Analysis
-
max time kernel
143s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
14/01/2024, 07:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7acc85ad6eea22222b77c6b97e70d70163d665decfb01c7ac37a521cad221910.exe
Resource
win7-20231215-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
7acc85ad6eea22222b77c6b97e70d70163d665decfb01c7ac37a521cad221910.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
7acc85ad6eea22222b77c6b97e70d70163d665decfb01c7ac37a521cad221910.exe
-
Size
4.8MB
-
MD5
bee3dc35e58b6c7cfb3373edd86f0f5c
-
SHA1
7d355964f351de173dd160fb2c101008adf63883
-
SHA256
7acc85ad6eea22222b77c6b97e70d70163d665decfb01c7ac37a521cad221910
-
SHA512
55329e7a2f02a3318c87bae712918a7f9b8fe96fe098e09f3549d70aa9fd5b5a71efa7119385eadf563d909736be243763fd7a66ea1e8e29b35a06874a1a0454
-
SSDEEP
98304:LpLE90Ta7PG5o2/JUqf7W1DSWCLT5S6SNZOreOa4:2932puiSeSOt
Score
8/10
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A} KB931125.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\ = "RootsUpdate" KB931125.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\IsInstalled = "1" KB931125.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\Version = "28,0,2195,0" KB931125.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\Locale = "*" KB931125.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\ComponentID = "Windows Roots Update" KB931125.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation 7acc85ad6eea22222b77c6b97e70d70163d665decfb01c7ac37a521cad221910.exe -
Executes dropped EXE 5 IoCs
pid Process 2700 KB931125.exe 4920 updroots.exe 3928 updroots.exe 1884 updroots.exe 1200 updroots.exe -
Loads dropped DLL 3 IoCs
pid Process 2700 KB931125.exe 3632 7acc85ad6eea22222b77c6b97e70d70163d665decfb01c7ac37a521cad221910.exe 3632 7acc85ad6eea22222b77c6b97e70d70163d665decfb01c7ac37a521cad221910.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 7acc85ad6eea22222b77c6b97e70d70163d665decfb01c7ac37a521cad221910.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\ED8DC8386C4886AEEE079158AAC3BFE658E394B4 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\912198EEF23DCAC40939312FEE97DD560BAE49B1\Blob = 0f000000010000002000000028e178aafed6448838c3ef00179709da1f7cc09c54ef5abab65093fb804e562a030000000100000014000000912198eef23dcac40939312fee97dd560bae49b1090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080b000000010000002e00000056006500720069007a006f006e00200047006c006f00620061006c00200052006f006f0074002000430041000000200000000100000079030000308203753082025da003020102020101300d06092a864886f70d01010b0500305c310b300906035504061302555331193017060355040a0c10566572697a6f6e20427573696e6573733111300f060355040b0c084f6d6e69526f6f74311f301d06035504030c16566572697a6f6e20476c6f62616c20526f6f74204341301e170d3039303733303134323730345a170d3334303733303134323730345a305c310b300906035504061302555331193017060355040a0c10566572697a6f6e20427573696e6573733111300f060355040b0c084f6d6e69526f6f74311f301d06035504030c16566572697a6f6e20476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a02820101008a000c701dbfeb3486c39945351e7f43f7ab6f242dcd19c210bbb0ca295ba920abab722cc4e202396d82b8c511eaf8fbb39e62f8331eb01fc9e3f637db04c83b634f36e285a4251dc7691f04bd68451396071f9450f53ec527549ec04957448e0763d4a6aeed2299cc4d966904136e76899f741694f91d54bda2b9d28301220c4d4480aafe35892725a78689c6d51a92e38fc595a014729ae856c502551c97f9202ed0f53c13195af6e1f90b038269a78cb7d66f9c563e9de82a09606d4be6fb8b9914f7344f6559808db957c8a23521d88871565dee82572d2690189f9a9c9c8fefd4c563a7547d4791877d1a12a81b186fa96fb127bae40474ce371e7f66c50203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604144c3811b898005b5a2b703eaa78e4d5676767a77e300d06092a864886f70d01010b05000382010100015fa0b10601f479d76518603ecf79a0bac2234f23df87965f810e38152e5cc802682920fc8beea58a1881645c98357e393082a4828a50b5bac3e85ad6a89ee2c317dbdbc4ebb00a200de99ee3ff605447f13b9dd4283ca2aea3fbaa8b82222a358790b81c594790d59d2efa49e365a836ebc7e41c68dcb3316cab4ece248015c810591011724d7a9c989cc4fc61e0b3b29d4ea0c6c259ab18d6a25545ec29aa2537d64e4a3d0b40c1e493e4fccd910bf8e6abccb376c462bf19ed86b679c3295454bc997d4657cfa6cff4542a9a03654701a1422acb25476e7c5e004b91d9f91b100670f94215a65faad7401efdc9489d9781ea5c68c2a0e789a1534dbfc7e3 7acc85ad6eea22222b77c6b97e70d70163d665decfb01c7ac37a521cad221910.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CFF810FB2C4FFC0156BFE1E1FABCB418C68D31C5\Blob = 0b0000000100000050000000430065007200740069007300690067006e0020004100750074006f00720069006400610064006500200043006500720074006900660069006300610064006f0072006100200041004300330053000000090000000100000016000000301406082b0601050507030406082b06010505070301030000000100000014000000cff810fb2c4ffc0156bfe1e1fabcb418c68d31c52000000001000000b7020000308202b33082021c020100300d06092a864886f70d01010405003081a1310b3009060355040613024252311730150603550408130e52696f206465204a616e6569726f311730150603550407130e52696f206465204a616e6569726f312e302c060355040a132543657274697369676e20436572746966696361646f7261204469676974616c204c7464612e3130302e060355040b132743657274697369676e204175746f72696461646520436572746966696361646f72612041433353301e170d3939303730393230353633325a170d3138303730393230353633325a3081a1310b3009060355040613024252311730150603550408130e52696f206465204a616e6569726f311730150603550407130e52696f206465204a616e6569726f312e302c060355040a132543657274697369676e20436572746966696361646f7261204469676974616c204c7464612e3130302e060355040b132743657274697369676e204175746f72696461646520436572746966696361646f7261204143335330819f300d06092a864886f70d010101050003818d0030818902818100ce644ed6cfae7c982798ef28efba34c3351a9dd2661e71f1e4962d27173990458f2defe6d547a9e183817c3e2871fa80bb5df8436b1910c1986f159e2dae496444ec841a69591657b23d92d8664bbf99ad4318c738c98b8e2c042eb34b6b93f69d1f84b2cde600c2be36a5bc59b59f8b1920ffe5a828a455b68ab6b2c5d744e30203010001300d06092a864886f70d010104050003818100cb75d7e4c1fff2a0438c9d2ea4439fae9148b86ab7ffc8338c13c6d2e426707ab8adedac9bc5a52baa578b04d781cdaa0d396fe444a9906502f7fa78d6d45577c56b40247854cbc446b1e5d28640859008fcdb15abce2a3e68be175fc4b2d0bcb22dcd4cb70cc42df8d60b4183cae474690be155b1911cc94a3c3ef052141df4 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7A74410FB0CD5C972A364B71BF031D88A6510E9E updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\6A6F2A8B6E2615088DF59CD24C402418AE42A3F1\Blob = 0300000001000000140000006a6f2a8b6e2615088df59cd24c402418ae42a3f109000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b060105050703080b000000010000005200000065005300690067006e0020004100750073007400720061006c00690061003a0020005000720069006d0061007200790020005500740069006c00690074007900200052006f006f00740020004300410000002000000001000000a8030000308203a43082028ca00302010202106f1c92c453004145ca9f7d896f1823e0300d06092a864886f70d0101040500305d31183016060355040a130f655369676e204175737472616c6961311f301d060355040b13165075626c6963205365637572652053657276696365733120301e060355040313175072696d617279205574696c69747920526f6f74204341301e170d3032303532343030303030305a170d3132303532333233353935395a305d31183016060355040a130f655369676e204175737472616c6961311f301d060355040b13165075626c6963205365637572652053657276696365733120301e060355040313175072696d617279205574696c69747920526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100a46daef21df44173ae6fc5c44466f3bcb1da860dc675444d467c17c467a707b47c55e30e50f6966741bf8d0603919e0fa7234da76e7de4f899489c7bb4e693a5ecf3ba9254d15aa58ba8698861bb6e60c531a63657ad8e678c0eba25818048d464a5baa046862a259de33ddc1b5a2c0c44352e56e36c7dcd87183b147d2b8f76425d99297d3d4ca5540bc20235854fcdc69e727071ca6b9278cbb87b8e9e3ec2e6a133c571df2d68f58f44f7fe0810d5a0387f914472406a0f049d0f262580390adf19e30b5c1270d5b96016b8945ade34f622ae3ba755a68ec0fbff7d39f7167d4a42f361c96089ee279703af350f602bf0e46e8fde45ecc7940f4e4d13165f0203010001a360305e300f0603551d13040830060101ff020108300b0603551d0f040403020106301d0603551d0e04160414cd1742be54a4b5fad1a8c0364af084016c2a552e301f0603551d23041830168014cd1742be54a4b5fad1a8c0364af084016c2a552e300d06092a864886f70d01010405000382010100070a3943ecce382c0af0a82d1256c3e5dfa0d79a24bff9a9f606b2eff4b786e01ba3705bba9204bd54f3e5d90c73b3112e7ba4c8d37495a04ce0f32d17dcef17ce37e78e9d92593c7f1231e2412d92f8228ffcd9cfe2939860b2c27dac5ea5abfefa05d1f11a1e484c70ffaaa7038d4f73d24b166ce1e3cefa594e3c1fd7acca91020a8df595efc1344929778bf77a53f70e64e4fd5f80b3e3dee89bbd91df5fb22254ae8ebdc28b9470a571b24d5f3bc628ef5c652a20429e5108fec509316a3942dce0166bc797cf9a5f3264e94aa120c449731747d883e64e34d859c262c720d76d11272e1e24ffb1186dcaf215c97f98cb6058758124a3c961ccbb508ba9 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D29F6C98BEFC6D986521543EE8BE56CEBC288CF3\Blob = 0f0000000100000010000000cc1b82c6b1de18aa04276ea2a4ed785f030000000100000014000000d29f6c98befc6d986521543ee8be56cebc288cf3090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000003400000054004300200054007200750073007400430065006e00740065007200200043006c006100730073002000340020004300410000002000000001000000600300003082035c308202c5a003020102020203ec300d06092a864886f70d01010405003081bc310b30090603550406130244453110300e0603550408130748616d627572673110300e0603550407130748616d62757267313a3038060355040a1331544320547275737443656e74657220666f7220536563757269747920696e2044617461204e6574776f726b7320476d624831223020060355040b1319544320547275737443656e74657220436c61737320342043413129302706092a864886f70d010901161a636572746966696361746540747275737463656e7465722e6465301e170d3938303330393131353935395a170d3131303130313131353935395a3081bc310b30090603550406130244453110300e0603550408130748616d627572673110300e0603550407130748616d62757267313a3038060355040a1331544320547275737443656e74657220666f7220536563757269747920696e2044617461204e6574776f726b7320476d624831223020060355040b1319544320547275737443656e74657220436c61737320342043413129302706092a864886f70d010901161a636572746966696361746540747275737463656e7465722e646530819f300d06092a864886f70d010101050003818d0030818902818100bf2f63d6367bb20dd355f5646ce6255dc6b4c814ba253883eb5662a555a965a3f42399c24bb9d0cd5467a6a3a0a3a9332b76e4bdad77b2ed5c1274c3c5b60f529a729343906266150f45a5dde0ddb86f406e57c17972a360aaba761d1289535afc02bee10913c54a2fdc3d8b19add78b2445fb4cf4cd5c351d294c51f3f26c550203010001a36b3069300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186303306096086480186f842010804261624687474703a2f2f7777772e747275737463656e7465722e64652f67756964656c696e6573301106096086480186f8420101040403020007300d06092a864886f70d0101040500038181007211e595414532ba1cf88014fb66b7ebae9ace758351c0ae8abb17d128e7761f13c62b4671a615770499e75eb291246f030c73e7239e76cabe0cc5cbc49018fc6d3a6ee056801bc3df8c361347f965c18352d55c5cbdd94266e13521681210a460903e3f81e8c38ca1b015045aceeb2c54564bf904792d9dea8c592fad79bd48 7acc85ad6eea22222b77c6b97e70d70163d665decfb01c7ac37a521cad221910.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B38FECEC0B148AA686C3D00F01ECC8848E8085EB 7acc85ad6eea22222b77c6b97e70d70163d665decfb01c7ac37a521cad221910.