b5d35117240f2342dec45eee36d06bb7bc5b434c8c98085d83f11be2ac0ed5b0

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 15:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b5d35117240f2342dec45eee36d06bb7bc5b434c8c98085d83f11be2ac0ed5b0.exe
Size

4.8MB
MD5

35d215e36f7b7b09f1a60e1b45fab112
SHA1

5d4a9ed9994f512b8bd5e308ceff5aec60ba6bcd
SHA256

b5d35117240f2342dec45eee36d06bb7bc5b434c8c98085d83f11be2ac0ed5b0
SHA512

2596e6f3b104a83d810e4a3332f5d6d43cc58d92ba80c877b0fc82aa094813bb23eff6527b59517c99499045d08ff9f4a0c70046f81fc8c7e1d8fe034fee252a
SSDEEP

98304:OX3oVSsYFZ2xtp/BZXxkIpPG1f5e8M/Cw/khc5FbKEQ26PVR7m6gZ1MRGNCyI5AB:IF2lBZBkIOhe8M/Cw/khc5FbKEV6PVRa

Score

8^/10

bootkit persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}	KB931125.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\ = "RootsUpdate"	KB931125.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\IsInstalled = "1"	KB931125.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\Version = "28,0,2195,0"	KB931125.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\Locale = "*"	KB931125.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\ComponentID = "Windows Roots Update"	KB931125.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	b5d35117240f2342dec45eee36d06bb7bc5b434c8c98085d83f11be2ac0ed5b0.exe

Executes dropped EXE 5 IoCs

pid	Process
4948	KB931125.exe
3728	updroots.exe
4184	updroots.exe
4884	updroots.exe
1704	updroots.exe

Loads dropped DLL 2 IoCs

pid	Process
1076	b5d35117240f2342dec45eee36d06bb7bc5b434c8c98085d83f11be2ac0ed5b0.exe
4948	KB931125.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	b5d35117240f2342dec45eee36d06bb7bc5b434c8c98085d83f11be2ac0ed5b0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 64 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\00EA522C8A9C06AA3ECCE0B4FA6CDC21D92E8099\Blob = 03000000010000001400000000ea522c8a9c06aa3ecce0b4fa6cdc21d92e8099090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000006c0000004a006100700061006e002000430065007200740069006600690063006100740069006f006e002000530065007200760069006300650073002c00200049006e0063002e0020005300650063007500720065005300690067006e00200052006f006f007400430041003200000020000000010000002d030000308203293082021102085f60585f00000000300d06092a864886f70d01010505003057310b3009060355040613024a50312b3029060355040a13224a6170616e2043657274696669636174696f6e2053657276696365732c20496e632e311b3019060355040313125365637572655369676e20526f6f74434132301e170d3939303931353135303030315a170d3230303931353134353935395a3057310b3009060355040613024a50312b3029060355040a13224a6170616e2043657274696669636174696f6e2053657276696365732c20496e632e311b3019060355040313125365637572655369676e20526f6f7443413230820122300d06092a864886f70d01010105000382010f003082010a0282010100967b92233f60df093c588008e3630997e8e40b7561d4cd0ea3f2e31e43ba83ffba815c2fc8de908b4c0e2f29f907d68eb3a628af822a7bc2b4664c71f40c741ab8db1ae86837a9f9a1a26e1c28cd6c263c8f2a339e9dcbb479c4d9643d95c633a847fbe50709dcf66db825424cc3fb4aed5b2ed407a8e593102493586e7dc1d01ecfe929d7d0bc5f4cf01516c3d8c2cee35b175b948b286b1467243bf452ec0d6e7c4eb49902dbc9f30f82ab01f48cde1670c6bc170761ff114084ea2c1b7a3ab0036107aa968dd0dab9838ee49d516975716481b48855dc1083ce2da5f53096612e3b0afc875f9c5c8275131ed398d1edc9ed72161c0c06dc59207ef05deff70203010001300d06092a864886f70d0101050500038201010069e05670ff335ac8e1c8d3ac302173484e22e23228cbbc173a8d7e38d1f9b73f3085328d57fc1f407f3f7a74ec120964c1fddcfc1c35bcf10bb4eaa15cde2b2990820316ca9ec4bbb0928d9556529932c0909b5543e4f34d7651ad6c3c5c9dc2417d8d4cf0a9ac3abe20270597704668b664f82599e995c38e3ae9c1e21ac022b16dadb0ee9f2cec74c3c1642c926f96680b0157e88699afe788c859606eb25604ab54b85d181676cdda1e74904b9b4611970981f3cef2619903f3e96e484c3fdbbc80db8120febd5c46ff4ee7af4dfebc4480e3096e677a25fb57e73ce655a5a20186283f7f5febf4eb1a8455319f24f0c9f6694c145213b3f9241a17d91870	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2964B686135B5DFDDD3253A89BBC24D74B08C64D	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B31EB1B740E36C8402DADC37D44DF5D4674952F9	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CC4307BC60755E7B22DD9F7FEA245936C7CF288	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\93E6AB220303B52328DCDA569EBAE4D1D1CCFB65	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7AC5FFF8DCBC5583176877073BF751735E9BD358	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\96974CD6B663A7184526B1D648AD815CF51E801A	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7A74410FB0CD5C972A364B71BF031D88A6510E9E	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C060ED44CBD881BD0EF86C0BA287DDCF8167478C\Blob = 030000000100000014000000c060ed44cbd881bd0ef86c0ba287ddcf8167478c090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b060105050703070b000000010000002400000044006900670069004e006f00740061007200200052006f006f007400200043004100000053000000010000002800000030263024060e6084100187690101010c0601010130123010060a2b0601040182373c0101030200c020000000010000008e0500003082058a30820372a00302010202100c76da9c910c4e2c9efe15d058933c4c300d06092a864886f70d0101050500305f310b3009060355040613024e4c31123010060355040a1309446967694e6f746172311a301806035504031311446967694e6f74617220526f6f742043413120301e06092a864886f70d0109011611696e666f40646967696e6f7461722e6e6c301e170d3037303531363137313933365a170d3235303333313138313932315a305f310b3009060355040613024e4c31123010060355040a1309446967694e6f746172311a301806035504031311446967694e6f74617220526f6f742043413120301e06092a864886f70d0109011611696e666f40646967696e6f7461722e6e6c30820222300d06092a864886f70d01010105000382020f003082020a0282020100acb058c100bdd821080b2b9afe6e5630059f1b779010415cc30d8711778e81f1ca7ce98c6aed387435bbdadff9bbc00937b49673817d331a9839f