfc602996e364a89e5062965904a5dcfac157c6b5d6ad0b8a.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
5a7859e80fe07dbbfc602996e364a89e5062965904a5dcfac157c6b5d6ad0b8a.exe
-
Size
4.8MB
-
MD5
ecdec27451f2730689ad1057e5d6689e
-
SHA1
44f5820bce67c51aabd8a92b8ce8d05e0d7e3552
-
SHA256
5a7859e80fe07dbbfc602996e364a89e5062965904a5dcfac157c6b5d6ad0b8a
-
SHA512
0386081ad5827950b6bb6ce4ba45526aa3de972a6291ed3ac697717851b93a733f8d5814585fea9ac0963f992b5823b2a392c59026e5d91ee8da863b6cc5cfa4
-
SSDEEP
98304:wX3oVSsYFZ2xtS/BZXxkIfPG1f5eAM/Cw/khc5FbKEQ26PVR7m6gZ1MRGNCyI5AG:2F2qBZBkI0heAM/Cw/khc5FbKEV6PVRd
Score
8/10
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 12 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Processes:
KB931125.exeKB931125.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\Version = "28,0,2195,0" KB931125.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\Locale = "*" KB931125.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\Locale = "*" KB931125.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A} KB931125.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\ = "RootsUpdate" KB931125.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\IsInstalled = "1" KB931125.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\ComponentID = "Windows Roots Update" KB931125.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\ComponentID = "Windows Roots Update" KB931125.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A} KB931125.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\ = "RootsUpdate" KB931125.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\IsInstalled = "1" KB931125.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\Version = "28,0,2195,0" KB931125.exe -
Executes dropped EXE 10 IoCs
Processes:
KB931125.exeupdroots.exeupdroots.exeupdroots.exeupdroots.exeKB931125.exeupdroots.exeupdroots.exeupdroots.exeupdroots.exepid process 2556 KB931125.exe 1504 updroots.exe 2024 updroots.exe 2200 updroots.exe 1576 updroots.exe 2940 KB931125.exe 1356 updroots.exe 2640 updroots.exe 1044 updroots.exe 2032 updroots.exe -
Loads dropped DLL 31 IoCs
Processes:
5a7859e80fe07dbbfc602996e364a89e5062965904a5dcfac157c6b5d6ad0b8a.exeKB931125.exeupdroots.exeupdroots.exeupdroots.exeupdroots.exeKB931125.exeupdroots.exeupdroots.exeupdroots.exeupdroots.exepid process 2092 5a7859e80fe07dbbfc602996e364a89e5062965904a5dcfac157c6b5d6ad0b8a.exe 2092 5a7859e80fe07dbbfc602996e364a89e5062965904a5dcfac157c6b5d6ad0b8a.exe 2556 KB931125.exe 2556 KB931125.exe 2556 KB931125.exe 2556 KB931125.exe 1504 updroots.exe 2556 KB931125.exe 2556 KB931125.exe 2024 updroots.exe 2556 KB931125.exe 2556 KB931125.exe 2200 updroots.exe 2556 KB931125.exe 2556 KB931125.exe 1576 updroots.exe 2092 5a7859e80fe07dbbfc602996e364a89e5062965904a5dcfac157c6b5d6ad0b8a.exe 2940 KB931125.exe 2940 KB931125.exe 2940 KB931125.exe 2940 KB931125.exe 1356 updroots.exe 2940 KB931125.exe 2940 KB931125.exe 2640 updroots.exe 2940 KB931125.exe 2940 KB931125.exe 1044 updroots.exe 2940 KB931125.exe 2940 KB931125.exe 2032 updroots.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
5a7859e80fe07dbbfc602996e364a89e5062965904a5dcfac157c6b5d6ad0b8a.exedescription ioc process File opened for modification \??\PhysicalDrive0 5a7859e80fe07dbbfc602996e364a89e5062965904a5dcfac157c6b5d6ad0b8a.exe -
Drops file in Windows directory 2 IoCs
Processes:
KB931125.exeKB931125.exedescription ioc process File opened for modification C:\Windows\INF\setupapi.app.log KB931125.exe File opened for modification C:\Windows\INF\setupapi.app.log KB931125.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
updroots.exeupdroots.exeupdroots.exeupdroots.exeupdroots.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\9ED18028FB1E8A9701480A7890A59ACD73DFF871\Blob = 0300000001000000140000009ed18028fb1e8a9701480a7890a59acd73dff87109000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b060105050703030b0000000100000042000000530065007200610073006100200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020004900490049000000200000000100000029040000308204253082030da00302010202083b57fc376d701fb4300d06092a864886f70d01010505003066310b300906035504061302425231143012060355040a130b53657261736120532e412e31163014060355040b130d53657261736120434120494949312930270603550403132053657261736120436572746966696361746520417574686f7269747920494949301e170d3034313132363133313431345a170d3234313132313133323431345a3066310b300906035504061302425231143012060355040a130b53657261736120532e412e31163014060355040b130d53657261736120434120494949312930270603550403132053657261736120436572746966696361746520417574686f726974792049494930820122300d06092a864886f70d01010105000382010f003082010a0282010100f247c400a81e1aefef4fc03f6f45343e38ea97bd4e34087943978c1464932461198b18500ccc1fb237c1b8bfc4b55940ad9556370492fc5b3eac213ed1db06e092cd85ee06f6815f86e35f94b56c7edae24fe7262632bda8635d029a39df3be8ce4c658409ef788d04a5498a7bc3517e6b01e0e9ebd29213cc00d7c6261f04e360efec1814ef18f63c0344433870360d9620d4437ebfd486d8f92cdccb2c7b2e1d5e83176fce12354d4f8c9d20d8356acfdafc0c4604012e037a454e840b2d26cbab2e587f684395b7b24ed4ff975ef9a7b22f94215cf37e3ec00007f7ff8c2db5814ef6f92885b7fbbee3ceb2be1f461d96a0e48debfaec34c6b4b49609f2090203010001a381d63081d330310603551d25042a302806082b0601050507030106082b0601050507030206082b0601050507030306082b06010505070304305e0603551d1f045730553053a051a04f864d687474703a2f2f7777772e636572746966696361646f6469676974616c2e636f6d2e62722f7265706f7369746f72696f2f73657261736163612f63726c2f53657261736143414949492e63726c301d0603551d0e0416041446c278ab54e0f8682739df42b3f354c3067d26a1300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106300d06092a864886f70d0101050500038201010080391c9d3d892006f4ed095c8f2e1f612965b06c3b2178d83193d8aefca780ed5525573804e81ceabb5e992758b43d70034fee065465fb5d0ad447905100ed82df97f6d790af18796033a048155cfa52c00d196c26c2731bbe1b033870188e953c7ae0f4ee38c2e630c3b6016c52078a295f549d5c8f2cfd3eb90acf6e57ffdc90f8f4d72657c602ca0b05adc670c74816aa65e0965bcaebfb5d3bb1c65fbc1e38eba040d0a8d896e26f3492853e960415aa240c3855b66922347c41d810bc349bcf1f4c2507562091423919510b3c90d37918daef1d9feee2ba01145e1583833bcea705f340c73b469cc00fd3d62a4f930707f5ff8ad4a706e52eae0c488b70 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D6DAA8208D09D2154D24B52FCB346EB258B28A58 updroots.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\379A197B418545350CA60369F33C2EAF474F2079 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\24A40A1F573643A67F0A4B0749F6A22BF28ABB6B updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E5DF743CB601C49B9843DCAB8CE86A81109FE48E updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8D08FC43C0770CA84F4DCCB2D41A5D956D786DC4 updroots.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E0925E18C7765E22DABD9427529DA6AF4E066428 updroots.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\61EF43D77FCAD46151BC98E0C35912AF9FEB6311 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D3C063F219ED073E34AD5D750B327629FFD59AF2\Blob = 0b000000010000002200000041002d00540072007500730074002d006e005100750061006c002d00300033000000090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b0601050508020206082b06010505070309030000000100000014000000d3c063f219ed073e34ad5d750b327629ffd59af22000000001000000d3030000308203cf308202b7a0030201020203016c1e300d06092a864886f70d010105050030818d310b300906035504061302415431483046060355040a0c3f412d5472757374204765732e20662e20536963686572686569747373797374656d6520696d20656c656b74722e20446174656e7665726b65687220476d624831193017060355040b0c10412d54727573742d6e5175616c2d30333119301706035504030c10412d54727573742d6e5175616c2d3033301e170d3035303831373232303030305a170d3135303831373232303030305a30818d310b300906035504061302415431483046060355040a0c3f412d5472757374204765732e20662e20536963686572686569747373797374656d6520696d20656c656b74722e20446174656e7665726b65687220476d624831193017060355040b0c10412d54727573742d6e5175616c2d30333119301706035504030c10412d54727573742d6e5175616c2d303330820122300d06092a864886f70d01010105000382010f003082010a0282010100ad3d616e03f3903bc0410b8480cdec2aa39d6bbb6ec24284f75114e1a0a82d51a351f2de23f03444ff94ebcc05239540b90778a525f60abd4586e8d9bdc0048e854461ef7fa7c9fac125cc852c633f0560734905e0607895104bdcf91159ce717f409b8aaa24df0b42e2db56bc4ad2a50c9bb7433edd83d3261002cfea23c4494ee5d3e9b488ab0cae6292d46587d96ad7f4859fe4332225a5e5c833bac3c741dc5fc66acc000e6d32a8b687360062779b1e1f34cb903c78887405eb79f5937165ca9dc76b182d3d5c4ee7d5f83f317d8f87ec0a222f23e9febb7dc9e0f4eceb7cc4b0c32d62b59a71d6b16ae8ecd9edd572ecbe5701ce05559fded1608810b30203010001a3363034300f0603551d130101ff040530030101ff30110603551d0e040a0408446a95675579114f300e0603551d0f0101ff040403020106300d06092a864886f70d0101050500038201010055d454d159485cb39385aabf632fe480ce34a334623ef6d8ee67883104036f0bd407fb4e750fd32ed3c017c7c628ec060d11240e0ea55dbf8cb2139671dcd4ce0e0d0a68326cb9413119abb1077b4d98d35cb0d1f0a742a0b5c48eaffef13ff4ef4f460076eb02fbf99dd24096c7883ab89f1179f38065a8bd1fd37881a0514c37b4a65d2570d166c968f92e111468f1549808ac26920fde899ed4fab3792bd2a379d4ec8bac875368424c5151741e1b272ee3f51f29744dedaff7e1929981e8be3ac71750f6b7c6fc9bb08a6bd68803918f06773a8502dd98d543783fc63015ac9b6bcb57b789518b3ae8c9840cdbb150200a1a4aba6a1abdec1bc8c5849acd updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3679CA35668772304D30A5FB873B0FA77BB70D54 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\BC7B3C6FEF26B9F7AB10D7A1F6B67C5ED2A12D3D\Blob = 