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3679CA35668772304D30A5FB873B0FA77BB70D54\Blob = 0f000000010000002000000017fe16f394ec70a5bb0c6784cab40b1e61025ae9d50ecaa0531d6b4d997bbc590b000000010000006000000056006500720069005300690067006e00200055006e006900760065007200730061006c00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079000000090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080300000001000000140000003679ca35668772304d30a5fb873b0fa77bb70d542000000001000000bd040000308204b9308203a1a0030201020210401ac46421b31321030ebbe4121ac51d300d06092a864886f70d01010b05003081bd310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303820566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79313830360603550403132f566572695369676e20556e6976657273616c20526f6f742043657274696669636174696f6e20417574686f72697479301e170d3038303430323030303030305a170d3337313230313233353935395a3081bd310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303820566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79313830360603550403132f566572695369676e20556e6976657273616c20526f6f742043657274696669636174696f6e20417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100c761375eb10134db62d7159bff585a8c2323d6608e91d79098837ae65819388cc5f6e56485b4a271fbedbdb9dacd4d00b4c82d73a5c76971951f393cb244079ce80efa4d4ac421df29618f32226182c5871f6e8c7c5f16205144d1704f57eae31ce3cc79ee58d80ec2b34593c02ce79a172b7b00377a413378e133e2f3101a7f872cbef6f5f742e2e5bf8762895f004bdfc5dde4754432413a1e716e69cb0b754608d1cad22b95d0cffbb9406b648c574dfc13117984ed5e54f6349f0801f3102506174adaf11d7a666b986066a4d9efd22e82f1f0ef09ea44c9156ae2036e33d3ac9f5500c7f6086a94b95fdce033f18460f95b2711b4fc16f2bb566a80258d0203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e04160414b677fa6948479f5312d5c2ea07327607d1970719300d06092a864886f70d01010b050003820101004af8f8b003e62c677be4947763cc6e4cf97d0e0ddcc8b935b9704f63fa24fa6c838c479d3b63f39af976329591b177bcac9abeb1e43121c68195565a0eb1c2d4b1a659acf163cbb84c1d59904aef9016281f5aae10fb8150380c6cccf13dc3f563e3b3e321c92439e9fd156646f41b11d04d73a37d46f93deda85f62d4f13ff8e074572b189d81b4c428da9497a570ebac1dbe0711f0d5dbdde58cf0d532b083e657e28fbfbea1aabf3d1db5d438ead7b05c3a4f6a3f8fc0666c63aae9d9a416f481d195140e7dcd9534d9d28f7073817b9c7ebd9861d845879890c5eb8630c635bff0ffc35588834bef05920671f2b89893b7eccd8261f138e64f97982a5a8d 7acc85ad6eea22222b77c6b97e70d70163d665decfb01c7ac37a521cad221910.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C18211328A92B3B23809B9B5E2740A07FB12EB5E\Blob = 0b000000010000001800000045002d0043006500720074006300680069006c0065000000090000000100000016000000301406082b0601050507030106082b06010505070302030000000100000014000000c18211328a92b3b23809b9b5e2740a07fb12eb5e20000000010000000d08000030820809308205f1a003020102021067d6b6ddd44b1eaa4bec947872359766300d06092a864886f70d01010505003081b1310b300906035504061302434c311d301b06035504081314526567696f6e204d6574726f706f6c6974616e613111300f0603550407130853616e746961676f31143012060355040a130b452d434552544348494c453120301e060355040b13174175746f726964616420436572746966696361646f7261311f301d06092a864886f70d010901161073636c69656e746573406363732e636c311730150603550403130e452d4345525420524f4f54204341301e170d3038303930353139333430385a170d3238303930353139333934315a3081b1310b300906035504061302434c311d301b06035504081314526567696f6e204d6574726f706f6c6974616e613111300f0603550407130853616e746961676f31143012060355040a130b452d434552544348494c453120301e060355040b13174175746f726964616420436572746966696361646f7261311f301d06092a864886f70d010901161073636c69656e746573406363732e636c311730150603550403130e452d4345525420524f4f5420434130820222300d06092a864886f70d01010105000382020f003082020a0282020100a4808725db9552ec183f3e212f94819da7231ac36a4e465e9ad8277ff4a4f118b0bd944cd48afb448845c45e27997e636a84125471d7593bb8a8124eb1a72de0e27c4714cdb570b46294c762a3fb6d953a665cea7eca8cfeea1f63f5c95beb409d84d833a8dd81ac7efbe8b899bb927964ff0a6f83378dde2bad0f0dbbe7c361fdb04ab31ae010e61d150c375d8bdfbc3d2bf2ed8a01a4404bfd426819146334355bc5446bcc50989c9eed6bddeb07433b1d6c0b047fcee2bc62bad33ecb4b14226c3bb456f4ba27db21450fbe16959254b5f1f917a7e7ed87c19dd692b7ac618d177650761e5133ce6f7e242b8e146fcd7cc4ad63709ed2ceee3c57c61a9440055d638e25d79163e2c6625a1fd0ecf7d4df0f4d56cd5ac58d27aa76838e661a1c95e3f982969ea213544dd6d6520eec438641ff54469e9435a46010b604cb98d9f67c7debb3a103e9d8b942df6f60266e47f08913e5812c07fbfd56d8fbd869ee3e87a9f98cf2f295d17cc88a9dc3c4c134d323e50b38ac7216dac3f4e6729b949b2d3f53b75db1dc6410238939c6c78e857b7f7c34988536f1bac7898722e2f23ea9e01de72b3063ac7455f7e032c9e32e6e8915be2c51d8100a78a9cf3a0d37e982920a9587e7033c4e7bdbe8e6720808d9ff9d3bd9a3f7f2f215109d394ef72e7325cbedbf5330d57fff19f7175d542a364856cf35eb74acd4a2c6ba38510203010001a382021930820215300e0603551d0f0101ff040403020106301306092b060104018237140204061e0400430041300f0603551d130101ff040530030101ff301d0603551d0e0416041450dd82d188922d8f3ce9ba5dc76266e26f7bab20308201130603551d1f0482010a3082010630820102a081ffa081fc8681ba6c6461703a2f2f2f434e3d452d43455254253230524f4f5425323043412c434e3d706b692d726f6f742c434e3d4344502c434e3d5075626c69632532304b657925323053657276696365732c434e3d53657276696365732c434e3d436f6e66696775726174696f6e2c44433d6563657274706b692c44433d636c3f63657274696669636174655265766f636174696f6e4c6973743f626173653f6f626a656374436c6173733d63524c446973747269627574696f6e506f696e74863d687474703a2f2f706b692d726f6f742e6563657274706b692e636c2f43657274456e726f6c6c2f452d43455254253230524f4f5425323043412e63726c301006092b0601040182371501040302010030620603551d20045b3059305706082b06010401c35205304b304906082b06010505070201163d687474703a2f2f7777772e652d636572746368696c652e636c2f68746d6c2f70726f647563746f732f646f776e6c6f61642f43505376312e372e70646630310603551d25042a302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070308300d06092a864886f70d010105050003820201007583953f21ed74792ededb1e76f221c2db9660be9bb0c54e0b572e4928a2b6c3a62e50048b004ca9b37285a4e6746f426fd29bd43ff8d4e8316b573e81cbb186ceb07ed9d8e3edeee004d77470ad551731b1bc1405579952a2e77bc3eedb4ab3b3faeca743b4c213565f0a32d10d5855e0303f640704aacf6f0b29afed891d1cc0e695031981b7b170ece17a7d383a53c5dcd2b9ea8229f14dae5dd9e8c59da84624690b6a29291aa9cd2fdce2e98319e27369ebeaf2d6d76816195eca62eb4a0b8f0456f5ee955d1211e30d50a0cdf4eb617ea820a2c4523731e7a6853063dfb64a298e5888cfb57558685c9bd23f1286aca6938d8793f73118a957d2ce37a517455f673e82dbe53a6f0a989206bf605d3a84a445124350401c569425fda7520a6c2dc4e8a0cd7142e4350ba85189a4f98708f81d08faae0e9d02bd2d7f596e1d0182a3897063b461ae63243574204dc0d71872e9ac2caf9951836ea37b17d8fc7215f3c711c44b41b472c470ff585121a1e12b6365e57490a26dc2ff917dad4f07372518aa9f9c2d1c28764edf82aece426e06923cbb877171a1ee341fec0d0e17f5a7f85afa66e47de7d1e882316547bb729f5495e4479a204cfaf81a45c968cb44986eec992d105dcbd8ecfb0a5449a58f30d3df8613d0543fee24b3a127fc20ef78e391b9d896f244ba6e5f8909ca7a274efbf98cacc117b75889ff763e updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\97226AAE4A7A64A59BD16787F27F841C0A001FD0 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\9C615C4D4D85103A5326C24DBAEAE4A2D2D5CC97\Blob = 0b00000001000000260000004b00450059004e00450043005400530049005300200052004f004f0054002000430041000000090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070308060a2b0601040182370a030406082b0601050507030606082b060105050703070300000001000000140000009c615c4d4d85103a5326c24dbaeae4a2d2d5cc972000000001000000e9030000308203e5308202cda00302010202121121bc276c5547af584eefd4ced629b2a285300d06092a864886f70d01010b0500304c310b300906035504061302465231123010060355040a13094b45594e4543544953310d300b060355040b1304524f4f54311a3018060355040313114b45594e454354495320524f4f54204341301e170d3039303532363030303030305a170d3230303532363030303030305a304c310b300906035504061302465231123010060355040a13094b45594e4543544953310d300b060355040b1304524f4f54311a3018060355040313114b45594e454354495320524f4f5420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6fdb31785a1ad261b956935213da488fadedb6036401769c21463fbb8d9c27415372e9cd020cd698d8432a2854c14b49bf225b3542a833f2dbe0ff33b64d1ffa050ef774f3b4ee13f0b64859aba587ed2c362d36425a2d4b2973c775d632a3392fccd820d9b549587f5b5eb8ccd5bd1ca302fc98846b5cd0d11b4188feed1a13e5d15e828cfdfc3909b6cccd10c4577b33aeb8a901de9af646a897ba93d4374fae46722a1fbdc4dc4f562c9ca25b4c9806033a9dd7ba002bf96250a5ec95f297bb417818b6d8119d0d9835c058f41691a6943809fa8afe0e98c918b272ba22660cd0ff2a4a302838e1881c2178a4315f96df31d10a45a9c446123217ad8fbd10203010001a381c03081bd30120603551d130101ff040830060101ff020104300e0603551d0f0101ff04040302010630570603551d1f0450304e304ca04aa0488646687474703a2f2f747275737463656e7465722d63726c2e63657274696669636174322e636f6d2f4b65796e65637469732f4b45594e45435449535f524f4f545f43412e63726c301d0603551d0e04160414efb72397d0a8917fa6cfa621c0349fcc7741e1d0301f0603551d23041830168014efb72397d0a8917fa6cfa621c0349fcc7741e1d0300d06092a864886f70d01010b050003820101001a31699942c2e54085a29f92c363d48f2139a81921fe7afcc34d40f32be84bac5b4c5993c6dc7e0baf7c5f95856bbdc76fbac1bef8c63a674b93c605693e242df01b91c63e3fec4218936c03248a6ef920672b7c6dab34c92a22330dd77d8feed2366442c8359a6e1961cb8d67f068a7d02405e6c317ba45ae7c43b58078034d207305fc43109d356942759425822ba63b9018dec1a9aff32d95bf95a7cf1897e159e2a2af1a16610df71371539337fd3caf001d6c8b14af46968cb6527ccc2d4ecde1e94b0aee9afe7a98e729ba1bda1cbadc6bcd040e2640a9eb733cfe50a8112755bddb8e4bef4f18ed15ffbd869866ee9a2571346c50f1b251cb669d4d29 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AFE5D244A8D1194230FF479FE2F897BBCD7A8CB4 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\FAB7EE36972662FB2DB02AF6BF03FDE87C4B2F9B\Blob = 0f0000000100000014000000fb3c6ab2de9a3f0b74e5c372ed86a52b25385a6c030000000100000014000000fab7ee36972662fb2db02af6bf03fde87c4b2f9b090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b060105050703070b000000010000002200000063006500720074005300490047004e00200052006f006f007400200043004100000020000000010000003c0300003082033830820220a0030201020206200605167002300d06092a864886f70d0101050500303b310b300906035504061302524f3111300f060355040a1308636572745349474e31193017060355040b1310636572745349474e20524f4f54204341301e170d3036303730343137323030345a170d3331303730343137323030345a303b310b300906035504061302524f3111300f060355040a1308636572745349474e31193017060355040b1310636572745349474e20524f4f5420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b733b97ec8254a8eb5dbb4281baa5790e8d122d364bad393e8d4ac8661406a60576854844dbc6a540205ffdf9b9a2aae5d078f4ac3287feffb2bfa79f1c7adf0105324908b66c9a888abaf5aa300e9beba46ee5b737b2c1782815e622ca10265b3bdc52b007ec4fc0333570dede2face5d45d638cd35b6b2c1d09c814aaae4b2015c1d8f5f99c4b1addb8821eb90088280f330a343e69082ae552849ed5bd7a910380efe8f4c5b9b46ea41f5b00874c3d08833b67cd774dfdc84d1430e7539a1254028ea78cb0e2c2e399d8c8b6e161c2f268210e2e365940a04c05ef75d5bf810e2d0ba7a4bfbde3700001a5b28e3d29c733e328798a1c9512fd7deac33b34f0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff0404030201c6301d0603551d0e04160414e08c9bdb2549b3f17c86d6b242870bd06ba0d9e4300d06092a864886f70d010105050003820101003ed21c892e35fcf875dde67f6588f4724cc92cd7324ef3dd197947bd8e3b5b930f504924136b140672ef09d3a1a1e34084c9e71832743c486e0f9f4bd4f71ed39386645497637250d555cffa209302a29bc323934e165576a070796dcd211fcf2f2dbc19e38831f8591a8109c897a674c760c45bcc578eb275fd1b0209db596f729369f73141d68838bf87b2bd1679f9aae4be8825dd6127231cb531070436b41a90bda0747150896dbc14e30f86aef1ab3ec7a009cca348d1e0db64e792b5cfaf7243708bf9c3843c13aa7e929b575393fa70c2910e31f99b675de996385e5fb3734e881567de9e76106220be5569954300394df6eeb05a4e494454585f4283 7acc85ad6eea22222b77c6b97e70d70163d665decfb01c7ac37a521cad221910.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b0b0000000100000012000000440069006700690043006500720074000000090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54362000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde 7acc85ad6eea22222b77c6b97e70d70163d665decfb01c7ac37a521cad221910.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\43D9BCB568E039D073A74A71D8511F7476089CC3 7acc85ad6eea22222b77c6b97e70d70163d665decfb01c7ac37a521cad221910.