7936f957f3db9b17587ba5148e88b703e9504c5d8b6c316d988b0b1871d70da86b40f148b7acf10d17436a2127b77864a79e67bdf021168a54e86ae34589b2413785622251e018b4b5171fb82cc599669885a6853c5b90d0237cb4bbc664a907e2a0b0507ed165f559075d846c91b83e208bef123cc991dd62a0f8320155827822efae222c249b1b901816a9d6d9d407768764e212a6d8440854e76997c82f3f3b70259d426011b8edfad5306d1ae18dde2b23acbd788388eac5b29b919d398f91803cf488286660b1b690fc9eb38887a261a054c92d724d496f2ac522da347d552f63ffece840670a6aa3ea2f2b656341857a2e4816de7caf06ad3c7916b0283417c15ef6b9a645ee3d03ce5b1eb7b5d86fbcbe67749cda365dcf7b99cb8e40b5f93cfcc301a321cce1c6395a5f9eae1748b9ee92ba9307ba0181f0e180be55ba9d3d16c1e07678f914ba98abcd266aa930188b291fa315cd5a6c1520809cd0a63a2d322a6e8a1d9390697f56e8d02908c147b3f80cd1b9cbac4587223afb6569fc67a423329073f82c9e61f050dcd4c28368bd3c83e1cc688ef5eee8964e91debda897e32a669d1ddcc889fd1d0c96621dc0667c5947a9a6d624c7dcce06480b29e478ea30203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604148868bfe08e35c43b386b62f7283b8481c80cd74d300d06092a864886f70d010105050003820201003b028dcb3c30e86ea0adf273b35f9e25130405d3f6e38bbb0b79ce53dee496c5d1af73bcd5c3d040557c407fcd1b5f09d5f27c9f681dbb5dce7a39c28cd6987bc58355a8d57d40cae01ef7895e635da113c25d8ab68a7c00f323c3ed855f7176f06863aa45213948617836dcf14393d425c7f28065e153027551fc7a3aef37ab8428570cd8d4d499566ce3a2fe5984b431e833f86494945197ab39c54beddadd800b6f7c290dc48e8a720de75314b260413d849131683d2744dbe5def4fa6345c84c3e98f53f41ba4ecb370dba6698f1ddcb9f5cf75436826b2cbc13619742f878bbccc8a29fcaf068bd6b1db2df8d6f079dda8e67c7471ecab9bf2a4291b7635366f142a3e1f45a4d586bb5e4a433ad5c701ddce0f2eb7314919a03c1ea0065bc07fccf1211222caea0bd3ae0a22ad859e929d31835a4ac115f19b5b51bff224a5cc67ae417ef20a9a7f43fad8aa79a04259d0eca37e650fd8c4229049aecb9cf4b72bde20836af232f62e5ca01d370db7c82232c16310cc63607907ab11f6758c43b585989b08c8c50b3d886cb68a3c40ae7694b20cec11e564b95a92368d830d8c3ebb05551cde5fd2bb8f5bb119f5354f634198c790936ca611725170b8298730c7774c3d50dc7a8124cc7a75471472e2c1a7dc9e32b3b48de2784a76336b37d8fa06439240d3d7b87af665c741b4b73b2e58cf08699b8e5c5df84c1b7eb	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\78E9DD0650624DB9CB36B50767F209B843BE15B3\Blob = 03000000010000001400000078e9dd0650624db9cb36b50767f209b843be15b3090000000100000016000000301406082b0601050507030406082b060105050703020b000000010000001200000056006500720069005300690067006e0000002000000001000000400200003082023c308201a50210325033cf50d156f35c81ad655c4fc825300d06092a864886f70d0101020500305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732031205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479301e170d3936303132393030303030305a170d3230303130373233353935395a305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732031205075626c6963205072696d6172792043657274696669636174696f6e20417574686f7269747930819f300d06092a864886f70d010101050003818d0030818902818100e519bf6da356612d994871f667deb98debb79e86800a910efa3825af468882e573a8a09b245d0d1fcc656e0cb0d0568418879a069b10a173dfb458396b6ec1f615d5a8a83faa12068d31ac7fb034d78f34678809cd1411e24e4556691f780280dadc479129bb36c9635cc5e0d72d877ba1b732b07b30ba2a2f31aaeea367dadb0203010001300d06092a864886f70d0101020500038181004b4466606864e4981bf3b072e695897cdd7bb395c01d2ed8d819d02d343dc6509a10868caa3f3ba804fc375295c3d9c9dbcdf28606c4b11bf0828830428e17501c647ab83e99497497fcac0243fb960c5604250c7c7c879d24a7d8f03229b5a4df5da24cc51632a842f645a6b636b9e0bf653693c2d2d76bdcde59d6a235f845	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\905F942FD9F28F679B378180FD4F846347F645C1	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D8A6332CE0036FB185F6634F7D6A066526322827\Blob = 030000000100000014000000d8a6332ce0036fb185f6634f7d6a066526322827090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b060105050703070b0000000100000018000000410066006600690072006d0054007200750073007400000053000000010000002400000030223020060a2b06010401828f09020330123010060a2b0601040182373c0101030200c020000000010000004a050000308205463082032ea00302010202086d8c1446b1a60aee300d06092a864886f70d01010c05003041310b300906035504061302555331143012060355040a0c0b41666669726d5472757374311c301a06035504030c1341666669726d5472757374205072656d69756d301e170d3130303132393134313033365a170d3430313233313134313033365a3041310b300906035504061302555331143012060355040a0c0b41666669726d5472757374311c301a06035504030c1341666669726d5472757374205072656d69756d30820222300d06092a864886f70d01010105000382020f003082020a0282020100c412dfa95ffe41ddddf59f8ae3f6ace13c789abcd8f07f7aa0332adc8d205bae2d6fe793d936706a68cf8e51a3855b6704a010246f5d2882c19757d8482913b6e1be914ddf850c53189a1e24a24f8ff0a2850bcbf4297fd2a458ee264dc9aaa87b9ad9fa38de445715e5f88cc8d948e20d16271d1ec8838525b7baaa5541cc03224b2d918d8be689af66c7e9ff2be93cacdad2b3c3e1689c89f87a0056def455956cfbba64dd628bdf0b7732eb62cc269a9bbbaa62834cb4067a30c829bfed064d97b91cc4312bd55fbc5312179c9957296677612131072e25499d18f2eef32b718cb5ba39074977fcef2e9290058d2d2f777bef43bf35bb9ad8f973a72cf2d057ee284e265f8f9068092fb8f8dc06e92e9a3e51a7d122c40aa738486cb3f9ff7dab8657e3bad6857877ba43ea487ff6d8be236d1ebfd1366c585cf1eea419541af503d276e6e18cbd3cb3d3484be2c8f87f92a876469c42653ea41ec107035a462db897f3b7d5b25521efbadc4c0097fb14952733bfe8434746d2089916603b9a7ed2e6ed38eaec011e3c48564909c74c37009e880ec073e16f66e97247303e10e50b03c99a42006cc5947e61c48adf7f821a0b59c4593277b3bc60695639fdb4067b2cd66436d9bd48ed841f7ea5228f2ab842f482b7d45390784e2d1afd816f44d73b01749642e000e22e6beac5ee72acbbbffeeaaaa8f8dcf6b2798ab6670203010001a3423040301d0603551d0e041604149dc067a60c22d926f545aba665521127d845ac63300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106300d06092a864886f70d01010c05000382020100b3574d10624e3ae4aceab81caf3223c8b3495a519c76288d79aa574617d5f552f6