Analysis
-
max time kernel
28s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-01-2023 10:36
Static task
static1
Behavioral task
behavioral1
Sample
a34b663f961d9d1e667b5a6c8c1d0385102a3a3bb9345c9530410e54e0c89138.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
a34b663f961d9d1e667b5a6c8c1d0385102a3a3bb9345c9530410e54e0c89138.exe
Resource
win10v2004-20220812-en
General
-
Target
a34b663f961d9d1e667b5a6c8c1d0385102a3a3bb9345c9530410e54e0c89138.exe
-
Size
1.0MB
-
MD5
74fb2f7818f324d637096a75675cfc0e
-
SHA1
af234d13310de6066a2c0c8601d5167c2b7ab496
-
SHA256
a34b663f961d9d1e667b5a6c8c1d0385102a3a3bb9345c9530410e54e0c89138
-
SHA512
87e6d81b1c9bbc777cc137a4b5e75df91acc28835265a967d18a278723b2614563436bbf04151a99139ac953ec93190b7d7ad6c806938a70dce0a80e6bdaa2a0
-
SSDEEP
12288:c/XEXxg5SJgzykSsjsappPTxKq9TUMZ6lrFDi/TJUL/j/A1dXJ0yOQG6AfIAFyw8:c/XEXjJSbjsWKKhAxET4/jWthOnrtK
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
Processes:
updroots.exeupdroots.exeupdroots.exeupdroots.exepid process 1496 updroots.exe 472 updroots.exe 1508 updroots.exe 1560 updroots.exe -
Loads dropped DLL 8 IoCs
Processes:
cmd.exepid process 976 cmd.exe 976 cmd.exe 976 cmd.exe 976 cmd.exe 976 cmd.exe 976 cmd.exe 976 cmd.exe 976 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
updroots.exeupdroots.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\9C615C4D4D85103A5326C24DBAEAE4A2D2D5CC97\Blob = 6800000001000000080000000080c82b6886d7017e000000010000000800000000003db65bd9d50153000000010000001f000000301d301b060567810c010130123010060a2b0601040182373c0101030200c00b00000001000000260000004b00450059004e00450043005400530049005300200052004f004f0054002000430041000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080300000001000000140000009c615c4d4d85103a5326c24dbaeae4a2d2d5cc972000000001000000e9030000308203e5308202cda00302010202121121bc276c5547af584eefd4ced629b2a285300d06092a864886f70d01010b0500304c310b300906035504061302465231123010060355040a13094b45594e4543544953310d300b060355040b1304524f4f54311a3018060355040313114b45594e454354495320524f4f54204341301e170d3039303532363030303030305a170d3230303532363030303030305a304c310b300906035504061302465231123010060355040a13094b45594e4543544953310d300b060355040b1304524f4f54311a3018060355040313114b45594e454354495320524f4f5420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6fdb31785a1ad261b956935213da488fadedb6036401769c21463fbb8d9c27415372e9cd020cd698d8432a2854c14b49bf225b3542a833f2dbe0ff33b64d1ffa050ef774f3b4ee13f0b64859aba587ed2c362d36425a2d4b2973c775d632a3392fccd820d9b549587f5b5eb8ccd5bd1ca302fc98846b5cd0d11b4188feed1a13e5d15e828cfdfc3909b6cccd10c4577b33aeb8a901de9af646a897ba93d4374fae46722a1fbdc4dc4f562c9ca25b4c9806033a9dd7ba002bf96250a5ec95f297bb417818b6d8119d0d9835c058f41691a6943809fa8afe0e98c918b272ba22660cd0ff2a4a302838e1881c2178a4315f96df31d10a45a9c446123217ad8fbd10203010001a381c03081bd30120603551d130101ff040830060101ff020104300e0603551d0f0101ff04040302010630570603551d1f0450304e304ca04aa0488646687474703a2f2f747275737463656e7465722d63726c2e63657274696669636174322e636f6d2f4b65796e65637469732f4b45594e45435449535f524f4f545f43412e63726c301d0603551d0e04160414efb72397d0a8917fa6cfa621c0349fcc7741e1d0301f0603551d23041830168014efb72397d0a8917fa6cfa621c0349fcc7741e1d0300d06092a864886f70d01010b050003820101001a31699942c2e54085a29f92c363d48f2139a81921fe7afcc34d40f32be84bac5b4c5993c6dc7e0baf7c5f95856bbdc76fbac1bef8c63a674b93c605693e242df01b91c63e3fec4218936c03248a6ef920672b7c6dab34c92a22330dd77d8feed2366442c8359a6e1961cb8d67f068a7d02405e6c317ba45ae7c43b58078034d207305fc43109d356942759425822ba63b9018dec1a9aff32d95bf95a7cf1897e159e2a2af1a16610df71371539337fd3caf001d6c8b14af46968cb6527ccc2d4ecde1e94b0aee9afe7a98e729ba1bda1cbadc6bcd040e2640a9eb733cfe50a8112755bddb8e4bef4f18ed15ffbd869866ee9a2571346c50f1b251cb669d4d29 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E621F3354379059A4B68309D8A2F74221587EC79 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D8EB6B41519259E0F3E78500C03DB68897C9EEFC\Blob = 030000000100000014000000d8eb6b41519259e0f3e78500c03db68897c9eefc090000000100000040000000303e06082b06010505070302060a2b0601040182370a030c06082b0601050507030406082b0601050507030606082b0601050507030706082b060105050703010b000000010000003a00000047006f007600650072006e006d0065006e00740020006f00660020004e00650074006800650072006c0061006e006400730020004700330000007e000000010000000800000000c0032f2df8d6017f000000010000000c000000300a06082b06010505070301200000000100000078050000308205743082035ca00302010202040098a239300d06092a864886f70d01010b0500305a310b3009060355040613024e4c311e301c060355040a0c15537461617420646572204e656465726c616e64656e312b302906035504030c22537461617420646572204e656465726c616e64656e20526f6f74204341202d204733301e170d3133313131343131323834325a170d3238313131333233303030305a305a310b3009060355040613024e4c311e301c060355040a0c15537461617420646572204e656465726c616e64656e312b302906035504030c22537461617420646572204e656465726c616e64656e20526f6f74204341202d20473330820222300d06092a864886f70d01010105000382020f003082020a0282020100be32a2540f70fb2c5c59eb6cc4a451e8852ab3cc4a34f2b05ff30ec71c3d531e880868d86f3dadc29ecc826707278768713a9f7596224605b0edadc75b9e2ade9cfc3ac695a7f5176718e72f49080c5ccfe6cc34ed78fb50b1dc6b32f0a2feb63ce4ec5a97c73f1e700830a0dcc5b36d6fd0827211abd28168598217b7789260faccde3f84eb8d3833900a7223fa35cc267131d1722892d95b236d66b56d0742eba633ce92dbc0f66c6378cdca4e3db5e5529bf1be3be65460b0661e09ab07fe54891142d1f724ba60781a98f7c911fd16c1351a5475ef43d3e5ae4ecee77bc3c64e61514bab9a454ba11f41bd48531571640b86b3e52ebecea41bc12984a2b5cb0823764322241f1704d46e9cc6fc7f2b661aec8ae5d6cf4df56309b71539d67bacebe37ce94efc7542c8ed58950c0642a29cf7e470b3df726f5a374089d885a4d7f10bde4319d44a582c8c8a399ebf8487f1163b360ce9d3b4ca6c19415209a11db06abf82ef70512132dc05768ccbf764e40350af8c9167abc5f2ee58d8debef7e731cf6cc93b71c1d588b565bcc0e817170712b55cd2ab2093b4e682837036c5cda38dad8beca3c14387e643e234be958b35ed0739daa81d7a9f369e12b00c6512901560d9264044e35660a510d46a3cfd41dc0e5a47b6ef9761754fd9fec7b21dd4ed5d49b3a96acb668413d55ca0dcdf6e7706d17175c8576faf0f775b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e0416041454adfac79257aeca359c2e12fbe4ba5d20dc9457300d06092a864886f70d01010b0500038202010030999d0532c85e0e3b98013a8aa4e707f77af8e79adf504353972a3dca3c47982ee1157bf192f361da90251665c09f545d0e033b5b77029c84b60d985f34dd3b63c2c32881c29c292e29e2c8c301f233ea2aaacc0908f76567c6cddfd3b62ba7bdccd10e705fb823d1cb914e0af4c87ae5d96336c1d4dffc2297f7605dea292f58b2bd58bd8d964f1075bf487b3d5187a13c7422c2fc077f80dcc4acfe6ac17030b0e98e69e22c69819409baddfe4dc0838c9458c04620af9c1f02f83555492f46d4c0f0a096020f33c571f39e237d94b7fd3ad309830621fd603dae32c0d2ee8da6f0e7b4827c0acc70c97980f8fe4cf73584198a31fb0ad9d77f9bf0a29a6bc3054aed41601430d1aa11426ed32302040bc665dddd5277da816bb2a8fa0138b996ea2a6c679789949ebce154d5e46a78ef4abd2b9a3d407ec6c075d26efb6830ecec8b9df949359a1a2cd9b39539d51e92f7a6b9652fe53d6d3a484c08dce4281228be7d355ceae0167e131b6ad73ed79efc2d75b2c114d52303db5b6f0b3e782f0dde338d16b748e7839a810f7bc1434d550417384a51d559a28974d39fbe1e4bd7c66db788246f6091a482855b5641bcd044ab6a13bed12c58b7123358b23763dc13f5941d3f4051f54ff53aedc8c5ebc21e1d16957ac77e4271936e4b15b730dfaaed578548ac1d6add3969e4e17978bece05bfa10cf7807b2167273059 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\9D70BB01A5A4A018112EF71C01B932C534E788A8\Blob = 0300000001000000140000009d70bb01a5a4a018112ef71c01b932c534e788a809000000010000002a000000302806082b0601050507030206082b0601050507030406082b0601050507030106082b060105050703080b000000010000002a000000430065007200740069006e006f006d006900730020002d00200052006f006f00740020004300410000007e0000000100000000000000200000000100000096050000308205923082037aa003020102020101300d06092a864886f70d01010b0500305a310b300906035504061302465231133011060355040a130a43657274696e6f6d697331173015060355040b130e3030303220343333393938393033311d301b0603550403131443657274696e6f6d6973202d20526f6f74204341301e170d3133313032313039313731385a170d3333313032313039313731385a305a310b300906035504061302465231133011060355040a130a43657274696e6f6d697331173015060355040b130e3030303220343333393938393033311d301b0603550403131443657274696e6f6d6973202d20526f6f7420434130820222300d06092a864886f70d01010105000382020f003082020a0282020100d4cc090a2c3f92f67f149e0b9c9a6a1d403064fdaadf0e1e065b9f5085eacd8dab4367deb0fa7e80969e84789248d6e339eecee4595897e52e2798ea93a8779b4af0ef74802deb301fb5d9c7809c62279188f04a89dddc88e614f9d5032fff95dbbd9fec2cfa141559950ac6477c6918b9a703f9ca76a9cfc76fb45e05feeec152b2753287eced29663bf34a1682f6d69adb7298e9def0c54ca5abb5ea01e28c2e647f646ffda325938bc8a20e498d34f01fec58452e34aa8450bde7b24a13b8b00fae385db0a91be673c95aa1d96640aaa94da63402ad847eb223c1fb2ac667f434b6b0956a334f7144b5adc0793388e0bfeda3a014b49c09b00ae360bef8f86688cd5bf17705e0b5736ec17d462e8e4b27a6cd350afde54d7daa2aa329c75a6804e8e5d693a462c2c5e6f44fc6f99f1a8d8249198aca59433ae80d32c1f44c13036f6ea63f9173cbca736f12208beec08278de4b2ec249c31ded16f624f4271b5c5731dc55eea81e6f6cace245cc57578a755719e0b558994936313c33016d164acdb82a8384869bf960d21f6d9103d360a6d53d9add77903d35a49f0f5ef5524469b9c0badccf7ddf7cd9c4ac862232bc7b6b91ef7af81768b0e25355602daf3ec283d8d9092bf0c064db878b91cc91eb04fd76b4959ae614061bd5341dbed8ff741c538599e059524a61ed889e6b4989467e205ad9e74ae56aeed26511430203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ef914cf5a5c330e82f08ead37122a492687874d9301f0603551d23041830168014ef914cf5a5c330e82f08ead37122a492687874d9300d06092a864886f70d01010b050003820201007e3d54da225d1a583e3b5427babaccc8e31a6aea3ef912eb565f3d50cee0ea482626cf79567e911c993fd0a1911c2c0f4f98955953bdd022d8885d9c37fcfb64c1788c8b9a6009ead5fa215fd07465e750c5bf2eb90b0badb5b017a6128cd46278ea566aec0ad240c33c05303e4d94b79f4a03d37d274bb6fe44cefa19331a6da442d1ddccc8c8d71652834f3594b312557de5e242ebe49c9309c04c5b07abc76d11a050179423a8b50a920fb27ac1602c38cc1aa65bfff20ce3aa1f1cdcb8a09327de63e37f219f3ae59efae0136a75eb965c6291948e6753b689f81209cb6f525b037286509508d48d8786151f9524d8a46f9acea49d9b6dd2b2760686c65608c5eb09da36c21b5b41be612ae370e6b8a6f8b65ac4bd21f7ffaa5fa16c763966d6ea4c55e100339b139863c96fd00120093752e70c4f3ecdbcf55f9627a7200295e02ee80741051f156ed6b0e419e00f0293002772c58bd1541f5d4ac340977e55a67cc1330414011d4920690b19939d6e5822f7400c460c2363f339d27f7651a7f4c8a1f10c7622234652292de2a34107566998d20509bc69c75a61cd8f8160154d80dd90e27dc450f28c3b6e4ac7c6e6802b3c81bc1180161027d7f0cd3f79cc732ac37e5391d66ef8f5f3c7d0514d8e4ba55be619173bd68109dc22dcee8eb9c48f53e167bb33b8881546cfed6935ff750d46f3ce71e1c56b864206b941 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7A1CDDE3D2197E7137433D3F99C0B369F706C749\Blob = 0300000001000000140000007a1cdde3d2197e7137433d3f99c0b369f706c74909000000010000004a000000304806082b0601050507030206082b06010505070303060a2b0601040182370a030c06082b0601050507030406082b0601050507030706082b0601050507030106082b060105050703080b00000001000000620000004100750074006f0072006900640061006400200043006500720074006900660069006300610064006f0072006100200052006100ed007a0020004e006100630069006f006e0061006c002000640065002000550072007500670075006100790000007e000000010000000800000000003db65bd9d5012000000001000000a10600003082069d30820485a003020102021202ee009b66d86a1d67feda8a256f215a751b300d06092a864886f70d01010b0500305a313a303806035504030c314175746f726964616420436572746966696361646f7261205261c3ad7a204e6163696f6e616c2064652055727567756179310f300d060355040a1306414745534943310b3009060355040613025559301e170d3131313130333135303234395a170d3331313032393135303234395a305a313a303806035504030c314175746f726964616420436572746966696361646f7261205261c3ad7a204e6163696f6e616c2064652055727567756179310f300d060355040a1306414745534943310b300906035504061302555930820220300d06092a864886f70d01010105000382020d0030820208028202010097c41f2a44a1814b489175ddebda8fca1b8bf2b43c2cc6e5f4c11ed1b830136f5c9fe551967f1aa416fed2d41d25f6d0e637605f00a319a9ec27bf502d05a05c5e93ebe368fd9b3db914362de7251510901a92c911b1299793565562ad47ac7fd50c7796d293686a31dd54ef93f20a4fa05f025aefb6443ee799b28e45dea0f7c0e848b047ecde4214db357ba069fc1ec0012916da33a121a1323210767da8c7c02e738364fc5af79b368c69ed20552379cdf3f36c6b605c788dfc3d852cbca9f770e8a5ca4dd87c98ef86761884d54029102732e7ef03440b4fc92af1b6b42ba0d503948421d374f3296d78f0056aae010f611fc6a5f0c78215d93bfbdd8b7469eee4c7c7f411dc1451c1841a2556136b5bce5f2cfd8b1b2d0fc8c055aa184f989ccfa27708b43595d8b98b9c490eb4100bfcfc474dd49a57f99f7abde957bbb40f5f1590d8686cd58525832d860c476297b3794db9650877526f4ae36e80c0aca3d5bcea49e265e24c596a82de2bf5aa3efe65e851704d378406043f9283d45628e325d554ca85ee56