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\00EA522C8A9C06AA3ECCE0B4FA6CDC21D92E8099\Blob = 03000000010000001400000000ea522c8a9c06aa3ecce0b4fa6cdc21d92e8099090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000006c0000004a006100700061006e002000430065007200740069006600690063006100740069006f006e002000530065007200760069006300650073002c00200049006e0063002e0020005300650063007500720065005300690067006e00200052006f006f007400430041003200000020000000010000002d030000308203293082021102085f60585f00000000300d06092a864886f70d01010505003057310b3009060355040613024a50312b3029060355040a13224a6170616e2043657274696669636174696f6e2053657276696365732c20496e632e311b3019060355040313125365637572655369676e20526f6f74434132301e170d3939303931353135303030315a170d3230303931353134353935395a3057310b3009060355040613024a50312b3029060355040a13224a6170616e2043657274696669636174696f6e2053657276696365732c20496e632e311b3019060355040313125365637572655369676e20526f6f7443413230820122300d06092a864886f70d01010105000382010f003082010a0282010100967b92233f60df093c588008e3630997e8e40b7561d4cd0ea3f2e31e43ba83ffba815c2fc8de908b4c0e2f29f907d68eb3a628af822a7bc2b4664c71f40c741ab8db1ae86837a9f9a1a26e1c28cd6c263c8f2a339e9dcbb479c4d9643d95c633a847fbe50709dcf66db825424cc3fb4aed5b2ed407a8e593102493586e7dc1d01ecfe929d7d0bc5f4cf01516c3d8c2cee35b175b948b286b1467243bf452ec0d6e7c4eb49902dbc9f30f82ab01f48cde1670c6bc170761ff114084ea2c1b7a3ab0036107aa968dd0dab9838ee49d516975716481b48855dc1083ce2da5f53096612e3b0afc875f9c5c8275131ed398d1edc9ed72161c0c06dc59207ef05deff70203010001300d06092a864886f70d0101050500038201010069e05670ff335ac8e1c8d3ac302173484e22e23228cbbc173a8d7e38d1f9b73f3085328d57fc1f407f3f7a74ec120964c1fddcfc1c35bcf10bb4eaa15cde2b2990820316ca9ec4bbb0928d9556529932c0909b5543e4f34d7651ad6c3c5c9dc2417d8d4cf0a9ac3abe20270597704668b664f82599e995c38e3ae9c1e21ac022b16dadb0ee9f2cec74c3c1642c926f96680b0157e88699afe788c859606eb25604ab54b85d181676cdda1e74904b9b4611970981f3cef2619903f3e96e484c3fdbbc80db8120febd5c46ff4ee7af4dfebc4480e3096e677a25fb57e73ce655a5a20186283f7f5febf4eb1a8455319f24f0c9f6694c145213b3f9241a17d91870 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\06083F593F15A104A069A46BA903D006B7970991 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\9656CD7B57969895D0E141466806FBB8C6110687\Blob = 0300000001000000140000009656cd7b57969895d0e141466806fbb8c6110687090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b060105050703070b000000010000004000000054004300200054007200750073007400430065006e00740065007200200055006e006900760065007200730061006c00200043004100200049004900490000005300000001000000230000003021301f06092a8214002c0101010430123010060a2b0601040182373c0101030200c02000000001000000e5030000308203e1308202c9a003020102020e632500010002148d331502e46cf4300d06092a864886f70d0101050500307b310b3009060355040613024445311c301a060355040a1313544320547275737443656e74657220476d624831243022060355040b131b544320547275737443656e74657220556e6976657273616c204341312830260603550403131f544320547275737443656e74657220556e6976657273616c20434120494949301e170d3039303930393038313532375a170d3239313233313233353935395a307b310b3009060355040613024445311c301a060355040a1313544320547275737443656e74657220476d624831243022060355040b131b544320547275737443656e74657220556e6976657273616c204341312830260603550403131f544320547275737443656e74657220556e6976657273616c2043412049494930820122300d06092a864886f70d01010105000382010f003082010a0282010100c2da9c62b0b97112b00bc81a57b2ae831499b3344b9b90a2c5e7e72f02a04d2da4fa85da9b25852d4028206deae0bdb148832229449f4e83ee3551137374d5bcf230669453c040362f0c8465ce0f6ec25893e82c0b3ae9c18efbf26bca3ce29c4e8ee4f97dd3279f1bd56778872d7f0b47b3c7e8c9487caf2fcc0ad941ef9ffe9ae1b2aef953b5e5e9469f60e3df8dd37ffb967eb3b572f84bad0879cd69894027f52ac1ad43eca453c861b6f7d2792a671876486d5b2501d126c5b7576923155b618aadf01b2dd9af5cf1269069a9d50c40f53380438f9ca3762a45b4afbf7f3e873f76c5cd2ade20c51658cbf91bf50fcb0d115264b8d276627783f1589fff0203010001a3633061301f0603551d2304183016801456e7e15b254380e0f68ce171bc8ee5802fc448e2300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e0416041456e7e15b254380e0f68ce171bc8ee5802fc448e2300d06092a864886f70d0101050500038201010083c7afea7f4d0a3c39b168be7b6d892ee9b309e718578d859a17f3764250130fc7906f33adc549602b6c495819d4e2beb7bfab49bc94c8abbe286c1668e0c8974620a068676088392051d8680111cea7f61107f6ececac1a1fb2666e5667607a745ec06d9736aeb50d5d6673c0253245d84a06078fc4b707b14d060de1a5ebf475caba9cd0bdb3d332244cee7ee276044b4953d8f2e95433fce5711f3d145c964bf13af200bb6cb4fa9655088809c1cc911929b0202dffcb38a440e117be796180ff0703864c4e7b069f11868d89ee27c4dbe2bc198e0bc3c313c72d03633bd3e8e4a22ac28208941654f0ef1f279025b80d0e281b477747bd1ca825f194b466 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\FEB8C432DCF9769ACEAE3DD8908FFD288665647D\Blob = 0f0000000100000014000000cf5c65cd58ebb3d31a6618c3d42be79bb5de72e8030000000100000014000000feb8c432dcf9769aceae3dd8908ffd288665647d090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703080b00000001000000360000005300450043004f004d002000540072007500730074002000530079007300740065006d007300200043004f0020004c0054004400000053000000010000002400000030223020060a2a83088c9b1b6485510130123010060a2b0601040182373c0101030200c02000000001000000810300003082037d30820265a003020102020100300d06092a864886f70d01010505003060310b3009060355040613024a5031253023060355040a131c5345434f4d2054727573742053797374656d7320434f2e2c4c54442e312a3028060355040b1321536563757269747920436f6d6d756e69636174696f6e20455620526f6f74434131301e170d3037303630363032313233325a170d3337303630363032313233325a3060310b3009060355040613024a5031253023060355040a131c5345434f4d2054727573742053797374656d7320434f2e2c4c54442e312a3028060355040b1321536563757269747920436f6d6d756e69636174696f6e20455620526f6f7443413130820122300d06092a864886f70d01010105000382010f003082010a0282010100bc7fec579b24e0fe9cba4279a9888afa80e0f5072943ea8e0a34368d1cfaa7b53978ff9775f72fe4aa6b048444caa6e2688efd5550620fa4710ece07382d428550ad3c966f8bd5a20ecfde49893dd6642e38e51e6cb5578a9eef480ecd7a69168744b590e4069daea104975879ef204a826b8c22bfec1f0fe98471edf10ee4b81813cc56365dd19a1e516b396e607688340bf3b3d1b09dca61e2641dc14607b863dd1e3365b38e0955523db5bdff07ebad6155182ca969984aaa40c53314657400f991deaf0348c54054dc0f84906820c59296dc2ee50245aac05f54f86dea49cf5d6c4bafef9ac2565cc63556426a305fc2abf6e23d3fb3c9118f314cd79f490203010001a3423040301d0603551d0e04160414354af54daf3fd78238acab716517758c9d5593e6300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010505000382010100a887e9ecf840675dc3c166c7404b97fc8713905ac4efa0ca5f8bb7a7b7f1d6b564b78ab3b81bccdafbac668841cee8fce4db1e88a6ed27501b0230244679fe048770974073d1c0c157199a69a52799ab9d6284f651c12cc92315d828b7ab2513b546e18602ff268cc488921d56fe1967f255e480a36b9cab77e151710d20db109adbbd767907779928ad9a5edab14f442c358ea596c7fd83f058c679d6987ca88dfe863e071692e17be71dec33767e422e4a85f9918968840381a59b9abee337c554ab563b182d41a40cf842db99a0e0726fbb5de1164f530a64f94ef4bf4e54bd786c88eabf9c1324c27069a27f0fc83cad08c9b09840a32ae78883ed778f74 7acc85ad6eea22222b77c6b97e70d70163d665decfb01c7ac37a521cad221910.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CC7EA292AF8715D74CA4B415F320154B24F565FD 7acc85ad6eea22222b77c6b97e70d70163d665decfb01c7ac37a521cad221910.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AADBBC22238FC401A127BB38DDF41DDB089EF012 7acc85ad6eea22222b77c6b97e70d70163d665decfb01c7ac37a521cad221910.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\6B2F34AD8958BE62FDB06B5CCEBB9DD94F4E39F3 7acc85ad6eea22222b77c6b97e70d70163d665decfb01c7ac37a521cad221910.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DBAC3C7AA4254DA1AA5CAAD68468CB88EEDDEEA8\Blob = 0b000000010000002800000047005400450020004300790062006500720054007200750073007400200052006f006f0074000000090000000100000020000000301e06082b0601050507030406082b0601050507030206082b06010505070301030000000100000014000000dbac3c7aa4254da1aa5caad68468cb88eeddeea82000000001000000500200003082024c308201b5020200fd300d06092a864886f70d0101040500306e310b300906035504061302555331183016060355040a130f47544520436f72706f726174696f6e31273025060355040b131e475445204379626572547275737420536f6c7574696f6e732c20496e632e311c301a06035504031313475445204379626572547275737420526f6f74301e170d3938303430333134353230315a170d3034303430333233353930305a306e310b300906035504061302555331183016060355040a130f47544520436f72706f726174696f6e31273025060355040b131e475445204379626572547275737420536f6c7574696f6e732c20496e632e311c301a06035504031313475445204379626572547275737420526f6f7430819f300d06092a864886f70d010101050003818d0030818902818100ba8ebd759012fae57974b2d9f726d40e411de936075672d5b869da54d4b1d6786daae33b3da3843725c7afaf04dcb322b1e96dbe826deb8d2fbdb4ae701ea2d66e203151e6565c7352b223504ebcfb9a6740c4861146c74322baea004f6c72cd619cdecbfaee30d2e6fa5b9dc599dc20f839bf648c07563bbddc6c5ef6bfe1d90203010001300d06092a864886f70d010104050003818100965f1d3cc67595b66baf8700cda5412b8bbfd08d315b3965d3f1d18f581e5222c33d86f2c29af6dd485e71c3451c7c4ca259eea151963df7d534243aaafd822665c54c420f0c8f69607ce7d6d51a4b79faee5ab54ca6cca36b46d6d1c83254a03067d25d861191bcc3ba2a9cd578511ad45ddd769122456b31593ef985594ecb updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\912198EEF23DCAC40939312FEE97DD560BAE49B1\Blob = 0b000000010000002e00000056006500720069007a006f006e00200047006c006f00620061006c00200052006f006f0074002000430041000000090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308030000000100000014000000912198eef23dcac40939312fee97dd560bae49b1200000000100000079030000308203753082025da003020102020101300d06092a864886f70d01010b0500305c310b300906035504061302555331193017060355040a0c10566572697a6f6e20427573696e6573733111300f060355040b0c084f6d6e69526f6f74311f301d06035504030c16566572697a6f6e20476c6f62616c20526f6f74204341301e170d3039303733303134323730345a170d3334303733303134323730345a305c310b300906035504061302555331193017060355040a0c10566572697a6f6e20427573696e6573733111300f060355040b0c084f6d6e69526f6f74311f301d06035504030c16566572697a6f6e20476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a02820101008a000c701dbfeb3486c39945351e7f43f7ab6f242dcd19c210bbb0ca295ba920abab722cc4e202396d82b8c511eaf8fbb39e62f8331eb01fc9e3f637db04c83b634f36e285a4251dc7691f04bd68451396071f9450f53ec527549ec04957448e0763d4a6aeed2299cc4d966904136e76899f741694f91d54bda2b9d28301220c4d4480aafe35892725a78689c6d51a92e38fc595a014729ae856c502551c97f9202ed0f53c13195af6e1f90b038269a78cb7d66f9c563e9de82a09606d4be6fb8b9914f7344f6559808db957c8a23521d88871565dee82572d2690189f9a9c9c8fefd4c563a7547d4791877d1a12a81b186fa96fb127bae40474ce371e7f66c50203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604144c3811b898005b5a2b703eaa78e4d5676767a77e300d06092a864886f70d01010b05000382010100015fa0b10601f479d76518603ecf79a0bac2234f23df87965f810e38152e5cc802682920fc8beea58a1881645c98357e393082a4828a50b5bac3e85ad6a89ee2c317dbdbc4ebb00a200de99ee3ff605447f13b9dd4283ca2aea3fbaa8b82222a358790b81c594790d59d2efa49e365a836ebc7e41c68dcb3316cab4ece248015c810591011724d7a9c989cc4fc61e0b3b29d4ea0c6c259ab18d6a25545ec29aa2537d64e4a3d0b40c1e493e4fccd910bf8e6abccb376c462bf19ed86b679c3295454bc997d4657cfa6cff4542a9a03654701a1422acb25476e7c5e004b91d9f91b100670f94215a65faad7401efdc9489d9781ea5c68c2a0e789a1534dbfc7e3 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E0B4322EB2F6A568B654538448184A5036874384\Blob = 0f0000000100000014000000db7c911bf8fe225c8ab812cd16072d8eda9395bf0b000000010000000e00000045004400490043004f004d000000090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b06010505070307030000000100000014000000e0b4322eb2f6a568b654538448184a50368743842000000001000000b9050000308205b53082039da0030201020208618dc7863b018205300d06092a864886f70d010105050030443116301406035504030c0d4143454449434f4d20526f6f74310c300a060355040b0c03504b49310f300d060355040a0c06454449434f4d310b3009060355040613024553301e170d3038303431383136323432325a170d3238303431333136323432325a30443116301406035504030c0d4143454449434f4d20526f6f74310c300a060355040b0c03504b49310f300d060355040a0c06454449434f4d310b300906035504061302455330820222300d06092a864886f70d01010105000382020f003082020a0282020100ff9295e1680676b42cc85848cafd805429556324ff90659b10757bc36adb620201f21886b57c5a38b1e458b9fbd3d82d9fbd3237bf2c156dbeb5f421d21391d907ad0105d6f3bd77ce5f42810af96ae38300a82b2e55136381ca471c7b5c16577a1b8360043a3e65c3cd01dedea4d60cba8eded904ee1756229b8f63fd4d160bb77b778cf925b5d16d99122e4f1ab8e6ea0492ae3d11b951423d87b03185af795a9cfee74e5e924f43fcab3aada5122666b9e20cd798ced458a595400ab7449d13742bc2a5eb22159810d88bc5049f1d8f60e5061b9bcfb979a03da2233f423f6bfa1c037b308dce6cc0bfe61b5fbf67b88419d515ef7bcb90363162c9bc02ab465f9bfe1a6894343d908eadf6e41d097f4a88383fbe67fd3496f51dbc3074cb38eed56cabd4fcf400b7005b8532167633e9d8a3999d0500aa16e6f3817d6f7daa866dad1574d3c4a271aaf4147de732b81fbcd5f14ebd6f170239d70e95423ac7003ee9266311ea0bd14aff189db2d77b2f3ad996fbe81e92ae1355c8d927f6dc481bb024c185e3779d9aa4f30c111d0dc8b414eeb5825709bf20587f2f2223d870cb796cc94bf2a92ac8fc872bd71a50f827e82f43e33abdd85771fdcea6525bf9dd4dede5f66f89edbb939c762175f0924c29f72f9c012efe50469e640c14b3075bc5c2736cf1075c45241435ae83f16a4d897afab3d82d66f03687f52b530203010001a381aa3081a7300f0603551d130101ff040530030101ff301f0603551d23041830168014a6b3e12b2b49b6d773a1aa94f501e773654cac50300e0603551d0f0101ff040403020186301d0603551d0e04160414a6b3e12b2b49b6d773a1aa94f501e773654cac5030440603551d20043d303b30390604551d20003031302f06082b060105050702011623687474703a2f2f6163656469636f6d2e656469636f6d67726f75702e636f6d2f646f63300d06092a864886f70d01010505000382020100ce2c0b525162267d0c27838fc5f6daa0687b4f925eeaa47332115344b244cb9dec0f7942b310a6c70d9dcbb6fa3f3a7ceabf88531b3cf782fa053533e135a857c0e7fd8d4f3f93324f786603770758e995c87e3ed079008cf21b51339bbc94e93a7b6e522d329e23a445fbb62e13b08b18b1ddced51da7427f55befb5bbb47d4fc24cd04ae960515d6acce30f3ca0bc5bae222e0a6ad22e402ee74117f4cff781d35dae60234eb1812617706091663ea18ada2871ff2c7800909754e10a88f3d86b87511c024628a967b4a45e9ec59c5be6b83e6e1e8acb5301efe050780f9e1230d508f0598ff2c5fe83bb6adcf81b52187ca082a232730202bcfed945bacb27ad2c728a18a0b9b4d4a2c6d853f09723c67e2d9dc07baeb657b5a0163d6905b4f17663d7f0b19a3936310522a9f141658e2dca5f4a1168b0e918b81ca9b59fad86b910765555f521faf3afb90dd69a55b9c6d0e2cb6faceaca57c324a6740dc303423ddd7042366f0fc5580a7fb66198235676270395e6fc7ea904044081eb8b2d6dbee59a70d187934bc54185e53ca3451ed450ae68ec782363ea73863a9302c171060929f5587125910c20f676911cc4e1e7e4a9aadaf40a875ac569074b8a09ca5796fdce91ac86905e9bafa03b37ce4e04ec2ce9de8b6460d6e7e573a6794c2cb1f9c774a674e6986439338fbb6db4f8391d4607e4b3e2b380755985ea4 7acc85ad6eea22222b77c6b97e70d70163d665decfb01c7ac37a521cad221910.