b744e80844bf1884d20b80cdc512fd005505618741dcb5249e3cc4d8c8fb709e2f7896832036de7c0f691388a575369808a6c6dfaccee358d6b73edebaf3eb3440d8a281f5783f2fd5a5fcd9a2d45e040e17adfe41f0e5b272fa44823342e82d58f7568c623fba42b09c0c5c7e2e65265c534f00b2787ea10d992d8db81d8ea2c4b0fd60d030a48ec80462a9c4ed35de7a97ed0e385e922f9370a5a99c6fa77d131d7ec60848b15e67eb510825e9e6256b5229919cd239730857de9906b45b9d1006e1c200a8b81c4a020a14d0c141cafb8c35217d8238f2a95491193593946d6a3ac5b2d0bb898693e89bc90f3aa77ab8a1f07846fafc372fe58a84f3dffe04d9a168a02f24e2099506d595cae12496eb7cf69305bbed73e92dd17539d7e724dbd84e5f438f9ed01439bf557048995731b49cee4a980396301f6006ee1b23fe8160231a476285a5cc1934806fb3ac1ae39ff07b48add501d967b6a97293ea2d66b5b2b8e43d3cb2ef4c8ceaeb07bfab359a5586bc18a6b5a85eb4836c6b6940d39fdcf1c3696bb9e16d09f4f1aa50760a7a7d7a17a1559642993109dd60118d05307ee68e46d19d14dac717e405968cc424b51bcf1407b240f8a39e4186bc04d06b96c82a8034fdbfef06a3dd58c5853d3e8ffe9e29e0b6b80968191c1843	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\027268293E5F5D17AAA4B3C3E6361E1F92575EAA\Blob = 0b000000010000001c0000004b00490053004100200052006f006f0074004300410020003100000009000000010000003e000000303c06082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030806082b06010505070309030000000100000014000000027268293e5f5d17aaa4b3c3e6361e1f92575eaa200000000100000077030000308203733082025ba003020102020104300d06092a864886f70d01010505003064310b3009060355040613024b52310d300b060355040a0c044b495341312e302c060355040b0c254b6f7265612043657274696669636174696f6e20417574686f726974792043656e7472616c3116301406035504030c0d4b49534120526f6f7443412031301e170d3035303832343038303534365a170d3235303832343038303534365a3064310b3009060355040613024b52310d300b060355040a0c044b495341312e302c060355040b0c254b6f7265612043657274696669636174696f6e20417574686f726974792043656e7472616c3116301406035504030c0d4b49534120526f6f744341203130820120300d06092a864886f70d01010105000382010d00308201080282010100bc04e4fa1339f03496206b6c68bbfadb77ff27f7acec2fe7fdf07f6d6f8c2acd25095b24f4a168fc28ecc925e2aceddec83384f5b0a5093aa7b14748c5cc4f8c799cf906577dddee38f6cf14b29cead3c05d7762f0470db91a40535c6470af085ac0f7cf75f96c8d64281e20feb71b19d35a668372e2b09bbdd325150d326f6437948546c872be77d56e1f282fc769ede783893358d3dea0bf40e84350eedc4d6bbca5eaa6c8618ef5c364af0615dc298b3f758cbc7144dbfcadb5171d6d8983cfc633bdbf45a2fe0a9fa3115f0fb91f9c1ac246cc9c28669f70263c2edfaa80fe8cc50409254fcd93473c37ea026792fefc22245cacd22ce05c01338ac119db020103a3323030301d0603551d0e04160414bfb627d8035a76654c6101415631e58b7b3ad9cc300f0603551d130101ff040530030101ff300d06092a864886f70d0101050500038201010013af510bde8a6a5be69a0ac8b1904a4ea1029dcc88d2ab66bd3decbbb142956ab25c5affa1636496a968157f255e8af8a473c1808a850a0e52e832e745f84e658091997443e5459d492af09495dde9e130d2136ec94eb177e504cfad5a1e94095ad73c081cae7ae91432c145add2264872aca841daf02187395edffc64ff61742a9cd99b8b5fc23793d8a3372f3b936bb21b07a77f0950efd33abe216b8a903b274a514e6b9e9c879df8789031ed1127c6a859befc180bfb8e7e2e42e1ede70921bdb913c55667f426a64243904454b4719b76e41a12ac1a2800df9bc1d5f8db5ca3f892b1bdb4d4f950d900024fdb83d0114fa44256613a7e1332d3841fc9ba	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4054DA6F1C3F4074ACED0FECCDDB79D153FB901D	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E0B4322EB2F6A568B654538448184A5036874384	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A69A91FD057F136A42630BB1760D2D51120C1650	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\339B6B1450249B557A01877284D9E02FC3D2D8E9	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D23209AD23D314232174E40D7F9D62139786633A	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\97E2E99636A547554F838FBA38B82E74F89A830A	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\81968B3AEF1CDC70F5FA3269C292A3635BD123D3	updroots.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\18F7C1FCC3090203FD5BAA2F861A754976C8DD25	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\720FC15DDC27D456D098FABF3CDD78D31EF5A8DA	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\61573A11DF0ED87ED5926522EAD056D744B32371\Blob = 5300000001000000220000003020301e0608608442011a01030330123010060a2b0601040182373c0101030200c00b000000010000002a0000004200750079007000610073007300200043006c0061007300730020003300200043004100200031000000090000000100000020000000301e06082b0601050507030106082b0601050507030206082b0601050507030403000000010000001400000061573a11df0ed87ed5926522ead056d744b32371200000000100000057030000308203533082023ba003020102020102300d06092a864886f70d0101050500304b310b3009060355040613024e4f311d301b060355040a0c14427579706173732041532d393833313633333237311d301b06035504030c144275797061737320436c61737320332043412031301e170d3035303530393134313330335a170d3135303530393134313330335a304b310b3009060355040613024e4f311d301b060355040a0c14427579706173732041532d393833313633333237311d301b06035504030c144275797061737320436c6173732033204341203130820122300d06092a864886f70d01010105000382010f003082010a0282010100a48ed774d92964de5f1f878091ea4e39e619c6440b80d50baf53078b12bde667f002b189f6608ac45bb042d1c021a8cbe19bef6451b6a7cf15f57480680490a058a2e674a653535548633f9256dd244e8ef8ba2bfff3348a9e28d7349fac2fd60ff1a42fbd52b249856d3935f04430934624f3b6e753fbbc61afa9a314fbc21717846ce07c88f8c91c572cf03d7e94bc259384e89a009a4505425780f44eced9ae39f6c853100c653a477b60c2d6fa91c9c6716cbd91873c918649abf30fa06c26765e1cac9b71e58dbc9b211e9cd6387e248015318296b149d362375b880c0a6234fea7487e99b1308b9037951ca81fa52c8df455c8dbdd590ac2ad78a0f48b0203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604143814e6c8f0a9a403f44e3e22a35bf2d6e0ad4074300e0603551d0f0101ff040403020106300d06092a864886f70d010105050003820101000167a38cc9253d13635d166feca13e095c91152a2ad980214f05dcbba589ab13332a9e38b78c6f027263c773771e0906ba3b287ba447c9616b080820fc8a058a1fbcbac6c2fecf6eec133371672e69faa92c3f66c012594d0b54029284bbdb12ef83707078c853fadfc6c6ffdc882f07c0499d325760d3f2f699295fe7aa01ccac33a81c0abb91c403a06fb634f986d3b3765498f44a81b3539d4d40ece5771345af5baa1fd82f4c827bfe2ac458bb4ffc9efd03651a2a0ec3a52016946b79a6a212b4bb1aa4237a5ff0ae8424e4f32bfb8a24a3279865da307576fc1991e8dbeb9b3f32bf40970726baccf394854a7a2793cf9042d4b85b16a6e7cb4003dd79	