c02ecef97010125f5d9ec6bc4b101d566dca72c153092a133dd8b5f91c3b45c68714d0387e9e215ffc761dff0b2942dba1c47939e14dd58650e3f2e0b3d7599bde3f1e1a03f3d469864b471c327f3c07091310a79b07307733bc6911d1343d7c102ab81e8ebd47def9b2795566210207fb392c0a17a1020103a382015d30820159300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff30620603551d1f045b3059302ca02aa0288626687474703a2f2f7777772e6167657369632e6775622e75792f6163726e2f6163726e2e63726c3029a027a0258623687474703a2f2f7777772e7563652e6775622e75792f6163726e2f6163726e2e63726c3081b20603551d200481aa3081a7305c060b60865a84e2ae1d84880500304d304b06082b06010505070201163f687474703a2f2f7777772e7563652e6775622e75792f696e666f726d6163696f6e2d7465636e6963612f706f6c6974696361732f63705f6163726e2e7064663047060b60865a84e2ae1d848805013038303606082b06010505070201162a687474703a2f2f7777772e6167657369632e6775622e75792f6163726e2f6370735f6163726e2e706466301d0603551d0e04160414929e91b855283d77422c33a5985fd0c9ac8db5a3300d06092a864886f70d01010b050003820201005de7ab59ea49dcbf4643fd94bb98709414face035df17d3113924e852430146b6cd3e7cee679d5db4e554e172bd79345df130c27671dc742905430c6f1a86928b44ea66da535a650966849a3ee2f0babfc03025068f195293e712cdcdae52dd9762eee56337e17a12702e1a12728218abf01e762c7bbb22504da1ba6238c7c93bac98beb0af937b79439fd4d8f7ea2dc816f1bad140f5b2003784173679ed29717902a8a544ba7797f2412919f3b2cc737a40c5c726a139e320927eb4332755fd747c32a45531556764fbb09e8846011ef73d5e7506e6928fdebc6cbca4e13630d0e372c311fdba758a0b2fd0d1787b392ae1b28801fb6927e8611e1f64c987f668b1f13490342fcfb989cee8696a92e057e701cc177c8e95d82b80ece5b640563ee3f062d360ce91f725b1eacdd26f51c386efd8c3d4d86eb27cbca038d40f32ad18ad8340ec2adb588ed879a8a85a287efe9b938e76896a301cf823d1c4b289d27f5f999967b48fdacd0f032f73804dd4d99ae0e9282c3fa3c1b13c768b75de09346b8b8b8a40cc41bc6ba4696dd9e550f479df681a5ac6559d8ddae066ce04382c667d8700235f53604e34a39a975021ee63f46cf9c2c1e848817aa26a9a64380e0c05ba364839b9aed6b0165b6c13d18ec93196694a8d31150997a887daf3e7f94903b0ac36ab78d5fd2a751d1321fb9f2327d77936d43ec4169abcfc961 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\40B331A0E9BFE855BC3993CA704F4EC251D41D8F updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DD50C0F779B3642E74A2B89D9FD340DDBBF0F24F updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\58D1DF9595676B63C0F05B1C174D8B840BC878BD updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\BED525D1AC63A7FC6A660BA7A895818D5E8DD564 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\6C155ED7271A904A0DC040F0C857FF53BF6DB290 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8DDEB82046B6227C79246A3EAD7B32C3E88FFCAC\Blob = 53000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000004a000000480041005200490043004100200043006f006400650020005300690067006e0069006e0067002000520053004100200052006f006f007400200043004100200032003000320031000000090000000100000016000000301406082b0601050507030306082b060105050703080300000001000000140000008ddeb82046b6227c79246a3ead7b32c3e88ffcac2000000001000000ba050000308205b63082039ea003020102021015c2ae2a4d999a638cd3ba13197608f5300d06092a864886f70d01010b05003075310b300906035504061302475231373035060355040a0c2e48656c6c656e69632041636164656d696320616e6420526573656172636820496e737469747574696f6e73204341312d302b06035504030c2448415249434120436f6465205369676e696e672052534120526f6f742043412032303231301e170d3231303231393130353935345a170d3435303231333130353935335a3075310b300906035504061302475231373035060355040a0c2e48656c6c656e69632041636164656d696320616e6420526573656172636820496e737469747574696f6e73204341312d302b06035504030c2448415249434120436f6465205369676e696e672052534120526f6f74204341203230323130820222300d06092a864886f70d01010105000382020f003082020a02820201008a6aeeaa0a23550c8b0642e3955b54785fc58e062c7c3c31beaf0da9a1ec4a2058059de268b2bbeb5f7f2a33b9f2559c6faaa41eed10be83291136e69e3ffa6d7b51e1d577a5bdcb690e3b2220940c3165400d09af10357a9bea790844a48b67a92b4dc1e7d0d7a7f6b53a8dd9a3a979b8a4655cbcf33ef79f99f6b8c365682dab832edd859904a9f5d15cd5514201b99f41b54b22b200f4cb6710ef69c410adfa94067650125782aec514ad3c7dbb9df173e17cf0ae71de5bf712ddf780f1dc3ef160bac919976f7574854cfd3943c3646e34ac13c11c65b65242f146eb2ffa5da6cf0e499df7747c780d063a2c12fbe24b26e46f8b218133423913e842ab5b55d41bbb37b61291f7f37dbcd2ffecb1c3d5a0ccb22bc78f5d7e4c524248fb8ffd5a907310d5a972548d49db3852aa46480e2ffa002ccc730c364b24ce136ca6a4a4a3d67c9be9380bc624db4dac6721495b413764e6606b1fed2a2f6019301ed83c9c194387dfc00af4e4ca60887ad6a3b9e4252e79e2fec1cb3cb7f7cf4e584cfbc3adab7daaca88fb0e380d1f9e5c39ebb807c450224df8857f6eec8cfab6714dde7d9669c4dd3e1ede26900a2c4d1595a9a23edc3d0e777c8d41284fb88351be3eb78f903a7031895afa9353fc60c98d7590ee5a2f1d849f00a9e6c38623a21edd12e3a146601b67bf501522927c4ab48c8f6e9c95c22cdc3b3a20b6bc8b0203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e04160414b4641648e8fc5a4b332989eb9940b920b4f6611a300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201002bac598be63944dcfbad4a88e064ffabc3f2d2ce702f03e56fb2c4f536d6536b87ab1d8b9907c8308e4772fda1b875d617a116bd6473913057ad7dfd05408693d14996b20bd47c64138bd3214938bbfbe8cc3e31f1ae7b4c2adf8206a38e05849c7f70cec0bb4517df5d650ce4504807448ba42f56dac67af6608da438f19d871630b2f05f7a42552071cfccee00b11247bf42b9e4b3b51d1984b9986de069b41541b5e25048c71fea9ab77991ddd5d55319fcae186c69dbad59289b6498a73cc7558ed13000cfd4329e62b1c32aee3522c6bbf07cbb83b80089f5dc1a97d9389a29536119a6a7f43b47fddd67950f8ea4662c829ab72d71e6dfaef8f868c1bb0fea50a04597b71a95126fc8b3b60568da6a1e0e358584ac740c8ab4f4759f22afb054bbb69e22f9d9ebd58a0dc7dcf898315f9efac697f4411075d381b6315f7add888508af704702377be24aec5df2dd291244c88aaaddd255781775af71690d77704ab01f7f42dbc771dc58d618bd50c5b97204c7677b7c5360ca491815bc4073ae2ba82bac6f114439ec82487e11cafbd63fb6c0b9b8069375bd932777170d5ca59eeac15b002d0ca83560c7e26f351b3d76b5e7addd74234f86b247efc82fd0857c399637a12b2902bd3e87cfa8f61d7532cf38e373b1ee1081b52ab18806511e5a3a4851f3365962df42665950b758bef576409a1216e60eaad76ca0d5 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5463283B6793FF55277CEDE39098E80422F912F7\Blob = 0300000001000000140000005463283b6793ff55277cede39098e80422f912f709000000010000005e000000305c06082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030506082b0601050508020206082b0601050507030606082b0601050507030706082b060105050703080b000000010000003200000041004300200052006100ed007a002000430065007200740069006300e1006d00610072006100200053002e0041002e0000007e00000001000000080000000000cf97a737d6017f000000010000000c000000300a06082b060105050703032000000001000000730600003082066f30820457a0030201020210431c28c6740fed2557449ff2fd0e5e14300d06092a864886f70d01010b0500307b310b300906035504061302434f31473045060355040a0c3e536f6369656461642043616d6572616c206465204365727469666963616369c3b36e204469676974616c202d20436572746963c3a16d61726120532e412e3123302106035504030c1a4143205261c3ad7a20436572746963c3a16d61726120532e412e301e170d3136303532343138333934365a170d3331303532343138333934365a307b310b300906035504061302434f31473045060355040a0c3e536f6369656461642043616d6572616c206465204365727469666963616369c3b36e204469676974616c202d20436572746963c3a16d61726120532e412e3123302106035504030c1a4143205261c3ad7a20436572746963c3a16d61726120532e412e30820222300d06092a864886f70d01010105000382020f003082020a0282020100ab6b89a353cc482308fbc3cf5196082eb8087a6d3c901786a9e9ed2e133447b2d070dcc93cd08dcaee4b17abd085b0a72304cba8a2fce575db40ca62898f509e013d265b18841ccb7c37b77decd37f7319b06ab2d8888a2d4574a8f7b3b8c0d4dacd2289744d5a15397318744fb5eb99a7c11e88b4c293906397f3a7a712b209220733d991cd0e9c1f0e20c7eebb338d8fc2d258a75ffd6537e288c2d88f86755ef92da78733f278372f8bbc1d863739b194f2d8bc4a9c83185a06fcf3d4d4ba8c150925f0f9b68d047e1712336b57484c4fdb261eebcc90e78bf9687c700fa32ad03a38df3797e25bde8061d380d89183425a4c048968113cac5f688041cc6042ce0d5a2a0c0f9b30c0a6f086dbab49d7976d488bf903c052679b12f7c2f22e986542d9d69ae3d019310cad87d557027a30e88626fb8f238a5487e4bf3ceeebc375485f1e396f81626cc52dc4175419b7378d9c3791c8f60bd5ea636f83ac38c2f33fde9afbe12361f0c826cb36c8a1f3308fa4a3a2a1dd53b3def09a321f83917930c1a91f539b53a215533fdd9db3103b487d890ffced03f5fb2564750e17190d8f001667797a40fc2d5907d990fa9aad3ddc808ae65c35a2674c116bb1f88064002d6f2261c5ac4b26e55a10829ba4837b34f79e899120978eb742c766c3d0e9a4d6f5208dc4c395ac440a9d5b733c263d2f4abea7c9a7101efb9f5069f30203010001a381ee3081eb301d0603551d0e04160414d109d0e9d7ce797454f93a30b3f46d2c03031b683081a80603551d200481a030819d30819a0604551d2000308191303306082b06010505070201162768747470733a2f2f7765622e636572746963616d6172612e636f6d2f6d6172636f2d6c6567616c305a06082b06010505070202304e1a4c4c696d69746163696f6e657320646520676172616e74ed6173206465206573746520636572746966696361646f2073652070756564656e20656e636f6e7472617220656e206c61204450432e300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106300d06092a864886f70d01010b05000382020100511b903e835a1ae86a70a5ad70fe10826130ad8cc3b5c6d8d33112c91f795315e243c7e10ef13d48ce680b15796de176877f7066edf50f82a4bc71efb12bccb1baeb2aa9601f4380be9272422e9fa1ff1808b15e5df56cce28dbc06c9acd875e96e9c8ef3597ba64aab77e454089b043834e7be1b4f476094bcc563e2149b2c69f63dbddf0b60f17f5ba4c708dd52700c943540f66aabaaeb1d976ee0391ed98b71a1ba296506e557fcd5e18d0671bbff4fa72d9bbdafbde9aaa512e05baceda6a6d18682668828534ed4d79da9a760df4f1d4c3fbb12a74ec9052e30d5df549585427003097a023016c89bf1d00f1fdfc19ac9f3b29a8c381cd9271f8d7e5b1da1b3a178f53daa6ae01ceb29e1acd0962cf75d4d76750a29f59f684f3c727319eaa1e264bba0e8aace9f5e35c1da12a3739bb346e3396d571a5433e363487ff92a2abe925e0d9517754aa7b41348658f1aae53e92dec8341093843f2645bd52c63c76f7211caee0e1c5a353f2099f7d139ea9f3b2598214944edf76aa83e928da8a8854fb1471aa503bbe24fdc43e44f89864f36a8f6275b0ac4765f69b223a21e1b5574156c524d619927770b0ac17f42e95104e123099a85445612f376ffa89574632f45be99bed09292f95ae94e287aa1e6a71e96f1b39edfc7cd40da64e232236f965cf42f01cb1339d34d5892469e61768a399ef7a5c2ffd20bd779960 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3E84D3BCC544C0F6FA19435C851F3F2FCBA8E814 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\84429D9FE2E73A0DC8AA0AE0A902F2749933FE02 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\535B001672ABBF7B6CC25405AE4D24FE033FD1CC updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1E0E56190AD18B2598B20444FF668A0417995F3F\Blob = 0300000001000000140000001e0e56190ad18b2598b20444ff668a0417995f3f090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b000000010000002e0000004c007500780054007200750073007400200047006c006f00620061006c00200052006f006f0074002000320000005300000001000000a50000003081a2301e06082b812b0101010a0330123010060a2b0601040182373c0101030200c0301e06082b812b0101010a0530123010060a2b0601040182373c0101030200c0301e06082b812b01010a050130123010060a2b0601040182373c0101030200c0301e06082b812b01010a050230123010060a2b0601040182373c0101030200c03020060a2b0601040182373c010130123010060a2b0601040182373c0101030200c07e000000010000000800000000c001b39667d6017f0000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703082000000001000000c7050000308205c3308203aba00302010202140a7ea6df4b449eda6a24859ee6b815d3167fbbb1300d06092a864886f70d01010b05003046310b3009060355040613024c5531163014060355040a0c0d4c7578547275737420532e412e311f301d06035504030c164c7578547275737420476c6f62616c20526f6f742032301e170d3135303330353133323135375a170d3335303330353133323135375a3046310b3009060355040613024c5531163014060355040a0c0d4c7578547275737420532e412e311f301d06035504030c164c7578547275737420476c6f62616c20526f6f74203230820222300d06092a864886f70d01010105000382020f003082020a0282020100d78597bf1198e9f062834c3c87f9536a370bf20f3c87ce6fdc2629bdc589bac9833df7eeca5bc66d4973b4c946a31b34133fc1894557f4d9b1fb36654bfb08e2487111c86e3b9e9ddf896537a685f63b4418b6c6373062449297697d423024e40d0c896b63dec5e1df4ea9146c53e061cef6172f1d3cbde6224c1d93f510c4a176ec6adec56cdf96b4564042c0629230a12d1594a0d22006096e6a6de5ebb7bed4f0f1157c8be64eba13cc4b275e993c175d8f817f333d4fd33f1bec5c3ff03c4c756ef2a6d59dda2d076302c672e994bc4c49954f8852c8dbe86982f8cc345b22f086a789bd480a6d66816dc8c864fb01e1f4e1ded99edddb5bd42a9926151b1e4c9229829ed5928192417019f7a4e5934bbc776731dd1cfd31700d17990cf90c39192a17b5307155d50fae58e13d2f349bcf9ff67885c2937a723e668f9c1611608f9e896f67bee0475a3b0c9a678bcf46c6ae38a3f2a7bce6d6856b332470224bcb089bbbc8f802291dbe200c46bf6b879bb32a664235466caabaadf9987be950551431bfb1da2ded80ad6824fb69abd8711330e667b38740fd897ef243d111df2f652f64ce5f14b9b1bf31bd87785a596588aafc59324886d64cb9294b95d376f377256d421c38834dfda35f9b7f2dac791b0e42319763a4fb8a69d5220d3490302ea8b4e06db694acbc8b4ed770fcc5388e6425e14d3990cec9878458710203010001a381a83081a5300f0603551d130101ff040530030101ff30420603551d20043b3039303706072b812b0101010a302c302a06082b06010505070201161e68747470733a2f2f7265706f7369746f72792e6c757874727573742e6c75300e0603551d0f0101ff040403020106301f0603551d23041830168014ff182876f948052ca1aef12b1b2bb253f84b7cb3301d0603551d0e04160414ff182876f948052ca1aef12b1b2bb253f84b7cb3300d06092a864886f70d01010b050003820201006a1914ed6e79c12c87d40d707ed7f678c90b044ec4b1ce9370feb054c032cd99306417bf0fe5e233fd073640720e1ab66a59d600e56820dd2e720d1f6a643120847d49a65a37eb45c985f5d4c7179907e69b55e40ce8a9b4ce8c5bb5115ccf8a0e0dd6ac7781fe329c249e72ce54f3d06fa256d6ecc3372c6558be57001af235faeb7b315dc2c1123d9681889689c1595c7ae67f7034e783e2b1e1e1b858efd495e4609cf09697728ceb84022e658fa4b7d27f67ddc8d39e5caaa9a4a02514069bec4f7e2d0b7f1d75f133d8edceb8756d3e5bb9981d310d56d8430f3091b2046bdd56be95805567bed8cd83d918ee2e0f862d929e7013ecde51c9437802a54dc8f95fc491584616775a74aa40bc079f30b9b1f71217dde3ff24401d7a6ad14f180aaa901deb401edfa11e4492109af28de1d14b469ee8454297ea4599f3ec66d502faf2a64a24aadeceb9caf93f936ff9a3baeaa53e99adfdff7b99f565eef0592867d79095a41384a984c1e8cece7593631abc3cead5641f2d2a1239c6c35a32ed4791160ebc38c150de8fca2a90341cee41949c5e192ef84549997491b0046fe3045ab1ab2aabfec7d096b6dae14a64066e604dbd424eff78da24ca1bb4d796396caef10eaaa77d488b204ccf64d6b89746b04ed12a563aa093bdaf8024e00a7ee7cad5cae88555dc362ae1946893c76672440f8021326c25c72380830aeb updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A9CAFE9DFD67F4145AD397D0E2F3050D198DE6EE\Blob = 030000000100000014000000a9cafe9dfd67f4145ad397d0e2f3050d198de6ee09000000010000005e000000305c06082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030506082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b00000001000000440000004100750073007400720061006c00690061006e00200044006500660065006e006300650020005000750062006c0069006300200052006f006f00740020004300410000007e00000001000000080000000000cf97a737d6017f000000010000000c000000300a06082b06010505070303200000000100000026040000308204223082030aa003020102021429eb9233464f3241ff831900a9adc4d9f8e3e27f300d06092a864886f70d01010b05003071310b3009060355040613024155310c300a060355040a1303474f56310c300a060355040b1303446f44310c300a060355040b1303504b49310c300a060355040b1303434173312a3028060355040313214175737472616c69616e20446566656e6365205075626c696320526f6f74204341301e170d3136313132383232323532385a170d3336313132383232313334385a3071310b3009060355040613024155310c300a060355040a1303474f56310c300a060355040b1303446f44310c300a060355040b1303504b49310c300a060355040b1303434173312a3028060355040313214175737472616c69616e20446566656e6365205075626c696320526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d34e54041bd0f49b9db82387e020c79e98b1717a06902ee2ad48fe93056cec86bf284085b34c79ef475398101e54ee7d78b818130c4452fdd081aa93082339be5f0f6bdd2597f30142dfd48100c450be7a892d19af734a3fcc3ac0bfa2a8c515f73e7c4174826b2e7766e26aa591886e0631a7af0be65ae0ae7d5aaf2f47d0f2fb84739c46a11e844451c45f2eda90025f81df110ed2fbbb3a1773a3f28d63aa4fff727a6562835a2a3cf2cd2c238dcfeb211fbfd40357f537160c5ee55711c2a8faff6c39f23d52e6b579c05be2b2ea63200c0ea52a5e12e1e6af5f8b7ca0ad393535985ff1af38d026d34dbd6277753daf6b14867b5af6218fd6eae2a70ead0203010001a381b13081ae300f0603551d130101ff040530030101ff304b0603551d200444304230060604551d2000303806092a2401824e01010107302b302906082b06010505070201161d687474703a2f2f63726c2e646566656e63652e676f762e61752f706b69300e0603551d0f0101ff0404030201c6301f0603551d23041830168014ac99e1022fe85c4b41b734b81ee99b83360d94b4301d0603551d0e04160414ac99e1022fe85c4b41b734b81ee99b83360d94b4300d06092a864886f70d01010b0500038201010078bc814ad83a57bbbd26bfea2a28f0888af2504c9067da4bf5b81408badb7f72a89a59bcf11c89a8f43a031054137a5dc6daba3e0f88d56ad31b972d62613a6ff900af720673ec10c0611ecc5c4f19324638c1dd3fd2371aa58e86a0f009cc35d619027ccd39fcf7f91fe794794e3db7f8974e3b446acd94b0b9f77ee2e3f9997fc5d3a650b449fb167e4e412ccf3ec77940ba81182608f9c59de3d8f16f1c683f6a5b771752a306de19c24b6ea295fcd508bf2cb5693551e3e3df4f1a296d83783d3824ca023f5410e1b364e1d59adef337f63310b576b3abd7c91f533aad55411c48c9369e87ff75dc69d0afd97a57c6cab143fc3981fcdc7aa39aa5985054 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\51501FBFCE69189D609CFAF140C576755DCC1FDF\Blob = 0b000000010000003e00000048006f007400730070006f007400200032002e003000200054007200750073007400200052006f006f00740020004300410020002d002000300033000000090000000100000020000000301e06082b0601050507030206082b0601050507030406082b0601050507030103000000010000001400000051501fbfce69189d609cfaf140c576755dcc1fdf2000000001000000700500003082056c30820354a00302010202100cb30f70f286a433e0b90989de01edb7300d06092a864886f70d01010b05003050310b300906035504061302555331183016060355040a130f57464120486f7473706f7420322e30312730250603550403131e486f7473706f7420322e3020547275737420526f6f74204341202d203033301e170d3133313230383132303030305a170d3433313230383132303030305a3050310b300906035504061302555331183016060355040a130f57464120486f7473706f7420322e30312730250603550403131e486f7473706f7420322e3020547275737420526f6f74204341202d20303330820222300d06092a864886f70d01010105000382020f003082020a0282020100ac744b5178851b3253be851e9bc909389c65484efde67984da0de5706674156a5f048c7baee0a77cf60f32458553bf727592af6e904ec20eb0de86b5caca6fbc56547bae8d2507f970472364dd6ef235c720dc0927434c797ca570705ce7c03fc5620dfba301a684616da4c4c1731ceb79068b5ef2ed6bc60d949535d1991fa6eb41a738bd6cb3d6b0b3a422b430eca1f559cf8e8b2e2150c51b4e54a2723a9a70a3d1d7cf26548a31c54a08087c955752af326619ad575cfdbe5d6e677485a307c42d154aa6f2757c714bbbeffe50ab0b6779a9b284eba3e2b813e4873c94ed223d0bc194fd2eda9189b530c4939f95bb952a760164439dff4b420e7574bbc3c49eedd9faee5ed4a492a1bf730635c9023c3be59960f0d384a3dc0e635b6b1544f653a2cc01d7155b1f62b5c03db6cc3a4cca7a16306888a498d81ca71b50370fb08a426265bf4df15c30b701caef55c4162fa7e431a53daf550d880162405cc6f568dab6c4de2ded7908079bea5664d3f4f1a14d5b0324f724249bf48e19d2ead632db400f7277b7f24750ad5b518bcca8b53a3affe97881f7f9e82f7a313fffa06fc39281ca957e4669e102efac67652a2388d9f13b06c966ce7ea5077513a40a6369bec143df6b097cc3c2ddd777b22b0ad009364c62df4d89ee4ea19c6956f12e283d00449643ada07f725c4869f6b352d25662bb0b459965b6ab9d1f910203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414670e492c61179eebede054e784d99bad64607365300d06092a864886f70d01010b0500038202010053e81850f2cc583d07dfa32543c65b7da899fb418428557208e5948d3b44289e2933018b8efe6aeb8b822328c77c51c8feff757ed869478c5c443504cbfa9e5aec5d6bf5947e32bbe44db9e84f96a46c7d8df9d6601f3ed43ae78481522d1683efbd8b24ce7e01796bd216103b7896749932f038be5c3ca540b3eb3a4a5c79c04572aba58ddb53ed9d9eb143291d1742198041da3b52f76c4f57a5568148c4784ba707f3c7e929121b6b5f0de71a0b7e3388cda7af385e85a9c5519a43856fbf4d129b60d0f23ab6b1ff45fa4456b3366940e4e2306299af4957d82239730c3575f99dd419008c8f5c2162e40fc61279a820673bd87b5a3d77b7bb94a7dd2668c3952434b81886efb91e50ae2d1767e2c454f189bb4fbb1e7aa7719843619d46c05a2a31f70371cc252297c08191fb06f5b20cff6c1765c894b2946f21603fffd07ca8f94acc52ccc076cce83e1318fb83a5dd01374115b35e2f96fcdb4a7980f62bcc54ce364cd74c0c77109fa0539af1bcf35a7c594259eef3cd142d44872310cf784f830d961839a375855d9187f86b14abef57e8098f67971c5e46ef2f6e620ee71d80827fb1f2f144c85c3b4001e0c240da27d5178df06f973aa84b43d4da9669c9e54e4046d0b431d40386ded30d9a5678456ffa94070115fd18357f4fce4c57644f2562aa7d9ea42b482f40392e9c00dd83c2216408f030cc7793a07f updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\97817950D81C9670CC34D809CF794431367EF474\Blob = 6800000001000000080000000040d10ffc47d5017e0000000100000008000000000010c51e92d20153000000010000002400000030223020060a2b0601040182375e010130123010060a2b0601040182373c0101030200c00b000000010000002a00000044006900670069004300650072007400200047006c006f00620061006c00200052006f006f007400000009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030103000000010000001400000097817950d81c9670cc34d809cf794431367ef47420000000010000005e0200003082025a308201c3020201a5300d06092a864886f70d01010405003075310b300906035504061302555331183016060355040a130f47544520436f72706f726174696f6e31273025060355040b131e475445204379626572547275737420536f6c7574696f6e732c20496e632e312330210603550403131a475445204379626572547275737420476c6f62616c20526f6f74301e170d3938303831333030323930305a170d3138303831333233353930305a3075310b300906035504061302555331183016060355040a130f47544520436f72706f726174696f6e31273025060355040b131e475445204379626572547275737420536f6c7574696f6e732c20496e632e312330210603550403131a475445204379626572547275737420476c6f62616c20526f6f7430819f300d06092a864886f70d010101050003818d0030818902818100950fa0b6f0509ce87ac788cddd170e2eb094d01b3d0ef694c08a94c706c89097c8b8641a7a7e6c3c53e1372873607fb29753079f53f96d5894d2af8d6d886780e6edb295cf7231caa51c72ba5c02e76442e7f9a92cd63a0dac8d42aa240139e69c3f0185570d588745f8d385aa936926857048803f1215c779b41f052f3b62990203010001300d06092a864886f70d0101040500038181006deb1b09e95ed951db672261a42a3c4877e3a07ca6de73a21403853dfbab0e30c58316338113089e7b344edf40c874d7b97ddcf476557d9b635418e9f0eaf35cb1d98b421eb9c0954ebafad5e27cf56861bf8eec05975f5bb0d7a38534c424a70d0f9593efcb94d89e1f9d5c856dc7aaae4f1f22b5cd95adbaa7ccf9ab0b7a7f updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1B1815AF925D140EFC5AF9A1AA55EEBB4FFBC561\Blob = 7e00000001000000000000000b000000010000002000000041002d00540072007500730074002d0052006f006f0074002d0030003700000009000000010000000c000000300a06082b060105050703010300000001000000140000001b1815af925d140efc5af9a1aa55eebb4ffbc5612000000001000000d0050000308205cc308203b4a003020102020453f4ea89300d06092a864886f70d01010b050030818b310b300906035504061302415431483046060355040a0c3f412d5472757374204765732e20662e20536963686572686569747373797374656d6520696d20656c656b74722e20446174656e7665726b65687220476d624831183016060355040b0c0f412d54727573742d526f6f742d30373118301606035504030c0f412d54727573742d526f6f742d3037301e170d3138303531373131323332325a170d3336313131393130323332325a30818b310b300906035504061302415431483046060355040a0c3f412d5472757374204765732e20662e20536963686572686569747373797374656d6520696d20656c656b74722e20446174656e7665726b65687220476d624831183016060355040b0c0f412d54727573742d526f6f742d30373118301606035504030c0f412d54727573742d526f6f742d303730820222300d06092a864886f70d01010105000382020f003082020a0282020100a307be5e01fa25d8058f347f9113281f5ab9c32240ef2c404aa350465d61b8d93828bb965e3f0df1a99474a66f8d904a6a80fd0dd9ab2a02bd7008e849a1ea9bf7e6139bde1f2900f1a8b51e1a784ea2c0d705a6b7c76153b5a08591b55a543ef7cf7dfb528e127038cc9b450cdf8995a777f8e567035b91c201d45b0a7b7f7d582eac0bc3b9773b1196ee9bfce927784bd32bd624be027ca8892375d71e251f5f6292a122f47ec903490891c599cd9532d25e7f9f294828c991574273fa7ac1b1dd02dc02a7540262f384930058c76257ccda1968fb2850bb046d674b8481e330dc7c2f7fd12e7a2ec562a3880ad35a8778e8f6a7512b2d7283a40d8ce4c9e63da57ccec1c3338668355259521893ff62c96a5371b7b3517e80a9b9df6afb5d1d40c657b35481ba464d815dbcd7572bac99a792e22a9ce65af27036336b5a21c70fb7c4f2570035ea7424942b9f06ebceade3d6e5e9745950b189ef7ce55c8ad551b5e4614f6cd324c9e4c2bb8728aeb9e69be34a684ea3965965465d007970605d684ea39c9d9019a86e530698a67954a7126276a10e3dd66bb74d2eaabedf9da9561f1d4763acbe00b2c44c4fd65db7b2eb8988f672655ee1f4f1ed0c66a52851677daca44baa5a459c402748c6f0391c3b8553bbf1b082f0064f08564cacf149622ed11902984488b69a3533f2f78dcebce33a57099f0e7df0d82113b5610203010001a336303430110603551d0e040a040844c011ad532787f4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010b050003820201009f4748eaf2bbb456b9c73d3040d4d3a3959618f411bf84b86416820aa6fa8495fbbc9cfba47c38ad4d5481163460d7ef5099ff88d22fcfa410c887026019791f75dae0837173ecc98092218c40d5e9e7960254089aba426fbfa57264f9eaff16d681ef96ce64f28fde5c158f9f1863865ea5c559a7edc6086064fc98957a01f70d3d85ca32eb6d21b550dc968a5a4173d5496ea0a53858b57ec819f4fd05cbfe7fc8d44a118d073f476b480fdb06c4ff63247cf0d7247b92e5e8937d9cf95d308eeb92c3309a6061e01eb5c49521f553d6d3981ddf79a36b806d97a732fdc24a69fb4c9eab3f34ad76fbb09a3d863defc0a6ec172699848b28b4d1c1f3a22c01a178be1ab477d598cde372f56422ba5c8956448d3f3deb268274bbfa9ef11532166c1397a09ca8bdc80f75a6432d706ed06c2dc3dd5767596aaafd9ff3d2059b0ddaafe9e7233191e6aa59bce871cee83699d4dbf79da26d9a92f07d8662394a983759c44d95afd67b75d0778f81a9abb56c1c3ab0500d03d3238d86132e86d181bbdc753cc7b44e9775eca7b044331521aeb7139d36a64c29a699a85ea5141c431205f6d6c2d72a4fe75d2217f53e37cf96220621327b0553ae67810ff84ce53fc876d26f3b90c790e89ac5f818de5476d9455b9c5f9a69b59e00e49b8b7b734eba59cbe4c2f361dd4e24394586d29c5b1b8c84ea26222fe216cbf2d6d76188 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\912198EEF23DCAC40939312FEE97DD560BAE49B1\Blob = 