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B80186D1EB9C86A54104CF3054F34C52B7E558C6 7acc85ad6eea22222b77c6b97e70d70163d665decfb01c7ac37a521cad221910.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\43F9B110D5BAFD48225231B0D0082B372FEF9A54\Blob = 03000000010000001400000043f9b110d5bafd48225231b0d0082b372fef9a54090000000100000016000000301406082b0601050507030406082b060105050703010b0000000100000048000000460061006200720069006300610020004e006100630069006f006e0061006c0020006400650020004d006f006e00650064006100200079002000540069006d0062007200650000002000000001000000fd020000308202f930820262a003020102020436f11b19300d06092a864886f70d01010505003036310b3009060355040613024553310d300b060355040a1304464e4d5431183016060355040b130f464e4d5420436c6173652032204341301e170d3939303331383134353631395a170d3139303331383135323631395a3036310b3009060355040613024553310d300b060355040a1304464e4d5431183016060355040b130f464e4d5420436c617365203220434130819d300d06092a864886f70d010101050003818b0030818702818100983fad1936933d3efe764214fd356ff1faad227a58e346d05dc65af9622d8f315efeb430fe5074acd69d1de062c649dd14127d710bac06c13fd70687e09089d6e5e303b2f227b19f33c8aa6b364aa3c43f79419d89462f2b3e63d4385691aa1db10d42754df3874ee30f4dccb46cbf621387ead09b8eb6e2ff19f49409d59661020103a382011430820110301106096086480186f842010104040302000730580603551d1f0451304f304da04ba049a4473045310b3009060355040613024553310d300b060355040a1304464e4d5431183016060355040b130f464e4d5420436c6173652032204341310d300b0603550403130443524c31302b0603551d1004243022800f31393939303331383134353631395a810f32303139303331383134353631395a300b0603551d0f040403020106301f0603551d23041830168014409a7644977407c4ac14cb1e8d4f3a457c30d761301d0603551d0e04160414409a7644977407c4ac14cb1e8d4f3a457c30d761300c0603551d13040530030101ff301906092a864886f67d074100040c300a1b0456342e3003020490300d06092a864886f70d010105050003818100614ca07c59635b66f8ee6513ce438047b9b235c9c884c76b736045e49d379df58e25b9f9aaaacae3f8439c2fa08905b14532942a1e038d5da6decf5795dadf26605fcbdf951eb8ce08d8f88ac94fa9687593e32f054c646002a2421e6f866865550ed8436ff291313ea3473c2805af45b69d224c267b4b7d5b15f91946df085d updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\11C5B5F75552B011669C2E9717DE6D9BFF5FA810\Blob = 03000000010000001400000011c5b5f75552b011669c2e9717de6d9bff5fa810090000000100000048000000304606082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030706082b0601050507030806082b060105050703090b000000010000003000000041004e004300450052005400200043006500720074006900660069006300610064006f0073002000430047004e00000020000000010000002e0500003082052a30820412a003020102020f4474ecc86c721e58ddb82c7ef4fc95300d06092a864886f70d0101050500307c310b3009060355040613024553314b3049060355040a13424167656e636961204e6f74617269616c2064652043657274696669636163696f6e20532e4c2e20556e69706572736f6e616c202d20434946204238333339353938383120301e06035504031317414e4345525420436572746966696361646f732043474e301e170d3034303231313137323731325a170d3234303231313137323731325a307c310b3009060355040613024553314b3049060355040a13424167656e636961204e6f74617269616c2064652043657274696669636163696f6e20532e4c2e20556e69706572736f6e616c202d20434946204238333339353938383120301e06035504031317414e4345525420436572746966696361646f732043474e30820122300d06092a864886f70d01010105000382010f003082010a028201010090753f3f0caccad47cc448a718bb3abba1bbd57bdf8b19e48244fb65ecb612613e692219623524b6d51006a9456a242af5278c783cc8b9f3056cc50203d24e8064ec86ab7894220200b5689bd4e5555fe0c88030e70bbf6bd7048e4e7998704c1c26b9b3a8eaf011a2b98a530226751289e1fb884e597a00d182d816aee5b6bc9525604077251b9eef8de4fdf04f333125bfee7a0a54f0903867127ba560da0c01899a76872ef51b437be5e7264afb1562ab451b7bd50aa54d6c4dab9f284884e18375b818705553dbd0df2990af39c61795c194c55ed9655f5dff6e169598219f5e4df0cd31392103170d911fa1559941ec55c9bb3d995c9bc57fd11c5eea530203010001a38201a7308201a3300f0603551d130101ff040530030101ff308201200603551d2004820117308201133082010f06092b060104018193680430820100302506082b060105050702011619687474703a2f2f7777772e616e636572742e636f6d2f6370733081d606082b060105050702023081c9300d1606414e4345525430030201011a81b74167656e636961204e6f74617269616c2064652043657274696669636163696f6e2e204c61206465636c61726163696f6e2064652070726163746963617320646520636572746966696163696f6e20717565207269676520656c2066756e63696f6e616d69656e746f206465206c612070726573656e7465206175746f726964616420736520656e6375656e74726120646973706f6e69626c6520656e20687474703a2f2f7777772e616e636572742e636f6d2f637073300e0603551d0f0101ff040403020186301c0603551d11041530138111616e6365727440616e636572742e636f6d301f0603551d23041830168014ec579fc876226fcc3aae5bf02da16258d18d02cc301d0603551d0e04160414ec579fc876226fcc3aae5bf02da16258d18d02cc300d06092a864886f70d010105050003820101008b3ddfdc362c7f279cfcb55853710a125d10645171b54a56f45e44671eef1db2f1a4513c676c2c65967aa112a3af0b08370e99d66e28870b62ab4e784e72819bdf114f8960c851a61b060971737c37b71c38379af987e1efa1ee7fd7c0ea3914fa7c6f0bf986cae6c57769a09f8d29a3776ec5ccdaf6dd067ad369663e603be332dfaef01b9e2a9dcc84df1a1047eda556964237b52d720d411293ba328844c8ae09c4bd80edfd600f72b2b664f66320327077872e332e9f35c85fa89256b7ff243a2c5df226056819f25167cfdf5209e982047a6b82a77fe5d2a9746b1826c8bad4d51ea54b3b26c19d22e1fb12bdd56246d5d75dd2ddc3fc610d30054f058b updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\720FC15DDC27D456D098FABF3CDD78D31EF5A8DA\Blob = 0f0000000100000010000000f2c7a7e41c698a8ef5be4f3aa68908de0b000000010000003400000054004300200054007200750073007400430065006e00740065007200200043006c00610073007300200031002000430041000000090000000100000016000000301406082b0601050507030406082b06010505070301030000000100000014000000720fc15ddc27d456d098fabf3cdd78d31ef5a8da2000000001000000600300003082035c308202c5a003020102020203e9300d06092a864886f70d01010405003081bc310b30090603550406130244453110300e0603550408130748616d627572673110300e0603550407130748616d62757267313a3038060355040a1331544320547275737443656e74657220666f7220536563757269747920696e2044617461204e6574776f726b7320476d624831223020060355040b1319544320547275737443656e74657220436c61737320312043413129302706092a864886f70d010901161a636572746966696361746540747275737463656e7465722e6465301e170d3938303330393131353935395a170d3131303130313131353935395a3081bc310b30090603550406130244453110300e0603550408130748616d627572673110300e0603550407130748616d62757267313a3038060355040a1331544320547275737443656e74657220666f7220536563757269747920696e2044617461204e6574776f726b7320476d624831223020060355040b1319544320547275737443656e74657220436c61737320312043413129302706092a864886f70d010901161a636572746966696361746540747275737463656e7465722e646530819f300d06092a864886f70d010101050003818d0030818902818100b029ebb476b3aed7b65bb45ee7bde3b19c4904575ba1abd97f131bfdba61abd8e771df2d00945d51487d23ef756284903c0a1f5911742f8e80a5fd30023d2952cd721a49219cbccb528e48a16396c810853069577445c05a86c6d53de068577d316a248d45973e317e6866326e246dec3236c941caf03144c8a361ca1ba0361f0203010001a36b3069300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186303306096086480186f842010804261624687474703a2f2f7777772e747275737463656e7465722e64652f67756964656c696e6573301106096086480186f8420101040403020007300d06092a864886f70d0101040500038181004f995985c8645682c56f3dd846092f3c51c1a77058819212eaf4d41600965e7228e7d6365f1a9caf1fc2831ab4055599a6585c3728f2571eeb5dbfb1d3450f721c03d200c72c55dafe5f89768be2d477f54d0917afc4baab302b4fb81dead9ff59f0507446ba5eea36b0eb927b0f58da32e152bd23370ff5f3004aaeb05ede6e 7acc85ad6eea22222b77c6b97e70d70163d665decfb01c7ac37a521cad221910.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5A5A4DAF7861267C4B1F1E67586BAE6ED4FEB93F 7acc85ad6eea22222b77c6b97e70d70163d665decfb01c7ac37a521cad221910.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8D1784D537F3037DEC70FE578B519A99E610D7B0 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\211165CA379FBB5ED801E31C430A62AAC109BCB4\Blob = 0b000000010000004a00000043006f006c006500670069006f0020006400650020005200650067006900730074007200610064006f0072006500730020004d0065007200630061006e00740069006c00650073000000090000000100000020000000301e06082b0601050507030106082b0601050507030206082b06010505070304030000000100000014000000211165ca379fbb5ed801e31c430a62aac109bcb420000000010000001707000030820713308204fba003020102020f2de40ae19bd1c2aa4cf400ac8135f9300d06092a864886f70d01010505003081a4310b3009060355040613024553314a3048060355040a0c41436f6c6567696f206465205265676973747261646f726573206465206c612050726f7069656461642079204d657263616e74696c65732064652045737061c3b161311b3019060355040b0c12436572746966696361646f2050726f70696f312c302a06035504030c235265676973747261646f7265732064652045737061c3b161202d204341205261c3ad7a301e170d3037303130393137303033395a170d3331303130393137303033395a3081a4310b3009060355040613024553314a3048060355040a0c41436f6c6567696f206465205265676973747261646f726573206465206c612050726f7069656461642079204d657263616e74696c65732064652045737061c3b161311b3019060355040b0c12436572746966696361646f2050726f70696f312c302a06035504030c235265676973747261646f7265732064652045737061c3b161202d204341205261c3ad7a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ac501b0e92ceb87c156af8e40f9d7c7c7c76e40b263a5106cd28b3ed0f3ed9917bccfc878342f77bb05db87a67fe342162bfb929c3de5af103f2ebf2e212c2656476a7f5e6cb31a368f279eb9d54c552ff9f3d83630ee6bf1d28027dfc23f44493a3a9439cd8e8251a2035f5b5b0ceeb552bfad95eb0a1442be5002c240f377f323484b2c8156f8af5f2e82ef7438e02b8329b801a531d0199486b74f35a704aa4e8f702d1ba91a36b87be105e7e54b958b20af63b0ae30e38f3805df7418ef88f36b9839b114ce10bb1c5938a33b2bf9bb69e44b71ffe2a8128397ccfd4af3565ae675e8d21df0060112bd43ce427509f93b705f1d20e14dc298296f12aa21b430570b3d05c1e034155fe1638c5524d93b5b43c76224da92bac15c4a94b74b9a523d8cd2b48c1e2efcddef84ab0dfa0e3ee8635bf5b72946fb2464aea4a53ae31e691b57498459aa47dec712ae590513643f949d4d7280603b1fd7987d606f8aca1f9bf14780dcb234bcdbb2e32f47dbc69bbb6357e79cfbd4b727e61ab2a7e40c70ce5b290b54c0cd657077c97ccf9d977db7be78c137ecc7e184f4c4b238eae1ac7ea5f1fa617dd38b64fde0a6e525059ac6dcdd63119bd24e9a058cfd9d4b243793f5fd66faa65c846f2d2d57ef92e4318c298e468dfc1d35f452f69d11dee912448d2eb000ec2104bd29dbda34d17a3379aafef973181da89b1617a63a70203010001a382013e3082013a300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604141b8d591cb3b758626466ace2e4a4f6a21912f6e53081f70603551d200481ef3081ec3081e90604551d20003081e0303c06082b060105050702011630687474703a2f2f706b692e7265676973747261646f7265732e6f72672f6e6f726d61746976612f696e6465782e68746d30819f06082b060105050702023081921a818f436572746966696361646f2073756a65746f2061206c61204465636c6172616369f36e206465205072e1637469636173206465204365727469666963616369f36e2064656c20436f6c6567696f206465205265676973747261646f726573206465206c612050726f7069656461642079204d657263616e74696c65732064652045737061f1612028a9203230303629300d06092a864886f70d010105050003820201003f1fd62c197640929c26e69e5806123d12c22b3adee5d88977401fc651aa748996c5c6c39df1fabc6913a00675172689fc65398d7379ebcf77a7bbd5482679319130279841a517e05f5c1b5a2a7cbaad166500517d87debaba63d663b435e0d74e19457ebf5169486f3e886e525583f08bc44cf40ad41121ae2960e85b8b9ff8c2ecb7763f80c2742e477862519edb8cf5ad5f8505e8fd9a7bbd70680b93c2307e12f44b4f74e2898fb943740fd6845e7ade7054a413365f647ed3040efedd196f245395ede9c90ed4a6f193a15b09e3a2d2574e3e1ace7dacc4f753d0cda892eda4c9972266f8c6a2f275e5117e2f751296f78f6fcf07e5cacc073ef53c8bedbc7c32603ee30fd41183340d768664bd33974e70edf620385f9a69c7c04f16ca85828f01b6ba135ed0f1ede928dd2abd258ed0fa130c160f779f762934706ceb794b9def4e34f045bb252c7592445fa79bc4aad2b36f2ebc61eb86014cd97ab975678b034bc73352789e05c0ed8f74781d1223b632fc51505e2dde50be103c8eef0885f53afaf2dee7d84c3ae512ebf43674985a528a941a66a96e453e142b8d3408aaef051361129084680d115a2caf799e70949fc564cbcc78f6535ce0d70db13ee3160bf3a6ec34423e751084a5d8bdb1e3ea61e6249cc281da1ed86ffc782d16e3442dc0d23d5e7da0d256d4603771fe4c8e659cd63bda36dcd83367d001 