030000000100000014000000bc7b3c6fef26b9f7ab10d7a1f6b67c5ed2a12d3d090000000100000048000000304606082b0601050507030306082b0601050507030106082b0601050507030206082b0601050507030406082b0601050508020206082b0601050507030806082b060105050703090b000000010000002600000050006f00730074002e0054007200750073007400200052006f006f00740020004300410000002000000001000000be060000308206ba308205a2a003020102020439a293e3300d06092a864886f70d01010505003056310b30090603550406130249453110300e060355040a1307416e20506f737431183016060355040b130f506f73742e5472757374204c74642e311b301906035504031312506f73742e547275737420526f6f74204341301e170d3030303832323134353632315a170d3130303832303133353632315a3056310b30090603550406130249453110300e060355040a1307416e20506f737431183016060355040b130f506f73742e5472757374204c74642e311b301906035504031312506f73742e547275737420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d67f13e40d24d8d8fbe9b6c3b152a34edcb73be2f70e5f81e601f0a6e63670d81373a1ff520890f215bcf2321ca8d7e106107b41a894c73f3d4415dc8051e730fe5348f5905f6d6d25e060bba0fbd6c629f84d70501a37a00ecd782ab668f399d40c8e5e1262ffc25f5a9a2b8847aabba1d975f02c5cfe6dc2b15b31cc83871aa7be900ee8105453520b9c49f38002fe6f27a6a35730b8dbb8d0000403e4e5d44306ebab684d6826d29934b9e012967f4bbb6b6e2171e608454a1d660d37c903e1d1cadcb12f70f6b78162961b64a7febbe186eb419fa89cd8caa0e1d62ff80fe1ba4038f76dd1a5ca4c19c896dccc491c0ab6d3a8913af9daec1dcd734a243f0203010001a382038e3082038a300f0603551d130101ff040530030101ff3082034d0603551d2004820344308203403082033c06072a8274bbe822013082032f308202f406082b06010505070202308202e61a8202e25468697320636572746966696361746520697320697373756564207375626a65637420746f2074686520506f73742e547275737420435053207465726d7320616e6420636f6e646974696f6e73207768696368206f75746c696e65207468652077617272616e746965732070726f76696465642077697468207468697320636572746966696361746520616e642074686520657874656e74206f6620746865206c696162696c697479206f6620506f73742e5472757374204c696d697465642e2020506f73742e5472757374204c696d6974656420657870726573736c79206578636c75646573206365727461696e206578707265737320616e6420696d706c6965642077617272616e7469657320616e6420636f6e646974696f6e732c20696e636c7564696e672077617272616e7469657320617320746f206669746e65737320666f7220707572706f7365206f72206d65726368616e746162696c6974792c20616e642077696c6c206e6f74206265206c6961626c6520666f7220696e64697265637420616e6420636f6e73657175656e7469616c2074797065206c6f737365732c206f7220666f72206c6f737320696e20657863657373206f6620612073706563696669656420616d6f756e742e20204163636f7264696e676c792c2074686520435053207465726d7320616e6420636f6e646974696f6e73206d7573742062652072656164206265666f726520616e792072656c69616e63652063616e20626520706c61636564206f6e20746869732063657274696669636174652c20616e6420627920616363657074696e67206f6e20746869732063657274696669636174652c2061207375627363726962657220616e642f6f722072656c79696e672070617274792069732061636b6e6f776c656467696e6720746861742069742068617320726561642c20756e64657273746f6f6420616e642061636365707465642074686520435053207465726d7320616e6420636f6e646974696f6e732e20303506082b060105050702011629687474703a2f2f7777772e706f73742e74727573742e69652f7265706f7369742f6370732e68746d6c30110603551d0e040a0408411a8ce34f3deff130130603551d23040c300a8008411a8ce34f3deff1300d06092a864886f70d01010505000382010100678da9e3aff8f1e16d2cfbd70d624baef0583bbe3243505bf2438e3e1bf0373512903c36011dff29f408a67eeeb11e51b8b90b5cebb7e20df48a30f8a835180bc78e73ea06992b0725070f734bffba245b84fcce943652fb909c7a8d8ba0887a46fc9a2858cb8dab54f4ed783af73bd367e38f908399a208528216b5815c9b0831fce5d678ae80f14c02636c8e049cb97b99f11c33a1af7b43518507aedf2ec509fc84a5fe55bc0ae4785ca6d8f73b8f0ac76ef99f8e100f4204fc5741fe523fb131946ff06dd44e05dd9e2b005fc1127e4264a76116314f7cbe0ec8e310fb2ef71565a754ca5da4cc2ccc7800bd01d7cddfd0db33dd89a714d7a221bc35d60e updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\59AF82799186C7B47507CBCF035746EB04DDB716 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\93E6AB220303B52328DCDA569EBAE4D1D1CCFB65 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 53000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd updroots.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4F65566336DB6598581D584A596C87934D5F2AB4 updroots.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0747220199CE74B97CB03D79B264A2C855E933FF updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\74207441729CDD92EC7931D823108DC28192E2BB\Blob = 03000000010000001400000074207441729cdd92ec7931d823108dc28192e2bb090000000100000016000000301406082b0601050507030406082b060105050703010b0000000100000038000000430065007200740050006c0075007300200043006c006100730073002000320020005000720069006d00610072007900200043004100000053000000010000002700000030253023060d2b0601040181ad5a020502030130123010060a2b0601040182373c0101030200c0200000000100000096030000308203923082027aa00302010202110085bd4bf3d8dae369f694d75fc3a54423300d06092a864886f70d0101050500303d310b30090603550406130246523111300f060355040a130843657274706c7573311b301906035504031312436c6173732032205072696d617279204341301e170d3939303730373137303530305a170d3139303730363233353935395a303d310b30090603550406130246523111300f060355040a130843657274706c7573311b301906035504031312436c6173732032205072696d61727920434130820122300d06092a864886f70d01010105000382010f003082010a0282010100dc5096d012f835d208787ab65270fd6feecfb911cb5d77e1ece97e048dd6cc6f73435760ac330a44ec035f1c802491e5a891561282f7e02bf4dbae612e89108d6b6cbab302bdd536c5483723e2f05a3752331712e2d1604dbe2f4111e3f617250c8b91c01b997b99560dafeed2bc4757e379497b3489272484deb1ece9584efe4edf5abe41adac08c5180eefd253ee6cd09d1201138ddc8062f795a944884a714e60559edb23197956070c3f630b5cb0e2be7e15fc943358413874c4e18f8bdf26ac1fb58b3bb743596bb024a66d908bc472ea5d3398b7cbde5e7bef94f11b3ecac921c1c59802aaa2f65b779bf57e9655341c6769c0f142e347acfc281c66550203010001a3818c308189300f0603551d13040830060101ff02010a300b0603551d0f040403020106301d0603551d0e04160414e3732ddfcb0e280cdeddb3a4ca79b88ebbe83089301106096086480186f842010104040302010630370603551d1f0430302e302ca02aa0288626687474703a2f2f7777772e63657274706c75732e636f6d2f43524c2f636c617373322e63726c300d06092a864886f70d01010505000382010100a754cf884419cbdfd47f00df563362b5f7510190ebc33fd18844e9245defe714bd20b79a3c00fe6d9fdb90dcd7f462d68b705de7e50448a9687cc9f142f36c7fc57a7c1d5188bad20a3e275dde2d514ed3136469e42ee3d3e79b0999a6e0959bce1ad77fbe3cce52b31115c10f17cd03bb9c2515baa27689fc06f118d0934b0e7c82b7a5f4f65ffeed40a69d847439b9dc1e8516da291b862300c9bb897e6e80881e2f14b40324a8326f039a472c30be56c6a74202701bea40d8ba05037007a496fffd48330ae1dca581909b4ddd7de7e7b2cd5cc86a95f8a5f68dc45d7808be7b06d649cf193650232e08e69e054d4718d516e9b1d6b610d5bb97bfa28eb454 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2964B686135B5DFDDD3253A89BBC24D74B08C64D\Blob = 0b000000010000002000000041002d004300450052005400200041004400560041004e004300450044000000090000000100000040000000303e06082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a03040300000001000000140000002964b686135b5dfddd3253a89bbc24d74b08c64d2000000001000000d7060000308206d3308205bba003020102020100300d06092a864886f70d01010505003081cc310b30090603550406130241543110300e0603550408130741757374726961310f300d060355040713065669656e6e61313a3038060355040a13314152474520444154454e202d20417573747269616e20536f636965747920666f7220446174612050726f74656374696f6e31253023060355040b131c412d434552542043657274696669636174696f6e2053657276696365311830160603550403130f412d4345525420414456414e434544311d301b06092a864886f70d010901160e696e666f40612d636572742e6174301e170d3034313032333134313431345a170d3131313032333134313431345a3081cc310b30090603550406130241543110300e0603550408130741757374726961310f300d060355040713065669656e6e61313a3038060355040a13314152474520444154454e202d20417573747269616e20536f636965747920666f7220446174612050726f74656374696f6e31253023060355040b131c412d434552542043657274696669636174696f6e2053657276696365311830160603550403130f412d4345525420414456414e434544311d301b06092a864886f70d010901160e696e666f40612d636572742e617430820122300d06092a864886f70d01010105000382010f003082010a0282010100ddeb97232fa69dfe8160a6caf901f993aefdb5416a793f23959c4c7b0f1e3621eec3d2a8c560732fa2a4b0afb9b8aec66adc3eb1b0189ed10613cd0ff898358400cc7be16be55d1b73a412de0915b5f5025bf448bdf30cdfda31be6a8998e80f9c953b1fafa798bb6cabad6dbfd915262ff6e18e705d6de875eb7bdac179ec4a06eacefcc3405454b35c327812f5b659ce6746dff77a25b906828345ffc0dc8020495bfb7426b708cf2a695c8395b54cf33abad4f3acee5204f746d925e648c6ec3107a456fd1f47d3398d6ff3e811a1a3bada00343c28b2b205598f08157987b7280835d67ce7ca5783bf5f7cb8adc3735a17206623271d85a4a594bc0b80130203010001a38202bc308202b8301d0603551d0e04160414377f3e3e997160ca24d4911379d07429b4a824d83081f90603551d230481f13081ee8014377f3e3e997160ca24d4911379d07429b4a824d8a181d2a481cf3081cc310b30090603550406130241543110300e0603550408130741757374726961310f300d060355040713065669656e6e61313a3038060355040a13314152474520444154454e202d20417573747269616e20536f636965747920666f7220446174612050726f74656374696f6e31253023060355040b131c412d434552542043657274696669636174696f6e2053657276696365311830160603550403130f412d4345525420414456414e434544311d301b06092a864886f70d010901160e696e666f40612d636572742e6174820100300f0603551d130101ff040530030101ff300b0603551d0f0404030201e630470603551d250440303e06082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070308060a2b0601040182370a0304301106096086480186f84201010404030200ff30510603551d20044a3048304606082a28001801010103303a303806082b06010505070201162c687474703a2f2f7777772e612d636572742e61742f63657274696669636174652d706f6c6963792e68746d6c303b06096086480186f8420108042e162c687474703a2f2f7777772e612d636572742e61742f63657274696669636174652d706f6c6963792e68746d6c30190603551d1104123010810e696e666f40612d636572742e6174302f0603551d1204283026810e696e666f40612d636572742e61748614687474703a2f2f7777772e612d636572742e617430450603551d1f043e303c303aa038a036863468747470733a2f2f7365637572652e612d636572742e61742f6367692d62696e2f612d636572742d616476616e6365642e636769300d06092a864886f70d0101050500038201010025f522f81f746dabbdfbf7e4ee3cbd212f71568476537c5121411d6cf7251028ce0cef681b701e48ca670b7997f0563ad8dbbc77d18c3b7b8a394111cc4e3ab342d5f7f2307c07ad7a6f7dfe98a50e709f198860441c5118861ccaabb845f45a4b8336048ac1e7ec817b36ede7816ae1e034655c4d81f5ae61eefd9c8ba4bc4ec894363c2cc0d43cd6deb5a4217f76a2027b95345d5ab6f1c142f55c68a7c679da43be3eff2d2923d24d12fee2736b6993079132991e75a2d69ac0b5fa8adf29379bb20ebd68c682c7ba3a8cd38d46647fed355a3dff3f93a839d9c1d9f585a342fba9db66f9ad6c46279af92d9e2f08f985e3e4f896eb6351801afe51ae4138 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 0b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f007200690074007900200013202000470032000000090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070308060a2b0601040182370a030406082b0601050507030606082b0601050507030703000000010000001400000047beabc922eae80e78783462a79f45c254fde68b2000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0CFD83DBAE44B9A0C8F676F3B570650B94B69DBF\Blob = 0300000001000000140000000cfd83dbae44b9a0c8f676f3b570650b94b69dbf090000000100000048000000304606082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030706082b0601050507030806082b060105050703090b000000010000005000000041004e004300450052005400200043006f00720070006f0072006100630069006f006e006500730020006400650020004400650072006500630068006f0020005000750062006c00690063006f0000002000000001000000510500003082054d30820435a00302010202103fb2e5f2d17c8b18645662a939817fa7300d06092a864886f70d010105050030818c310b3009060355040613024553314b3049060355040a13424167656e636961204e6f74617269616c2064652043657274696669636163696f6e20532e4c2e20556e69706572736f6e616c202d20434946204238333339353938383130302e06035504031327414e4345525420436f72706f726163696f6e6573206465204465726563686f205075626c69636f301e170d3034303231313137323234355a170d3234303231313137323234355a30818c310b3009060355040613024553314b3049060355040a13424167656e636961204e6f74617269616c2064652043657274696669636163696f6e20532e4c2e20556e69706572736f6e616c202d20434946204238333339353938383130302e06035504031327414e4345525420436f72706f726163696f6e6573206465204465726563686f205075626c69636f30820122300d06092a864886f70d01010105000382010f003082010a0282010100a2219587dc8aebd67a90a86835fd17fc743a541092359342752ed83ecba994a1be6a373f52baa47bda849916794e0068d41f13e9463b3c4a9d833ad821efc2f24045e10f604504edfc8a182ef93de4a41132208e3ab7ee9640151a99e9219d72accd1f89aeaad9a140b0a867befc7a0e47b15ebcf8306a8e379f0542ec2cc3a61b8babc4503dfae473f521b0b8555f87e0a247382f405f4f6cab942456e34c8f7e90e92782289b98ba9ad6b59b576f6b151cf9bb70297d3cf713a8d171f1b0fe884571a9a57465cbc3f9f5030f10c38630006ec1c026a288fe21c7323dbbc67b1bb79b8ab3fab17c71d901a74290aa2f989084aadec6adec3c514a051d01519b0203010001a38201a7308201a3300f0603551d130101ff040530030101ff308201200603551d2004820117308201133082010f06092b060104018193680330820100302506082b060105050702011619687474703a2f2f7777772e616e636572742e636f6d2f6370733081d606082b060105050702023081c9300d1606414e4345525430030201011a81b74167656e636961204e6f74617269616c2064652043657274696669636163696f6e2e204c61206465636c61726163696f6e2064652070726163746963617320646520636572746966696163696f6e20717565207269676520656c2066756e63696f6e616d69656e746f206465206c612070726573656e7465206175746f726964616420736520656e6375656e74726120646973706f6e69626c6520656e20687474703a2f2f7777772e616e636572742e636f6d2f637073300e0603551d0f0101ff040403020186301c0603551d11041530138111616e6365727440616e636572742e636f6d301f0603551d230418301680148c4c1e370cb19fd2ac440b3abe02cff48d2d6695301d0603551d0e041604148c4c1e370cb19fd2ac440b3abe02cff48d2d6695300d06092a864886f70d010105050003820101004774c09491e2a5fb985244936cc4c01de079db69642d61aea4779135b5b7ca97aac0b186f51b686baa58b27c3fe70327f84171bca6d220a98095a247ad6d4674ad849bd86fa9f5b92f6d9bc0dd9987ed59b27581a589852accd085814df3af77de8cc1289a42ac05870c349c7187fdec01141fbec32ef0dffa24a65d1f3cf1a20b518801ae1287a4b55d71b2dfef0d7c20e37f130b4da6c077cc3fd60f71c7714c2e1efa190665c9ad566c778d463fbd30831ee02e55b87823743c580a633a4d817b6f3570aeb625d9f624fe23c6da1a88afa8149373e0c05bb031691af6295f56b71a0ac2f90bea02c13311626a7c43e8ea1aab900085e0450f7d8eba50d5c6 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8EB03FC3CF7BB292866268B751223DB5103405CB updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0446C8BB9A6983C95C8A2E5464687C1115AAB74A updroots.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\968338F113E36A7BABDD08F7776391A68736582E\Blob = 0b00000001000000540000004a006100700061006e0020004c006f00630061006c00200047006f007600650072006e006d0065006e007400200050004b00490020004100700070006c00690063006100740069006f006e00200043004100000009000000010000003e000000303c06082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030806082b06010505070309030000000100000014000000968338f113e36a7babdd08f7776391a68736582e2000000001000000a4030000308203a030820288a003020102020131300d06092a864886f70d01010505003039310b3009060355040613024a50310e300c060355040a13054c47504b49311a3018060355040b13114170706c69636174696f6e204341204732301e170d3036303333313135303030305a170d3136303333313134353935395a3039310b3009060355040613024a50310e300c060355040a13054c47504b49311a3018060355040b13114170706c69636174696f6e20434120473230820122300d06092a864886f70d01010105000382010f003082010a0282010100b935c610f8db68db07c4404cb01d1e36dcc341f6cf55156d087f5cc66855e5e757f19651e6e14d780f6e4015703b65fe11dfe7d3d658353be19f02fc9452462eb39e609b029ec982d2f6e3ae094f8444b6629b005168b83aadec64d1324be9944483b40ece21896bb036c098c64b9cc23e5b602a09312b2dab4cdeb1a0fd5856c2831d20bcc48409877ba89597c6258e83e03e930dd1c77d73a9a8fc1900402e22b87a3341f578fd5a71e782d948885ceca885872d6d8089671a69be10c05a8eed887d3e6f2c386b37ce47d8a23130de7e53656c8b865341206cbd48a57eaf005a56125881d1dc8959f9b5eef84d9ad844298b79a7f722aaea7c5cb41688200d0203010001a381b23081af301d0603551d0e041604147fb85d8ec4186bc67dcc2ee9aece34e7175de0a1300e0603551d0f0101ff040403020106304c0603551d1f044530433041a03fa03da43b3039310b3009060355040613024a50310e300c060355040a13054c47504b49311a3018060355040b13114170706c69636174696f6e204341204732300f0603551d130101ff040530030101ff301f0603551d230418301680147fb85d8ec4186bc67dcc2ee9aece34e7175de0a1300d06092a864886f70d010105050003820101003cd873364006484a5419f527483925a56e42e7b6cd1bcb3934b79bec4f2abe77e4ca84fc1deb9b2240d5f4fb688772fc475d6a0e524ae3b55d48c62296e6336d6dabf6cdd7cb245a8ca8459e3e61827d94d505f01a355f712f2e54b54105ef860d52ef9c981bf12c4c3ad1f386d38c3e7a2f86458e8332265bbf53ca0e5156dc9ac25a30190da79ed5aa9b2039697821f4976dd10e114c2ed31b5ab0f997785c2a8f5265ee4c4225c237300e6d2b35948306e8af453b0466a730bbf9e0213b636e7d445d3a6a53ef111724fd54b25a6c735621c96c2d97a442b327610521636dea28bc4f1a6f42dc98ab55d31e1bc0923f9bc1e63b1756e2c4984325eeb6cb00 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\FEB8C432DCF9769ACEAE3DD8908FFD288665647D\Blob = 53000000010000002400000030223020060a2a83088c9b1b6485510130123010060a2b0601040182373c0101030200c00b00000001000000360000005300450043004f004d002000540072007500730074002000530079007300740065006d007300200043004f0020004c00540044000000090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070308030000000100000014000000feb8c432dcf9769aceae3dd8908ffd288665647d2000000001000000810300003082037d30820265a003020102020100300d06092a864886f70d01010505003060310b3009060355040613024a5031253023060355040a131c5345434f4d2054727573742053797374656d7320434f2e2c4c54442e312a3028060355040b1321536563757269747920436f6d6d756e69636174696f6e20455620526f6f74434131301e170d3037303630363032313233325a170d3337303630363032313233325a3060310b3009060355040613024a5031253023060355040a131c5345434f4d2054727573742053797374656d7320434f2e2c4c54442e312a3028060355040b1321536563757269747920436f6d6d756e69636174696f6e20455620526f6f7443413130820122300d06092a864886f70d01010105000382010f003082010a0282010100bc7fec579b24e0fe9cba4279a9888afa80e0f5072943ea8e0a34368d1cfaa7b53978ff9775f72fe4aa6b048444caa6e2688efd5550620fa4710ece07382d428550ad3c966f8bd5a20ecfde49893dd6642e38e51e6cb5578a9eef480ecd7a69168744b590e4069daea104975879ef204a826b8c22bfec1f0fe98471edf10ee4b81813cc56365dd19a1e516b396e607688340bf3b3d1b09dca61e2641dc14607b863dd1e3365b38e0955523db5bdff07ebad6155182ca969984aaa40c53314657400f991deaf0348c54054dc0f84906820c59296dc2ee50245aac05f54f86dea49cf5d6c4bafef9ac2565cc63556426a305fc2abf6e23d3fb3c9118f314cd79f490203010001a3423040301d0603551d0e04160414354af54daf3fd78238acab716517758c9d5593e6300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010505000382010100a887e9ecf840675dc3c166c7404b97fc8713905ac4efa0ca5f8bb7a7b7f1d6b564b78ab3b81bccdafbac668841cee8fce4db1e88a6ed27501b0230244679fe048770974073d1c0c157199a69a52799ab9d6284f651c12cc92315d828b7ab2513b546e18602ff268cc488921d56fe1967f255e480a36b9cab77e151710d20db109adbbd767907779928ad9a5edab14f442c358ea596c7fd83f058c679d6987ca88dfe863e071692e17be71dec33767e422e4a85f9918968840381a59b9abee337c554ab563b182d41a40cf842db99a0e0726fbb5de1164f530a64f94ef4bf4e54bd786c88eabf9c1324c27069a27f0fc83cad08c9b09840a32ae78883ed778f74 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\086418E906CEE89C2353B6E27FBD9E7439F76316 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A3E31E20B2E46A328520472D0CDE9523E7260C6D\Blob = 0b000000010000002c00000044005300540020002800420061006c00740069006d006f0072006500200045005a0029002000430041000000090000000100000016000000301406082b0601050507030406082b06010505070301030000000100000014000000a3e31e20b2e46a328520472d0cde9523e7260c6d20000000010000000604000030820402308202eaa003020102020437826d48300d06092a864886f70d01010505003075310b300906035504061302555331243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311c301a0603550403131342616c74696d6f726520455a2062792044535431223020060a0992268993f22c640103141263614064696773696774727573742e636f6d301e170d3939303730363230353635335a170d3039303730333139353635335a3075310b300906035504061302555331243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311c301a0603550403131342616c74696d6f726520455a2062792044535431223020060a0992268993f22c640103141263614064696773696774727573742e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100bcccb33d4379b847f915b76e26b14c929879edc570f33ae9d5dd03f42a3f608c96e5471602f736b2f19e2688f59e42659e0fae7fe3ccb16e21f5f1882274d61fb277043932ba47b535c0135d0172a30543cc4eda269a87a86163f466a7c31546ead1d1ea30c3bb716a9bc14386c1391fc65660021bfc883aa099bb8cd77861d05e578f913b808b6effc965810a39bb90132035483fa5e1bf2dc171838520ed2087cbb6fe198c04dded295ddf0a12ce8956f21f5a193158b6fd6336eac923dea79197276572996cc77a44c45fbe9b1f1eca9e581ca6aa236ae3061b9224d857220950159046f0835eb6804c12813d666f04553a886bd0ef568750a0b9d6551b9d0203010001a38199308196300f0603551d130101ff040530030101ff305b0603551d2004543052305006096086480186f92f00003043304106082b060105050702011635687474703a2f2f7777772e64696773696774727573742e636f6d2f4453545f54525553545f4350535f763939303730312e68746d6c30110603551d0e040a04084cd762ce894ede2430130603551d23040c300a80084cd762ce894ede24300d06092a864886f70d010105050003820101007c028914385f831be6c6585bf34cc21cf6db27772ddcce1b13502f12478aca9cb3026727c41f32dfe0c25444a02518e32ff4ac2d66e4cc875eab097dd394a9d57d5948abee297c087b0738dd2bb22f1ee0cde79710ffc608065d3f81f436fec60e0dc16b7a509de7375ca059475dac18953f859edc73580400a44ce421b7ee90ba2afc58e309b07017b4aa66a3fa8939f403438322024374b3ddb5c9062996c7b993385fe00b65e27c7c19c35573e8cc0e060808c9a40571512a2c7d03170ecc8ee05da2d0777772b1661b748def08735358bd20dbf91b01a210d192fec3b2a574722ee6ec3dfc5a2fa86986bb6e40e16657842389af3164e78fe17a65a00b86 updroots.