030000000100000014000000912198eef23dcac40939312fee97dd560bae49b1090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b000000010000003000000044006900670069004300650072007400200047006c006f00620061006c00200052006f006f00740020004300410000007e00000001000000080000000080c82b6886d7017f000000010000000c000000300a06082b06010505070303200000000100000079030000308203753082025da003020102020101300d06092a864886f70d01010b0500305c310b300906035504061302555331193017060355040a0c10566572697a6f6e20427573696e6573733111300f060355040b0c084f6d6e69526f6f74311f301d06035504030c16566572697a6f6e20476c6f62616c20526f6f74204341301e170d3039303733303134323730345a170d3334303733303134323730345a305c310b300906035504061302555331193017060355040a0c10566572697a6f6e20427573696e6573733111300f060355040b0c084f6d6e69526f6f74311f301d06035504030c16566572697a6f6e20476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a02820101008a000c701dbfeb3486c39945351e7f43f7ab6f242dcd19c210bbb0ca295ba920abab722cc4e202396d82b8c511eaf8fbb39e62f8331eb01fc9e3f637db04c83b634f36e285a4251dc7691f04bd68451396071f9450f53ec527549ec04957448e0763d4a6aeed2299cc4d966904136e76899f741694f91d54bda2b9d28301220c4d4480aafe35892725a78689c6d51a92e38fc595a014729ae856c502551c97f9202ed0f53c13195af6e1f90b038269a78cb7d66f9c563e9de82a09606d4be6fb8b9914f7344f6559808db957c8a23521d88871565dee82572d2690189f9a9c9c8fefd4c563a7547d4791877d1a12a81b186fa96fb127bae40474ce371e7f66c50203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604144c3811b898005b5a2b703eaa78e4d5676767a77e300d06092a864886f70d01010b05000382010100015fa0b10601f479d76518603ecf79a0bac2234f23df87965f810e38152e5cc802682920fc8beea58a1881645c98357e393082a4828a50b5bac3e85ad6a89ee2c317dbdbc4ebb00a200de99ee3ff605447f13b9dd4283ca2aea3fbaa8b82222a358790b81c594790d59d2efa49e365a836ebc7e41c68dcb3316cab4ece248015c810591011724d7a9c989cc4fc61e0b3b29d4ea0c6c259ab18d6a25545ec29aa2537d64e4a3d0b40c1e493e4fccd910bf8e6abccb376c462bf19ed86b679c3295454bc997d4657cfa6cff4542a9a03654701a1422acb25476e7c5e004b91d9f91b100670f94215a65faad7401efdc9489d9781ea5c68c2a0e789a1534dbfc7e3 updroots.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F9DD19266B2043F1FE4B3DCB0190AFF11F31A69D\Blob = 6800000001000000080000000040d10ffc47d5017e000000010000000800000000c0a06c6128d4010b000000010000003400000043006f007200720065006f00200055007200750067007500610079006f0020002d00200052006f006f0074002000430041000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308030000000100000014000000f9dd19266b2043f1fe4b3dcb0190aff11f31a69d20000000010000001e0600003082061a30820402a003020102021000ca227908232af0f582b885d363ddf1300d06092a864886f70d0101050500307f310b3009060355040613025559312b3029060355040a0c2241444d494e495354524143494f4e204e4143494f4e414c20444520434f5252454f53311f301d060355040b0c16534552564943494f5320454c454354524f4e49434f533122302006035504030c19436f7272656f20557275677561796f202d20526f6f74204341301e170d3038303731343136353231355a170d3330313233313032353935395a307f310b3009060355040613025559312b3029060355040a0c2241444d494e495354524143494f4e204e4143494f4e414c20444520434f5252454f53311f301d060355040b0c16534552564943494f5320454c454354524f4e49434f533122302006035504030c19436f7272656f20557275677561796f202d20526f6f7420434130820222300d06092a864886f70d01010105000382020f003082020a0282020100b13dd2a725709783780ed732c9660e7823e42a1becc3ef538583bbcacf7eea53996d2755c8d13821406e494dc33df6092b061943a998c9014ef4aa80300755f3f5b77d99b77385d51c65566c0d329b080e34612a40098437c366ed0d4c9c0c78403aecedabcca484f275319540a8aabb93b577986cf2c8e0215a23e442a793c8a81d38cea41a4040bf3c93909b5fd694c1225b46d7c50015d58fc6f7de0baf6e8b058f5b80950ea3bd93cc90f27de3487eb2cd073d1bed149074f3dd341f7ce40359f12dcde0a3a03b212e5caeac080650153135ee5ff91f0d34a5806e62724fe321ba38405d5fdb682a5c34c6083bf67c2ea88dc4b7a6add99bbf19410e483909666e0d3401c5bb071123a4dafe60962847dc8f679b13af7d790e78cdc08c2fbb212cfc74161edec0329dfa783a86ba3ec9780a00d1e4e0c912e25bdcebbb809a3235abf030c30e48842f8d080af62c8c4d3280455508dbcd0da8bf087ab8e7685d9a948995bcfc9a8eb87f3ad86cd5f418ac69e2a4c10bb31fa3829ff38a3c85403809fac2053ee19c89fac3056c088f5d51f47fbbc4f36c01bd3d4fc4198b39d9cacce979880455ab6db8da16456539150518fb0b2c7301ed9452e57d0c013b09a04df13d08816634361744f067f35bf205b6219858d9f4a137d96fe6ef56c4fbbf566202ac3030b602d6d216fc4eea87439a685d88a39146282bbf3915150203010001a3819130818e300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147dbb69eb8861e140cf4723640086a2666bdc8495304c0603551d200445304330410604551d20003039303706082b06010505070201162b687474703a2f2f7777772e636f7272656f2e636f6d2e75792f636f7272656f636572742f6370732e706466300d06092a864886f70d0101050500038202010056df1389be62b70e812173a4d437caedb72f9574d789f84b4781ee67edb829df21a0fc546767c8572c5ba10a75782121caa0a8df6b9cd936028db801c16f8e7b6cc9a4b2c546a9ca4c0281faa37b9d3d48e6ca4066d2449d76e055b9a69ca7d143d8f5a0b49df8f7e5a6a642f302325946722b14ec5e65d5518178ceaa2f8d9689796afb0fc85bcfb4ae90b65fe37c626cb7a6ff9081b59891731230afc7e88102687329bb58753db7d643d5ae4df242b9f0dfda310013dae1b3b6068b5bfdc998b8a213d1ba8fc18a1a9e0fff82be0482e52b933e1eb5a20c1bc61ab073897683bc8e3bbb176d14c38bbe7d1526b5a99c177a507a2debe99994ae9810bdee2a5d5dd68e345bac1e87606b98c7878fd39cb268054907f9a931669cfebfa759e82cf036d4f2a81982c09ea739f9b19834a31ffacdc9192d78deb7fd62f093a3fe005bd60ae4f37e7c9728e105ec05344513ff2913618a274fdbb8d2922127b5887767a87ecf243c87080433738f0bb686f8cfefb2a6241e0b91910050163212d80925da634edddb2dd7e7046be3631fa9fea90163c4ca4c146883bc05ac5916fb6ea1076fbb4bbe6d984876257b4a11965408aca9f337ab83c3d1cd8198c0e54035b89f91e76fe64b20168a537bac3ad1983554d0d4bfae7e9a4b1ee975a325b03be765bf4f95f41dbdc4bac94d8151c23f5ad912f4211bd695ea3d90fea993e2 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\FE45659B79035B98A161B5512EACDA580948224D updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CFE970840FE0730F9DF60C7F2C4BEE2046349CBB updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\EB9237B72076F8CC8BC13E7046F2FCABC18199D3 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E\Blob = 53000000010000001f000000301d301b060567810c010130123010060a2b0601040182373c0101030200c00b000000010000002200000041006d0061007a006f006e00200052006f006f007400200043004100200033000000090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080300000001000000140000000d44dd8c3c8c1a1a58756481e90f2e2affb3d26e2000000001000000ba010000308201b63082015ba0030201020213066c9fd5749736663f3b0b9ad9e89e7603f24a300a06082a8648ce3d0403023039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412033301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120333059301306072a8648ce3d020106082a8648ce3d030107034200042997a7c6417fc00d9be8011b56c6f252a5ba2db212e8d22ed7fac9c5d8aa6d1f73813b3b986b397c33a5c54e868e8017686245577d44581db337e56708eb66dea3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414abb6dbd7069e37ac3086079170c79cc419b178c0300a06082a8648ce3d0403020349003046022100e08592a317b78df92b06a593ac1a98686172fae1a1d0fb1c7860a64399c5b8c40221009c02eff1949cb396f9ebc62af8b62cfe3a901416d78c6324481cdf307dd5683b updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CB658264EA8CDA186E1752FB52C397367EA387BE\Blob = 0b00000001000000240000004500630068006f0077006f0072007800200052006f006f00740020004300410032000000090000000100000022000000302006082b06010505070302060a2b0601040182370a030c06082b06010505070304030000000100000014000000cb658264ea8cda186e1752fb52c397367ea387be2000000001000000eb040000308204e7308203cfa003020102020100300d06092a864886f70d010105050030818d310b30090603550406130243413110300e060355040813074f6e746172696f3110300e06035504071307546f726f6e746f311d301b060355040a13144563686f776f727820436f72706f726174696f6e311f301d060355040b131643657274696669636174696f6e205365727669636573311a3018060355040313114563686f776f727820526f6f7420434132301e170d3035313030363130343931335a170d3330313030373130343931335a30818d310b30090603550406130243413110300e060355040813074f6e746172696f3110300e06035504071307546f726f6e746f311d301b060355040a13144563686f776f727820436f72706f726174696f6e311f301d060355040b131643657274696669636174696f6e205365727669636573311a3018060355040313114563686f776f727820526f6f742043413230820120300d06092a864886f70d01010105000382010d00308201080282010100bad53fe41915d795017feb3e250aee290c6befbb37ae3a7f4693ad9a11c82c888ee60b0458ff0c32b7eb5448a276323a421e9a9ecd0a0167360f0d3f8f8a8a010cce4b201982371dca9353059ee6bafdb5d830363eee35ad7ab032b941ad58bf2938217dd2e5351bba26b0b9cbc1daaeb9d1152285d5385bcf3f76d642c34680a2f8556ce5e56e2b92ef21f921340a806f2ad380edd3f737d9824f2ea6612400d3c32f5fbccbb7463c1fddea59342399aff0f112297d364e5bf08114888931d193cfbe88e3cb056946a7b65fa9311790f519860ad042fc5caf0094a3a9a4f13aa0c420cfe4580fa071623cb79fe6cccf64b0490d6a7b18bc84d4f9a4408e968b020103a38201503082014c300f0603551d130101ff040530030101ff300b0603551d0f040403020106301d0603551d0e041604143be1811ba0ab3f3b2182d5e212aeae50ab14a5133081ba0603551d230481b23081af80143be1811ba0ab3f3b2182d5e212aeae50ab14a513a18193a4819030818d310b30090603550406130243413110300e060355040813074f6e746172696f3110300e06035504071307546f726f6e746f311d301b060355040a13144563686f776f727820436f72706f726174696f6e311f301d060355040b131643657274696669636174696f6e205365727669636573311a3018060355040313114563686f776f727820526f6f742043413282010030500603551d20044930473045060b2b06010401f9110a0103013036303406082b060105050702011628687474703a2f2f7777772e6563686f776f72782e636f6d2f63612f726f6f74322f6370732e706466300d06092a864886f70d010105050003820101006fa7acf8bfd11a5f133ae3d360ba2463d46abe276e3221718e8dec358d7aa06852e9414881ff3d818d1d8c7bfe59c979f8a2c4f184ed3439c4f8049716fd6caf33a000293bb537dceb9ba99eccec39479c5782a0ea080199c6d64bb02b00f9097281d9aef81f372a367156d08b0114262aad587fad08093b30c0f0f3866c7d03783d318f0041a28028964293fbb648b491753dbe7a4290cbf46fb5e85ec69269ca9402184f74134b7c851980a19c971dfbab7150f84a8bdb1238e98021a2879e41fd49ccfe0367128b8037c1461755ab6e54d1e945bda5ca07c7dd2b825fd314f14adedf3065494d4b00bb4ca88e0999c42642922acc8cef3b68c7caef4f42aa updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3753D295FC6D8BC39B375650BFFC821AED504E1A\Blob = 0300000001000000140000003753d295fc6d8bc39b375650bffc821aed504e1a090000000100000036000000303406082b06010505070302060a2b0601040182370a030c06082b0601050507030406082b0601050507030906082b060105050703087a000000010000000c000000300a06082b060105050703090b000000010000002c0000005a0045005400450053002000540053005000200052004f004f005400200043004100200030003000310000007e00000001000000080000000000042beb77d5017f000000010000000c000000300a06082b060105050703092000000001000000f0050000308205ec308203d4a003020102020802541aa950d7ce1f300d06092a864886f70d01010b05003061310b300906035504061302424531243022060355040a0c1b5a45544553205341202856415442452d3034303834323536323629310c300a06035504051303303031311e301c06035504030c155a455445532054535020524f4f5420434120303031301e170d3136303532303133323333385a170d3336303532303133323333385a3061310b300906035504061302424531243022060355040a0c1b5a45544553205341202856415442452d3034303834323536323629310c300a06035504051303303031311e301c06035504030c155a455445532054535020524f4f542043412030303130820222300d06092a864886f70d01010105000382020f003082020a0282020100abf9960e84287635812a563f02edd5f170910e4097225cbb96e69a1e0e3c2b993c2f6b3461ab07cc4a2615659e0b28cc00380f5bf6ac464cc55c22888e23d656285e75e2c44f52e33904733939e64ff7f3a9b220ea0c27d2c7f474733bec24ce616c1a95dbdc5542b1169431f9a67c8c14f838a27da0b5399cd7d65f952f857351bfaca9881c1cc9326c3800c3a2b02bd68fb286caba39386c6783ca4787578b9d56a47f764d481516b3c0978ac20cfa64b02043568c6a87c32d21173e5ee008aa1ab7aa843d56232b8331e3d302d9120305c239af6f53561703ab231c7af0bc0a1795972681ef78203de6dff4dabe8e5f5fd11efd997cf7216d5cb7049662c3d36e1dcaf7efa6459353df267be4d444d76d7fb054997eb627e2c3be4a674205ae6a4af2ee97065d679e81be5fe8005a544ab64cd9152e08f6421a25193e2b817b5adc19f46a2702dd8f940297ece29607b456e6e42eefdd2c168508fa1cf700967e0ee4a0fa298090b644537d3b7515ef5946e1cadcd8971b904943972e580572b45d31067d39e174ff1a4c4d9532e88da5aff43c7bff201ccbf0b0f732f3e612c5a1d7e49219e94967c03c7f9bb882de04f11557d6b0091e393a6ba6e2f8a69f217099a8b0597912ba4846e6f572ccccd40fb3b74cc3a3df2e9778c85f7b2b2122b53eb21cd96b43518bdb20498eda6a13340b3b4ef56b8e871b4ec64a002b0203010001a381a73081a4301d0603551d0e0416041438bc5c3054dce2bb20efee6f41a0316e5cfd8b75300f0603551d130101ff040530030101ff301f0603551d2304183016801438bc5c3054dce2bb20efee6f41a0316e5cfd8b7530410603551d20043a303830360604551d2000302e302c06082b06010505070201162068747470733a2f2f7265706f7369746f72792e7473702e7a657465732e636f6d300e0603551d0f0101ff040403020106300d06092a864886f70d01010b050003820201009c310a1ddecaa4a052b0962ae0fc2ce5a176dc14386586b32ed5a597f37360ae46687587b133c8128dd929a3ea1fbd6efeba275081e1716cceab309c269a517170671fd144a71434cd46dd2be30e65bdc64e436853b2b8b13df0643d0787b1f98732047a96e442bb3028c79a5d2b6bc7500a21b68622f612ad2e15f0bb53a930ca2deb02a194676311d8b7e6f3a70b061f9279a1f2ab537b3fa348084cfb440003ffc900c26cc24ac586c4b3ea595c0e7de53fb6a94f92e311045db777c635c3b23173da77d73f7f1019ad0022dd43c8e0127e44983851d238c8b6431a4c515d9c3a8bc83c79b8dcb01eebdde5e69e449be9503dcb11bc55fec7746565080da4aa773d1c13b69c9f152af94ee13482703673d234198455f30dc04f8dff56169a5b6512f032419c1b58bfbdaf321076d72d0fc53771e61afd31e6b436186cfb4bf5aa35b06c502de75b224ae0fa9d392041c62e0025e491df9b38d3059b9cfd046891b80e825cd835f762dcc960058b95cc3f7ceb8fc6fd9a9fa96f3201549a64a4dde5c5455eea55ede143cbade21e6e0a9e8e32e4e3aebc01d053040e9d424d36fb99e51ae907d453f045074213c76b213e84b7f7c58957531ff8f34e515bfe6732c359f69119880d806ce1de450a46997a3fcc3ef0206cf8bccfae772cfb6ef50b11768b99ceae8e3391780aa50c24b3530f6b11e9b3b01d64012e941d21d5 