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A1DB6393916F17E4185509400415C70240B0AE6B updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F4914F7D874951DDDAE02C0BEFD3A2D82755185\Blob = 0300000001000000140000001f4914f7d874951dddae02c0befd3a2d8275518509000000010000003e000000303c06082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030806082b060105050703090b0000000100000026000000510075006f0056006100640069007300200052006f006f00740020004300410020003300000053000000010000002600000030243022060c2b06010401be58000264010230123010060a2b0601040182373c0101030200c02000000001000000a10600003082069d30820485a003020102020205c6300d06092a864886f70d01010505003045310b300906035504061302424d31193017060355040a131051756f5661646973204c696d69746564311b30190603550403131251756f566164697320526f6f742043412033301e170d3036313132343139313132335a170d3331313132343139303634345a3045310b300906035504061302424d31193017060355040a131051756f5661646973204c696d69746564311b30190603550403131251756f566164697320526f6f74204341203330820222300d06092a864886f70d01010105000382020f003082020a0282020100cc574216549ce698d3d34deefeedc79f43394a65b3e8168834db0d599174cf92b80440ad024b31abbc8d9168d8200e1a01e21a7b4e175de28ab73f991acdeb61abc265a61fb7b7bdb78ffcfd708f0ba067be01a259cf71e60f2976ffb15679452b1f9e7a54e8a3293568a4014f0fa42e37ef1bbfe38f10a872ab5857e75486c8c9f35bda2cda5d8e6e3ca33edafb82e5ddf25cb205336f8a36ced0134effbf4a0c344ca6c321bd500455ebb1bb9dfb451e6415de55018c0276b5cba13f4269bc2fbd68431656892a376191fda6ae4ec0cb146594374b9206ef04d0c89c88db0b7b81afb13d2ac4653a78b6eedc80b1d2d3999c3aee6b5a6bb38db7d5ce9cc2bea54b2f16b19e683b066fae7d9ff8deeccc29a798a325432feff15f26e1884df85e6ed7d9146e193369a73b848993c4535513a1517840f8b8c9a2ee7bba5242839e14ed05525a5956a797fc9d3f0a29d8dc4f910e13bcde95a4df8b99beac9b3388efb581af1bc62253c8f6c7ee9714b0c57c7852c8f0ce6e776084a6e92a7620ed5801173093e91a8be07363d96a9294494eb4ad4a85c4a32230fc09ed682273a6880c552158c5e13a9f2addcae190e0d973ab6c80b8e80b6493a09c8c19ffb3d20cec9126878ab3a2e1708f2c0ae5cd6d6851ebda3f057f8b32e6135c6bfe5f40e222c8b4b4644fd6ba7d483ea8690cd7bb8671c973b83f3b9d254bdaff40eb0203010001a382019530820191300f0603551d130101ff040530030101ff3081e10603551d200481d93081d63081d306092b06010401be5800033081c530819306082b060105050702023081861a8183416e7920757365206f66207468697320436572746966696361746520636f6e737469747574657320616363657074616e6365206f66207468652051756f566164697320526f6f74204341203320436572746966696361746520506f6c696379202f2043657274696669636174696f6e2050726163746963652053746174656d656e742e302d06082b060105050702011621687474703a2f2f7777772e71756f7661646973676c6f62616c2e636f6d2f637073300b0603551d0f040403020106301d0603551d0e04160414f2c013e082433efbee2f673296355cdbb8cb02d0306e0603551d23046730658014f2c013e082433efbee2f673296355cdbb8cb02d0a149a4473045310b300906035504061302424d31193017060355040a131051756f5661646973204c696d69746564311b30190603550403131251756f566164697320526f6f742043412033820205c6300d06092a864886f70d010105050003820201004fada02c4cfac0f26ff76655ab2334eee729dac35bb6b083d9d0d0e221fbf360a73b5d605327a29bf608222ae7bfa072e59c246a31b1907a27db84118927a6775a38d7bfac86fcee5d83bc06c6d1776b0f6d242f4b7a6ca70796cae3849fad888b1dab168d5b6617d916f48b80d2ddf8b276c3fc3813aa0cde42692b6ef33ceb8027dbf5a6440d9f5a55590bd50d5248c5ae9ff22f80c5ea32503512972ec1e1fff1238851389ff2665676e70f5197a5520c4d495195363dbfa24b0c101d86994caaf3721193e4eaf69bdaa85da74db79e02ae7300c8da2303e8f9ea1974620094cb2220be94a759b5826abe99797aa9f24a2452f774fdba4ee6a81d026eb10d8044c1aed323375fbb857c2b922ee87ea58bdd99e1bf276f2d5daa7b87fe0add4bfc8ef526e46e70426e33ec319e7b93c1e4c9691a3dc06b4e226deeab584dc6d041c12bea4f12875eeb45d86cf59802d3a0d8558a069919a2a077d1309eaccc75ee83f5b06239cf6c57e24cd2910b0e75281b9abffd1a43f1ca77fb3b8f61b869281642045e702a1c21d88fe1bd235b2d744092d963190d73dd69bc6247bce0742bb2eb7dbe411bb5c046c5a122cb5f4ec12892de18bad52a28bb118b1793989960945c23cf5a27975e0b050693371e3b6936eba99e611d8f32da8e0cd6743e7b0924da017747c43bcd348c99f5cae1256133b2591be26ed73757b60da912da updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F 7acc85ad6eea22222b77c6b97e70d70163d665decfb01c7ac37a521cad221910.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8C96BAEBDD2B070748EE303266A0F3986E7CAE58 7acc85ad6eea22222b77c6b97e70d70163d665decfb01c7ac37a521cad221910.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8B1A1106B8E26B232980FD652E6181376441FD11 7acc85ad6eea22222b77c6b97e70d70163d665decfb01c7ac37a521cad221910.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7F8AB0CFD051876A66F3360F47C88D8CD335FC74 7acc85ad6eea22222b77c6b97e70d70163d665decfb01c7ac37a521cad221910.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\273EE12457FDC4F90C55E82B56167F62F532E547 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E0AB059420725493056062023670F7CD2EFC6666\Blob = 030000000100000014000000e0ab059420725493056062023670f7cd2efc6666090000000100000020000000301e06082b0601050507030106082b0601050507030306082b060105050703080b000000010000004000000054006800610077007400650020005000720065006d00690075006d0020005300650072007600650072002000430041002000280053004800410031002900000020000000010000003a030000308203363082029fa003020102021036122296c5e338a520a1d25f4cd70954300d06092a864886f70d01010505003081ce310b3009060355040613025a41311530130603550408130c5765737465726e204361706531123010060355040713094361706520546f776e311d301b060355040a131454686177746520436f6e73756c74696e6720636331283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e3121301f06035504031318546861777465205072656d69756d205365727665722043413128302606092a864886f70d01090116197072656d69756d2d736572766572407468617774652e636f6d301e170d3936303830313030303030305a170d3231303130313233353935395a3081ce310b3009060355040613025a41311530130603550408130c5765737465726e204361706531123010060355040713094361706520546f776e311d301b060355040a131454686177746520436f6e73756c74696e6720636331283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e3121301f06035504031318546861777465205072656d69756d205365727665722043413128302606092a864886f70d01090116197072656d69756d2d736572766572407468617774652e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100d236366a8bd7c25b9eda8141628f38ee490455d6d0ef1c1b951647ef1848353a52f42b6a068f3b2fea56e3af868d9e17f79eb46575024defcb09a22151d89bd067d0ba0d92061473d493cb972a009c5c4e0cbcfa1552fcf2446eda114a6e089f2f2de3f9aa3a8673b6465358c88905bd8311b8733faa078df4424de7409d1c370203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d0101050500038181006590ac880f56d9e63034d426c7d050f192de6bd439880922c6a6638303f79977d8b2e518b85d63f3d473fb6c9c9978f14b787d1924c32b0284f8bc22d98a22d7a0fc71ec918720f1b8ecb1e55580ac3d52c8390ec2f0c0054fd682758cbd5fd2dc769a0512c9af72c3dc257ea44d8e17a5e0877fe19a5ae160dc64233c422e4d updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7030AABF8432A800666CCCC42A887E42B7553E2B 7acc85ad6eea22222b77c6b97e70d70163d665decfb01c7ac37a521cad221910.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3921C115C15D0ECA5CCB5BC4F07D21D8050B566A\Blob = 0f0000000100000014000000b31da18fba765c5ed3df3080593871db9e0dcc290300000001000000140000003921c115c15d0eca5ccb5bc4f07d21d8050b566a09000000010000005e000000305c06082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020b000000010000005c00000041006d006500720069006300610020004f006e006c0069006e006500200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079002000310000002000000001000000a8030000308203a43082028ca003020102020101300d06092a864886f70d01010505003063310b3009060355040613025553311c301a060355040a1313416d6572696361204f6e6c696e6520496e632e313630340603550403132d416d6572696361204f6e6c696e6520526f6f742043657274696669636174696f6e20417574686f726974792031301e170d3032303532383036303030305a170d3337313131393230343330305a3063310b3009060355040613025553311c301a060355040a1313416d6572696361204f6e6c696e6520496e632e313630340603550403132d416d6572696361204f6e6c696e6520526f6f742043657274696669636174696f6e20417574686f72697479203130820122300d06092a864886f70d01010105000382010f003082010a0282010100a82fe8a469060347c3e92a98ff19a2709ac650b27ea5df684d1b7c0fb697687d2da68b97e96486c9a3efa086bf60659c4b5488c248c54a39bf14e35955e519b474c8b405395c16a5e29505e012ae598ba23368581ca6d415b7d89fd7dc71ab7e9abf9b8e330f22fd1f2ee70736ef6239c5ddcbba251423de0cc63d3cce8208e6663eda513b163aa3057fa0dc87d59cfc72a9a07d78e4b731551e65bbd461b02160ed103272c592251ef8904a187847df7e30373e501bdb1cd36b9a865307b0efac0678f88499fe218d4c80b60c82f66670791ad34fa3cff1cf46b04b0f3edd8862b88ca909283b7ac797e11ee5f49fc0c0ae24a0c8a1d90fd67b268269323da70203010001a3633061300f0603551d130101ff040530030101ff301d0603551d0e0416041400add9a3f679f66e74a97f333d8117d74ccf33de301f0603551d2304183016801400add9a3f679f66e74a97f333d8117d74ccf33de300e0603551d0f0101ff040403020186300d06092a864886f70d010105050003820101007c8ad11f183782e0b8b0a3ed5695c862619c05a2cdc2622661cd1016d7ccb46534d0118aada8a90566ef74f36d5f9d99aff68bfbeb52b20598a26f2ac554bd25bd5faec886ea462cc1b3bdc1e9497018169708138c20e01b2e3a47cb1ee40030955bf445a3c01ab0014eabbdc0236e633f804ac507eddce26fc7c162f1e372d604c874670bfa88aba101c86ff014afd299cd51937eed2e38c7bdce46503d72e379259d9b882b1020dda5b8329f8de029df21748682db2f8230c6c73586b3f9965f46db0c45fdf350c36fc6c348ad46a6e127470a1d0e9bb6c2777f63f2e07d1abefce0dfd7c7a76cb0f9aeba3cfd74b411e8580d80bcd3a8803a99ed75cc467b 7acc85ad6eea22222b77c6b97e70d70163d665decfb01c7ac37a521cad221910.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0747220199CE74B97CB03D79B264A2C855E933FF\Blob = 0300000001000000140000000747220199ce74b97cb03d79b264a2c855e933ff090000000100000016000000301406082b0601050507030206082b060105050703040b000000010000002200000053006f006e00650072006100200043006c00610073007300310020004300410000002000000001000000240300003082032030820208a003020102020124300d06092a864886f70d01010505003039310b3009060355040613024649310f300d060355040a1306536f6e6572613119301706035504031310536f6e65726120436c61737331204341301e170d3031303430363130343931335a170d3231303430363130343931335a3039310b3009060355040613024649310f300d060355040a1306536f6e6572613119301706035504031310536f6e65726120436c6173733120434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b5891f2b4f670a79ffc51ef87f3cedd17edab0cd6d2f36ac34c6dbd9641708633033228a4cee8ebb0f0d4255c99d2ea5eff7a78cc3abb997cb8eef3f1567a8827263530f418c7d109524a15aa506fa92579dfaa501f275e91fbc5626524e78196558550358c014ae8c7c555f705b7723063697f324b59a4695e4df0d0b0545e5d1f21d82bbc613e0feaa7afd693094f3d24585fcf2325b32dee86c5d1fcba42274b0808e5d94f706004ba9d45e2e355009f38097f40c17ae39d85fcd33c11cca89c222f74512ed5e12939d63ab822eb9eb424144cb4a1a00820d9ef98b573e4cc717ed2c8b72335f727a3856d5e6d9ae051a1d7545b1cba5251c125736fd22370203010001a3333031300f0603551d130101ff040530030101ff30110603551d0e040a040847e20c8bf6538852300b0603551d0f040403020106300d06092a864886f70d010105050003820101008b1ab2c95d61b4e1b92bb953d1b2859d778e16ee113ddbc263d95b9765fb1267d82a5cb6abe55ec3b7162fc8e8ab1d8afdab1a7cd55f63cfdcb0dd77b9a8e6d22238870714d9ffbe56b5fd070e3c55ca16cca7a67737fbdb5c1f4e590687a30343f516abb784bd4eef9f3137f046f140b6d10ca564f8635e21db554e4f31769c10618eb6533aa311beaf6d7c1ebdae2de20c69c7855368a261bac53eb47954789e0ac702be62d111824b652f915ac2a887b156689479f925f7c1d5ae1ab8bb3d8fa98a3815f773d05a60d180b0f0dcd550cd4eee924869edb2231e30ccc894c8b6f53b867f3fa62e9ff63e2cb592963edf2c938aff818c0f0f59211957bd559a updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A0A1AB90C9FC847B3B1261E8977D5FD32261D3CC 7acc85ad6eea22222b77c6b97e70d70163d665decfb01c7ac37a521cad221910.