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\FAB7EE36972662FB2DB02AF6BF03FDE87C4B2F9B	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\06083F593F15A104A069A46BA903D006B7970991\Blob = 0b00000001000000520000004e00650074004c006f0063006b0020004100720061006e0079002000280043006c00610073007300200047006f006c0064002900200046005101740061006e00fa007300ed0074007600e1006e0079000000090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b0601050507030703000000010000001400000006083f593f15a104a069a46ba903d006b797099120000000010000001904000030820415308202fda003020102020649412ce40010300d06092a864886f70d01010b05003081a7310b30090603550406130248553111300f06035504070c08427564617065737431153013060355040a0c0c4e65744c6f636b204b66742e31373035060355040b0c2e54616ec3ba73c3ad7476c3a16e796b696164c3b36b202843657274696669636174696f6e205365727669636573293135303306035504030c2c4e65744c6f636b204172616e792028436c61737320476f6c64292046c59174616ec3ba73c3ad7476c3a16e79301e170d3038313231313135303832315a170d3238313230363135303832315a3081a7310b30090603550406130248553111300f06035504070c08427564617065737431153013060355040a0c0c4e65744c6f636b204b66742e31373035060355040b0c2e54616ec3ba73c3ad7476c3a16e796b696164c3b36b202843657274696669636174696f6e205365727669636573293135303306035504030c2c4e65744c6f636b204172616e792028436c61737320476f6c64292046c59174616ec3ba73c3ad7476c3a16e7930820122300d06092a864886f70d01010105000382010f003082010a0282010100c4245e73be4b6d14c3a1f4e397906ed230451e3cee67d964e01a8a7fca30ca83e320c1e3f43ad3945f1a7c5b6dbf304f8427f69f1f49bcc6990a90f20ff57f43843763518b7aa570fc7a58cd8e9bedc3466c84705ddaf3019023fc4e30a97ee12763e7ed643ca0b8c93363fe1690ffb0b8fdd7a8c0c094430bb6d559a69e56d0241f7079afdb39540d6575d915419401af5eecf68df1ffad64fe209ad75cebfea61f0864a38b7655ad1e3b28602e8725e8aaaf1fc6644620b7707f3cde48db9653b73977e41ae2c7168476975b2fbb191585f86985f599a7a9f234a7a9b6a603fc6f863d547c76049b6bf9405d0034c72e99759de58803aa4df803d24276c01b020300a88ba345304330120603551d130101ff040830060101ff020104300e0603551d0f0101ff040403020106301d0603551d0e04160414ccfa6793f0b6b8d0a5c01ef353fd8c53df83d796300d06092a864886f70d01010b05000382010100ab7fee1c16a99c3c5100a0c0110805a799e66f018854616ef1b918ad4aadfe814023942ffb757c2f284b622481820bf561f11c6eb86138eb81fa62a13b5a62d39465c4e1e66d82f82f2570b22126c172511f8c2cc38490c35a8fbacff4a765a5eb98d1fb05b2467515236a6f85633080f0d59e1f291cc26cb050595d905b3ba80d30cfbf7d7fcef19d83bdc9466e20a6f96151ba212f7bbea51563a1d49587f19eb9f389f33d85b8b8dbbeb5b929f9da3705004994038444e7bf4331cf758b25d1f4a664f592f6ab05eb3de9a50b3662dacc065f368bb65e31b82afb5ef671df44269ec4e60d91b42e759580516a4b30a6b062a193f19bd8cec463753f5947b1	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D6DAA8208D09D2154D24B52FCB346EB258B28A58	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B19DD096DCD4E3E0FD676885505A672C438D4E9C\Blob = 0b000000010000001200000056006500720069005300690067006e000000090000000100000016000000301406082b0601050507030406082b06010505070303030000000100000014000000b19dd096dcd4e3e0fd676885505a672c438d4e9c200000000100000039020000308202353082019e020502b5000002300d06092a864886f70d010102050030613111300f06035504071308496e7465726e657431173015060355040a130e566572695369676e2c20496e632e31333031060355040b132a566572695369676e20496e646976696475616c20536f667477617265205075626c697368657273204341301e170d3936303430393039333734395a170d3939313233313039333734385a30613111300f06035504071308496e7465726e657431173015060355040a130e566572695369676e2c20496e632e31333031060355040b132a566572695369676e20496e646976696475616c20536f667477617265205075626c69736865727320434130819f300d06092a864886f70d010101050003818d0030818902818100c17aca65a72dd50f4f6c4732f8737786e53df26f7990b5de4fd21479334bb20e46fd88722ac2fc649e618f6bc05be8f01104da7aba72f6ec5daffbf197f114d228e328855c7bbd8aa27fc233b56d0b92780b387174857f3dbab92fefbe27480d3822c956308d77fa5d2c5a9c97ce7030e9515fa68be49596a5a01777f193b8290203010001300d06092a864886f70d01010205000381810088d656439b33dc5cd143e4f13acf1113394b2e061c688180ca9cc9fc93169a050f77725d6c8d86af0a97c23292c75cf91003e48440af496be171fa658dddb238fd05ae6ec8e26a3178f70d4a4aef183bad2938cef862bddd9c23ba9bde2357c9523e78fbb378646a45b2687ed1b29961eadae4e330374564e7ea3b5a3ac814e3	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\688B6EB807E8EDA5C7B17C4393D0795F0FAE155F\Blob = 0b000000010000001200000056006500720069005300690067006e000000090000000100000016000000301406082b0601050507030406082b06010505070303030000000100000014000000688b6eb807e8eda5c7b17c4393d0795f0fae155f200000000100000039020000308202353082019e020502b4000001300d06092a864886f70d010102050030613111300f06035504071308496e7465726e657431173015060355040a130e566572695369676e2c20496e632e31333031060355040b132a566572695369676e20436f6d6d65726369616c20536f667477617265205075626c697368657273204341301e170d3936303430393039333535395a170d3939313233313039333535385a30613111300f06035504071308496e7465726e657431173015060355040a130e566572695369676e2c20496e632e31333031060355040b132a566572695369676e20436f6d6d65726369616c20536f667477617265205075626c69736865727320434130819f300d06092a864886f70d010101050003818d0030818902818100c3d3696552019454ab28c66218b35455c54487454a3bc27ed8d3d7c880868dd80cf1169ccc6ba929b28f767392c8c562a63ced1e0575f013006c144dd4989007be697381b8624e311ed1fcc90ceb7d90bfaeb44751ec6fce643502d67d670577e28fd951d7fb9719bc3ed77781c643ddf2dddfcaa3838bcb41c13d224848a6190203010001300d06092a864886f70d01010205000381810031bb30c56fa7be23266da5997668c52a03284bf389b09903325b94a17bc1c819d7f4956cac73240acb44057d78eefaf6a79f87a47fe8f34b4f32303015081701b280fca1d92487a5005fcddd29c8a1a5ca58753960451fde8dd65708d3c01b81c2d9e2008cec0a9102c69d36749a836bef7c8cd2a52a6ac97edba9bd2b22ff1c	