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\BDB1B93CD5978D45C6261455F8DB95C75AD153AF\Blob = 030000000100000014000000bdb1b93cd5978d45c6261455f8db95c75ad153af090000000100000016000000301406082b0601050507030206082b060105050703010b000000010000001a0000004900530052004700200052006f006f007400200058003200000020000000010000001f0200003082021b308201a1a003020102021041d29dd172eaeea780c12c6ce92f8752300a06082a8648ce3d040303304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205832301e170d3230303930343030303030305a170d3430303931373136303030305a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f742058323076301006072a8648ce3d020106052b8104002203620004cd9bd59f80830aec094af3164a3e5ccf77acde67050d1d07b6dc16fb5a8b14dbe27160c4ba459511898eea06dff72a161ca4b9c5c532e003e01e8218388bd745d80a6a6ee60077fb02517d22d80a6e9a5b77dff0fa41ec39dc75ca68070c1feaa3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604147c4296aede4b483bfa92f89e8ccf6d8ba9723795300a06082a8648ce3d040303036800306502307b794e465084c24487461b4570ff5899def4fda4d255a6202d74d634bc41a3505f012756b4be277506af122e75988dfc0231008bf5776cd4c865aae00b2cee149d2737a4f953a551e42983d7f890315b429f0af5feae0068e78c490fb66f5b5b15f2e7 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1C3AC0977AAF147E5821A87F8DA32226A210693 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\20A8F5FFC43AF4A9BC89881EBF9920FF91E9FD0A updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7E04DE896A3E666D00E687D33FFAD93BE83D349E\Blob = 0300000001000000140000007e04de896a3e666d00e687d33ffad93be83d349e090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b000000010000003000000044006900670069004300650072007400200047006c006f00620061006c00200052006f006f0074002000470033000000530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c02000000001000000430200003082023f308201c5a0030201020210055556bcf25ea43535c3a40fd5ab4572300a06082a8648ce3d0403033061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204733301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f742047333076301006072a8648ce3d020106052b8104002203620004dda7d9bb8ab80bfb0b7f21d2f0bebe73f3335d1abc34eadec69bbcd095f6f0ccd00bba615b51467e9e2d9fee8e630c17ec0770f5cf842e40839ce83f416d3badd3a4145936789d0343ee10136c72deae88a7a16bb543ce67dc23ff031ca3e23ea3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414b3db48a4f9a1c5d8ae3641cc1163696229bc4bc6300a06082a8648ce3d0403030368003065023100adbcf26c3f124ad12d39c30a099773f488368c8827bbe6888d5085a763f99e32de66930ff1ccb1098fdd6cabfa6b7fa0023039665bc2648db89e50dca8d549a2edc7dcd1497f1701b8c8868f4e8c882ba89aa98ac5d100bdf854e29ae55b7cb32717 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B31EB1B740E36C8402DADC37D44DF5D4674952F9 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A2BEE4AD032713ADCE0A0E9B19B6B85FC24ECA8D\Blob = 030000000100000014000000a2bee4ad032713adce0a0e9b19b6b85fc24eca8d09000000010000000c000000300a06082b060105050703020b000000010000005400000047006c006f00620061006c005300690067006e00200043006c00690065006e0074002000410075007400680065006e007400690063006100740069006f006e00200052006f006f0074002000450034003500000020000000010000003802000030820234308201bba00302010202107653febab21dd827e96916a2eb81be58300a06082a8648ce3d040303305c310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613132303006035504031329476c6f62616c5369676e20436c69656e742041757468656e7469636174696f6e20526f6f7420453435301e170d3230303331383030303030305a170d3435303331383030303030305a305c310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613132303006035504031329476c6f62616c5369676e20436c69656e742041757468656e7469636174696f6e20526f6f74204534353076301006072a8648ce3d020106052b8104002203620004ccccb43abb1a4df89d91c47781ed167f03117fb8e970844896410983605df424932a321e5e07fb47a4872a24d8578c5cd9a8df11787fb644d5ddafd501d926345f7d31c8c1eee3d6b9fe8f930270a26f603b1973b58b740a7b9d4217bc2d3ea7a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b583d670068ac69d868277d5a905653613f1c648300a06082a8648ce3d0403030367003064023066a5d17f7d3409160e0efbee7787814a9dd88087a06468cb5fb67458accbb298e29212892d1d3db15468f892f18d4e4a02301455327b766674916b24d45a94e2e56a80f67a7dcd42f3587863c1e9027b54dd1c01159dcbbf0418554024fa22f2d95e updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DD83C519D43481FAD4C22C03D702FE9F3B22F517 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1B3D1114EA7A0F9558544195BF6B2582AB40CE9A\Blob = 0300000001000000140000001b3d1114ea7a0f9558544195bf6b2582ab40ce9a090000000100000036000000303406082b06010505070302060a2b0601040182370a030c06082b0601050507030406082b0601050507030106082b060105050703080b000000010000003400000053002d0054007200750073007400200055006e006900760065007200730061006c00200052006f006f00740020004300410000007e000000010000000800000000403db21959d4016800000001000000080000000040d10ffc47d5012000000001000000dc030000308203d8308202c0a00302010202106056c54b23405b64d4ed25dad9d61e1e300d06092a864886f70d01010b0500308185310b300906035504061302444531293027060355040a132044657574736368657220537061726b617373656e205665726c616720476d624831273025060355040b131e532d54525553542043657274696669636174696f6e2053657276696365733122302006035504031319532d545255535420556e6976657273616c20526f6f74204341301e170d3133313032323030303030305a170d3338313032313233353935395a308185310b300906035504061302444531293027060355040a132044657574736368657220537061726b617373656e205665726c616720476d624831273025060355040b131e532d54525553542043657274696669636174696f6e2053657276696365733122302006035504031319532d545255535420556e6976657273616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100a8e30bdf113785829ab56c667c613fc0471a1d46e3b05564e5b8823928077e17fff49b8af09181ea383f21786c48ec6b2fa2d38a72b2a7d7d9ea7fb4c0496b3025898cebb7d5406198e2dc3c2092cd654a729f1a8e8cfa2515bff32183280d8baf591182435c9b4d25517f581863603bb3b58a8b58633748489044c240dd5df7436929985c12655eab90924b66dfd57512535418a6de8ad6bb570339599918050cf9fd15c69064461782d7c24a413dfd00be57721894771b535a8901f633720e933adce81efd0505d6bc73e088dcab4fecb518864f79840e482a662add32c87865c80b9d58010571ed81f568176ecb0db44bd8a1ecae38eb1c582fa16503342f0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604149a7dd7ebeb7f54984529b420ab6d0b962319a4c2300d06092a864886f70d01010b050003820101004e9612db7e775e92279e2117188276d83fbca50904668889addb55b3336ac665c48f4df33236dc790496a97732d197f5186b8cbaedce11d044c792f1b4448eed8852489ed5fd59f8a31e51fb0152e55fe57addaa244f228bdd7646f6a5a00f35d8ca0f98b9305d206fc2811ebdbdc0fe15d3382a099398271b937bd02b345e68a5154fd152c3a0caa083451df5f5b759735d59018faac2472f1471d529e310b5479325cc2329dab772d891d4ec1b488a22e4c12af73a68939f45196e43b7ccfeb8919a611a366963649228f36f619285139fc9072c8b57dceb9e79d5c2de08d554b2574e2a328da1e23ad1102022397d34456f713bc31dfcffb24fa8e2f6301e updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\204285DCF7EB764195578E136BD4B7D1E98E46A5 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D496592B305707386CC5F3CDB259AE66D7661FCA\Blob = 7f0000000100000016000000301406082b0601050507030306082b060105050703017e00000001000000080000000040fb4657b6d7010b0000000100000012000000410043004100200052004f004f0054000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308030000000100000014000000d496592b305707386cc5f3cdb259ae66d7661fca2000000001000000cc050000308205c8308203b0a0030201020210474391243fcec30d5748286bee805dab300d06092a864886f70d01010b0500305d310b3009060355040613024553311230100603550405130951323836333030364931273025060355040a0c1e434f4e53454a4f2047454e4552414c204445204c412041424f47414349413111300f06035504030c0841434120524f4f54301e170d3136303532373130353835315a170d3431303532373130353835315a305d310b3009060355040613024553311230100603550405130951323836333030364931273025060355040a0c1e434f4e53454a4f2047454e4552414c204445204c412041424f47414349413111300f06035504030c0841434120524f4f5430820222300d06092a864886f70d01010105000382020f003082020a0282020100b92b5ef53eba891e9df5d113cfbba35ebae9df39726498528769a5b6dee1bf9445bec5f8a453671550dc524f2a762c2e8d206a8ce65db9d968be911bba690318ad184e36a2ac46ab20f8036aaaad79d5df1dc1ee456f2174f94db1b13d903b3c3280edff15cf51cad7a4872eaae50eb6d17a5ac7b9f851bbd994dd3ec6864e0afe3b89f2f86e24ce91035805124add50ab417aceeda91f11531ea513db61f0f5aa80de74791da4e329d6fbe0fc97daa2b8ab223e65b021c4e5c5104487b2e3e02a822e7de6f4b8a41325f377605f6353ae2eb19d8a6b767b3a71bd928136b09c82f1f7c589285dffbc4206b3086a4f61cda42d90d339b877ffc8c7a379bb03b99103013412d8308bb68c02cae448ec382a324c6dca76285a860abad4208eafa05f202d629c88f9f1156d5bbdb10350c03f36d7ae3f51d1cae3586644e6a39b772e31fad97f22c4054ceb741b5c637aa602937e430e76140f4d6f3295888092529714f53cfc9407d36c290595460fe471e17ff86d14128292b5f3533e99119747764a0972eed4c39609acdafff14b4bb6d725cf1e4c97260b34bbb694f12c64715f89f2153b37a702e40d4f488933a38c68783151670a19dbb4e2742f3d7af377009f711263ff732a646954ecac3aaedaf25863347ef83c5ec0423aa5dbb3a8d45ac14e58b869b6ac8262dbd1fb1a432122fc1df59c4f4e3be58dff765a235e5b0203010001a38183308180300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604141a55e41531e2319b11d488717a003d702805bfcd303e0603551d200437303530330604551d2000302b302906082b06010505070201161d687474703a2f2f7777772e616361626f67616369612e6f72672f646f63300d06092a864886f70d01010b050003820201007b30ca5586d3afee1ad7b89598ecf93bdd9013a39c9245a0928969a17191bc718587a02d3009e4c2533df4a9b7682d4d99cda4cf9e3b909d9a0a290d2a42c13d5b6b4082c58b13b141678fbea477e0c076e4f3b629562cef714fc264f1dab40bcad0395f53b28301fbb27dd983747a35d0c15d8f9bf75ee752dfeeaa3793abd93d7d1ef1bd1cdbe875ddb85b4ce316a3f675880e8f3cc30b6cdb6059e405ab2846f766692577deca4a33d8585e7b8f9acf528e3d6dfdd1b2bd3e7957861e441c074df4c210aa78cbf351170d763d8d6e6849e9ef0749d1b816c9799dccae0b05477afd98ac31a1905a8762f9f8ab625ae02176d06842e81cbe7281f0c6677d7e743cd5556f8fa5689611f1cad33017bd46b631af70e9a4843757ba093c2ed90b1356073e95c4b5702f93c2aeaf815d461430fbaec5f39af7417ab1de4b16d9457547027c141ed5b13ba02c41b59b4b7ba383f0b9ccce1e94b75e2e230695911c38471cedc4780ea40ffc1b7cd6f26bd08a5bea96f331d45e6ac494b8309f95e10789b888d22785a46174e5a844317a2075e8f8d8ebb34faaff533f96edeabbfc5140a62bec24a1fbf9448d23e7a697000fcba46abf50a0ca71a26cae6fdfd9838266dc535daffa54f783ffab3f8995a7b46df30f0a0d48332f8129c74b05c4c6577484c39836ffef8532ab629c13d12287b1be98db749a8feac2d693794520c3 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0560A2C738FF98D1172A94FE45FB8A47D665371E updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1B3D1114EA7A0F9558544195BF6B2582AB40CE9A updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D27AD2BEED94C0A13CC72521EA5D71BE8119F32B updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\182E1F324F89DFBEFE8889F093C2C4A02B677521\Blob = 0b000000010000004000000047006c006f00620061006c005300690067006e00200053006500630075007200650020004d00610069006c00200052006f006f0074002000450034003500000009000000010000000c000000300a06082b06010505070304030000000100000014000000182e1f324f89dfbefe8889f093c2c4a02b67752120000000010000002502000030820221308201a7a00302010202107653feaa271d95465dd6f19ee5b8900a300a06082a8648ce3d0403033052310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d7361312830260603550403131f476c6f62616c5369676e20536563757265204d61696c20526f6f7420453435301e170d3230303331383030303030305a170d3435303331383030303030305a3052310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d7361312830260603550403131f476c6f62616c5369676e20536563757265204d61696c20526f6f74204534353076301006072a8648ce3d020106052b8104002203620004f9798b81473789963f4549507f1a260b93327e2ec0c0a7089ac36e8f9b3e0b22ec3753b76f8ab0bc27374b6da9463bd91fffa5a144bb2d73bf9e41075c539b51083a5abb6f38c7169178c24a13691d82df5a2f008896a22e1c74f99d7e66378aa3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414df135e8b5fc24002fd56b7944cb61ed5a6b11496300a06082a8648ce3d0403030368003065023013b0bed771203ee4ab9cce36127d5f4c1f2ab56945335fd32d5ab2e488c7de0a364232799da66bbae1f9442a7b8ac312023100a0661c4e879d87c9ed994c1b0aee2d60c337c71dcdb572b0d9c6efbcf2ff3ff052dd08e7aa6479c3e46957912fa4cb7c updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\23D731FEDC5C8BB97DE6DC8E13B411BD4F24004F updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7618D1F380243D5240C6116AAD5777097D8130A0\Blob = 0300000001000000140000007618d1f380243d5240c6116aad5777097d8130a009000000010000000c000000300a06082b060105050703040b000000010000004000000047006c006f00620061006c005300690067006e00200053006500630075007200650020004d00610069006c00200052006f006f007400200052003400350000002000000001000000740500003082057030820358a00302010202107653fea84c50ab9f8d32b51d038f57dc300d06092a864886f70d01010c05003052310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d7361312830260603550403131f476c6f62616c5369676e20536563757265204d61696c20526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3052310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d7361312830260603550403131f476c6f62616c5369676e20536563757265204d61696c20526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100dc79cc6d06f96dbbe056046c7fe075cc2d0549e84bdc54ec5b779572bf7f629d85a98a24505f53e5db746fa4295b132a09ad9ac52fc2f7763ba14546aa43e624fe2bb06f327019465a79262ffc3d7d5f64cb57cc6161a8d9956ee395a06e7f471218d6ef03c9fb8afa9abd8215a955774b114f59e06bc371f30cd854d581683e13b9152e878a3c44273662246ef82c05723061bd429123c49d25a7d9549a14a331ad80790ca7636c98a3ac5747331f6596e1d0d235daf971f7a1a625b5415ddf3e60d8d1f69fa5f2b8cc13aa8ff9b26ee1832d93dd3e851adde8b15c2601cb4985fcfcd2d47f85628674f9cbec3522a20c308f3bab79eb56f2fa42f3edf91f45894029adea9274ea52fd56b42bdaa2ed75c26eabce52904bf6def0498f9a48d488196d45e6cc8cb9dd6460600240f8b9cfbc58eb3d85b9c60ad39c07668fc718392346e13c1ea32f5061920b3d2b6cf1a347385791ab0d8fc69d4d04d226525ce5a5fd2a2d162a0169e7a97de136b7b12ac5d9b18dbdb98bcecc8ba13e0b48cd509534c4d80859d86b26f4bef5d422170057c9ae9b0430339f0bfbdf56a2c96e5476dab1976227590f118a221b64963fa8f1b7244a8d3c537c6d83763db2264873f54416012d092a8e169650d073065dbb2248824c0a465a3f80ff5cf2f29aac2c08e0d6eaf01238814fa610ed46abcc169c0bcf64a6990285446746adfd4de70203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414a09315286eee8f08b235c69e627974a7b10e2b7b300d06092a864886f70d01010c05000382020100450af8d15cac6281d004d7b6ff5751890b0ccbde246537fbab9eed66f4ea0c196989b819b13056b4d9f6f7bec6ae97cb45f6118c3a30644cc19f59c04642080647641778e0950706d68ca2aca9d93fd37b564ffcc48728dfb62b1623c09f1f5be3d6445e224f23048c3516b57907865c2f97e2f60864a6dcdba88ae3a47b770dd129932820b453a34b4e5fdec1f67523fc1f3c784f7031782fa235547104acc8c46dc3f691b1fecdee446e81f640c53e2a01bfab4cb1033f0d11e40fd224e322889b9f5f473d5149e009377e17213176b7677148284b25d710e89f615916c53e324e1f0ccea3cc0fe4c71107222f3808dd5b97eb426c599a9aee7ad09ddfc5db09432e0aaa193d6be86a307a57e6bfb36a39a98fe3f14f6568b6bd9f288fa1165a09503a322e1d2f441142a600e63198ff2da10fe6a46056cf79d7b24ed7b0fa6e0c5723c7ce1fa5b14c6d19499e0e7f708f713f58289f75dd61e03ab739b6ee97d43551fb8b4960c83c66ae97ee8d265957bb78f07a503009b060aa9f4edcc93e1e3adc629333b03a54746f2c3145d16b11326a6876f63df66a135e2498e7ea1d9acf78820760f74d10d3819a458d9eaf9bdc80c743b29568a4c30ee80a4715bf5433dc01e7d5a61e73d87ab2bf2fade355309edf0e41bce011f5a10ca822e1e300a34e707c92e304d17a428a759059e39bd14ca264bd73799b6ff2b3c1f63c updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\53A2B04BCA6BD645E6398A8EC40DD2BF77C3A290 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F44095C238AC73FC4F77BF8F98DF70F8F091BC52\Blob = 030000000100000014000000f44095c238ac73fc4f77bf8f98df70f8f091bc52090000000100000020000000301e06082b0601050507030406082b0601050507030106082b060105050703080b000000010000003c000000430065007200740050006c0075007300200043006c00610073007300200033005400530020005000720069006d00610072007900200043004100000053000000010000001f000000301d301b060567810c010130123010060a2b0601040182373c0101030200c07e000000010000000800000000c0a06c6128d40168000000010000000800000000809ef40c18d501200000000100000087030000308203833082026ba003020102021100af3f646b56028666c6d843f94b7d96cf300d06092a864886f70d0101050500303f310b30090603550406130246523111300f060355040a130843657274706c7573311d301b06035504031314436c61737320335453205072696d617279204341301e170d3939303730373137313430305a170d3139303730363233353935395a303f310b30090603550406130246523111300f060355040a130843657274706c7573311d301b06035504031314436c61737320335453205072696d61727920434130820122300d06092a864886f70d01010105000382010f003082010a0282010100bd659a2343003cf9250143985b4634376737f45b578ea3decd8c2f41b3153de5988bf2cc5ca7c7af35c7b3a74fc7102957e903898372067652c170023740edf0ce8bb1b189ac02a85bdddcd5434506dc28b6e9511b6aeef37b48c59d11ae8da67293c0254291a83e46e2684c8140b042d37abe7b47d247500ca412a6cae412d0c07c3a3c01a9ca0296de825ac5fb19ba3c9cd80f741f9818ae945032075210114a4bec58552cd49e4b947b05d272df06f08dcb089ee4eeb444ad82f11b616af1b3f81631364224ba90bfb57e616ec2590c5479b44c88281ecc1bdf848b23c8beaf07f291b2da8dca8c5f7c283c7c896c0659bd3ecec582d36ac9ac6855eec5af0203010001a37a3078300f0603551d13040830060101ff02010a300b0603551d0f040403020106301d0603551d0e04160414a2760e39786b8fba2d714a08f7a27b6e00a2642530390603551d1f04323030302ea02ca02a8628687474703a2f2f7777772e63657274706c75732e636f6d2f43524c2f636c6173733354532e63726c300d06092a864886f70d01010505000382010100b59f689cc492f0777c13c215bc1cd40e6e7428a1fa86d2081b25fce47bd97dd30258676f046e50ee7b4a010263bf4236d6be0cfe220c993d8ef3ae1d94d6aaeaa63de3439e47bb09c9cbeecea12c0faa7cdf7c7392e54bb904c43bdb20fe60f90c6e781a3d48d7274898b591aca4dc22b3e79d5fece54062268f7a17c6eafb0ad6435b90db3616ed982e9e5fac1407822a50bfa6bf6fa6073472b66168ec5198195377e8c8bff6217bbcb0de7f743af91534389afb8933f0120d9fe8f1966df61d487e3e12effa066759deb3b2d6970b3b405742b2c17bc66dd826523425d285b6a10a0addaa94aa4e7b2093dda4804356cfb6c4e058e96c958f626e5806af78 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2\Blob = 030000000100000014000000742c3192e607e424eb4549542be1bbc53e6174e209000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703017a000000010000000e000000300c060a2b0601040182375e01020b000000010000004600000056006500720069005300690067006e00200043006c006100730073002000330020005000750062006c006900630020005000720069006d00610072007900200043004100000053000000010000002400000030223020060a2b0601040182375e010130123010060a2b0601040182373c0101030200c07e0000000100000008000000000010c51e92d20168000000010000000800000000003db65bd9d5012000000001000000400200003082023c308201a5021070bae41d10d92934b638ca7b03ccbabf300d06092a864886f70d0101020500305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479301e170d3936303132393030303030305a170d3238303830313233353935395a305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f7269747930819f300d06092a864886f70d010101050003818d0030818902818100c95c599ef21b8a0114b410df0440dbe357af6a45408f840c0bd133d9d911cfee02581f25f72aa84405aaec031f787f9e93b99a00aa237dd6ac85a26345c77227ccf44cc67571d239ef4f42f075df0a90c68e206f980ff8ac235f702936a4c986e7b19a20cb53a585e73dbe7d9afe244533dc7615ed0fa271644c652e816845a70203010001300d06092a864886f70d010102050003818100bb4c122bcf2c26004f1413dda6fbfc0a11848cf3281c67922f7cb6c5fadff0e895bc1d8f6c2ca851cc73d8a4c053f04ed626c076015781925e21f1d1b1ffe7d02158cd6917e3441c9c194439895cdc9c000f568d0299eda290454ce4bb10a43df032030ef1cef8e8c9518ce6629fe69fc07db7729cc9363a6b9f4ea8ff640d64 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3E2BF7F2031B96F38CE6C4D8A85D3E2D58476A0F\Blob = 68000000010000000800000000800c13c1b9d4017e000000010000000800000000c00c0f7f39d30153000000010000002500000030233021060b2b0601040181b53701010130123010060a2b0601040182373c0101030200c00b00000001000000420000005300740061007200740043006f006d002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080300000001000000140000003e2bf7f2031b96f38ce6c4d8a85d3e2d58476a0f2000000001000000cd070000308207c9308205b1a003020102020101300d06092a864886f70d0101050500307d310b300906035504061302494c31163014060355040a130d5374617274436f6d204c74642e312b3029060355040b1322536563757265204469676974616c204365727469666963617465205369676e696e6731293027060355040313205374617274436f6d2043657274696669636174696f6e20417574686f72697479301e170d3036303931373139343633365a170d3336303931373139343633365a307d310b300906035504061302494c31163014060355040a130d5374617274436f6d204c74642e312b3029060355040b1322536563757265204469676974616c204365727469666963617465205369676e696e6731293027060355040313205374617274436f6d2043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a0282020100c188db09bc6c467c789f957bb53390f27262d6c1362022245ecee977f2430aa20664a4cc8e36f838e623f06e6db13cdd72a3851ca1d33db4332bd32faffeeab0415967b6c4067d0a9e7485d6794c80377adf39055259f7f41b4643a4d28585d2c371f3756234ba2c8a7f1e8feeed34d011c796cd523dba33d6dd4dde0b3b4a4b9fc2262ffab5161c723577ca3c5de6cae1268b1a36765c01db741425feedb5a0880fdd78ca2d1f079730012d7279fa46d6132aa8b9a6ab83491de5f2efdde4018e180a8f6353168562a90e193accb566a6c26b7407e42be1763eb46dd8f644e173621f3bc4bea05356256c5109f7aaabcabf76fd6d9bf39ddbbf3d66bc0c56aaaf9848953a4bdfa75850d93875a95bea430c02ff99ebe86c4d705b29659cddaa5dccaf0131ec0cebd28de8ea9c7be66ef727660c1a48d76e42e33fde213e7be10d70fb63aaa86c1a54b45c257ac9a2c98b16a6bb2c7e175e054d586e121d01ee12100dc6327f18fffcf4facd6e91e83649be1a48698bc2964d1a12b26917c10a90d6fa792248bfba7b69f870c7fa7a37d8d80dd2764f57ff90b7e391d2ddefc260b7673addfeaa9cf0d48b7f7222cec69f97b6f8af8aa010a8d9fb18c6b6b55c523c89b6192a73010a0f03b31260f27a2f81dba36eff263097f58bdd8957b6ad3db3af2bc5b77602f0a5d62b9a86142a72f6e3338c5d094b13dfbb8c7413524b0203010001a38202523082024e300c0603551d13040530030101ff300b0603551d0f0404030201ae301d0603551d0e041604144e0bef1aa4405ba517698730ca346843d041aef230640603551d1f045d305b302ca02aa0288626687474703a2f2f636572742e7374617274636f6d2e6f72672f73667363612d63726c2e63726c302ba029a0278625687474703a2f2f63726c2e7374617274636f6d2e6f72672f73667363612d63726c2e63726c3082015d0603551d2004820154308201503082014c060b2b0601040181b5370101013082013b302f06082b060105050702011623687474703a2f2f636572742e7374617274636f6d2e6f72672f706f6c6963792e706466303506082b060105050702011629687474703a2f2f636572742e7374617274636f6d2e6f72672f696e7465726d6564696174652e7064663081d006082b060105050702023081c330271620537461727420436f6d6d65726369616c20285374617274436f6d29204c74642e30030201011a81974c696d69746564204c696162696c6974792c2072656164207468652073656374696f6e202a4c6567616c204c696d69746174696f6e732a206f6620746865205374617274436f6d2043657274696669636174696f6e20417574686f7269747920506f6c69637920617661696c61626c6520617420687474703a2f2f636572742e7374617274636f6d2e6f72672f706f6c6963792e706466301106096086480186f8420101040403020007303806096086480186f842010d042b16295374617274436f6d20467265652053534c2043657274696669636174696f6e20417574686f72697479300d06092a864886f70d01010505000382020100166c99f4660c34f5d0855e7d0aecda104e381c5edfa625054b9132c1e83bf13ddd44095b07498a29cb6602b7b19af72598093c8e1be1dd36872b4bbb68d339663da026c7f239911d51ab827b7ed5ce5ae4e2035770699708f95e58a60adf8c069a451616380a5e57f662c77a0205e6bc1eb5f29ef4a92983f8b214e36e288744c3901ade38a93cac434d6445cedd28a95cf2737b04f817e8abb1f32e5c646e73313a12b8bcb311e47d8f81519a3b8d89f44d93667b3c03edd39a1d9af36550f5a0d0759f2faff0ea824398f8699c8979c4438e4672e3643612aff7251e388990777ec36b6ab9c3cb444bac78908be7c72c1e4b1144c8345227cd0a5d9f85c189d51a78f295105332dd80846675d9b56828fb612ebe84a838c0991286a51e6764ad062e2fa97085c7960f7c8965f58e43540eabdda580399460c034c996702ca312f51f487bbd1c7e6bb79d90f4223baef8fc2acafa8252a0efaf4b5593ebc1b5f0228bac344e262204a1872c754ab7e57d13d7b80c64c036d2c92f86128c2309c11b823b7349a36a578794e5d678c5994363e34de0772de165997269041a4709e60f015624fb1fbf0e79a9582eb9c409017e95ba6d00063eb2ea4a1039d8d02bf5bfec75bf9702c5091b08dc5537e281fb3784436220cae7564b65eafe6cc1249324a134eb05ff9a22ae9b7d3ff165510aa6306ab3f4881c800dfc728ae8835e updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0B7199A1C7F3ADDF7BA7EAB8EB574AE80D60DDDE\Blob = 