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\9078C5A28F9A4325C2A7C73813CDFE13C20F934E\Blob = 0f00000001000000140000007a840eb8584382d10e44a8f27502c09bd638f0380b000000010000004800000053004500520056004900430049004f0053002000440045002000430045005200540049004600490043004100430049004f004e0020002d00200041002e004e002e0043002e000000090000000100000016000000301406082b0601050507030406082b060105050703010300000001000000140000009078c5a28f9a4325c2a7c73813cdfe13c20f934e2000000001000000ff030000308203fb308202e3a003020102020436e58d9e300d06092a864886f70d01010505003081b4310b3009060355040613025559312b3029060355040a132241444d494e495354524143494f4e204e4143494f4e414c20444520434f5252454f53311f301d060355040b1316534552564943494f5320454c454354524f4e49434f53312c302a06035504031323534552564943494f532044452043455254494649434143494f4e202d20412e4e2e432e31293027060a0992268993f22c6401031419636f7272656f5f6365727440636f7272656f2e636f6d2e7579301e170d3939303330393231303830375a170d3039303330393231303830375a3081b4310b3009060355040613025559312b3029060355040a132241444d494e495354524143494f4e204e4143494f4e414c20444520434f5252454f53311f301d060355040b1316534552564943494f5320454c454354524f4e49434f53312c302a06035504031323534552564943494f532044452043455254494649434143494f4e202d20412e4e2e432e31293027060a0992268993f22c6401031419636f7272656f5f6365727440636f7272656f2e636f6d2e757930820122300d06092a864886f70d01010105000382010f003082010a0282010100b22a2fec2b596a439389462a8ae5ecfa05fae2c8de416baf03db005aef4837cf5789fbddc99210de7703951c903ec7b667253b5598efd93cfe26e48a3b44a97437830a772774b8a971addd9713d2caa22eb8ba9dc9be59e8d972f28a85661c475eb48782d60fdf6726a6bd36b1f35d90505176322c3b2faa5f615ee354d5125dff0d8d11c7827a36dfe14c16c474dd2d6aefd0b1f033a7febf376743122e794a94af84fb0711084e309375e90154cec5de1486f0aeae9b72250f4477e2f36caf799c2e49c79e987632169abc00dee0b420059117dd801514ee3641c4218feed9004a19c67161a5115d003be4a7746c3a4a6e83e07a315c2165f80887428767e50203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d01010505000382010100991f49225cf8657f836e90662f02cfb4f6563a6636a1b7920d36c34558364be6ccf15acc73329e9aa8aed376ebeffe802ce31034b2479f1c256ae844b58f4cbe81f3d0c0c10bcd0316a04255564ec1e3b420ad5f9bb6555f481012ef24b3567ccc051bb2c92aa96811927e2fe93f44f1d0c6901b4bddf76122ec69861540b3e2a56a77f3b3f25427da492a6419f439de7c7686d99c72570a34f5f52fd039681bdb45a518e380543b93109014c21401aaa5762d7d0fe456f3ff732a6f8ec1d880fbbb901d1b1a499c0463c4421df36fbbb3494add47ed49ba022d2a8cc70356b9e268d0c1b086b58c4b3aae8d1c88844cfd50af99267608c280ad287955d32de6 7acc85ad6eea22222b77c6b97e70d70163d665decfb01c7ac37a521cad221910.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\688B6EB807E8EDA5C7B17C4393D0795F0FAE155F\Blob = 0f00000001000000100000004ab5c2a797d83568f7a7ecf9c8b0bf95030000000100000014000000688b6eb807e8eda5c7b17c4393d0795f0fae155f090000000100000016000000301406082b0601050507030406082b060105050703030b000000010000001200000056006500720069005300690067006e000000200000000100000039020000308202353082019e020502b4000001300d06092a864886f70d010102050030613111300f06035504071308496e7465726e657431173015060355040a130e566572695369676e2c20496e632e31333031060355040b132a566572695369676e20436f6d6d65726369616c20536f667477617265205075626c697368657273204341301e170d3936303430393039333535395a170d3939313233313039333535385a30613111300f06035504071308496e7465726e657431173015060355040a130e566572695369676e2c20496e632e31333031060355040b132a566572695369676e20436f6d6d65726369616c20536f667477617265205075626c69736865727320434130819f300d06092a864886f70d010101050003818d0030818902818100c3d3696552019454ab28c66218b35455c54487454a3bc27ed8d3d7c880868dd80cf1169ccc6ba929b28f767392c8c562a63ced1e0575f013006c144dd4989007be697381b8624e311ed1fcc90ceb7d90bfaeb44751ec6fce643502d67d670577e28fd951d7fb9719bc3ed77781c643ddf2dddfcaa3838bcb41c13d224848a6190203010001300d06092a864886f70d01010205000381810031bb30c56fa7be23266da5997668c52a03284bf389b09903325b94a17bc1c819d7f4956cac73240acb44057d78eefaf6a79f87a47fe8f34b4f32303015081701b280fca1d92487a5005fcddd29c8a1a5ca58753960451fde8dd65708d3c01b81c2d9e2008cec0a9102c69d36749a836bef7c8cd2a52a6ac97edba9bd2b22ff1c 7acc85ad6eea22222b77c6b97e70d70163d665decfb01c7ac37a521cad221910.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5F3AFC0A8B64F686673474DF7EA9A2FEF9FA7A51\Blob = 0f0000000100000014000000a80fb311312188fd9deedf37fb087479bd6b47c80b00000001000000260000005300770069007300730063006f006d00200052006f006f00740020004300410020003100000009000000010000003e000000303c06082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030806082b060105050703090300000001000000140000005f3afc0a8b64f686673474df7ea9a2fef9fa7a512000000001000000dd050000308205d9308203c1a00302010202105c0b855c0be75941df57cc3f7f9da836300d06092a864886f70d01010505003064310b30090603550406130263683111300f060355040a13085377697373636f6d31253023060355040b131c4469676974616c204365727469666963617465205365727669636573311b3019060355040313125377697373636f6d20526f6f742043412031301e170d3035303831383132303632305a170d3235303831383232303632305a3064310b30090603550406130263683111300f060355040a13085377697373636f6d31253023060355040b131c4469676974616c204365727469666963617465205365727669636573311b3019060355040313125377697373636f6d20526f6f74204341203130820222300d06092a864886f70d01010105000382020f003082020a0282020100d0b9b0a80cd9bb3f21f81bd533938016652075b23d9b606d46c88c316f17c3fa9a6c56ed3cc59157c3cdab9649902a194b1ea36d57ddf12b622875455eaad65bfa0b25d8a116f91cc42ee6952a67ccd0296e3c8534386149b1009fd63a715f4d6dce5fb9a9e4897f6a52faca9bf2dca9f99d99473f4e295fb4a68d5d7b0b99110303fee7dbdba3ff1da5cd901e011f35b07f00db906fc67e7bd1ee7a7aa7aa0c576fa46dc5133bb0a5d9ed321cb45e678b54dc7387e5d3177c6650725dd41a58c1d9cfd889026fa749b4365dd0a4de072cb675b72891d697be28f5981eea5b26c9bdb09773daae9126eb68c1f93915d6674b0a6d4fcbcfb0e442718c5379e7eee1db1da06e1d8c1a77355c161e2b531f348bd16cfcf267077af5adedd69aaba1b14be1cc375ffd7fcd4daeb81f9c43f92a58554345bc96cd700efcc9e366ba4e8d3b81cb15647bb994e85d335285712e4f8ea2061151c9e3cba16e3108640cc2d23cf536e8d7d00e78232091c9242a65295b22f721ce835ea4f3de4bd3688f46755c83096e296bc4708cf59dd7202fff46d22b38c22f751c3d7edaa5ef1e60856942d3ccf863fe1e433985a6b6634110b3731ebcd3faca7d1647e2a7d5d0a38a0a089662566e34dbd902b93075e304d2e78fc2b011400aacd57102628b31beddc623583142432d74f9c69ea68a0fe9febf83e6435724baef4634aad7120138ed0203010001a38186308183300e0603551d0f0101ff040403020186301d0603551d2104163014301206076085740153000106076085740153000130120603551d130101ff040830060101ff020107301f0603551d2304183016801403252fde6f82013a5c2cdc2ba169b567d48cd3fd301d0603551d0e0416041403252fde6f82013a5c2cdc2ba169b567d48cd3fd300d06092a864886f70d010105050003820201003510cbeca6040d0d0fcdc0dbaba8f288970cdf932f4d7c4056317aeba40f60cd7af3bec3278e033ea4dd12ef7e1e74063c3f31f21c7b913121b4f0d06c97d4e997b224561e56c335bd88050f5b101a64e1c78230f932ad9e502ce77805d031b15a988a754e905c6a142ae052478260e61eda81b1fb140b5af19fd295ba3ed01bd6151da3be86d5db0fc04964bb2e50194bd224f8dd1e0756d038a0957020768cd7dd1ede9f71c423ef83135ca324154d29403c6ac4a9d8b7a644a50df4e09d771e407026fcdad936e479e4b53fbc9b65bebb1196cfdbc628393a08ce475b535ac599fe5da9ddef4cd4c6a5ad02e68c07121e6f03d16fa0a3f329bd12c750a2b07f88a999779ab1c0a5392e5c7c69e22cb0ea376aa4e15ae1f550e583efa5bb2a88e78cdbfd6d5e9719a87e66756b71eabfb1c76fa0f48ea4ec34515b8c260370a177d50112570035db23de0e8a2899fdb1106f4bff382d604e2c9ceb67b5ad49ee4b1facaffb0d905a6660705daacd78d424eec841a09301929c6a9efcb924c5b315827ebeae952bebb1c0dae301600b5e69ac845661be7117fe1d130ffec68745e9fe32a01a0d13a4945571a5168bbaca89b0b2c7fc8fd854b593629dcecf59fb3d18ce2acb3515825dff54225b7152fbb7c9fe609b004164f0aa2aecb64243ce896681c88b9f39540325d316358e84d05ffa301af59a6cf40e53f93a5bd11c 7acc85ad6eea22222b77c6b97e70d70163d665decfb01c7ac37a521cad221910.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\FAB7EE36972662FB2DB02AF6BF03FDE87C4B2F9B\Blob = 0b000000010000002200000063006500720074005300490047004e00200052006f006f0074002000430041000000090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b06010505070307030000000100000014000000fab7ee36972662fb2db02af6bf03fde87c4b2f9b20000000010000003c0300003082033830820220a0030201020206200605167002300d06092a864886f70d0101050500303b310b300906035504061302524f3111300f060355040a1308636572745349474e31193017060355040b1310636572745349474e20524f4f54204341301e170d3036303730343137323030345a170d3331303730343137323030345a303b310b300906035504061302524f3111300f060355040a1308636572745349474e31193017060355040b1310636572745349474e20524f4f5420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b733b97ec8254a8eb5dbb4281baa5790e8d122d364bad393e8d4ac8661406a60576854844dbc6a540205ffdf9b9a2aae5d078f4ac3287feffb2bfa79f1c7adf0105324908b66c9a888abaf5aa300e9beba46ee5b737b2c1782815e622ca10265b3bdc52b007ec4fc0333570dede2face5d45d638cd35b6b2c1d09c814aaae4b2015c1d8f5f99c4b1addb8821eb90088280f330a343e69082ae552849ed5bd7a910380efe8f4c5b9b46ea41f5b00874c3d08833b67cd774dfdc84d1430e7539a1254028ea78cb0e2c2e399d8c8b6e161c2f268210e2e365940a04c05ef75d5bf810e2d0ba7a4bfbde3700001a5b28e3d29c733e328798a1c9512fd7deac33b34f0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff0404030201c6301d0603551d0e04160414e08c9bdb2549b3f17c86d6b242870bd06ba0d9e4300d06092a864886f70d010105050003820101003ed21c892e35fcf875dde67f6588f4724cc92cd7324ef3dd197947bd8e3b5b930f504924136b140672ef09d3a1a1e34084c9e71832743c486e0f9f4bd4f71ed39386645497637250d555cffa209302a29bc323934e165576a070796dcd211fcf2f2dbc19e38831f8591a8109c897a674c760c45bcc578eb275fd1b0209db596f729369f73141d68838bf87b2bd1679f9aae4be8825dd6127231cb531070436b41a90bda0747150896dbc14e30f86aef1ab3ec7a009cca348d1e0db64e792b5cfaf7243708bf9c3843c13aa7e929b575393fa70c2910e31f99b675de996385e5fb3734e881567de9e76106220be5569954300394df6eeb05a4e494454585f4283 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\85B5FF679B0C79961FC86E4422004613DB179284\Blob = 