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DA40188B9189A3EDEEAEDA97FE2F9DF5B7D18A41	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\9BAAE59F56EE21CB435ABE2593DFA7F040D11DCB\Blob = 0300000001000000140000009baae59f56ee21cb435abe2593dfa7f040d11dcb09000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b060105050703030b0000000100000038000000530077006900730073005300690067006e002000530069006c00760065007200200047003200200052006f006f00740020004300410000002000000001000000c1050000308205bd308203a5a00302010202084f1bd42f54bb2f4b300d06092a864886f70d01010505003047310b300906035504061302434831153013060355040a130c53776973735369676e2041473121301f0603550403131853776973735369676e2053696c766572204341202d204732301e170d3036313032353038333234365a170d3336313032353038333234365a3047310b300906035504061302434831153013060355040a130c53776973735369676e2041473121301f0603550403131853776973735369676e2053696c766572204341202d20473230820222300d06092a864886f70d01010105000382020f003082020a0282020100c4f1877fd37831f738c9f8c39943bcc7f7bc37e74e71ba4b8fa5731d5c6e98ae0357ae3837432f173d1fc8ce6810c178ae19032b10fa2c7983f6e8b968b955f20444a739f9fc048b1ef1a24d27f9617bbab7e5a213b6eb613ed06cd1e6fbfa5eed1db49ea0355ba192cbf04992fe850a053ee6d90be24fbbdc9537fc91e9323522d11f3a4e27859db0159432da610d474d6042ae9247e8835a5058e98a8bb95da1dcdd994a1f3667bb48e483b637eb483aaf0f678f1707e804caef6a3187d4c0b6f994717b6764b8b6914a427b652e306a0cf590ee95e6f2cd82ecd9a14aecf6b24be54585e66d7893042e9c826d36a9c431641f86830b2af4350a78c955cf41b047e9309f99be61a80684b9287a5f38d91ba938b0837f73c1c33b482a820f219bb8cca835c3841b83b33ebea49569013a89007804d9c9f49919ab567e5b8b86391591a4102c09328060b393c02ab6180b9d7e8d49f2104a7ff9d5462f1992a399a726acbb8c3ce60ebc4707dc7351f170642f08f9b4471d306c44ea293785926866bc8338fe7b392ed350f01ffb5e60b6a9a6fa2741f19b1872f2f584744ac967c454ae4864df8cd16eb01de1078f081e999c71e94cd8a5f747121f74d1519e86f3c2a223400b73db4ba6e773068cc1a0e9c159ac46fae62ff8cf719c466db9c4158d3879034548efc45dd708ee87392286b20d0f5843f771a9482efdead61f0203010001a381ac3081a9300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041417a0cdc1e441b63a5b3bcb459dbd1cc298fa8658301f0603551d2304183016801417a0cdc1e441b63a5b3bcb459dbd1cc298fa865830460603551d20043f303d303b0609608574015901030101302e302c06082b060105050702011620687474703a2f2f7265706f7369746f72792e73776973737369676e2e636f6d2f300d06092a864886f70d0101050500038202010073c681e027d22d0fe09530e29a417f502c5f5f6261a9866a69180c7449d65d84ea4152186f58ad5056206ac6bd28695891dc911135a93a1dbc1aa5609ed81f7f459169d97ebb7872c1060f2ace8f857061aca0cd0bb839295684324e86bb3dc42ad9d71f72eefe51a12241b17102631a82b062ab5e57121fdfcbdd75a0c05d79908c1be050e6de31fe987b705fa590d8adf802b66fd360dd404b22c53dad3a7a9f1a1a47917933ba82dc326903966e1f4bf071fee36772a0b1bf5c8be4fa9922c784b91b8d23973fed25e0cf65bbf56104efdd1eb25a41225aa19f5d2ce85bc96da90c0c78aa60c6568f015a0c68bc691979c41f7e9705bfc5e924515ed4d54b53edd9235a360365a3c103ad4130f3461b8590af65b5d5b1e4165b78751d977a6d59a92a8f7bdec387891099497378c83dbd5135742ad5f17e691b2abb3bbd25b89a5a3d7261906687ee0cd64dd411740b6afe0b03fca3555789fe4acbae5b1705c8f28d23315338d22d6a3f82b98d086af75e41746ec3117e07ac2960913f38ca57100dbd302fc7a5e641a0daae05879aa0a4656c4c090c89bab8d3b9c0938a30fa8de59a6b15014e67aada62563e840866d2c4367da73e10fc88e0d480e500bdaaf34e06a37a6af96272e3094feb9b0e0123f19fbb7cdcdc6c119725b2f2b46314d2062a678c83f5ceea07d89a6a1eece40abb2a4ceb096039ceca62d82e6e	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F5C27CF5FFF3029ACF1A1A4BEC7EE1964C77D784	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\28903A635B5280FAE6774C0B6DA7D6BAA64AF2E8\Blob = 0b00000001000000660000004100670065006e00630069006100200043006100740061006c0061006e0061002000640065002000430065007200740069006600690063006100630069006f00200028004e0049004600200051002d0030003800300031003100370036002d0049002900000009000000010000003e000000303c06082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030806082b0601050507030903000000010000001400000028903a635b5280fae6774c0b6da7d6baa64af2e820000000010000005a050000308205563082043ea0030201020210ee2b3debd421de14a862ac04f3ddc401300d06092a864886f70d01010505003081f3310b3009060355040613024553313b3039060355040a13324167656e63696120436174616c616e612064652043657274696669636163696f20284e494620512d303830313137362d492931283026060355040b131f53657276656973205075626c6963732064652043657274696669636163696f31353033060355040b132c56656765752068747470733a2f2f7777772e636174636572742e6e65742f766572617272656c20286329303331353033060355040b132c4a657261727175696120456e7469746174732064652043657274696669636163696f20436174616c616e6573310f300d0603550403130645432d414343301e170d3033303130373233303030305a170d3331303130373232353935395a3081f3310b3009060355040613024553313b3039060355040a13324167656e63696120436174616c616e612064652043657274696669636163696f20284e494620512d303830313137362d492931283026060355040b131f53657276656973205075626c6963732064652043657274696669636163696f31353033060355040b132c56656765752068747470733a2f2f7777772e636174636572742e6e65742f766572617272656c20286329303331353033060355040b132c4a657261727175696120456e7469746174732064652043657274696669636163696f20436174616c616e6573310f300d0603550403130645432d41434330820122300d06092a864886f70d01010105000382010f003082010a0282010100b322c74fe297