6800000001000000080000000040d10ffc47d5017e000000010000000800000000c06bd91de8d4015300000001000000230000003021301f060960857401590102010130123010060a2b0601040182373c0101030200c00b0000000100000038000000530077006900730073005300690067006e00200047006f006c006400200052006f006f007400200043004100200013202000470033000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080300000001000000140000000b7199a1c7f3addf7ba7eab8eb574ae80d60ddde20000000010000007e0500003082057a30820362a003020102020900dec4f244f31da6fc300d06092a864886f70d01010b0500304a310b300906035504061302434831153013060355040a130c53776973735369676e204147312430220603550403131b53776973735369676e20476f6c6420526f6f74204341202d204733301e170d3039303830343133333134375a170d3337303830343133333134375a304a310b300906035504061302434831153013060355040a130c53776973735369676e204147312430220603550403131b53776973735369676e20476f6c6420526f6f74204341202d20473330820222300d06092a864886f70d01010105000382020f003082020a0282020100c3e89fc8655a9d671bc14597b4b487435b6160809ef27f5ef96744dd44faabb5ab77ff2a194cce6fc48f419fe0e2cd72e0d1d4526141090abf0a70fbe083696129cadb229a5ba5e6dd1795b06f848e3a3e645a41fb1b58fcfd2b3eb2a4e6acc982bccef695f89777ed26f658ae9e27e20f83ecc53658c87bcfd587a1a9871a136761016da6699ce290f12b6865f3e8b07cfc823ddeadd80a00094479139cf0fe6e757bc2bcb359010b7cc5d52df0bfff6d57d24981ebb4b350ac5bf90b15158c69ffa33901edfcdcdc27978e7b8bd56aa6d6e01d5fcd0191e6f52298ba2e0918386f13a881d2fb2137e72db462e78190b0c67959b76775febe8f3bfa36ecafadd24f743601e557ab2304cc4a5e97cf7ec6ef8ccc9523698dcb38c719f6d68a00141e343d6fda0c0bc3ba97fc114b52613ebf33675310bf781b09c247ba1eaf58f575817fbd56f1eb56d7d9690c07e93731b0121c32ef56d9be7a2b7cbdd33dbc6a334d3a3c50108727c77a0a6753db7f809be89e23faf9083a8ba18e345a48335f64d3978607197d8894ce2a7cc56adfafbca99fcd3aa6babb54f97f8fdfcf0e5ac4ad9abcb33a7773834c933c9068b57c509511c8825e9471d04118fbc9c665ecce89b6ce22b3115b3fe09d3e1b18680daa03a16759bf6b9dbcf8f2652f9a413a45d85ed0366c6f3b1e63b48e984c13db210e9f7bedeaa0aa71c3eba3a0d2250203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604145c97064634abdf30c57cc50d55716630b5608f9e301f0603551d230418301680145c97064634abdf30c57cc50d55716630b5608f9e300d06092a864886f70d01010b05000382020100774b4ddeea854aab2c27d645c7f15f20c15b60ed07cba233dc36cfc794f106c7d5dacfcdad843eff12487f41e8a5665730c41de4a71a2f2d42c1ef4673b2d5f55afd0e7a6bd2c831a30d48965765635518c0fce48acc98865bab0c8a2737fa2368595c26d7a1c1c2b94e2cff295ee6940bbecd724f95e88ff6f7b83e5ececf9e11c9ac0329488aa9b6a634b9ac40ffc4b67337b1c77fa951db4b2a475f4024078806b724b3fb7ff7b08b33fabf2375a35cfeaa651ac2bef17d81770381b18dd7950d7a3c4298b78fa97d50e1df52069aa05254788307615209375e8a9ca7c651d15c63d184dcc2dbd2fa5b18367d66bcd428972f75961c8407ac8b8e5311be2421aa67f2c1ad889cd3b0786778f5d35803200a5d20f1b5e765cc0e20e3d5dfe62f192b8568c10426cf8fed0553a1dd070eeb4126c7b4a92c5be3693d66c0621bc0aa86c037c33104867039be6b5f214041a07fe5d90f384b705f49f885b82b2eaa1f934143f8fbb2743c1f4b575bb7d451a1924acebe10a2eed814227bb941bd8de988a9d18f031a60ff3f8789a099272266b03e689e728851389d133e456d05e546b573ed4386b1140a1ebcda0dbf1e245c668f0ebea1fdc6eb69bc4379d70376f9dc8799b898c4cd7f6d10f910be2c42fe9c294d836b0abdb58ec4488afd2107a6807d1f9be9abbd8261440a71275f6d9b909eaeff3624b36803d6958c6b73 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5BB59920D11B391479463ADD5100DB1D52F43AD4 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8DDEB82046B6227C79246A3EAD7B32C3E88FFCAC updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D11478E8E5FB62540593D22C51570D014EAC76D8 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\9158C5EF987301A8903CFDAB03D72DA1D88909C9\Blob = 6800000001000000080000000040620c5339d2010b000000010000003a00000041006300740061006c00690073002000410075007400680065006e007400690063006100740069006f006e002000430041002000470031000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080300000001000000140000009158c5ef987301a8903cfdab03d72da1d88909c9200000000100000098030000308203943082027ca003020102020101300d06092a864886f70d0101050500306a310b3009060355040613024954310f300d06035504070c064d696c616e6f31233021060355040a0c1a416374616c697320532e702e412e2f30333335383532303936373125302306035504030c1c416374616c69732041757468656e7469636174696f6e204341204731301e170d3039303632333134303630305a170d3232303632353134303630305a306a310b3009060355040613024954310f300d06035504070c064d696c616e6f31233021060355040a0c1a416374616c697320532e702e412e2f30333335383532303936373125302306035504030c1c416374616c69732041757468656e7469636174696f6e20434120473130820122300d06092a864886f70d01010105000382010f003082010a0282010100c31c86343f27524260ba2b60d0212bc9d7e940753a6c580f233bcf863ed464ab6edaeac82ad89545dfc91cd225929e10985a8b7169c095e9f66b68dcf7b6c40dfe6ef5703bc1a4a84f20a2270b9ff112757ccfae7f5ecb78025828d72faadba0ae743d7eabf6e972a12acfd69060dfe0a035cac0db04c40756fc66758c8e7a13a13c066b1ae67f399c88e4846fa2e27f6b9fec01aad2c4cbb2ec9a3db81718ac1f609933e6eb05ddccf26967b00ebe282443cb2db9478419f9eae4f1f568f49fc77b5051afa2fc6f778831bf92db7f9cc5b5aca10898e76a33fed1bb00e1b70508aff3a65688363de38a4ae20d9d8086669fd4c2a350ba1c12d7878a314ab8150203010001a3453043300e0603551d0f0101ff04040302010630120603551d130101ff040830060101ff020100301d0603551d0e0416041401bbd69b56b47ee6c558dd2c98f4ca72f65f3386300d06092a864886f70d01010505000382010100a120d6cba2346d3c6ee155d24ad0d9bab23751887727ee0248934541e27551f2199409a0f3b87dba038023a025ef0119b5d91a7a2de3428ab186310f96ec6684f2ce231246966b315e06baafa352aa4220a8d1aeaa9bdfc4179e537001b4a91ada68c8630fb65a7353d16911061352e76ba80531b7b0fc8746c5758881f15f7802e79fad9cbb54ed5f996a37d5eb55b32ac0436051dcb4719226a30fcc7a3ddcc04289172908675464c5f9a844bc847158963d67577fbbac90b37122bf3ebaac66264510b3f01f3a3a68a55035cab4179106012cf70db070b25b5675b97799c0d99585022d736607c94f9911ee5b2ba8e3682305a8f3040f06bb1f098ec65b1d updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\9CBB4853F6A4F6D352A4E83252556013F5ADAF65 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7618D1F380243D5240C6116AAD5777097D8130A0 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\89DF74FE5CF40F4A80F9E3377D54DA91E101318E\Blob = 03000000010000001400000089df74fe5cf40f4a80f9e3377d54da91e101318e090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000003e0000004d006900630072006f00530065006300200065002d0053007a00690067006e006f00200052006f006f00740020004300410020003200300030003900000020000000010000000e0400003082040a308202f2a003020102020900c27e43044e473f19300d06092a864886f70d01010b0500308182310b30090603550406130248553111300f06035504070c08427564617065737431163014060355040a0c0d4d6963726f736563204c74642e3127302506035504030c1e4d6963726f73656320652d537a69676e6f20526f6f742043412032303039311f301d06092a864886f70d0109011610696e666f40652d737a69676e6f2e6875301e170d3039303631363131333031385a170d3239313233303131333031385a308182310b30090603550406130248553111300f06035504070c08427564617065737431163014060355040a0c0d4d6963726f736563204c74642e3127302506035504030c1e4d6963726f73656320652d537a69676e6f20526f6f742043412032303039311f301d06092a864886f70d0109011610696e666f40652d737a69676e6f2e687530820122300d06092a864886f70d01010105000382010f003082010a0282010100e9f88ff363adda86d8a7e042fbcf91dea626f899a56370ad9baeca33407d6d966ea10e44eee1139d9442529abd7585742ca80e1d93b618b78c2ca8cffb5c71b9daecfee87e8fe42f1db2a87587d8b7a1e53bcf994a46d083197dc0a1121c956d4af4d8c7a54d332e853940757e147c80129850c74167b8a0806154a66c4e1fe09d0e07e9c9ba33e7fec055282c0280a719f59edc555303977b0748ff99fb378a24c459cc5010638eaaa91ab0841a86f95fbbb1506ea4d10accd5717e1fa71b7cf5536e225fcb2be6d47c5daed6c2c64ce50501d9ed57fcc12379fcfac8248395f3b56a5101d077d6e912a1f91a83fb821bb9b097f47606334349a0ff0bb5fab50203010001a38180307e300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414cb0fc6df4243cc3dcbb54823a11a7aa62abb3468301f0603551d23041830168014cb0fc6df4243cc3dcbb54823a11a7aa62abb3468301b0603551d11041430128110696e666f40652d737a69676e6f2e6875300d06092a864886f70d01010b05000382010100c9d10e5e2ed5ccb37c3ecbfc3dff0d28959304c8bfdacd79b84390f0a4beeff2ef2198bcd4d45d06f6ee42ec306ca0aaa9caf1af8afa3f0b736a3eea2e407e1fae546179eb2e0837d723f38c9fbe1db1e1a475dba0e25414b1ba1c29a418f612baa21414e33135c840ffb7e0057657c11c59f2f8bfe4ed25625c84f07e7e1fb3bef9b72111cc03015670a710921e1b34811ead9c1ac3043ced0261d61e06f35f3a87f22bf14587e53dacd1c75784bd6baedcd8f9b61b62700b3d36c942f232d77a61e6d2db3dcfc8a9c99bdcdb5844d76f38af7f78d3a3ad1a75ba1cc1367c8f1e6d1cc37546ae3505a6f65c3d21ee56f0c982222d7a54ab70c37d2265827096 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7F8AB0CFD051876A66F3360F47C88D8CD335FC74 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B38FECEC0B148AA686C3D00F01ECC8848E8085EB\Blob = 030000000100000014000000b38fecec0b148aa686c3d00f01ecc8848e8085eb09000000010000003e000000303c06082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000004000000044004900520045004300430049004f004e002000470045004e004500520041004c0020004400450020004c004100200050004f004c00490043004900410000007e00000001000000080000000080c82b6886d7017f000000010000003e000000303c06082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703082000000001000000c3050000308205bf308203a7a003020102021000d28570fdaea7d65f118415c631b5cb300d06092a864886f70d0101050500305d310b300906035504061302455331283026060355040a0c1f444952454343494f4e2047454e4552414c204445204c4120504f4c49434941310d300b060355040b0c04444e49453115301306035504030c0c4143205241495a20444e4945301e170d3036303231363130333732355a170d3336303230383232353935395a305d310b300906035504061302455331283026060355040a0c1f444952454343494f4e2047454e4552414c204445204c4120504f4c49434941310d300b060355040b0c04444e49453115301306035504030c0c4143205241495a20444e494530820222300d06092a864886f70d01010105000382020f003082020a02820201008000ad0cc3a32007a363fff734a0cdee6a5408175db10115a7e6b95f8a71ff0cc21dea37f3de937fd6054d84b2d5d71c0cf4c49170400e5ac898a480e80d33c007f3b7f5aca1387ac0665424fc52cc302af2c3c4a12c76bfc1c0bf82f19bf0687a1340c897bc1c2507080ab796efcc2954e0e6652deab22eb10969124e30d5d8f8bc00802f4d930fcd2e571b33bb9f304ec4a5cb79a7fbe23418b6209e1b9f5da7c93aad4564b318ce11129c6d1e554528849c57674df9cbe28b8f5809d439ffc836d238e20c657f150e7dc107dda922df9100c46c713474dc39eaea4f44697f58db580a52712beca91d507433f9296afafe99f4e7cc45456dca5a25a212e3ced7380539f01a09f57659ce626f7a340d2cd1bc0412ec3d53c8fad002cbce3d21b5c5e0393365cf3953c99b46f99d33f359800841be6f4ba0fa4acea4761c85e2afaf149d65acf77f97e43349a6afbece2b37f12ec173059c9c604c9d300d97549e8162bbe7e02ff7140714a97791e9dc91958ed3889033476f71c31469faa62d011e1bead32ee27f0bdccfe722f0f141a30192e580d3bea962a855880b3434ecdc2115aaefd6225e89f55192132a6f8016d9b10dd92ef810b8c2fe5245339c1d387cdc15693473bfa02cbb117b94cdf8372d6f3def835ac61e9b74498fd9c28dbe167650c85ad12516f6f6cc8c9c5a309e65bed09a4893d7fa680d753187f9f70203010001a37b3079300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604148e45f49f73c5ff2f1b05db0147601b038a81b7ba30370603551d200430302e302c0604551d20003024302206082b060105050702011616687474703a2f2f7777772e646e69652e65732f647063300d06092a864886f70d0101050500038202010075e573c951512f8b19a087e9ffae3636a6fc411fe31ed7716019c66f9a0230bd6271ad73fe912d4ee4264044a9ae7826233169dc9a73961e49510be0efc1b843ef719cee41b7c5501f32849e2286f1f71f8fd9ad2b4eda972897bb969a1af8b1d97a04f3549912199615806739ff025f7afc5542505ae6b9a2ffb8a8621e14cdd93fbea36548c53bd737ce0dfa2890dabff9e35147257d4ad3674d87aa62bc5eec7a80447cf79f0abd655794caf21166d6527fe43a707504cd3b97d43672f75156bf34f5d241e1b4daa843fe6b124912b45dcf2242968c0823268cb2104e5daa53ee012f75e5b9a21133c4d76afdf80eca6e82d9e7bb59234eb5f9111d2f6b23f57b1120ea4112903246db313ba9c15b73683a461b8cfe97b756b96199cc4ef083fa37f1de1c9d1c718b0393c3c473822ea8981d64a29a8cf754084dcfea81cbf55b099963af758c96f87935d5dceb41817938845e6ff16f6276db91ce5a8560391d5be22a2f4325dbc27a24d315b0a2f18ca07d6b480913ffa24c668aec705209538c30ccb8d5ba24dc30993ea15eb7df81acec37be4e9b2758de7ea19b547f06b62fe43250fde710bba8cdda181bd463663dea517139f49c3edf5af4dac74c26ed8bb521ba347902736110da9831a860cb7e07a7d0b70543895bcd8526d9b051aff78c52aa12a758df929b67f29df2e6f46931f416e7de775b1edd9a0501ad updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D067C11351010CAAD0C76A65373116264F5371A2 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\409D4BD917B55C27B69B64CB9822440DCD09B889 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B12E13634586A46F1AB2606837582DC4ACFD9497\Blob = 