03000000010000001400000085b5ff679b0c79961fc86e4422004613db17928409000000010000005e000000305c06082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020b000000010000005c00000041006d006500720069006300610020004f006e006c0069006e006500200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079002000320000002000000001000000a8050000308205a43082038ca003020102020101300d06092a864886f70d01010505003063310b3009060355040613025553311c301a060355040a1313416d6572696361204f6e6c696e6520496e632e313630340603550403132d416d6572696361204f6e6c696e6520526f6f742043657274696669636174696f6e20417574686f726974792032301e170d3032303532383036303030305a170d3337303932393134303830305a3063310b3009060355040613025553311c301a060355040a1313416d6572696361204f6e6c696e6520496e632e313630340603550403132d416d6572696361204f6e6c696e6520526f6f742043657274696669636174696f6e20417574686f72697479203230820222300d06092a864886f70d01010105000382020f003082020a0282020100cc41451de93d4d10f68cb141c9e05ecb0db7bf4773d3f0554dddc60cfab166056acd78b4dc02db4e81f3d7a77c71bc7563a05de3070c48ec25c40320f4ff0e3b12ff9b8de1c6d51bb46d22e3b1db7f2164af86bc57222ad647815744825653bd8614010bfc7f74a45aaef1ba11b59b585a80b4377809337c3247035cc4a58348f457566e813627184fec9b28c2d4b4d77c0c3e0c2bdfca04d7c68eea584ea8a4a5181c6c4598a341d12dd2c76d8d19f1ad79b7813fbd0682272d105805b57805b92fdb0c6b90907e145938bb942413e5d19d14dfd3824d46f0803952320fe384b27a43f25ede5f3f1ddde3b21ba0a12a23036e2e0115875ca67575c79761bede86dcd448dbbd2abf4a55dae87d50fbb48017b894bf013deadaba7ce0586717b958e0888646676c9d10475832d0357c792a90a25a10112335ad2fcce44a5ba7c827f283de5ebb5e77e7e8a56e63c20d5d61d08cd26c5a210eca28a3ce2ae995c748cf966f1d9225c8c6c6c1c10c05ac26c4d275d2e12a67c03d5ba59aebcf7b1aa89d1445e50fa09a65de2f28bdce6f9466834829d8ea658caf93d9649f555726bf6fcb373199a360bb1cad89343262b8432106720ca15c6d46c5fa29cf30de89dc715bddb6373edf50f5b8072526e5bcb5fe3c02b3b7f8be43c18711949e236c178ab88a270c5447f0a9b3c0808ca027eb1d19e3078e7770ca2bf47d76e078670203010001a3633061300f0603551d130101ff040530030101ff301d0603551d0e041604144d45c16838bb73a969a120e7edf522a12314d79e301f0603551d230418301680144d45c16838bb73a969a120e7edf522a12314d79e300e0603551d0f0101ff040403020186300d06092a864886f70d01010505000382020100676b06b95f453b2a4b33b3e61b6b594e22ccb9b7a425c9a7c4f054960b64f3b1584f5e51fcb2977b2765c2e5cae70d0c257b62e3fa9fb487b74546af83a597488ca5bdf1162b9b762c7a35606c118097cca99252e62be669eda9f8362d2c77bf6148d1630bb95b52ed18b0434222a6b177aede69c5cdc71ca1b1a51c10fb18be1a70ddc1924bbe295a9d3f35bee57d51f855e0257523871e5cdcba9db0acb369db1783c9f7de0cbc08dc919ea8d0d7153773a535b8fc7ec5444006c3ebf822805c47ce02e3119f44fffd9a32cc7d64510eeb5726763ae31e223cc2a636dd19efa7fc12f326c05931854c9cd8cfdfa4cccc2993ff946d765c130897f2eda50b4ddde8c9680e66d3000e33125bbc95e53290a8b3c66c83ad77ee8b7e7eb1a9abd3e1f1b6c0b1ea88c0e7d390e92892947b687b972a0a672d85023810e40361d4da2536c708582da1a751af300a49f5a66987072d4446768e2ae59a3bd718a2fc9c3810ccc63bd2b5173a6ffdae25bdf5725964b1742a385f184cdfcf71045a36d4bf2f999ce8d9bab195e6024b21a15bd5c14f8fae696d53db0193b55c1e18dd645aca18283e630411fd1c8d000fb837df678a9d66a9026a91ff13ca2f5d83bc87936cdc245116042566fab3d9c2ba29be9a48388299f4bf3b4a3119f9bf8e213314ca4f545ffbcefb8f717ffd5e19a00f4b91b8c454bc06b0458f2691a28efea9 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D2EDF88B41B6FE01461D6E2834EC7C8F6C77721E 7acc85ad6eea22222b77c6b97e70d70163d665decfb01c7ac37a521cad221910.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2AC8D58B57CEBF2F49AFF2FC768F511462907A41 7acc85ad6eea22222b77c6b97e70d70163d665decfb01c7ac37a521cad221910.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 190000000100000010000000d8b5fb368468620275d142ffd2aade370f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c90300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e509000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b060105050703030b000000010000001200000056006500720069005300690067006e00000053000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c01400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331332000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a 7acc85ad6eea22222b77c6b97e70d70163d665decfb01c7ac37a521cad221910.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\97E2E99636A547554F838FBA38B82E74F89A830A\Blob = 03000000010000001400000097e2e99636a547554f838fba38b82e74f89a830a09000000010000002a000000302806082b0601050507030406082b0601050507030206082b0601050507030306082b060105050703010b000000010000001200000056006500720069005300690067006e000000200000000100000006030000308203023082026b021046a433bd761f6a49e6a8c3a7f58540f5300d06092a864886f70d01010505003081c1310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e313c303a060355040b1333436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204732313a3038060355040b1331286329203139393820566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d060355040b1316566572695369676e205472757374204e6574776f726b301e170d3938303531383030303030305a170d3138303531383233353935395a3081c1310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e313c303a060355040b1333436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204732313a3038060355040b1331286329203139393820566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d060355040b1316566572695369676e205472757374204e6574776f726b30819f300d06092a864886f70d010101050003818d0030818902818100cc5ed1115d5c69d0abd3b96a4c991f5998308e168520466d473fd4852084e16db3f8a4ed0cf1170f3bf9a7f925d7c1cf8463f27c63cfa247f2c65b338e64400468c180b9641c4577c7d86ef595293c50e834d7781fa8ba6d4391958f45575e7ec5fbcaa404ebea973754306fbb01473233cddc579b646961f89b1d1c894f5c670203010001300d06092a864886f70d010105050003818100107bf4893fdc3d0bbb004ceb3428cbfd07a9436986f24b00a4c7d5d8b082780eed963c667b0707e13e73f67e72c8c541dd29485c63eb36f4752ec5048daabbb6b714a58066463d010cd2c000b5481b4b1df42947a83c4217582d787b205002274b9b270bedf32f54267348f025a989f79fc9aa8a61b7ca0c3dd684770614e815 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\30779E9315022E94856A3FF8BCF815B082F9AEFD updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AE5083ED7CF45CBC8F61C621FE685D794221156E\Blob = 030000000100000014000000ae5083ed7cf45cbc8f61c621fe685d794221156e090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080b000000010000003a00000054004300200054007200750073007400430065006e00740065007200200043006c006100730073002000320020004300410020004900490000002000000001000000ae040000308204aa30820392a003020102020e2e6a000100021fd752212c115c3b300d06092a864886f70d01010505003076310b3009060355040613024445311c301a060355040a1313544320547275737443656e74657220476d624831223020060355040b1319544320547275737443656e74657220436c6173732032204341312530230603550403131c544320547275737443656e74657220436c6173732032204341204949301e170d3036303131323134333834335a170d3235313233313232353935395a3076310b3009060355040613024445311c301a060355040a1313544320547275737443656e74657220476d624831223020060355040b1319544320547275737443656e74657220436c6173732032204341312530230603550403131c544320547275737443656e74657220436c617373203220434120494930820122300d06092a864886f70d01010105000382010f003082010a0282010100ab80879b8ef0c37c87d7e8248211b33cdd4362eef8c345dae8e1a05fd12ab2ea9368dfb4c8d643e9c475597ffce11df83170231b889e27b97bfd3ad2c9a9e9142f90be0352c149cdf6fde408660b578aa242a0b8d57f695c9032b2970dca4adc463e02558953e31a5acb36c60756f78ccf11f44cbb30700495a5f6398cfd7381087d895e321e22a922454bb0662e30cc9f65fdfccb81a9f1e03bafa386d189eac44579505daee92174924d8b59828f94e3e94af1e749b014e3f562cbd572bd1fb9d29fa0cda8fa01c8d90ddfdafc479db3c854df494af121a9fe184eee48d419bbef7de4e29dcb5bb66effe3cd5ae7748205ba802538cbe4699eaf41aa1a84f50203010001a382013430820130300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414e3ab544c80a1db5643b7914acbf3827a135c08ab3081ed0603551d1f0481e53081e23081dfa081dca081d98635687474703a2f2f7777772e747275737463656e7465722e64652f63726c2f76322f74635f636c6173735f325f63615f49492e63726c86819f6c6461703a2f2f7777772e747275737463656e7465722e64652f434e3d5443253230547275737443656e746572253230436c61737325323032253230434125323049492c4f3d5443253230547275737443656e746572253230476d62482c4f553d726f6f7463657274732c44433d747275737463656e7465722c44433d64653f63657274696669636174655265766f636174696f6e4c6973743f626173653f300d06092a864886f70d010105050003820101008cd7df7eee1b8010b383f5db11ea6b4ba89218d9f70739f52cbe06757a6853151cea4aed5efc23b213a0d309fff6f62e6b417179cde26dfdae596b851db84e229aed66396e4b94e655fc0b1b8b77c153136689d928d68bf3454a63b7fd7b0b615db86dbec3dc5b79d2ed86e5a24dbe5e747c6aed16381f7f58815a1aeb32882db2f3397780af5eb6617529db234d88ca5028cb85d2d310a2596ed39354007aa2469586059ca91998e531720c00e267d940e024337b6f2cb95cab659d2cac76ea3599f597b90f24ecc776212865ae57e80788754a56a0d2053aa4e68d92882cf3f2e1c1c661db41c5c79bf70e1a5145c2616bdc6427178c5ab7da7428cd97e4bd updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\23E833233E7D0CC92B7C4279AC19C2F474D604CA updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8C96BAEBDD2B070748EE303266A0F3986E7CAE58\Blob = 0300000001000000140000008c96baebdd2b070748ee303266a0f3986e7cae5809000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030306082b060105050703040b0000000100000058000000450042004700200045006c0065006b00740072006f006e0069006b00200053006500720074006900660069006b0061002000480069007a006d006500740020005300610067006c00610079006900630069007300690000002000000001000000eb050000308205e7308203cfa00302010202084caf73421c8e7402300d06092a864886f70d01010505003081803138303606035504030c2f45424720456c656b74726f6e696b20536572746966696b612048697a6d6574205361c49f6c6179c4b163c4b173c4b131373035060355040a0c2e4542472042696c69c59f696d2054656b6e6f6c6f6a696c6572692076652048697a6d65746c65726920412ec59e2e310b3009060355040613025452301e170d3036303831373030323130395a170d3136303831343030333130395a3081803138303606035504030c2f45424720456c656b74726f6e696b20536572746966696b612048697a6d6574205361c49f6c6179c4b163c4b173c4b131373035060355040a0c2e4542472042696c69c59f696d2054656b6e6f6c6f6a696c6572692076652048697a6d65746c65726920412ec59e2e310b300906035504061302545230820222300d06092a864886f70d01010105000382020f003082020a0282020100eea08461d03a6a661032d831387fa7a7e5fda1e1fb9777b87196e8139646834fb6f25f72566e1360a50191e25bc5cd571f776351ff2f3ddbb93faaa935e779d0f5d024b621eaeb2394fe29bffb89910c649a054a2bcc0ceef13d9b8269a44cf89a6fe722da10ba5f92fc18270aa8aa44fa2e2cb4fb469a08038372ab88e46a72c9e5651f6e2a0f9db3e83be40c6e7ada57fdd7eb798b5e2006d3760b6c0295a396e4cb7651d1289da11afc44a24dcc7a76a80d3dbf174f228850fdaeb6ec90504a5b9f9541aaca0fb24afe80994ea34615abf873426ac26676b10a2615dd9392ecdba95f54225291705d13ea48ec6e036cd9dd6cfceb0d03ffa683129bf1a9930fc5264c31b263996172e72a6499d2b8e975e27ca9a99a1aaac356db109a3c8352b67b96b7ac8777a8b9f2670b9443b3af3e73fa4236b125c50a3126375667baa30b7dd6f789cd67a1b73a1e664ff6a05514254c2c330da6418cbd04316a10720a9d0e2e76bd5ef351898ba83f5573bfdb3ac62405969248aa4b8d2a03e5579110f46a28156e4777845c51749f19e9e61e631639e31115e3581a44bdcbc46c66d78406df30f437a2432279d2106cdfbbe61311fc9d840a137bf03bd0fca30ad789ea967e8d48851e645fdb54a2acd57a02796bd28af067da65720d1470e4e98e788f32747c57f2d6d6f436891bf8296c8bb9f697d1a42eaabe0b19c245e9705d0203009dd9a3633061300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414e7cec64ffc166796fa4aa307c104a7cb6adeda47301f0603551d23041830168014e7cec64ffc166796fa4aa307c104a7cb6adeda47300d06092a864886f70d010105050003820201009b989a5dbef3282376c66cf77fe6409ec036dc950d1dad15c536d8d539eff21e225eb382b45dbb4c1aca920ddf47241eb324da9188e98370dd93d7e9bab3df165a3edee0c8fbd3fd6c29f81546a06826cc9352ae82019390ca77ca4d49efe25ad92abd30ce4cb281b630ce594fda591d6a7aa445b08226818676f5f51000b8eeb309e84f870207ae245cf05fac0a30cc8a40a07304c1fb8924f69a1c5cb73c0a6736050831b3afd801682ae0788f74deb851a48c6c203da2fbb3d409fd7bc280aa936c299821a8bb16f3a9125f74b58798f29526df34ef8a5391885d1a94a33f7c22f8d788baa68c96a83d5234629f001e54554267c64d468fbb14453d0a96168e10a19799d5d33085ccdeb472b7bc8a3c182968fddc7107ee24396afaeda5ac382ff91e100e06711a104cfe757eff1e573942cad7e115a15655591bd1a3af11d84ec3a52bef90bfc0ec82135b8dd6722c934e8f6a29df853cd30de0a21812cc552f47b7a79b02fe41f6884c6ddaa90147836427621082d6127b5e031f34a9c991feaf5d6d8627b723aa7518ca20e7b00fd7890ea6672263f483412b064bbb58d5d1d7b7b91063d8894ab4aadd1663f56ebe60a1f8ede8d6904f1ac6c5a029d3a721a8f55a3cf7c749a2219a4a95522096729a66cbf7d286437c22be96f9bd01a847dde53b40f9752b9b2b4664868d1ef48ffb0777d0ea49a21c8d5214a60a93 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\9158C5EF987301A8903CFDAB03D72DA1D88909C9\Blob = 0f00000001000000140000009ab638b1a08f6ee35c35b8695ae46789f70e91410b000000010000003a00000041006300740061006c00690073002000410075007400680065006e007400690063006100740069006f006e002000430041002000470031000000090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b060105050703070300000001000000140000009158c5ef987301a8903cfdab03d72da1d88909c9200000000100000098030000308203943082027ca003020102020101300d06092a864886f70d0101050500306a310b3009060355040613024954310f300d06035504070c064d696c616e6f31233021060355040a0c1a416374616c697320532e702e412e2f30333335383532303936373125302306035504030c1c416374616c69732041757468656e7469636174696f6e204341204731301e170d3039303632333134303630305a170d3232303632353134303630305a306a310b3009060355040613024954310f300d06035504070c064d696c616e6f31233021060355040a0c1a416374616c697320532e702e412e2f30333335383532303936373125302306035504030c1c416374616c69732041757468656e7469636174696f6e20434120473130820122300d06092a864886f70d01010105000382010f003082010a0282010100c31c86343f27524260ba2b60d0212bc9d7e940753a6c580f233bcf863ed464ab6edaeac82ad89545dfc91cd225929e10985a8b7169c095e9f66b68dcf7b6c40dfe6ef5703bc1a4a84f20a2270b9ff112757ccfae7f5ecb78025828d72faadba0ae743d7eabf6e972a12acfd69060dfe0a035cac0db04c40756fc66758c8e7a13a13c066b1ae67f399c88e4846fa2e27f6b9fec01aad2c4cbb2ec9a3db81718ac1f609933e6eb05ddccf26967b00ebe282443cb2db9478419f9eae4f1f568f49fc77b5051afa2fc6f778831bf92db7f9cc5b5aca10898e76a33fed1bb00e1b70508aff3a65688363de38a4ae20d9d8086669fd4c2a350ba1c12d7878a314ab8150203010001a3453043300e0603551d0f0101ff04040302010630120603551d130101ff040830060101ff020100301d0603551d0e0416041401bbd69b56b47ee6c558dd2c98f4ca72f65f3386300d06092a864886f70d01010505000382010100a120d6cba2346d3c6ee155d24ad0d9bab23751887727ee0248934541e27551f2199409a0f3b87dba038023a025ef0119b5d91a7a2de3428ab186310f96ec6684f2ce231246966b315e06baafa352aa4220a8d1aeaa9bdfc4179e537001b4a91ada68c8630fb65a7353d16911061352e76ba80531b7b0fc8746c5758881f15f7802e79fad9cbb54ed5f996a37d5eb55b32ac0436051dcb4719226a30fcc7a3ddcc04289172908675464c5f9a844bc847158963d67577fbbac90b37122bf3ebaac66264510b3f01f3a3a68a55035cab4179106012cf70db070b25b5675b97799c0d99585022d736607c94f9911ee5b2ba8e3682305a8f3040f06bb1f098ec65b1d 7acc85ad6eea22222b77c6b97e70d70163d665decfb01c7ac37a521cad221910.