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\54F9C163759F19045121A319F64C2D0555B7E073 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E updroots.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\273EE12457FDC4F90C55E82B56167F62F532E547 updroots.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\80BF3DE9A41D768D194B293C85632CDBC8EA8CF7 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C8EC8C879269CB4BAB39E98D7E5767F31495739D updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\51A44C28F313E3F9CB5E7C0A1E0E0DD2843758AE updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\627F8D7827656399D27D7F9044C9FEB3F33EFA9A\Blob = 030000000100000014000000627f8d7827656399d27d7f9044c9feb3f33efa9a090000000100000016000000301406082b0601050507030106082b060105050703030b000000010000000e000000740068006100770074006500000053000000010000002500000030233021060b6086480186f8450107300130123010060a2b0601040182373c0101030200c020000000010000002b0300003082032730820290a003020102020101300d06092a864886f70d01010405003081ce310b3009060355040613025a41311530130603550408130c5765737465726e204361706531123010060355040713094361706520546f776e311d301b060355040a131454686177746520436f6e73756c74696e6720636331283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e3121301f06035504031318546861777465205072656d69756d205365727665722043413128302606092a864886f70d01090116197072656d69756d2d736572766572407468617774652e636f6d301e170d3936303830313030303030305a170d3230313233313233353935395a3081ce310b3009060355040613025a41311530130603550408130c5765737465726e204361706531123010060355040713094361706520546f776e311d301b060355040a131454686177746520436f6e73756c74696e6720636331283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e3121301f06035504031318546861777465205072656d69756d205365727665722043413128302606092a864886f70d01090116197072656d69756d2d736572766572407468617774652e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100d236366a8bd7c25b9eda8141628f38ee490455d6d0ef1c1b951647ef1848353a52f42b6a068f3b2fea56e3af868d9e17f79eb46575024defcb09a22151d89bd067d0ba0d92061473d493cb972a009c5c4e0cbcfa1552fcf2446eda114a6e089f2f2de3f9aa3a8673b6465358c88905bd8311b8733faa078df4424de7409d1c370203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d01010405000381810026482c16c258fae816740caaaa5f543ff2d7c978605e5e6e37632277367eb217c434b9f50885fcc90138ff4dbef2164243e7bb5a46fbc1c6111ff14ab02846c9c3c4427dbcfaab596ed5b7518811e3a485196b824ca40c12ade9a4ae3ff1c349659a8cc5c83e25b79499bb92327107f0865eed5027a60da623f9bbcba6071442 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFCED9C6BDD0C985CA3C7D253063C5BE6FC620C\Blob = 0300000001000000140000004efced9c6bdd0c985ca3c7d253063c5be6fc620c090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000004e000000430065007200740069007300690067006e0020004100750074006f00720069006400610064006500200043006500720074006900660069006300610064006f00720061002000410043003200000020000000010000006e0200003082026a308201d3a003020102020100300d06092a864886f70d01010405003072310b3009060355040613024252312e302c060355040a132543657274697369676e20436572746966696361646f7261204469676974616c204c7464612e31333031060355040b132a43657274697369676e202d204175746f72696461646520436572746966696361646f7261202d20414332301e170d3939303632373030303030305a170d3138303632373030303030305a3072310b3009060355040613024252312e302c060355040a132543657274697369676e20436572746966696361646f7261204469676974616c204c7464612e31333031060355040b132a43657274697369676e202d204175746f72696461646520436572746966696361646f7261202d2041433230819f300d06092a864886f70d010101050003818d0030818902818100b930cca5eb90d65694673389836d46be709793174e0a2770cec9c5f2c5d22dd1119c77326c74d3926ffae9d5b8619aaa4c133e353af0ee0936d9d19731c75eac4149bf486d4e2053c97b6aa396316bb26ea8cf2f724c06ad32cf5a08f37d109caabbba73f9f3f0b8246fa865b622fe055b105544c2031dadd122cc086dfb8ccb0203010001a310300e300c0603551d13040530030101ff300d06092a864886f70d010104050003818100486bdebd8372d0816a091205dc6303956a86482eaae2254b62643c8784a430a4bda51e8b56125743644fc7e98fbdaaf11a75798a5391f6435d029a0fd742143a828df4691eb0ac51cec9d5db604e2870285149eadd8326619c0bf58eaa15a7b50abe0fb88d02d4e511403c6ec70c637c5163dae25210723d4db323d14d0541c4 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E0B4322EB2F6A568B654538448184A5036874384 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7E784A101C8265CC2DE1F16D47B440CAD90A1945\Blob = 0300000001000000140000007e784a101c8265cc2de1f16d47b440cad90a1945090000000100000020000000301e06082b0601050507030406082b0601050507030106082b060105050703030b000000010000004a00000045007100750069006600610078002000530065006300750072006500200047006c006f00620061006c002000650042007500730069006e006500730073002000430041002d003100000020000000010000009402000030820290308201f9a003020102020101300d06092a864886f70d0101040500305a310b3009060355040613025553311c301a060355040a1313457175696661782053656375726520496e632e312d302b06035504031324457175696661782053656375726520476c6f62616c2065427573696e6573732043412d31301e170d3939303632313034303030305a170d3230303632313034303030305a305a310b3009060355040613025553311c301a060355040a1313457175696661782053656375726520496e632e312d302b06035504031324457175696661782053656375726520476c6f62616c2065427573696e6573732043412d3130819f300d06092a864886f70d010101050003818d0030818902818100bae717900265b134553c49c251d5dfa7d1378fd1e781734152609b9da1172678adc7b1e8269432b5de338d3a2fdbf29a7a5a7398a35ce9fb8a731b5ce7c3bf806ccda9f4d62bc0f7f999aa63a2b147020fd4e4513a123c6c8a5a548470dbc1c590cf7245cba859c0cd339d3fa396eb8533211c3e1e3e606e769c6785c5c8c3610203010001a3663064301106096086480186f8420101040403020007300f0603551d130101ff040530030101ff301f0603551d23041830168014bea8a07472506b44b7c923d8fba8ffb3576b686c301d0603551d0e04160414bea8a07472506b44b7c923d8fba8ffb3576b686c300d06092a864886f70d01010405000381810030e20151aac7ea5fdab9d0650f30d63eda0d14496e9193271431efc4f72d45f8ecc7bfa2410d23b492f9190067bd01afcde071fc5acf64c4e09698d0a340e2018aef2707f165018a442d06657552c0861020215f6c6b0f6cae091caff2a21834c475a4731cf18ddcefadf9b376b492bfdc95101ebecbc83b5a8460195694a955 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\9ED18028FB1E8A9701480A7890A59ACD73DFF871 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8EFDCABC93E61E925D4D1DED181A4320A467A139 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\503006091D97D4F5AE39F7CBE7927D7D652D3431 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\BC9219DDC98E14BF1A781F6E280B04C27F902712\Blob = 030000000100000014000000bc9219ddc98e14bf1a781f6e280b04c27f902712090000000100000016000000301406082b0601050507030406082b060105050703010b00000001000000260000004400530054002d0045006e00740072007500730074002000470054004900200043004100000020000000010000004b03000030820347308202b0a0030201020204366dc518300d06092a864886f70d01010505003050310b300906035504061302555331243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311b3019060355040b13124453542d456e747275737420475449204341301e170d3938313230393030303232345a170d3138313230393030333232345a3050310b300906035504061302555331243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311b3019060355040b13124453542d456e74727573742047544920434130819d300d06092a864886f70d010101050003818b0030818702818100b61df74b8d0f13e312f509fe06320eaf4c41f57dd4473d2a0adf8305dede7de60316f6513acb471a4aad7ec4fd1db4be748a78dd0b838eb48413c4fbf86d29aea1e10f0f43e3b55e6069fa8394fc79e6dc76edd1442b8efd12bbfe1777170c89eda7ef517dc4ed38c33ba37afbe24da060b5f2fd1365d3c6ec3fbe359c3d22ef020103a382012e3082012a301106096086480186f842010104040302000730720603551d1f046b30693067a065a063a461305f310b300906035504061302555331243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311b3019060355040b13124453542d456e747275737420475449204341310d300b0603550403130443524c31302b0603551d1004243022800f31393938313230393030303232345a810f32303138313230393030303232345a300b0603551d0f040403020106301f0603551d23041830168014939a44cad0785380294904dfc7af333f99755fae301d0603551d0e04160414939a44cad0785380294904dfc7af333f99755fae300c0603551d13040530030101ff301906092a864886f67d074100040c300a1b0456342e3003020490300d06092a864886f70d0101050500038181006489cc03a7dc0af25820e7fd17a02872cd87b0cd98b524476333311010b2ef8a5772ae4c03e0679fac60438422c1a9a3e5b1a7de09d4cf0d7846235b8f497bfe13229794ea7248e12c207896e9664519cb096563613fd14998b1761055d5634a664ba4076bde7b7fb9e6935b1a025b800edd8d18d48aa3c268f1a3e018d14e4c updroots.