7f000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d50153000000010000002400000030223020060a2b0601040182375e010130123010060a2b0601040182373c0101030200c00b00000001000000120000004300650072007400690067006e00610000007a000000010000000c000000300a06082b0601050507030909000000010000005c000000305a06082b0601050507030206082b0601050507030306082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b06010505070308030000000100000014000000b12e13634586a46f1ab2606837582dc4acfd94972000000001000000ac030000308203a830820290a003020102020900fedce3010fc948ff300d06092a864886f70d01010505003034310b300906035504061302465231123010060355040a0c094468696d796f7469733111300f06035504030c084365727469676e61301e170d3037303632393135313330355a170d3237303632393135313330355a3034310b300906035504061302465231123010060355040a0c094468696d796f7469733111300f06035504030c084365727469676e6130820122300d06092a864886f70d01010105000382010f003082010a0282010100c868f1c9d6d6b3347526821eecb4beea5ce126ed114761e1a27c16784021e4609e5ac863e1c4b19692ff186d6923e12b62f7dde2362f9107b948cf0eec79b62ce7344b700825a33c871b19f281070f389019d311fe86b4f2d15e1e1e96cd806cce3b3193b6f2a0d0a995127da59acc6bc884568a33a9e722155316f0cc17ec575fe9a20a9809dee35f9c6fdc48e3850b155aa6ba9fac48e309b2f7f432de5e34be1c785d425bce0e228f4d90d77d3218b30b2c6abf8e3f141189200e7714b53d940887f7251ed5b26000ec6f2a28256e2a3e186317253f3e442016f626c825ae054ab4e7632cf38c16537e5cfb111a08c146629f22b8f1c28d69dcfa3a5806df0203010001a381bc3081b9300f0603551d130101ff040530030101ff301d0603551d0e041604141aedfe413990b42459be01f252d545f65a39dc1130640603551d23045d305b80141aedfe413990b42459be01f252d545f65a39dc11a138a4363034310b300906035504061302465231123010060355040a0c094468696d796f7469733111300f06035504030c084365727469676e61820900fedce3010fc948ff300e0603551d0f0101ff040403020106301106096086480186f8420101040403020007300d06092a864886f70d0101050500038201010085031e9271f642afe1a3619eebf3c00ff2a5d4da95e6d6be68363d7e6e1f4c8aefd10f216d5ea55263ce12f8ef2ada6feb37fe1302c7cb3b3e226bda612e7fd4723ddd30e11e4c40198c0fd79cd183307b9859dc7dc6b90c294ca133a2eb673a6584d396e2ed7645708fb52bdef923d6496e3c14b5c69f351e50d0c18f6a70440262cbae1d6841a7aa57e853aa07d206f6d514060b9103752c6c72b561959a0d8bb90de7f5df54cddee6d8d609089763e5c12eb0b74426c026c0af55309e3bd5362a1904f45c1effcf2cb7ffd0fd874011d51123bb48c021a9a4282dfd15f8b04e2bf4305b21fc119134be41ef7b9d9775ff9795c096582feabb46d7bbe4d92e updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4F658E1FE906D82802E9544741C954255D69CC1A\Blob = 68000000010000000800000000809ef40c18d5017e000000010000000000000053000000010000002600000030243022060c2b0601040181ad5a0305030230123010060a2b0601040182373c0101030200c00b0000000100000028000000430065007200740070006c0075007300200052006f006f00740020004300410020004700320000007a000000010000000e000000300c060a2b0601040182375e010209000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080300000001000000140000004f658e1fe906d82802e9544741c954255d69cc1a2000000001000000200200003082021c308201a2a00302010202121120d991ceaea3e8c5e7ffe902afcf73bc55300a06082a8648ce3d040303303e310b30090603550406130246523111300f060355040a0c0843657274706c7573311c301a06035504030c1343657274706c757320526f6f74204341204732301e170d3134303532363030303030305a170d3338303131353030303030305a303e310b30090603550406130246523111300f060355040a0c0843657274706c7573311c301a06035504030c1343657274706c757320526f6f742043412047323076301006072a8648ce3d020106052b8104002203620004cd0f5b5682dff0451ad6adf779f01dc9ac96d69e4e9c1fb44211ca86bf6dfb85a3c5e5195cd7eea63f6967d878e2a6c9c4db2d792ee78b8d026f31224d06e36072459d0e42779ececfe57f859b18e4fccc2e72d316934eca99635ca1052a6c06a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414da836302798eda4cc63c2314d88fc320ab286059301f0603551d23041830168014da836302798eda4cc63c2314d88fc320ab286059300a06082a8648ce3d0403030368003065023070feb00bd9f78397ecf3551dd4dcb3060efe33989d8b39906b9421edb6d75dd64cd721a7e7bf210f2bcdf72adc85079d023100861416e5dcb065c2c08e149fbf241668e5bcf97969dcad452bf7b63173cc06a55393911a93ae706a67bad79ee5611a5f updroots.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
a34b663f961d9d1e667b5a6c8c1d0385102a3a3bb9345c9530410e54e0c89138.execmd.exedescription pid process target process PID 852 wrote to memory of 976 852 a34b663f961d9d1e667b5a6c8c1d0385102a3a3bb9345c9530410e54e0c89138.exe cmd.exe PID 852 wrote to memory of 976 852 a34b663f961d9d1e667b5a6c8c1d0385102a3a3bb9345c9530410e54e0c89138.exe cmd.exe PID 852 wrote to memory of 976 852 a34b663f961d9d1e667b5a6c8c1d0385102a3a3bb9345c9530410e54e0c89138.exe cmd.exe PID 852 wrote to memory of 976 852 a34b663f961d9d1e667b5a6c8c1d0385102a3a3bb9345c9530410e54e0c89138.exe cmd.exe PID 852 wrote to memory of 976 852 a34b663f961d9d1e667b5a6c8c1d0385102a3a3bb9345c9530410e54e0c89138.exe cmd.exe PID 852 wrote to memory of 976 852 a34b663f961d9d1e667b5a6c8c1d0385102a3a3bb9345c9530410e54e0c89138.exe cmd.exe PID 852 wrote to memory of 976 852 a34b663f961d9d1e667b5a6c8c1d0385102a3a3bb9345c9530410e54e0c89138.exe cmd.exe PID 976 wrote to memory of 1496 976 cmd.exe updroots.exe PID 976 wrote to memory of 1496 976 cmd.exe updroots.exe PID 976 wrote to memory of 1496 976 cmd.exe updroots.exe PID 976 wrote to memory of 1496 976 cmd.exe updroots.exe PID 976 wrote to memory of 472 976 cmd.exe updroots.exe PID 976 wrote to memory of 472 976 cmd.exe updroots.exe PID 976 wrote to memory of 472 976 cmd.exe updroots.exe PID 976 wrote to memory of 472 976 cmd.exe updroots.exe PID 976 wrote to memory of 1508 976 cmd.exe updroots.exe PID 976 wrote to memory of 1508 976 cmd.exe updroots.exe PID 976 wrote to memory of 1508 976 cmd.exe updroots.exe PID 976 wrote to memory of 1508 976 cmd.exe updroots.exe PID 976 wrote to memory of 1560 976 cmd.exe updroots.exe PID 976 wrote to memory of 1560 976 cmd.exe updroots.exe PID 976 wrote to memory of 1560 976 cmd.exe updroots.exe PID 976 wrote to memory of 1560 976 cmd.exe updroots.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a34b663f961d9d1e667b5a6c8c1d0385102a3a3bb9345c9530410e54e0c89138.exe"C:\Users\Admin\AppData\Local\Temp\a34b663f961d9d1e667b5a6c8c1d0385102a3a3bb9345c9530410e54e0c89138.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\RootCert\setup.bat" "2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RootCert\updroots.exeupdroots.exe authroots.sst3⤵
- Executes dropped EXE
- Modifies system certificate store
-
C:\Users\Admin\AppData\Local\Temp\RootCert\updroots.exeupdroots.exe updroots.sst3⤵
- Executes dropped EXE
- Modifies system certificate store
-
C:\Users\Admin\AppData\Local\Temp\RootCert\updroots.exeupdroots.exe -l roots.sst3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RootCert\updroots.exeupdroots.exe -d delroots.sst3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RootCert\ADVPACK.DLLFilesize
129KB
MD5e98ce891b708859e0ced9d2a0ef5a24b
SHA176bedd4599ceb80f8289b1a7ac4f43a0f0ede87d
SHA2567735dfb067c97033031d45593c320d1229f3acba896c1a4e815a2d1bfd786b11
SHA51211c6ec18bf8ba8e2b8f4afaa442664c1c89b8026bb1bdba68391f380c0d3a8d35afc3f1a34ffc3643833e28437737dde2c80d3e185ac74c0dba42b54fe53c616
-
C:\Users\Admin\AppData\Local\Temp\RootCert\authroots.sstFilesize
35KB
MD5af0ce68c1428817dd6cfba3cee907a1b
SHA10ada11d87dc27151e9982dc69a1a581b6294bf22
SHA25685a80056d3bd21b531575e37208ac45e673eae38ccda4daf08e1c7aef389f581
SHA51240a2bdb4aab518b8620f1500f16f042b761c26c8d743c3df5d8925d319e8f26d1d11ecb8c27b53ed667dfc13ec979cfa88f0638c44dd118707255b44c8fb957c
-
C:\Users\Admin\AppData\Local\Temp\RootCert\delroots.sstFilesize
179KB
MD57c30111da3c87ab35c3ab7ae5121c1dd
SHA1020b16eaa7b1d889e5a821bc4dda027555fec107
SHA256c122b9ad6eaaa4b6f4e21c25c7c56be34a999497dfd3fb809b6c636664db1df8
SHA512eea98fa8f9071047691ac7d74db18991f02e0e559410c7ff629f8e2a34098d325bd35396161a385016ccbca6bb9125ec1e2fbcb5bcdf55613b84123e0f26f092
-
C:\Users\Admin\AppData\Local\Temp\RootCert\roots.sstFilesize
5KB
MD572544afdfcf3014ddd8231146c52d218
SHA1edcda01b0e7afe0eec62a618a67801a5e6c674de
SHA256a95d014bf5876d49aa3d7b7581f4b8650dc7305709ac800fbb4cc1d036c39347
SHA5123d0f7bc23408f67cf44b2d522ef74b0c83b5bf9dfdeeb7e2658fb6a20776fe38ebbfaf129bd6401af6b61a75db717ddb0064cbe885b7d9c894442b1ee2451cc4
-
C:\Users\Admin\AppData\Local\Temp\RootCert\rootsupd.infFilesize
1KB
MD562e9fa5b395a827324a21052727f547e
SHA11af0fad2790531b8287eb5b1db5b8ddafb6d3571
SHA25694fe83c96d71ca4e80b7426af32c7e02b784d6492b7b16405114b04f4ffc5464
SHA51248a93e55e91cde8125714d45fc98180fe7127ef6ce7433ab43d4c09b0d4cea1543f941876e393bf99eac0dcdfae5106821acec86c86babfeaeb0a2f4711a55f3
-
C:\Users\Admin\AppData\Local\Temp\RootCert\setup.batFilesize
165B
MD5173a16c24d2b4e93fe5f79919ac58631
SHA1e4548ac1228623cc5b821807ab69328b80f24e30
SHA2567ea63bc0cc41c2031342c1172a84d22309b8ba07bc5f4eae83e7dccdad8341ca
SHA512130e1a11715c6bed9378f4f85dc2cf7021c2dc3434ace8585cf75bf9f799c149ce3b440b28a1fd648ee7923a1a5f6d8b542489bc66139bfb152f544c240f6c43
-
C:\Users\Admin\AppData\Local\Temp\RootCert\updroots.exeFilesize
5KB
MD59c18ae971cbffb096952177f6804ea31
SHA1bb255dd1bd9bb39cdbb8671af66054432c686828
SHA2562703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb
SHA51221086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c
-
C:\Users\Admin\AppData\Local\Temp\RootCert\updroots.exeFilesize
5KB
MD59c18ae971cbffb096952177f6804ea31
SHA1bb255dd1bd9bb39cdbb8671af66054432c686828
SHA2562703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb
SHA51221086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c
-
C:\Users\Admin\AppData\Local\Temp\RootCert\updroots.exeFilesize
5KB
MD59c18ae971cbffb096952177f6804ea31
SHA1bb255dd1bd9bb39cdbb8671af66054432c686828
SHA2562703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb
SHA51221086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c
-
C:\Users\Admin\AppData\Local\Temp\RootCert\updroots.exeFilesize
5KB
MD59c18ae971cbffb096952177f6804ea31
SHA1bb255dd1bd9bb39cdbb8671af66054432c686828
SHA2562703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb
SHA51221086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c
-
C:\Users\Admin\AppData\Local\Temp\RootCert\updroots.exeFilesize
5KB
MD59c18ae971cbffb096952177f6804ea31
SHA1bb255dd1bd9bb39cdbb8671af66054432c686828
SHA2562703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb
SHA51221086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c
-
C:\Users\Admin\AppData\Local\Temp\RootCert\updroots.sstFilesize
578KB
MD579c72d9b5be9bfe6d4eaf09383e7faa0
SHA1be2df198e4a08df768a374f3fc7419d9317452da
SHA256685b864c884012cc04465a2bb8994144f9affdcef447d5676ebe96322793af8f
SHA512d72986becc42caa1b1a3ed1e4c64a36ca3884a8c52cbf797ff1dcaadf358cb79d06470d6b72e7d5150f88dc1fd84d43e30c333a270e0ea0624e185f57ac629e1
-
\Users\Admin\AppData\Local\Temp\RootCert\updroots.exeFilesize
5KB
MD59c18ae971cbffb096952177f6804ea31
SHA1bb255dd1bd9bb39cdbb8671af66054432c686828
SHA2562703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb
SHA51221086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c
-
\Users\Admin\AppData\Local\Temp\RootCert\updroots.exeFilesize
5KB
MD59c18ae971cbffb096952177f6804ea31
SHA1bb255dd1bd9bb39cdbb8671af66054432c686828
SHA2562703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb
SHA51221086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c
-
\Users\Admin\AppData\Local\Temp\RootCert\updroots.exeFilesize
5KB
MD59c18ae971cbffb096952177f6804ea31
SHA1bb255dd1bd9bb39cdbb8671af66054432c686828
SHA2562703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb
SHA51221086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c
-
\Users\Admin\AppData\Local\Temp\RootCert\updroots.exeFilesize
5KB
MD59c18ae971cbffb096952177f6804ea31
SHA1bb255dd1bd9bb39cdbb8671af66054432c686828
SHA2562703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb
SHA51221086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c
-
\Users\Admin\AppData\Local\Temp\RootCert\updroots.exeFilesize
5KB
MD59c18ae971cbffb096952177f6804ea31
SHA1bb255dd1bd9bb39cdbb8671af66054432c686828
SHA2562703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb
SHA51221086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c
-
\Users\Admin\AppData\Local\Temp\RootCert\updroots.exeFilesize
5KB
MD59c18ae971cbffb096952177f6804ea31
SHA1bb255dd1bd9bb39cdbb8671af66054432c686828
SHA2562703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb
SHA51221086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c
-
\Users\Admin\AppData\Local\Temp\RootCert\updroots.exeFilesize
5KB
MD59c18ae971cbffb096952177f6804ea31
SHA1bb255dd1bd9bb39cdbb8671af66054432c686828
SHA2562703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb
SHA51221086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c
-
\Users\Admin\AppData\Local\Temp\RootCert\updroots.exeFilesize
5KB
MD59c18ae971cbffb096952177f6804ea31
SHA1bb255dd1bd9bb39cdbb8671af66054432c686828
SHA2562703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb
SHA51221086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c
-
memory/472-65-0x0000000000000000-mapping.dmp
-
memory/852-54-0x0000000075FF1000-0x0000000075FF3000-memory.dmpFilesize
8KB
-
memory/976-55-0x0000000000000000-mapping.dmp
-
memory/1496-60-0x0000000000000000-mapping.dmp
-
memory/1508-70-0x0000000000000000-mapping.dmp
-
memory/1560-75-0x0000000000000000-mapping.dmp