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7F8A77836BDC6D068F8B0737FCC5725413068CA4 7acc85ad6eea22222b77c6b97e70d70163d665decfb01c7ac37a521cad221910.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0048F8D37B153F6EA2798C323EF4F318A5624A9E\Blob = 0f0000000100000010000000ec5862b54910cbfe122e8bb75f40f0ea0300000001000000140000000048f8d37b153f6ea2798c323ef4f318a5624a9e090000000100000016000000301406082b0601050507030406082b060105050703010b0000000100000050000000430065007200740069007300690067006e0020004100750074006f00720069006400610064006500200043006500720074006900660069006300610064006f007200610020004100430031005300000020000000010000006802000030820264308201cda003020102020105300d06092a864886f70d0101040500306f310b3009060355040613024252312e302c060355040a132543657274697369676e20436572746966696361646f7261204469676974616c204c7464612e3130302e060355040b132743657274697369676e204175746f72696461646520436572746966696361646f72612041433153301e170d3939303632373030303030305a170d3138303632373030303030305a306f310b3009060355040613024252312e302c060355040a132543657274697369676e20436572746966696361646f7261204469676974616c204c7464612e3130302e060355040b132743657274697369676e204175746f72696461646520436572746966696361646f7261204143315330819f300d06092a864886f70d010101050003818d0030818902818100b0c095eba3c541f89b6f71638e911157f903c7689a1a9c61f0c30f0c9762887e2601357dfdf16f4f1795aa7ef2bbbcefe2767361953651833e84e83fba57363794136c92641f940deb542f515ae5285ef09286e7e46d217a5f370be75bbd2d02a881f93fcb14c8bca4c5e3d1cb37dcabe587aaf20b982e7acfcc1ec27fe8fd010203010001a310300e300c0603551d13040530030101ff300d06092a864886f70d0101040500038181001baea9d876bc7a9ef88b1ae7fb45d35e300e93bdf8a95d03429bf064c6793d43693c40a13646488256e888f03a95e6bee8a1b640bdffd62cada1330673780265e9ed7b7b49846d64d3f39d9b6c9fe143039860c0b5d3e5eb48a94962e2b9cecc240ad822c13d3730049c75fe88ba04a57aa200deed011da63913a46cd8b59aa2 7acc85ad6eea22222b77c6b97e70d70163d665decfb01c7ac37a521cad221910.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E70715F6F728365B5190E271DEE4C65EBEEACAF3 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C060ED44CBD881BD0EF86C0BA287DDCF8167478C\Blob = 0f000000010000001400000000bbba38b51af4d816e03a4eb30914062687951153000000010000002800000030263024060e6084100187690101010c0601010130123010060a2b0601040182373c0101030200c00b000000010000002400000044006900670069004e006f00740061007200200052006f006f0074002000430041000000090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b06010505070307030000000100000014000000c060ed44cbd881bd0ef86c0ba287ddcf8167478c20000000010000008e0500003082058a30820372a00302010202100c76da9c910c4e2c9efe15d058933c4c300d06092a864886f70d0101050500305f310b3009060355040613024e4c31123010060355040a1309446967694e6f746172311a301806035504031311446967694e6f74617220526f6f742043413120301e06092a864886f70d0109011611696e666f40646967696e6f7461722e6e6c301e170d3037303531363137313933365a170d3235303333313138313932315a305f310b3009060355040613024e4c31123010060355040a1309446967694e6f746172311a301806035504031311446967694e6f74617220526f6f742043413120301e06092a864886f70d0109011611696e666f40646967696e6f7461722e6e6c30820222300d06092a864886f70d01010105000382020f003082020a0282020100acb058c100bdd821080b2b9afe6e5630059f1b779010415cc30d8711778e81f1ca7ce98c6aed387435bbdadff9bbc00937b49673817d331a9839f7936f957f3db9b17587ba5148e88b703e9504c5d8b6c316d988b0b1871d70da86b40f148b7acf10d17436a2127b77864a79e67bdf021168a54e86ae34589b2413785622251e018b4b5171fb82cc599669885a6853c5b90d0237cb4bbc664a907e2a0b0507ed165f559075d846c91b83e208bef123cc991dd62a0f8320155827822efae222c249b1b901816a9d6d9d407768764e212a6d8440854e76997c82f3f3b70259d426011b8edfad5306d1ae18dde2b23acbd788388eac5b29b919d398f91803cf488286660b1b690fc9eb38887a261a054c92d724d496f2ac522da347d552f63ffece840670a6aa3ea2f2b656341857a2e4816de7caf06ad3c7916b0283417c15ef6b9a645ee3d03ce5b1eb7b5d86fbcbe67749cda365dcf7b99cb8e40b5f93cfcc301a321cce1c6395a5f9eae1748b9ee92ba9307ba0181f0e180be55ba9d3d16c1e07678f914ba98abcd266aa930188b291fa315cd5a6c1520809cd0a63a2d322a6e8a1d9390697f56e8d02908c147b3f80cd1b9cbac4587223afb6569fc67a423329073f82c9e61f050dcd4c28368bd3c83e1cc688ef5eee8964e91debda897e32a669d1ddcc889fd1d0c96621dc0667c5947a9a6d624c7dcce06480b29e478ea30203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604148868bfe08e35c43b386b62f7283b8481c80cd74d300d06092a864886f70d010105050003820201003b028dcb3c30e86ea0adf273b35f9e25130405d3f6e38bbb0b79ce53dee496c5d1af73bcd5c3d040557c407fcd1b5f09d5f27c9f681dbb5dce7a39c28cd6987bc58355a8d57d40cae01ef7895e635da113c25d8ab68a7c00f323c3ed855f7176f06863aa45213948617836dcf14393d425c7f28065e153027551fc7a3aef37ab8428570cd8d4d499566ce3a2fe5984b431e833f86494945197ab39c54beddadd800b6f7c290dc48e8a720de75314b260413d849131683d2744dbe5def4fa6345c84c3e98f53f41ba4ecb370dba6698f1ddcb9f5cf75436826b2cbc13619742f878bbccc8a29fcaf068bd6b1db2df8d6f079dda8e67c7471ecab9bf2a4291b7635366f142a3e1f45a4d586bb5e4a433ad5c701ddce0f2eb7314919a03c1ea0065bc07fccf1211222caea0bd3ae0a22ad859e929d31835a4ac115f19b5b51bff224a5cc67ae417ef20a9a7f43fad8aa79a04259d0eca37e650fd8c4229049aecb9cf4b72bde20836af232f62e5ca01d370db7c82232c16310cc63607907ab11f6758c43b585989b08c8c50b3d886cb68a3c40ae7694b20cec11e564b95a92368d830d8c3ebb05551cde5fd2bb8f5bb119f5354f634198c790936ca611725170b8298730c7774c3d50dc7a8124cc7a75471472e2c1a7dc9e32b3b48de2784a76336b37d8fa06439240d3d7b87af665c741b4b73b2e58cf08699b8e5c5df84c1b7eb 7acc85ad6eea22222b77c6b97e70d70163d665decfb01c7ac37a521cad221910.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\6A6F2A8B6E2615088DF59CD24C402418AE42A3F1 updroots.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3632 wrote to memory of 2700 3632 7acc85ad6eea22222b77c6b97e70d70163d665decfb01c7ac37a521cad221910.exe 90 PID 3632 wrote to memory of 2700 3632 7acc85ad6eea22222b77c6b97e70d70163d665decfb01c7ac37a521cad221910.exe 90 PID 3632 wrote to memory of 2700 3632 7acc85ad6eea22222b77c6b97e70d70163d665decfb01c7ac37a521cad221910.exe 90 PID 2700 wrote to memory of 4920 2700 KB931125.exe 91 PID 2700 wrote to memory of 4920 2700 KB931125.exe 91 PID 2700 wrote to memory of 4920 2700 KB931125.exe 91 PID 2700 wrote to memory of 3928 2700 KB931125.exe 92 PID 2700 wrote to memory of 3928 2700 KB931125.exe 92 PID 2700 wrote to memory of 3928 2700 KB931125.exe 92 PID 2700 wrote to memory of 1884 2700 KB931125.exe 93 PID 2700 wrote to memory of 1884 2700 KB931125.exe 93 PID 2700 wrote to memory of 1884 2700 KB931125.exe 93 PID 2700 wrote to memory of 1200 2700 KB931125.exe 94 PID 2700 wrote to memory of 1200 2700 KB931125.exe 94 PID 2700 wrote to memory of 1200 2700 KB931125.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\7acc85ad6eea22222b77c6b97e70d70163d665decfb01c7ac37a521cad221910.exe"C:\Users\Admin\AppData\Local\Temp\7acc85ad6eea22222b77c6b97e70d70163d665decfb01c7ac37a521cad221910.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\{9803C0C4-AECB-446a-8DDC-B2BFAD7CBA1B}.tmp\KB931125.exe"C:\Users\Admin\AppData\Local\Temp\{9803C0C4-AECB-446a-8DDC-B2BFAD7CBA1B}.tmp\KB931125.exe" /Q2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe authroots.sst3⤵
- Executes dropped EXE
- Modifies system certificate store
PID:4920
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe updroots.sst3⤵
- Executes dropped EXE
- Modifies system certificate store
PID:3928
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe -l roots.sst3⤵
- Executes dropped EXE
PID:1884
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe -d delroots.sst3⤵
- Executes dropped EXE
PID:1200
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
89KB
MD5a64e4b204d44548eeb5c3d86eca2ad70
SHA1e3245bf6dbb2e56d71a9cbad2697aa4fa0df6bbe
SHA256985a5603ebf94539ac11549999f83b5e6dc008180994898c5daa6fd31ae1e9dc
SHA512dca4099318954bab5f1204645be0d0e8fea0c2e97ee95496fa884fbed627e376358623fa94c39bf0abe97d07d46a7e6c5e1081496cdd1987e07e595995a46cd5
-
Filesize
73KB
MD5bb49ccc10926cdb601eba81afef749a2
SHA1a4766c9aea8d211e9632148fd4b625cece195be9
SHA256f013ee3b7fede9a95844e83e83ee298d38cba6efce5a5cafcd8b95255c32f86c
SHA51294c2809727039d1ed07a3742a4b2f9300e865ea7c49bc1fcf547a30238eeecc88d8dd06a2d4f3112317f948908b9af082b50f412a41a2bcb48d5e30d6d8ecbba
-
Filesize
9KB
MD57b32871e409608ff887b6cf4d87debb0
SHA1191f9ea1298ee52dbd6f977b3584109a064f57b9
SHA2563f01268547364d2d60a0f65b46757cccfd9225fc39d581846a8fbffdb5756ff2
SHA512534a384f7946db4083e639b8e02d83ac97293c60630b8811a84c85e0330e9c293f05f5cf71e0f3580551e7923bc5a3bfb7f0406432ca3cdb7efeb4a950ac5e8a
-
Filesize
7KB
MD59e5de0fd1f90486a66dee4bfe89a78d7
SHA190e3188ef63495aaa71c85d4ff0f23253c834b40
SHA2568b95ff56d61586582864d05563762615c8705779578dca3c98a303c3b1f4122e
SHA51260006fa6f57e4d280642d51055f85f8d27b913ce71373de5b928c515c77647295030ab73ab4a55024de4a40c18f200909f49ffb52c26cf554835fc3d4cc348f1
-
Filesize
1KB
MD5421e60325404f5f29ac04c9b9d59096b
SHA1aace2fd74d799e8af5c8d5b2646361bb67a1620c
SHA256571a8da5298aacc37700c747ee5d72b5a7797835140e7a4d4f895e9604574d77
SHA51286693975b1b187ee65b0a23b1f3f8e05d1a3f61e7e47b060f938fe1602bbad96021847b709e64c2d5a295b72f10f4db587a11a1e7ca0a0b64c3bed7fa683b1d2
-
Filesize
5KB
MD59c18ae971cbffb096952177f6804ea31
SHA1bb255dd1bd9bb39cdbb8671af66054432c686828
SHA2562703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb
SHA51221086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c
-
Filesize
320KB
MD52d9b4498c847715418160bfd7e7c8a2d
SHA1e0873091d476d2566aa6fc988cb364247c95dc97
SHA256c49c05b701c390c679e5e3226ec621f22a08155b1065fcfc37b509f648f03b41
SHA512dcf3208cdd1e4353f82823f796d735c1209f149f183eea827a90753ec55509a1c460a16c120e07c12a5eacf0e67d2661c25638491ecf4403e25d6508983e519b
-
Filesize
238KB
MD58786d469338c30e0ba9fedfc62bd5197
SHA15fb12028ceae9772f938e1b98b699f0e02e32718
SHA256beeaf8b72f7008e9adabacfcd85e32a50747a0dfb5c86802aeb973bd1f5c3d2f
SHA5125db1e5b78e62cda81a63e8e712e720f87a7c7a539237a55a9098c076f9fb4e0b5adb83383c23657b4ccc90c117e55e3946a399cdf3d15cb94444b203d9d6c45c
-
Filesize
1.1MB
MD52706693dda10c6cc79eed24c56d4e5ef
SHA14f34ef1bd49273a0d260b9dab15c73eb0ccb6383
SHA2560edad8a1af22d5b97c1f324791c86243a6ecce7b5a9d2f30415af99aba9129c3
SHA5127e7f7ae894528587ba33b6e10999549bb9a2ec2748b5662fa1b8806e5f4ce33af47507b3ef2954f2747a76b5b7c775c1cd671061f577c5016d1f8ba165bbe21c
-
Filesize
349KB
MD54a4d72d34f9da1fc5019e0748fcde2f5
SHA1f54752ec63369522f37e545325519ee434cdf439
SHA25683b660f3f3eaddd4b388ed3f806f7444f03429fb63fc1f8db3d86294914a05ca
SHA51295986ffbf51483a0d1a256028847c7ee6ac73ffd62f6d838309a69e1833f719a7cfed5422815f4d4a49dbd599c449f8db8f60273136720cb1da5f8b0eb24cb33