429588478340f61d17f38373241e51f3988ac392b8ff409005708760c900a9b5946519221517c2436c66449a0d043e396fa54b7aaa63b78a449dd963918466e0280fba42e36e8ef714279369ee910ea35f0eb1eb66a2724f121386657a3edb4f07f4a70960da3a4299c7b27fb316951cc7f934b59485d5995ea048a07ee71765b8a275b81ef3e5427dafedf38a48645d821493d8c0e4ffb35072f276f6b35d425079d0943e6b0c00bed86b0e4e2aec3ed2cc82a218653313779e9a5d1a13d8c3db3dc8977aee70eda7e67cdb71cf2d9462df6dd6f538be3fa5850a19b8a8d809754270c4eaefcb0ec834a81222980cb81394b64becf0d090e7270203010001a381e33081e0301d0603551d1104163014811265635f61636340636174636572742e6e6574300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414a0c38b44aa37a545bf97805ad1f178a29be95d8d307f0603551d20047830763074060b2b06010401f5780103010a3065302c06082b06010505070201162068747470733a2f2f7777772e636174636572742e6e65742f766572617272656c303506082b0601050507020230291a2756656765752068747470733a2f2f7777772e636174636572742e6e65742f766572617272656c20300d06092a864886f70d01010505000382010100a0485b8201f64d48b83955359c807a5399d55affb1713bcc3909945ed6daefbe015b5dd31ed8fd7d4fcda041e03493bfcbe2869c379290561cdceb2905e5c49ec735df8a0ccdc52143e9aa88e535c01942635a025ea448183a856fdc9dbc3f9d9cc187b87a6108e9770b7f70ab7addd9972c641e85bfbc7496a1c37a12ec0c1a6e830c3ce872469ffb48d55e97e6b1a1f8e4ef4625949c89db6938beec5c0e56c76551e5508888bf42d52b3de5f9ba9e2eb3caf47392020bbe4c66eb20feb9cbb5997fe6b613faca4b4dd9ee5346063bc64ead935a817e6c2a4b6a05458cf221a43190876c659c9da560953a527ff5d1ab086ef3ee5bf9883d7eb86f6e03e442	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\9C615C4D4D85103A5326C24DBAEAE4A2D2D5CC97	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DD83C519D43481FAD4C22C03D702FE9F3B22F517\Blob = 0b00000001000000920000004100750074006f00720069006400610064002000640065002000430065007200740069006600690063006100630069006f006e0020005200610069007a0020006400650020006c0061002000520065007000750062006c00690063006100200042006f006c006900760061007200690061006e0061002000640065002000560065006e0065007a00750065006c0061000000090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b06010505070307030000000100000014000000dd83c519d43481fad4c22c03d702fe9f3b22f51720000000010000009f0900003082099b30820783a003020102020101300d06092a864886f70d01010505003082011e313e303c060355040313354175746f72696461642064652043657274696669636163696f6e205261697a2064656c2045737461646f2056656e657a6f6c616e6f310b30090603550406130256453110300e06035504071307436172616361733119301706035504081310446973747269746f204361706974616c31363034060355040a132d53697374656d61204e6163696f6e616c2064652043657274696669636163696f6e20456c656374726f6e69636131433041060355040b133a5375706572696e74656e64656e63696120646520536572766963696f732064652043657274696669636163696f6e20456c656374726f6e6963613125302306092a864886f70d010901161661637261697a4073757363657274652e676f622e7665301e170d3037303231363135333535315a170d3237303231313233353935395a3082011e313e303c060355040313354175746f72696461642064652043657274696669636163696f6e205261697a2064656c2045737461646f2056656e657a6f6c616e6f310b30090603550406130256453110300e06035504071307436172616361733119301706035504081310446973747269746f204361706974616c31363034060355040a132d53697374656d61204e6163696f6e616c2064652043657274696669636163696f6e20456c656374726f6e69636131433041060355040b133a5375706572696e74656e64656e63696120646520536572766963696f732064652043657274696669636163696f6e20456c656374726f6e6963613125302306092a864886f70d010901161661637261697a4073757363657274652e676f622e766530820222300d06092a864886f70d01010105000382020f003082020a0282020100b72893d28e790b33f8511af8c5c674025524deb7c28ce68dcae0eae0ae2a0b94f558670b5533c508c5b14cdeae7a465705f6418567034349c72ce6f5f58c4a48a67329e7a4ef39b87785ca4f0cd434fb58147c4449f9d1e2bd32a568f2d357012f34954c7119d9bb75b298e222fd4cbf267a02e77cd04d49451a2deab5d5dd4d2f8ed6fee5bdfa10335a5bba68fb7771cfc5a5dd355cc9462ff2b4c3d341e53bfd2905837ab007e905882a33249b199e439512a23579e61ced4b580fb2795c3d693ee683c2f47fcc919c533e7f092bd0135dc3a914c030367f638092fb04c96363357f7191474b4ddababaf37e76fe848de578c4e90b39676c5011fde512376248caefdb96c1eedd2e5a5d088357135bfaaecd08ca8009ecdadfc65de8e353c9a0fc82f015e8947dad8eb00774aa296af935e7f4c0c9fdfc42681a17d3962e522236267e360a5a3e60ceb0d4faf3378079e5162c7a862b246a376cc202c4a0af8f1bba275b66abe824296b2fd4ebc15c0ec9f68c80c78710086992122ba16879c218bd95fa3fc4a57a60c1331b8c69ea5747d7451ccf61a7209aab35dbba67b86ec712f2968b590c0c76e8a5a108ce10fd0e725ec59ee938c362af7a4f9a2faf6cd32929eb23e81acd32d374bcdc598b7f0b48b78ad3e4b7d4610bfdddd0c196e2ceb7ef84970dc0dc76da8e2ad53c8e25cec2c5962af0517aa6fd67fb1b2e8f0203010001a38202de308202da30120603551d130101ff040830060101ff02010230370603551d120430302e820f73757363657274652e676f622e7665a01b060560865e0202a0120c105249462d472d32303030343033362d30301d0603551d0e04160414660d9c0caebad14a4303ee139b6df1d2d472d59a308201500603551d2304820147308201438014660d9c0caebad14a4303ee139b6df1d2d472d59aa1820126a48201223082011e313e303c060355040313354175746f72696461642064652043657274696669636163696f6e205261697a2064656c2045737461646f2056656e657a6f6c616e6f310b30090603550406130256453110300e06035504071307436172616361733119301706035504081310446973747269746f204361706974616c31363034060355040a132d53697374656d61204e6163696f6e616c2064652043657274696669636163696f6e20456c656374726f6e69636131433041060355040b133a5375706572696e74656e64656e63696120646520536572766963696f732064652043657274696669636163696f6e20456c656374726f6e6963613125302306092a864886f70d010901161661637261697a4073757363657274652e676f622e7665820101300e0603551d0f0101ff04040302010630370603551d110430302e820f73757363657274652e676f622e7665a01b060560865e0202a0120c105249462d472d32303030343033362d3030540603551d1f044d304b3024a022a020861e687474703a2f2f7777772e73757363657274652