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8BAF4C9B1DF02A92F7DA128EB91BACF498604B6F updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\9C615C4D4D85103A5326C24DBAEAE4A2D2D5CC97\Blob = 0b00000001000000260000004b00450059004e00450043005400530049005300200052004f004f0054002000430041000000090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070308060a2b0601040182370a030406082b0601050507030606082b060105050703070300000001000000140000009c615c4d4d85103a5326c24dbaeae4a2d2d5cc972000000001000000e9030000308203e5308202cda00302010202121121bc276c5547af584eefd4ced629b2a285300d06092a864886f70d01010b0500304c310b300906035504061302465231123010060355040a13094b45594e4543544953310d300b060355040b1304524f4f54311a3018060355040313114b45594e454354495320524f4f54204341301e170d3039303532363030303030305a170d3230303532363030303030305a304c310b300906035504061302465231123010060355040a13094b45594e4543544953310d300b060355040b1304524f4f54311a3018060355040313114b45594e454354495320524f4f5420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6fdb31785a1ad261b956935213da488fadedb6036401769c21463fbb8d9c27415372e9cd020cd698d8432a2854c14b49bf225b3542a833f2dbe0ff33b64d1ffa050ef774f3b4ee13f0b64859aba587ed2c362d36425a2d4b2973c775d632a3392fccd820d9b549587f5b5eb8ccd5bd1ca302fc98846b5cd0d11b4188feed1a13e5d15e828cfdfc3909b6cccd10c4577b33aeb8a901de9af646a897ba93d4374fae46722a1fbdc4dc4f562c9ca25b4c9806033a9dd7ba002bf96250a5ec95f297bb417818b6d8119d0d9835c058f41691a6943809fa8afe0e98c918b272ba22660cd0ff2a4a302838e1881c2178a4315f96df31d10a45a9c446123217ad8fbd10203010001a381c03081bd30120603551d130101ff040830060101ff020104300e0603551d0f0101ff04040302010630570603551d1f0450304e304ca04aa0488646687474703a2f2f747275737463656e7465722d63726c2e63657274696669636174322e636f6d2f4b65796e65637469732f4b45594e45435449535f524f4f545f43412e63726c301d0603551d0e04160414efb72397d0a8917fa6cfa621c0349fcc7741e1d0301f0603551d23041830168014efb72397d0a8917fa6cfa621c0349fcc7741e1d0300d06092a864886f70d01010b050003820101001a31699942c2e54085a29f92c363d48f2139a81921fe7afcc34d40f32be84bac5b4c5993c6dc7e0baf7c5f95856bbdc76fbac1bef8c63a674b93c605693e242df01b91c63e3fec4218936c03248a6ef920672b7c6dab34c92a22330dd77d8feed2366442c8359a6e1961cb8d67f068a7d02405e6c317ba45ae7c43b58078034d207305fc43109d356942759425822ba63b9018dec1a9aff32d95bf95a7cf1897e159e2a2af1a16610df71371539337fd3caf001d6c8b14af46968cb6527ccc2d4ecde1e94b0aee9afe7a98e729ba1bda1cbadc6bcd040e2640a9eb733cfe50a8112755bddb8e4bef4f18ed15ffbd869866ee9a2571346c50f1b251cb669d4d29 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B8236B002F1D16865301556C11A437CAEBFFC3BB updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\968338F113E36A7BABDD08F7776391A68736582E\Blob = 0b00000001000000540000004a006100700061006e0020004c006f00630061006c00200047006f007600650072006e006d0065006e007400200050004b00490020004100700070006c00690063006100740069006f006e00200043004100000009000000010000003e000000303c06082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030806082b06010505070309030000000100000014000000968338f113e36a7babdd08f7776391a68736582e2000000001000000a4030000308203a030820288a003020102020131300d06092a864886f70d01010505003039310b3009060355040613024a50310e300c060355040a13054c47504b49311a3018060355040b13114170706c69636174696f6e204341204732301e170d3036303333313135303030305a170d3136303333313134353935395a3039310b3009060355040613024a50310e300c060355040a13054c47504b49311a3018060355040b13114170706c69636174696f6e20434120473230820122300d06092a864886f70d01010105000382010f003082010a0282010100b935c610f8db68db07c4404cb01d1e36dcc341f6cf55156d087f5cc66855e5e757f19651e6e14d780f6e4015703b65fe11dfe7d3d658353be19f02fc9452462eb39e609b029ec982d2f6e3ae094f8444b6629b005168b83aadec64d1324be9944483b40ece21896bb036c098c64b9cc23e5b602a09312b2dab4cdeb1a0fd5856c2831d20bcc48409877ba89597c6258e83e03e930dd1c77d73a9a8fc1900402e22b87a3341f578fd5a71e782d948885ceca885872d6d8089671a69be10c05a8eed887d3e6f2c386b37ce47d8a23130de7e53656c8b865341206cbd48a57eaf005a56125881d1dc8959f9b5eef84d9ad844298b79a7f722aaea7c5cb41688200d0203010001a381b23081af301d0603551d0e041604147fb85d8ec4186bc67dcc2ee9aece34e7175de0a1300e0603551d0f0101ff040403020106304c0603551d1f044530433041a03fa03da43b3039310b3009060355040613024a50310e300c060355040a13054c47504b49311a3018060355040b13114170706c69636174696f6e204341204732300f0603551d130101ff040530030101ff301f0603551d230418301680147fb85d8ec4186bc67dcc2ee9aece34e7175de0a1300d06092a864886f70d010105050003820101003cd873364006484a5419f527483925a56e42e7b6cd1bcb3934b79bec4f2abe77e4ca84fc1deb9b2240d5f4fb688772fc475d6a0e524ae3b55d48c62296e6336d6dabf6cdd7cb245a8ca8459e3e61827d94d505f01a355f712f2e54b54105ef860d52ef9c981bf12c4c3ad1f386d38c3e7a2f86458e8332265bbf53ca0e5156dc9ac25a30190da79ed5aa9b2039697821f4976dd10e114c2ed31b5ab0f997785c2a8f5265ee4c4225c237300e6d2b35948306e8af453b0466a730bbf9e0213b636e7d445d3a6a53ef111724fd54b25a6c735621c96c2d97a442b327610521636dea28bc4f1a6f42dc98ab55d31e1bc0923f9bc1e63b1756e2c4984325eeb6cb00 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2964B686135B5DFDDD3253A89BBC24D74B08C64D\Blob = 0b000000010000002000000041002d004300450052005400200041004400560041004e004300450044000000090000000100000040000000303e06082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a03040300000001000000140000002964b686135b5dfddd3253a89bbc24d74b08c64d2000000001000000d7060000308206d3308205bba003020102020100300d06092a864886f70d01010505003081cc310b30090603550406130241543110300e0603550408130741757374726961310f300d060355040713065669656e6e61313a3038060355040a13314152474520444154454e202d20417573747269616e20536f636965747920666f7220446174612050726f74656374696f6e31253023060355040b131c412d434552542043657274696669636174696f6e2053657276696365311830160603550403130f412d4345525420414456414e434544311d301b06092a864886f70d010901160e696e666f40612d636572742e6174301e170d3034313032333134313431345a170d3131313032333134313431345a3081cc310b30090603550406130241543110300e0603550408130741757374726961310f300d060355040713065669656e6e61313a3038060355040a13314152474520444154454e202d20417573747269616e20536f636965747920666f7220446174612050726f74656374696f6e31253023060355040b131c412d434552542043657274696669636174696f6e2053657276696365311830160603550403130f412d4345525420414456414e434544311d301b06092a864886f70d010901160e696e666f40612d636572742e617430820122300d06092a864886f70d01010105000382010f003082010a0282010100ddeb97232fa69dfe8160a6caf901f993aefdb5416a793f23959c4c7b0f1e3621eec3d2a8c560732fa2a4b0afb9b8aec66adc3eb1b0189ed10613cd0ff898358400cc7be16be55d1b73a412de0915b5f5025bf448bdf30cdfda31be6a8998e80f9c953b1fafa798bb6cabad6dbfd915262ff6e18e705d6de875eb7bdac179ec4a06eacefcc3405454b35c327812f5b659ce6746dff77a25b906828345ffc0dc8020495bfb7426b708cf2a695c8395b54cf33abad4f3acee5204f746d925e648c6ec3107a456fd1f47d3398d6ff3e811a1a3bada00343c28b2b205598f08157987b7280835d67ce7ca5783bf5f7cb8adc3735a17206623271d85a4a594bc0b80130203010001a38202bc308202b8301d0603551d0e04160414377f3e3e997160ca24d4911379d07429b4a824d83081f90603551d230481f13081ee8014377f3e3e997160ca24d4911379d07429b4a824d8a181d2a481cf3081cc310b30090603550406130241543110300e0603550408130741757374726961310f300d060355040713065669656e6e61313a3038060355040a13314152474520444154454e202d20417573747269616e20536f636965747920666f7220446174612050726f74656374696f6e31253023060355040b131c412d434552542043657274696669636174696f6e2053657276696365311830160603550403130f412d4345525420414456414e434544311d301b06092a864886f70d010901160e696e666f40612d636572742e6174820100300f0603551d130101ff040530030101ff300b0603551d0f0404030201e630470603551d250440303e06082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070308060a2b0601040182370a0304301106096086480186f84201010404030200ff30510603551d20044a3048304606082a28001801010103303a303806082b06010505070201162c687474703a2f2f7777772e612d636572742e61742f63657274696669636174652d706f6c6963792e68746d6c303b06096086480186f8420108042e162c687474703a2f2f7777772e612d636572742e61742f63657274696669636174652d706f6c6963792e68746d6c30190603551d1104123010810e696e666f40612d636572742e6174302f0603551d1204283026810e696e666f40612d636572742e61748614687474703a2f2f7777772e612d636572742e617430450603551d1f043e303c303aa038a036863468747470733a2f2f7365637572652e612d636572742e61742f6367692d62696e2f612d636572742d616476616e6365642e636769300d06092a864886f70d0101050500038201010025f522f81f746dabbdfbf7e4ee3cbd212f71568476537c5121411d6cf7251028ce0cef681b701e48ca670b7997f0563ad8dbbc77d18c3b7b8a394111cc4e3ab342d5f7f2307c07ad7a6f7dfe98a50e709f198860441c5118861ccaabb845f45a4b8336048ac1e7ec817b36ede7816ae1e034655c4d81f5ae61eefd9c8ba4bc4ec894363c2cc0d43cd6deb5a4217f76a2027b95345d5ab6f1c142f55c68a7c679da43be3eff2d2923d24d12fee2736b6993079132991e75a2d69ac0b5fa8adf29379bb20ebd68c682c7ba3a8cd38d46647fed355a3dff3f93a839d9c1d9f585a342fba9db66f9ad6c46279af92d9e2f08f985e3e4f896eb6351801afe51ae4138 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0446C8BB9A6983C95C8A2E5464687C1115AAB74A updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8C96BAEBDD2B070748EE303266A0F3986E7CAE58\Blob = 0300000001000000140000008c96baebdd2b070748ee303266a0f3986e7cae5809000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030306082b060105050703040b0000000100000058000000450042004700200045006c0065006b00740072006f006e0069006b00200053006500720074006900660069006b0061002000480069007a006d006500740020005300610067006c00610079006900630069007300690000002000000001000000eb050000308205e7308203cfa00302010202084caf73421c8e7402300d06092a864886f70d01010505003081803138303606035504030c2f45424720456c656b74726f6e696b20536572746966696b612048697a6d6574205361c49f6c6179c4b163c4b173c4b131373035060355040a0c2e4542472042696c69c59f696d2054656b6e6f6c6f6a696c6572692076652048697a6d65746c65726920412ec59e2e310b3009060355040613025452301e170d3036303831373030323130395a170d3136303831343030333130395a3081803138303606035504030c2f45424720456c656b74726f6e696b20536572746966696b612048697a6d6574205361c49f6c6179c4b163c4b173c4b131373035060355040a0c2e4542472042696c69c59f696d2054656b6e6f6c6f6a696c6572692076652048697a6d65746c65726920412ec59e2e310b300906035504061302545230820222300d06092a864886f70d01010105000382020f003082020a0282020100eea08461d03a6a661032d831387fa7a7e5fda1e1fb9777b87196e8139646834fb6f25f72566e1360a50191e25bc5cd571f776351ff2f3ddbb93faaa935e779d0f5d024b621eaeb2394fe29bffb89910c649a054a2bcc0ceef13d9b8269a44cf89a6fe722da10ba5f92fc18270aa8aa44fa2e2cb4fb469a08038372ab88e46a72c9e5651f6e2a0f9db3e83be40c6e7ada57fdd7eb798b5e2006d3760b6c0295a396e4cb7651d1289da11afc44a24dcc7a76a80d3dbf174f228850fdaeb6ec90504a5b9f9541aaca0fb24afe80994ea34615abf873426ac26676b10a2615dd9392ecdba95f54225291705d13ea48ec6e036cd9dd6cfceb0d03ffa683129bf1a9930fc5264c31b263996172e72a6499d2b8e975e27ca9a99a1aaac356db109a3c8352b67b96b7ac8777a8b9f2670b9443b3af3e73fa4236b125c50a3126375667baa30b7dd6f789cd67a1b73a1e664ff6a05514254c2c330da6418cbd04316a10720a9d0e2e76bd5ef351898ba83f5573bfdb3ac62405969248aa4b8d2a03e5579110f46a28156e4777845c51749f19e9e61e631639e31115e3581a44bdcbc46c66d78406df30f437a2432279d2106cdfbbe61311fc9d840a137bf03bd0fca30ad789ea967e8d48851e645fdb54a2acd57a02796bd28af067da65720d1470e4e98e788f32747c57f2d6d6f436891bf8296c8bb9f697d1a42eaabe0b19c245e9705d0203009dd9a3633061300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414e7cec64ffc166796fa4aa307c104a7cb6adeda47301f0603551d23041830168014e7cec64ffc166796fa4aa307c104a7cb6adeda47300d06092a864886f70d010105050003820201009b989a5dbef3282376c66cf77fe6409ec036dc950d1dad15c536d8d539eff21e225eb382b45dbb4c1aca920ddf47241eb324da9188e98370dd93d7e9bab3df165a3edee0c8fbd3fd6c29f81546a06826cc9352ae82019390ca77ca4d49efe25ad92abd30ce4cb281b630ce594fda591d6a7aa445b08226818676f5f51000b8eeb309e84f870207ae245cf05fac0a30cc8a40a07304c1fb8924f69a1c5cb73c0a6736050831b3afd801682ae0788f74deb851a48c6c203da2fbb3d409fd7bc280aa936c299821a8bb16f3a9125f74b58798f29526df34ef8a5391885d1a94a33f7c22f8d788baa68c96a83d5234629f001e54554267c64d468fbb14453d0a96168e10a19799d5d33085ccdeb472b7bc8a3c182968fddc7107ee24396afaeda5ac382ff91e100e06711a104cfe757eff1e573942cad7e115a15655591bd1a3af11d84ec3a52bef90bfc0ec82135b8dd6722c934e8f6a29df853cd30de0a21812cc552f47b7a79b02fe41f6884c6ddaa90147836427621082d6127b5e031f34a9c991feaf5d6d8627b723aa7518ca20e7b00fd7890ea6672263f483412b064bbb58d5d1d7b7b91063d8894ab4aadd1663f56ebe60a1f8ede8d6904f1ac6c5a029d3a721a8f55a3cf7c749a2219a4a95522096729a66cbf7d286437c22be96f9bd01a847dde53b40f9752b9b2b4664868d1ef48ffb0777d0ea49a21c8d5214a60a93 