e676f622e76652f6c63723023a021a01f861d6c6461703a2f2f61637261697a2e73757363657274652e676f622e7665303706082b06010505070101042b3029302706082b06010505073001861b687474703a2f2f6f6373702e73757363657274652e676f622e766530400603551d20043930373035060560865e0102302c302a06082b06010505070201161e687474703a2f2f7777772e73757363657274652e676f622e76652f647063300d06092a864886f70d010105050003820201008219ec31e411a1281c81ab251e386008c6f70c865d430ea5a8307c1532066ae151cdac01136e0619902648581945272f00ee0d9171ed8dc5c23719a0463396cd6728933af3dfe94ec905978824eb166745597c8a67f68fc3f58d6055cd0f81d8016eb881345551f19326b9efb2e489ea91e407136d5fbddc345dbf2fedb20a4d68451d2909888194dbf876f3114c491cd2c94b2a9cb43b930198baea04061bf8a6912bb8ada4071ddbdc2bc5e6528330c337611bfbcabfab007ef2934be94095903bde5671f27ff403dc06cfc7e911dd007618540c7dd2031c844ca92bb4da7676cbf41368db12f0baa62014a18bda25c1a164c331ab8766031cf3c061618a5c51c43c2fe116098f157dc47951987cd58b0548d7f341ece6fc7796c80dcef0e35ede488b9e97fff10080bcb9f5733eca0cff5da7de685e30b8a76de739d8dd3f5a2fe064a6d500d9747bfd6f59b3ddea890efe8bbb404fcf1a4e1a1f0abcac0f94ef634ce96013022715fab664474fea94356481f59e220fd2a65e7f92aaf30071f04f761008d1056469cfcbab15a8f6d70d09c6e7425a01160a2e6f33dda91a95ff208d8e54209dcf1dbdfd248aa920a47053ce10ff5448b2a268f4710b777cccaed7071417d37daeddc770cf628df4af8984ecb353f606797fdf82b7c78e02f6d0dd6a2e6d0186e6be79f9cec5640536107805cbdeb113f1409dd11747cef6	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\90DECE77F8C825340E62EBD635E1BE20CF7327DD\Blob = 03000000010000001400000090dece77f8c825340e62ebd635e1be20cf7327dd090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070308060a2b0601040182370a030406082b0601050507030606082b060105050703070b000000010000005000000049002e00430041002000132020005300740061006e0064006100720064002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000020000000010000002e0400003082042a30820312a003020102020316e360300d06092a864886f70d01010b05003081ab310b300906035504061302435a3139303706035504030c30492e4341202d205374616e646172642043657274696669636174696f6e20417574686f726974792c2030392f32303039312d302b060355040a0c245072766ec3ad20636572746966696b61c48d6ec3ad206175746f726974612c20612e732e31323030060355040b0c29492e4341202d2050726f7669646572206f662043657274696669636174696f6e205365727669636573301e170d3039303930313030303030305a170d3139303930313030303030305a3081ab310b300906035504061302435a3139303706035504030c30492e4341202d205374616e646172642043657274696669636174696f6e20417574686f726974792c2030392f32303039312d302b060355040a0c245072766ec3ad20636572746966696b61c48d6ec3ad206175746f726974612c20612e732e31323030060355040b0c29492e4341202d2050726f7669646572206f662043657274696669636174696f6e20536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100a80856123ffb9483a96076bd45837e96343ccf494ed6cffc20e1e1b102146dadca7e507229a9fd9c77263864f743413f148204a2419002e799f78362784485e89d0570d4fe78a17434c7ac3b8502ddee515b463b5333d667ecec142ee3c4e5b3748300ccc696e61c83dadc185069fadd43d18e40fd16a4b78c6587e0beac971fb071eb00655716ce6c87af9788f05df7874d3a110aa2c24414c016f24ff5db9542af29b329a083516efe3c515793302526ba3b6a86c8f60bd1713f9cb73ac8ce67098cfa401b7a6cdec81ca0c65cbb6118883f2e591d56fc7a459ca6d938d9c560ccb94155b7cabc4deeb4a7c4f6a00ebc89c50195b15cdf4ff0ccc2cd42bb5f0203010001a3553053300f0603551d130101ff040530030101ff300e0603551d0f0101ff04040302010630110603551d20040a300830060604551d2000301d0603551d0e04160414c14c3894d5808648d922902cd3ee1910db674787300d06092a864886f70d01010b05000382010100a3cbd17d74fb35780792e8ee68e9e4525ef0d86391949f68fbbe5bbaa9e16377ab5076c6e95647545099b4258be8c11972365a09bee7d6fac2b6323d47c3504e996e9336c58a517763e04933ab3c1f8ae93bd986b528c7c275715b666a8d580ef37590b5ad2c8118cd9cd8c3cd4ff1fb692097c048cf134512b51cf63e83e24e5edd59c66b4ae048ced92a9d653abd2ff0f04cbc097acb3700a43f3b0c23dde3fbc642a2b4b6e6d272854cdfb3de16a77e1de7d4cfadabb350e4708cdfb07090c9869eee7c848b641c6be168157ec9a574e04ef75aeadd1231ab914085710bce2928f96e38145c1dfeec11bf4d437e9e5f38bfd7ea9e932fd01d74b50509d322	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\85371CA6E550143DCE2803471BDE3A09E8F8770F\Blob = 03000000010000001400000085371ca6e550143dce2803471bde3a09e8f8770f09000000010000002a000000302806082b0601050507030406082b0601050507030206082b0601050507030306082b060105050703010b000000010000001200000056006500720069005300690067006e000000200000000100000006030000308203023082026b02107dd9fe07cfa81eb7107967fba78934c6300d06092a864886f70d01010505003081c1310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e313c303a060355040b1333436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204732313a3038060355040b1331286329203139393820566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d060355040b1316566572695369676e205472757374204e6574776f726b301e170d3938303531383030303030305a170d3238303830313233353935395a3081c1310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e313c303a060355040b1333436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204732313a3038060355040b1331286329203139393820566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d060355040b1316566572695369676e205472757374204e6574776f726b30819f300d06092a864886f70d010101050003818d0030818902818100cc5ed1115d5c69d0abd3b96a4c991f5998308e168520466d473fd4852084e16db3f8a4ed0cf1170f3bf9a7f925d7c1cf8463f27c63cfa247f2c65b338e64400468c180b9641c4577c7d86ef595293c50e834d7781fa8ba6d4391958f45575e7ec5fbcaa404ebea973754306fbb01473233cddc579b646961f89b1d1c894f5c670203010001300d06092a864886f70d010105050003818100514dcdbe5ccb98199c15b20139782e4d0f67707099c6105a94a4534d546d2baf0d5d408b64d3d7eede5661925fa6c41d106136d32c273ce82909b9116474ccb5739f1c48a9bc6101eee217a60ce340083b0ee7eb44732a9af16992ef7114c339ac71a791096fe47106b3ba5957267900f6f80da2333028d4aa58a09d9d6991fd	