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\74207441729CDD92EC7931D823108DC28192E2BB\Blob = 03000000010000001400000074207441729cdd92ec7931d823108dc28192e2bb090000000100000016000000301406082b0601050507030406082b060105050703010b0000000100000038000000430065007200740050006c0075007300200043006c006100730073002000320020005000720069006d00610072007900200043004100000053000000010000002700000030253023060d2b0601040181ad5a020502030130123010060a2b0601040182373c0101030200c0200000000100000096030000308203923082027aa00302010202110085bd4bf3d8dae369f694d75fc3a54423300d06092a864886f70d0101050500303d310b30090603550406130246523111300f060355040a130843657274706c7573311b301906035504031312436c6173732032205072696d617279204341301e170d3939303730373137303530305a170d3139303730363233353935395a303d310b30090603550406130246523111300f060355040a130843657274706c7573311b301906035504031312436c6173732032205072696d61727920434130820122300d06092a864886f70d01010105000382010f003082010a0282010100dc5096d012f835d208787ab65270fd6feecfb911cb5d77e1ece97e048dd6cc6f73435760ac330a44ec035f1c802491e5a891561282f7e02bf4dbae612e89108d6b6cbab302bdd536c5483723e2f05a3752331712e2d1604dbe2f4111e3f617250c8b91c01b997b99560dafeed2bc4757e379497b3489272484deb1ece9584efe4edf5abe41adac08c5180eefd253ee6cd09d1201138ddc8062f795a944884a714e60559edb23197956070c3f630b5cb0e2be7e15fc943358413874c4e18f8bdf26ac1fb58b3bb743596bb024a66d908bc472ea5d3398b7cbde5e7bef94f11b3ecac921c1c59802aaa2f65b779bf57e9655341c6769c0f142e347acfc281c66550203010001a3818c308189300f0603551d13040830060101ff02010a300b0603551d0f040403020106301d0603551d0e04160414e3732ddfcb0e280cdeddb3a4ca79b88ebbe83089301106096086480186f842010104040302010630370603551d1f0430302e302ca02aa0288626687474703a2f2f7777772e63657274706c75732e636f6d2f43524c2f636c617373322e63726c300d06092a864886f70d01010505000382010100a754cf884419cbdfd47f00df563362b5f7510190ebc33fd18844e9245defe714bd20b79a3c00fe6d9fdb90dcd7f462d68b705de7e50448a9687cc9f142f36c7fc57a7c1d5188bad20a3e275dde2d514ed3136469e42ee3d3e79b0999a6e0959bce1ad77fbe3cce52b31115c10f17cd03bb9c2515baa27689fc06f118d0934b0e7c82b7a5f4f65ffeed40a69d847439b9dc1e8516da291b862300c9bb897e6e80881e2f14b40324a8326f039a472c30be56c6a74202701bea40d8ba05037007a496fffd48330ae1dca581909b4ddd7de7e7b2cd5cc86a95f8a5f68dc45d7808be7b06d649cf193650232e08e69e054d4718d516e9b1d6b610d5bb97bfa28eb454 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\634C3B0230CF1B78B4569FECF2C04A8652EFEF0E updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7998A308E14D6585E6C21E153A719FBA5AD34AD9\Blob = 0300000001000000140000007998a308e14d6585e6c21e153a719fba5ad34ad909000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b060105050703090b00000001000000640000005400550052004b0054005200550053005400200045006c0065006b00740072006f006e0069006b00200053006500720074006900660069006b0061002000480069007a006d006500740020005300610067006c00610079006900630069007300690000002000000001000000ff030000308203fb308202e3a003020102020101300d06092a864886f70d01010505003081b7313f303d06035504030c3654c39c524b545255535420456c656b74726f6e696b20536572746966696b612048697a6d6574205361c49f6c6179c4b163c4b173c4b1310b300906035504060c025452310f300d06035504070c06414e4b41524131563054060355040a0c4d28632920323030352054c39c524b54525553542042696c676920c4b06c657469c59f696d2076652042696c69c59f696d2047c3bc76656e6c69c49f692048697a6d65746c65726920412ec59e2e301e170d3035303531333130323731375a170d3135303332323130323731375a3081b7313f303d06035504030c3654c39c524b545255535420456c656b74726f6e696b20536572746966696b612048697a6d6574205361c49f6c6179c4b163c4b173c4b1310b300906035504060c025452310f300d06035504070c06414e4b41524131563054060355040a0c4d28632920323030352054c39c524b54525553542042696c676920c4b06c657469c59f696d2076652042696c69c59f696d2047c3bc76656e6c69c49f692048697a6d65746c65726920412ec59e2e30820122300d06092a864886f70d01010105000382010f003082010a0282010100ca5205d66303d81c5fddd27b5df20c60615b6b3b742b780d7d45bd2274e88c03c1c6112a3d95bca994b0bb9197c8697c84c5b4916c6c136aa455ada485e8957eb300af00c20518f5709d368baecbe41b817f9388fb6a55bb7d8592ceba589fdb32c5bd5def224a2f41077e4961b386ec4ea6416e84bc03ecf53b1cc81fc2eea8eeea124a8d14cff30ae05039f90835f81159ade722ea4bca1406de42bab299f32d54881006eae11a3e3d671ffbcefb7c82e8115d4ac1b914ea54d9669b7c897d049a62c9e9523c9e9cefd2f526e4e6e5187c8b6edf6ccc785b4f72b2cb5c3f8c058dd14c8cad92c7e1787f656c4906502c9e32c2d74ac6758a594e756f475ec10203010001a310300e300c0603551d13040530030101ff300d06092a864886f70d0101050500038201010015f555ff3796805921a4fca1154c20f6d45fda0324fccf901af4210a9aee3ab16aefeff860d14c3666451df3660274047b9230a8de0a760fef956ebdc937e61a0dac89485bcc8336c2f5465c598256b4d5fe23b4d8541c44abc4a7e514ce3c41617c43e6cdc481098b24fb5425d616a8960c67076fb35047e31c2428dd2a98a461fedbea1237bc011a3485bd6e4fe791720744851e58ca5444ddf7acb9cb892172db8fc06929972aa3ae1823971c412a8b7c2ac17c90e8a928c0d391c6ad28874068b5ffeca7d2d338189cd37d695df0c6a51e241ba347fc690768e7e49ab4ed0fa1878702ce87d2484ee1bcffcbf1729244640325eade5b6e9fc9f24eacddc7 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\24A40A1F573643A67F0A4B0749F6A22BF28ABB6B updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DE990CED99E0431F60EDC3937E7CD5BF0ED9E5FA\Blob = 0b000000010000001c00000043006900730063006f002000530079007300740065006d0073000000090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050508020206082b0601050507030606082b0601050507030706082b06010505070305030000000100000014000000de990ced99e0431f60edc3937e7cd5bf0ed9e5fa200000000100000047030000308203433082022ba00302010202105ff87b282b54dc8d42a315b568c9adff300d06092a864886f70d0101050500303531163014060355040a130d436973636f2053797374656d73311b301906035504031312436973636f20526f6f742043412032303438301e170d3034303531343230313731325a170d3239303531343230323534325a303531163014060355040a130d436973636f2053797374656d73311b301906035504031312436973636f20526f6f74204341203230343830820120300d06092a864886f70d01010105000382010d00308201080282010100b09ab9aba7af0a77a7e271b6b4666294788847c66255844032bfc0ab2ea51c71d6bc6e7ba8aaba6ed2158848459da2fc83d0ccb98ce02668704a78df21179ef46105c915c8cf16da3561899443a884a83198789bb94e6f2c53126ccd1dad2b24bb31c42bff83446fb63d247709eabf2aa81f6a56f6200f1154978175a725ce596a8265efb7eae7e28d758b6ef2dd4fa65e629ccf100a64d04e6dce2bcc5bf560a527478d69f47fce1b70de701b20d66ecda601a83c12d2a93fa06b5ebb8e208b7a91e3b568eea0e7c40174a8530b2b4a9a0f65120e824d8e63fdefeb9b1adb53a61360afc27dd7c76c1725d473fb4764508180944ce1bfae4b1cdf92ed2e05df020103a351304f300b0603551d0f040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041427f3c8151e6e9a020916ad2ba089605fda7b2faa301006092b06010401823715010403020100300d06092a864886f70d010105050003820101009d9d8484a341a97c770cb753ca4e445062ef547cd375171ce8e0c6484bb6fe4c3a198156b056ee199662aa5aa364c1f64e5433c677fec51cbae55d25caf5f0939a83112ee6cbf87445fee705b8abe7dfcb4be13784dab98b97701ef0e28bd7b0d80e9db169d62a917ba9494f7ee68e95d883273cd568490ed49df62eeba7beeb30a4ac1f44fc95ab3306fb7d600adeb48a63b09ca9f2a4b9530187d068a4277fabffe9fac940388867b439c6846f57c953dbba8eeec043b2f809836eff66cf3eef17b358182509345ee3cbd614b6ecf2926f74e42f812ad59291e0e0973c326805854bd1f757e2521d931a549f0570c04a71601e430b601efea3ce8119e10b35 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1B2364FD4D4F52E89B2D0FAF33E4D62BD969921\Blob = 030000000100000014000000b1b2364fd4d4f52e89b2d0faf33e4d62bd969921090000000100000048000000304606082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030806082b0601050507030606082b060105050703070b000000010000003a00000053006f0075007400680020004100660072006900630061006e00200050006f007300740020004f0066006600690063006500200043004100000020000000010000003d0600003082063930820421a003020102020102300d06092a864886f70d01010505003081ce310b3009060355040613025a41311530130603550408130c5765737465726e2043617065311630140603550407130d536f6d65727365742057657374312a3028060355040a1321536f757468204166726963616e20506f7374204f6666696365204c696d69746564311a3018060355040b13115341504f2054727573742043656e747265311d301b060355040313145341504f20436c617373203320526f6f742043413129302706092a864886f70d010901161a706b6961646d696e40747275737463656e7472652e636f2e7a61301e170d3130303931353030303030305a170d3330303931343030303030305a3081ce310b3009060355040613025a41311530130603550408130c5765737465726e2043617065311630140603550407130d536f6d65727365742057657374312a3028060355040a1321536f757468204166726963616e20506f7374204f6666696365204c696d69746564311a3018060355040b13115341504f2054727573742043656e747265311d301b060355040313145341504f20436c617373203320526f6f742043413129302706092a864886f70d010901161a706b6961646d696e40747275737463656e7472652e636f2e7a6130820222300d06092a864886f70d01010105000382020f003082020a0282020100ca781a07bcf6fbb4b789bcd01956382a599d07ea1af9f8f868675e8fefcaf7f56a89e6a3957fa9db29241c35d038966c3e5624ff5e6251902e87e89cc7dabc33f19ea16f0b8e0a24f4f84d90a6b2cd5e11d3c2974cf55f401d26244d8d09100bffbb201b9326190c433fe98ebc3137106e91ca48825646c7bcb93a9e468166cfd9e85c10cf399e65c39ec55af44bcc44996686f4721ba35349eaae47cd320d70e6a0a076079dff58efe43c91c0b5e4dcb8010cd3feb342a03b6102d4375bd74c4595d2755df56e305f57518bb2ff7ec88b9caaa341370c1091a8a6855cb9c78f0551b2d078d2e24b49e9d41aa73bacaa33e69a2a0340986f7452133194d112c1b4cb30f9ff44b8925b52d630d933d175e319a51615b75457f15650ce4ebe033b2fecb630ee14605e5f7a35f44e640711eaa507661b6e93e2b04f5ed6e044e0b3dcaeefb8fda8b3ecece5398844b4a1bb1460648fd69293cbf3cc50dde907c86767f9f0878491b20062e9bf4a1574c5bf044c05465d0acbe5ea6100e16f41b1348ea600a27ca6a5a6fa6c4c43e5a8269a34981e8798e74c78d18f9f05555d8a4bc9cfa00b7d06909c1892b2c4b2d7e345d96b73c39739bf291e06095540babcda487543edfe447e3d2ce6629103fd3d89ef7ef45d248fa50b2bb33e7a2928bcbb3fbfeb778504268b94b290f5eb8d4fa2442250a89c2a4448007819ab9d0896150203010001a320301e300e0603551d0f0101ff040403020106300c0603551d13040530030101ff300d06092a864886f70d0101050500038202010045c99ea4602589fe9799b8c2f1aed735133679d0dd822251f14cf66336a10d5b20f21b85d6768f790fababa2c837b82963ece59eb67896a6ff8a109e146e1a6ddf5e9bb92c857209f2371a9b79b328efe596dd469b878c8df8418c14e1ad455fcba7240cc137ba2c02c4ab8c353809e990f16672a5914279090a144e9a749645a12f20a497742acb01b3cb562ade2c585f176762be2bba11132d10404561f0c3c5ef8f19d03ac2650ad968e89c062037ba9f4b16396078e0756255c0d9cb372109109039cf5c99ecdfacd65a474123abb8a721079214ac8cda8a2416eb148848bcef81ce8e16df3dd25a6f9fc041712589062ce6bc4feda491f3c6ed54ddd9930322aa8407a873dba75a894df6ed7280eb837844a922246898b13fa941f2ece904a422335fe675dcbd9e25f5e364651ec1f357272ec9c0327844dbd8381376e11d7fe017879a7f4d4b076eb8573885b9e9534e973a0d1f53b981724546f3c87ea609ee1834757e87e7e820eedc16d4e6c784aada6f5f9ccceb580641938ce5cc590c6865393c291661f169fb47b9c2d86781240bf4fc496200af07a3ff9ea00ec3018b2167d63b1b3ce0a1b76ddc554be3d02e9dd69eca6ebab3baf0607e7f0550e341f1be403a9057e02d696c0bc1bc7ac18efb09deea957f399bc3639f49f578af7e4982ac9f6e8c121a50b6c0e3dc8482d8ebd2bb0e5d368602492b053b57 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CFF360F524CB20F1FEAD89006F7F586A285B2D5B\Blob = 0b000000010000001200000056006500720069005300690067006e000000090000000100000020000000301e06082b0601050507030406082b0601050507030206082b06010505070303030000000100000014000000cff360f524cb20f1fead89006f7f586a285b2d5b200000000100000006030000308203023082026b02101f42285f3c880f8e3c89b384b3ab1f1c300d06092a864886f70d01010505003081c1310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e313c303a060355040b1333436c6173732032205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204732313a3038060355040b1331286329203139393820566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d060355040b1316566572695369676e205472757374204e6574776f726b301e170d3938303531383030303030305a170d3138303531383233353935395a3081c1310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e313c303a060355040b1333436c6173732032205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204732313a3038060355040b1331286329203139393820566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d060355040b1316566572695369676e205472757374204e6574776f726b30819f300d06092a864886f70d010101050003818d0030818902818100a7880121742ce71a03f098e1973c0f2108f19cdb97e99afcc2040613be5f52c8cc1e2c12562cb801692ccc991fadb096ae7904f21339c17b98ba082ce8c284132caa69e909f4c7a902a442c2234f4ad8f00ea2fb316cc9e66f992707f5e6f44c789e6deb4686fab986c954f2b2c4afd4461c5ac91530ff0d6cf52d0e6dce7f770203010001300d06092a864886f70d0101050500038181001145a8a47ff1e37320cabdeedff58723913d8dac47451ade6ddb5421ce0e830ef8dce543d5eb2e619123e272003455f7c4cf1133ddc1e422235c505319f864e7f7090f4551a0572bdfbc2266fe31707b253a0fc58a7ec3bb7201ccf0bd4d5281a41b585853d5533af50e6adae9afc4e158f3426f546247ac3194d10dceef1d31 updroots.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\61573A11DF0ED87ED5926522EAD056D744B32371 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E0AB059420725493056062023670F7CD2EFC6666\Blob = 030000000100000014000000e0ab059420725493056062023670f7cd2efc6666090000000100000020000000301e06082b0601050507030106082b0601050507030306082b060105050703080b000000010000004000000054006800610077007400650020005000720065006d00690075006d0020005300650072007600650072002000430041002000280053004800410031002900000020000000010000003a030000308203363082029fa003020102021036122296c5e338a520a1d25f4cd70954300d06092a864886f70d01010505003081ce310b3009060355040613025a41311530130603550408130c5765737465726e204361706531123010060355040713094361706520546f776e311d301b060355040a131454686177746520436f6e73756c74696e6720636331283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e3121301f06035504031318546861777465205072656d69756d205365727665722043413128302606092a864886f70d01090116197072656d69756d2d736572766572407468617774652e636f6d301e170d3936303830313030303030305a170d3231303130313233353935395a3081ce310b3009060355040613025a41311530130603550408130c5765737465726e204361706531123010060355040713094361706520546f776e311d301b060355040a131454686177746520436f6e73756c74696e6720636331283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e3121301f06035504031318546861777465205072656d69756d205365727665722043413128302606092a864886f70d01090116197072656d69756d2d736572766572407468617774652e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100d236366a8bd7c25b9eda8141628f38ee490455d6d0ef1c1b951647ef1848353a52f42b6a068f3b2fea56e3af868d9e17f79eb46575024defcb09a22151d89bd067d0ba0d92061473d493cb972a009c5c4e0cbcfa1552fcf2446eda114a6e089f2f2de3f9aa3a8673b6465358c88905bd8311b8733faa078df4424de7409d1c370203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d0101050500038181006590ac880f56d9e63034d426c7d050f192de6bd439880922c6a6638303f79977d8b2e518b85d63f3d473fb6c9c9978f14b787d1924c32b0284f8bc22d98a22d7a0fc71ec918720f1b8ecb1e55580ac3d52c8390ec2f0c0054fd682758cbd5fd2dc769a0512c9af72c3dc257ea44d8e17a5e0877fe19a5ae160dc64233c422e4d updroots.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3BC0380B33C3F6A60C86152293D9DFF54B81C004 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A43489159A520F0D93D032CCAF37E7FE20A8B419 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46 updroots.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A1E7C600AA4170E5B74BC94F9B9703EDC261B4B9 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A1E7C600AA4170E5B74BC94F9B9703EDC261B4B9\Blob = 0b0000000100000040000000530077006900730073005300690067006e00200050006c006100740069006e0075006d00200052006f006f007400200043004100200013202000470033000000090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b06010505070307030000000100000014000000a1e7c600aa4170e5b74bc94f9b9703edc261b4b92000000001000000850500003082058130820369a0030201020208223fa91720de8194300d06092a864886f70d01010b0500304e310b300906035504061302434831153013060355040a130c53776973735369676e204147312830260603550403131f53776973735369676e20506c6174696e756d20526f6f74204341202d204733301e170d3039303830343133333430345a170d3337303830343133333430345a304e310b300906035504061302434831153013060355040a130c53776973735369676e204147312830260603550403131f53776973735369676e20506c6174696e756d20526f6f74204341202d20473330820222300d06092a864886f70d01010105000382020f003082020a028202010094a0ef131b9f44201bcdc5aa22bbd9f2523e7a5a5877e68da12bc9dca4f3e4b3139400629b1cf2435043817eaf303649ac18890c1845b83ec7546de3d89a596b8a1a25a9b6b50db77d23f05f7da807a9f73e862ec8014ddce636ed1de5370769124be383d1041c24f01f7071e719ed73486e952b15b656e602df56e99bfaeaa6eee0c2c3bae0ccc6c87bd76f3a959b3a8fbe5b2cd2a9a0383ed688e1b162138edcab3067cda86aa6632b82b0cbc73d4eed72f67dab324e6502eb0f9974f81c1a288c0e4500932c149f6dc71b9ef68adc7b78e3b494471d4d056d847a9054b29e8b75c280df87393f9ffb4854078da029f5f9605f5a72e8bb9ba042e0080034a3153c13e3d61a6b02b29421a39d41bc2a6b4e333ba69438fc3dc72b33b32e2b0674ac9b106fc54e45f75da156032c0d5f7abd1ede1d77906bdaa52d8a4ce9df41f4e74bec7d95429f4ca9090f43883f3d93e72bf47a48da68c4dd1280311a5d245426a62421b34cadda1708360257c69c8670c975c99e7c61d878e6b9e81469f91c1028125d4b7550ba3cd067705555564bfb3d1cd8db794d97dfb89edb172cd53507b850a9f78ef756ff7a67434f20d9ca66d638604bee9431d60da2489bff346994c635f59688efaa66cc81a6eb4c53ff3274a7b69d9857b4ba26a9f13333627e3ab0031157ffdc6f1123ad3ec60ad0cc54b72dc2931de5c2a68cc7d8ef53f70203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414562a3f9058f4175a14b2d7081b855b546a541a28301f0603551d23041830168014562a3f9058f4175a14b2d7081b855b546a541a28300d06092a864886f70d01010b050003820201006ced8ae743a879279bb8cf873e6438188c1142928637e058c31bee042ef784ec8310680c7f782d9cc2978e364e16d80eea6b48ad4f9e5d0dcc0da93e18857ecc68993935d6d89f86c132fb4d65b322144bc88566da17ff7191ac9c5657de712c5642bff8cd0ef0a2d3ffd22215fbd0780a7ee1b05ace8e37dba99ee795cf63f22c0dd2fa6ff3c8d5fb00b7f7356710d37b52ec1032f8bfdd5ec9a682a4f1b0bf1d2edd25e4bd4df035a9910147f81002945beb3eeb0dbad51d632ca52eabe7e31ea3ee4baa5fb16601b4825af9464bc7f1f8df2cbefd75dd96389a373a6ea5e632156eb390c0398a74a595a0be0d2e8979cd29568ec35e5751c4056f04558f81e94cbd5946cb2abc4dc91df2c64f05e4c8040df76e4fdac33a9cd2c2f5e9c6247a143e1c4230a8024531a9fc50a9dcdc86380f5b933f7f084e6a0d273a107956c315b83e0686f6d97067af757a8be258ccc6754f3255c56c1409283bf295e46ade2c2807ada07d0728ddd45aa3e9a67c138c990b5278dbd9d1df3e5a43767f466053c2cde776477c55cdb43964105b954b355d448324d5e02e240cc1806e69008006770a6682100c516f378957dbf34ce5b8b9ee23669760b752ddd996fbba8a3ba04dce5ef0444c90cc214f1b3a986b8e3183f9830852cb19c1356beea1155b883f6dacf2349253a6302a13d7e686a85dd942d2c79da97a8bcbdfeea231c2e5 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7F88CD7223F3C813818C994614A89C99FA3B5247 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F5C27CF5FFF3029ACF1A1A4BEC7EE1964C77D784 updroots.exe -
Suspicious use of AdjustPrivilegeToken 14 IoCs
Processes:
KB931125.exeKB931125.exedescription pid process Token: SeRestorePrivilege 2556 KB931125.exe Token: SeRestorePrivilege 2556 KB931125.exe Token: SeRestorePrivilege 2556 KB931125.exe Token: SeRestorePrivilege 2556 KB931125.exe Token: SeRestorePrivilege 2556 KB931125.exe Token: SeRestorePrivilege 2556 KB931125.exe Token: SeRestorePrivilege 2556 KB931125.exe Token: SeRestorePrivilege 2940 KB931125.exe Token: SeRestorePrivilege 2940 KB931125.exe Token: SeRestorePrivilege 2940 KB931125.exe Token: SeRestorePrivilege 2940 KB931125.exe Token: SeRestorePrivilege 2940 KB931125.exe Token: SeRestorePrivilege 2940 KB931125.exe Token: SeRestorePrivilege 2940 KB931125.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5a7859e80fe07dbbfc602996e364a89e5062965904a5dcfac157c6b5d6ad0b8a.exeKB931125.exeKB931125.exedescription pid process target process PID 2092 wrote to memory of 2556 2092 5a7859e80fe07dbbfc602996e364a89e5062965904a5dcfac157c6b5d6ad0b8a.exe KB931125.exe PID 2092 wrote to memory of 2556 2092 5a7859e80fe07dbbfc602996e364a89e5062965904a5dcfac157c6b5d6ad0b8a.exe KB931125.exe PID 2092 wrote to memory of 2556 2092 5a7859e80fe07dbbfc602996e364a89e5062965904a5dcfac157c6b5d6ad0b8a.exe KB931125.exe PID 2092 wrote to memory of 2556 2092 5a7859e80fe07dbbfc602996e364a89e5062965904a5dcfac157c6b5d6ad0b8a.exe KB931125.exe PID 2092 wrote to memory of 2556 2092 5a7859e80fe07dbbfc602996e364a89e5062965904a5dcfac157c6b5d6ad0b8a.exe KB931125.exe PID 2092 wrote to memory of 2556 2092 5a7859e80fe07dbbfc602996e364a89e5062965904a5dcfac157c6b5d6ad0b8a.exe KB931125.exe PID 2092 wrote to memory of 2556 2092 5a7859e80fe07dbbfc602996e364a89e5062965904a5dcfac157c6b5d6ad0b8a.exe KB931125.exe PID 2556 wrote to memory of 1504 2556 KB931125.exe updroots.exe PID 2556 wrote to memory of 1504 2556 KB931125.exe updroots.exe PID 2556 wrote to memory of 1504 2556 KB931125.exe updroots.exe PID 2556 wrote to memory of 1504 2556 KB931125.exe updroots.exe PID 2556 wrote to memory of 1504 2556 KB931125.exe updroots.exe PID 2556 wrote to memory of 1504 2556 KB931125.exe updroots.exe PID 2556 wrote to memory of 1504 2556 KB931125.exe updroots.exe PID 2556 wrote to memory of 2024 2556 KB931125.exe updroots.exe PID 2556 wrote to memory of 2024 2556 KB931125.exe updroots.exe PID 2556 wrote to memory of 2024 2556 KB931125.exe updroots.exe PID 2556 wrote to memory of 2024 2556 KB931125.exe updroots.exe PID 2556 wrote to memory of 2024 2556 KB931125.exe updroots.exe PID 2556 wrote to memory of 2024 2556 KB931125.exe updroots.exe PID 2556 wrote to memory of 2024 2556 KB931125.exe updroots.exe PID 2556 wrote to memory of 2200 2556 KB931125.exe updroots.exe PID 2556 wrote to memory of 2200 2556 KB931125.exe updroots.exe PID 2556 wrote to memory of 2200 2556 KB931125.exe updroots.exe PID 2556 wrote to memory of 2200 2556 KB931125.exe updroots.exe PID 2556 wrote to memory of 2200 2556 KB931125.exe updroots.exe PID 2556 wrote to memory of 2200 2556 KB931125.exe updroots.exe PID 2556 wrote to memory of 2200 2556 KB931125.exe updroots.exe PID 2556 wrote to memory of 1576 2556 KB931125.exe updroots.exe PID 2556 wrote to memory of 1576 2556 KB931125.exe updroots.exe PID 2556 wrote to memory of 1576 2556 KB931125.exe updroots.exe PID 2556 wrote to memory of 1576 2556 KB931125.exe updroots.exe PID 2556 wrote to memory of 1576 2556 KB931125.exe updroots.exe PID 2556 wrote to memory of 1576 2556 KB931125.exe updroots.exe PID 2556 wrote to memory of 1576 2556 KB931125.exe updroots.exe PID 2092 wrote to memory of 2940 2092 5a7859e80fe07dbbfc602996e364a89e5062965904a5dcfac157c6b5d6ad0b8a.exe KB931125.exe PID 2092 wrote to memory of 2940 2092 5a7859e80fe07dbbfc602996e364a89e5062965904a5dcfac157c6b5d6ad0b8a.exe KB931125.exe PID 2092 wrote to memory of 2940 2092 5a7859e80fe07dbbfc602996e364a89e5062965904a5dcfac157c6b5d6ad0b8a.exe KB931125.exe PID 2092 wrote to memory of 2940 2092 5a7859e80fe07dbbfc602996e364a89e5062965904a5dcfac157c6b5d6ad0b8a.exe KB931125.exe PID 2092 wrote to memory of 2940 2092 5a7859e80fe07dbbfc602996e364a89e5062965904a5dcfac157c6b5d6ad0b8a.exe KB931125.exe PID 2092 wrote to memory of 2940 2092 5a7859e80fe07dbbfc602996e364a89e5062965904a5dcfac157c6b5d6ad0b8a.exe KB931125.exe PID 2092 wrote to memory of 2940 2092 5a7859e80fe07dbbfc602996e364a89e5062965904a5dcfac157c6b5d6ad0b8a.exe KB931125.exe PID 2940 wrote to memory of 1356 2940 KB931125.exe updroots.exe PID 2940 wrote to memory of 1356 2940 KB931125.exe updroots.exe PID 2940 wrote to memory of 1356 2940 KB931125.exe updroots.exe PID 2940 wrote to memory of 1356 2940 KB931125.exe updroots.exe PID 2940 wrote to memory of 1356 2940 KB931125.exe updroots.exe PID 2940 wrote to memory of 1356 2940 KB931125.exe updroots.exe PID 2940 wrote to memory of 1356 2940 KB931125.exe updroots.exe PID 2940 wrote to memory of 2640 2940 KB931125.exe updroots.exe PID 2940 wrote to memory of 2640 2940 KB931125.exe updroots.exe PID 2940 wrote to memory of 2640 2940 KB931125.exe updroots.exe PID 2940 wrote to memory of 2640 2940 KB931125.exe updroots.exe PID 2940 wrote to memory of 2640 2940 KB931125.exe updroots.exe PID 2940 wrote to memory of 2640 2940 KB931125.exe updroots.exe PID 2940 wrote to memory of 2640 2940 KB931125.exe updroots.exe PID 2940 wrote to memory of 1044 2940 KB931125.exe updroots.exe PID 2940 wrote to memory of 1044 2940 KB931125.exe updroots.exe PID 2940 wrote to memory of 1044 2940 KB931125.exe updroots.exe PID 2940 wrote to memory of 1044 2940 KB931125.exe updroots.exe PID 2940 wrote to memory of 1044 2940 KB931125.exe updroots.exe PID 2940 wrote to memory of 1044 2940 KB931125.exe updroots.exe PID 2940 wrote to memory of 1044 2940 KB931125.exe updroots.exe PID 2940 wrote to memory of 2032 2940 KB931125.exe updroots.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a7859e80fe07dbbfc602996e364a89e5062965904a5dcfac157c6b5d6ad0b8a.exe"C:\Users\Admin\AppData\Local\Temp\5a7859e80fe07dbbfc602996e364a89e5062965904a5dcfac157c6b5d6ad0b8a.exe"1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\{0C1C744B-7302-4bf1-AB9A-409F2E97EAE6}-TemporaryCache\KB931125.exe"C:\Users\Admin\AppData\Local\Temp\{0C1C744B-7302-4bf1-AB9A-409F2E97EAE6}-TemporaryCache\KB931125.exe"2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe authroots.sst3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe updroots.sst3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe -l roots.sst3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe -d delroots.sst3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\{721674E3-C63B-446d-8CA6-EA1F4C6482B8}-TemporaryCache\KB931125.exe"C:\Users\Admin\AppData\Local\Temp\{721674E3-C63B-446d-8CA6-EA1F4C6482B8}-TemporaryCache\KB931125.exe"2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe authroots.sst3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe updroots.sst3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe -l roots.sst3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe -d delroots.sst3⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\W95INF16.DLLFilesize
2KB
MD57210d5407a2d2f52e851604666403024
SHA1242fde2a7c6a3eff245f06813a2e1bdcaa9f16d9
SHA256337d2fb5252fc532b7bf67476b5979d158ca2ac589e49c6810e2e1afebe296af
SHA5121755a26fa018429aea00ebcc786bb41b0d6c4d26d56cd3b88d886b0c0773d863094797334e72d770635ed29b98d4c8c7f0ec717a23a22adef705a1ccf46b3f68
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\W95INF32.DLLFilesize
4KB
MD588d01717dc4f1119ea925ff0217c5f49
SHA17da9c2e12283800f9896c1f15f789539529e00ec
SHA256c6407f5792a945bf0948de191e6c54c4fbd2abcc0af3994140fb4319f685dbbd
SHA51239ecd9d2bb8b4edf88b8882640ec49c061fa34496c026ad19adf4bc4462de3949c72ad00bcc2ca27d53596221c026e978f875bb6cf7e0e8c2d884c1d37a83781
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\authroots.sstFilesize
73KB
MD5bb49ccc10926cdb601eba81afef749a2
SHA1a4766c9aea8d211e9632148fd4b625cece195be9
SHA256f013ee3b7fede9a95844e83e83ee298d38cba6efce5a5cafcd8b95255c32f86c
SHA51294c2809727039d1ed07a3742a4b2f9300e865ea7c49bc1fcf547a30238eeecc88d8dd06a2d4f3112317f948908b9af082b50f412a41a2bcb48d5e30d6d8ecbba
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\delroots.sstFilesize
9KB
MD57b32871e409608ff887b6cf4d87debb0
SHA1191f9ea1298ee52dbd6f977b3584109a064f57b9
SHA2563f01268547364d2d60a0f65b46757cccfd9225fc39d581846a8fbffdb5756ff2
SHA512534a384f7946db4083e639b8e02d83ac97293c60630b8811a84c85e0330e9c293f05f5cf71e0f3580551e7923bc5a3bfb7f0406432ca3cdb7efeb4a950ac5e8a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\roots.sstFilesize
7KB
MD59e5de0fd1f90486a66dee4bfe89a78d7
SHA190e3188ef63495aaa71c85d4ff0f23253c834b40
SHA2568b95ff56d61586582864d05563762615c8705779578dca3c98a303c3b1f4122e
SHA51260006fa6f57e4d280642d51055f85f8d27b913ce71373de5b928c515c77647295030ab73ab4a55024de4a40c18f200909f49ffb52c26cf554835fc3d4cc348f1
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rootsupd.infFilesize
1KB
MD5421e60325404f5f29ac04c9b9d59096b
SHA1aace2fd74d799e8af5c8d5b2646361bb67a1620c
SHA256571a8da5298aacc37700c747ee5d72b5a7797835140e7a4d4f895e9604574d77
SHA51286693975b1b187ee65b0a23b1f3f8e05d1a3f61e7e47b060f938fe1602bbad96021847b709e64c2d5a295b72f10f4db587a11a1e7ca0a0b64c3bed7fa683b1d2
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.sstFilesize
320KB
MD52d9b4498c847715418160bfd7e7c8a2d
SHA1e0873091d476d2566aa6fc988cb364247c95dc97
SHA256c49c05b701c390c679e5e3226ec621f22a08155b1065fcfc37b509f648f03b41
SHA512dcf3208cdd1e4353f82823f796d735c1209f149f183eea827a90753ec55509a1c460a16c120e07c12a5eacf0e67d2661c25638491ecf4403e25d6508983e519b
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\ADVPACK.DLLFilesize
89KB
MD5a64e4b204d44548eeb5c3d86eca2ad70
SHA1e3245bf6dbb2e56d71a9cbad2697aa4fa0df6bbe
SHA256985a5603ebf94539ac11549999f83b5e6dc008180994898c5daa6fd31ae1e9dc
SHA512dca4099318954bab5f1204645be0d0e8fea0c2e97ee95496fa884fbed627e376358623fa94c39bf0abe97d07d46a7e6c5e1081496cdd1987e07e595995a46cd5
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeFilesize
5KB
MD59c18ae971cbffb096952177f6804ea31
SHA1bb255dd1bd9bb39cdbb8671af66054432c686828
SHA2562703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb
SHA51221086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c
-
\Users\Admin\AppData\Local\Temp\{0C1C744B-7302-4bf1-AB9A-409F2E97EAE6}-TemporaryCache\KB931125.exeFilesize
349KB
MD54a4d72d34f9da1fc5019e0748fcde2f5
SHA1f54752ec63369522f37e545325519ee434cdf439
SHA25683b660f3f3eaddd4b388ed3f806f7444f03429fb63fc1f8db3d86294914a05ca
SHA51295986ffbf51483a0d1a256028847c7ee6ac73ffd62f6d838309a69e1833f719a7cfed5422815f4d4a49dbd599c449f8db8f60273136720cb1da5f8b0eb24cb33
-
\Users\Admin\AppData\Local\Temp\{5FB10D42-28D2-48a3-BAA3-6E7F00A4C388}-TemporaryCache\7z.dllFilesize
1.1MB
MD5f0fef6362d4886e85a186a5e3766650a
SHA165843b7052a4d1b84762479d79445c46834e18b5
SHA25615b9fe7d408cbf2204039087526e7df947df57b42ea479e303b682e956638816
SHA5123f6dfd701cf62b77219f8825a2257c4bd7d44ebafc5654b06abaf906ced2571f4eeb04fe22ae6136c14bddebddb12555aa6efd322e779443d57bb122ea786043