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4054DA6F1C3F4074ACED0FECCDDB79D153FB901D\Blob = 0b000000010000001e000000440053005400200041004300450053002000430041002000580036000000090000000100000016000000301406082b0601050507030406082b060105050703010300000001000000140000004054da6f1c3f4074aced0feccddb79d153fb901d20000000010000000d04000030820409308202f1a00302010202100d5e990ad69db778ecd807563b8615d9300d06092a864886f70d0101050500305b310b30090603550406130255533120301e060355040a13174469676974616c205369676e61747572652054727573743111300f060355040b13084453542041434553311730150603550403130e4453542041434553204341205836301e170d3033313132303231313935385a170d3137313132303231313935385a305b310b30090603550406130255533120301e060355040a13174469676974616c205369676e61747572652054727573743111300f060355040b13084453542041434553311730150603550403130e445354204143455320434120583630820122300d06092a864886f70d01010105000382010f003082010a0282010100b93df52cc994dc758a955d63e884777666b959915c46dd923e9ff90e03b43d6192bd2326b563ee92d29ed63cc80d905f6481b1a8080d4cd8f9d3052852b40125c5951c0c7e3e108475cfc1199163cfe8a89188b94352bb80b155898b31fad0b776be413d309aa422251773e81ee2d3ac2abd5b3821d52a4bd7557de33a55bdd76d6b02576be6477c08c882badea7873da16db83056c2b302815f2df5e29a301828b866d3cb01966fea8a4555d6e09dff672b1702a64e1a6a110b7eb77be798d68c766fc13bdb50937ee5d08e1f37b8bdbac69f6ce97c33f2323c2647fa272402c97e1d5b8842136a357c7d35e92e66917293d53226c474f553a3b35d9af609cb0203010001a381c83081c5300f0603551d130101ff040530030101ff300e0603551d0f0101ff0404030201c6301f0603551d11041830168114706b692d6f70734074727573746473742e636f6d30620603551d20045b30593057060a608648016503020101013049304706082b06010505070201163b687474703a2f2f7777772e74727573746473742e636f6d2f6365727469666963617465732f706f6c6963792f414345532d696e6465782e68746d6c301d0603551d0e041604140972064e18430fe5d6ccc36a8b317b788fa883b8300d06092a864886f70d01010505000382010100a3d88ed6b2dbce05e732cd01d30403e576e4562b9c9990e808306cdf7d3deee5bfb524408449e1d128aec4c23a533088f1f5776e51cafaff99af245f1ba0fdf2ac84cadfa9f05f042ead16bf219710813de3ff878d32dc94e5478a5e6a13c994953dd2eec83495d080d4ad320880543ce0bd5253d7527cb2693f7f7acf6a74cafa042a9c4c5a06a5e920ad45660f69f1ddbfe9e3328bfae0c1864d723c2ed893780a2af8d8d2273d19895f5a7b8a3bcc0cda51aec70bf72bb03705ecbc5723e238d29b68f35612884f427cb831c4b5dbe4c82134e9481135eefac79257c59f34e4c7f6f70e0b4c9c68787b7131c7eb1ee06741f3b7a0a7cde57a33366afa9a2b	updroots.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A1DB6393916F17E4185509400415C70240B0AE6B	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\18F7C1FCC3090203FD5BAA2F861A754976C8DD25\Blob = 03000000010000001400000018f7c1fcc3090203fd5baa2f861a754976c8dd2509000000010000000c000000300a06082b060105050703080b000000010000003400000056006500720069005300690067006e002000540069006d00650020005300740061006d00700069006e00670020004300410000002000000001000000c0020000308202bc3082022502104a19d2388c82591ca55d735f155ddca3300d06092a864886f70d010104050030819e311f301d060355040a1316566572695369676e205472757374204e6574776f726b31173015060355040b130e566572695369676e2c20496e632e312c302a060355040b1323566572695369676e2054696d65205374616d70696e67205365727669636520526f6f7431343032060355040b132b4e4f204c494142494c4954592041434345505445442c20286329393720566572695369676e2c20496e632e301e170d3937303531323030303030305a170d3034303130373233353935395a30819e311f301d060355040a1316566572695369676e205472757374204e6574776f726b31173015060355040b130e566572695369676e2c20496e632e312c302a060355040b1323566572695369676e2054696d65205374616d70696e67205365727669636520526f6f7431343032060355040b132b4e4f204c494142494c4954592041434345505445442c20286329393720566572695369676e2c20496e632e30819f300d06092a864886f70d010101050003818d0030818902818100d32e20f0687c2c2d2e811cb106b2a70bb7110d57da53d875e3c9332ab2d4f6095b34f3e990fe090cd0db1b5ab9cde7f688b19dc08725eb7d5810736a78cb7115fdc658f629ab585e9604fd2d621158811cca7194d522582fd5cc14058436ba94aab44d4ae9ee3b22ad56997e219c6c86c04a47976ab4a636d5fc092dd3b4399b0203010001300d06092a864886f70d01010405000381810061550e3e7bc792127e11108e22ccd4b3132b5be844e40b789ea47ef3a707721ee259efcc84e389944cdb4e61efb3a4fb463d50340b9f7056f68e2a7f17cee563bf796907732eb095288af5edaaa9d25dcd0aca10098fceb3af2896c479298492dcffba674248a69010e4bf61f89c53e593d1733ff8fd9d4f84ac55d1fd116363	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F48B11BFDEABBE94542071E641DE6BBE882B40B9\Blob = 030000000100000014000000f48b11bfdeabbe94542071e641de6bbe882b40b9090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080b000000010000005600000054005700200047006f007600650072006e006d0065006e007400200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079000000200000000100000076050000308205723082035aa00302010202101f9d595ad72fc20644a5800869e35ef6300d06092a864886f70d0101050500303f310b30090603550406130254573130302e060355040a0c27476f7665726e6d656e7420526f6f742043657274696669636174696f6e20417574686f72697479301e170d3032313230353133323333335a170d3332313230353133323333335a303f310b30090603550406130254573130302e060355040a0c27476f7665726e6d656e7420526f6f742043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a02820201009a25b8eccca275a87bf7ce5b598ac9d186120854ec9cf2e746f688f37ce9a5df4c4736a41b011c7f1e578a8dc3c5d121e3da243f482bfb9f2ea194e72c1c93d1bf1b01875399cea7f50a217677ffa9b7c673944f46f7104937faa859495d6a810756f28af906d0f770224db4b741b932b8b1f0b1c39c3f70fd53dd81aad86378f6d8536ea1ac6a8424725486c6d2b2ca1c0e7981d6b5706208012e4e4f0ed511afa9afe59abfdccc876d26e4c957a2fb96f9cce13f538c6c4c7e9b53080b6c17fb67c8c2adb1cd80b497dc76011615e96ad7a4e17847ce86d5fb31f3fa31be34aa28fb704c1d49c7af2c9d6d66a6b68d647eb5206a9d3b81b68f4000674b8986b8cc65fe1553e904c1d65f1d44d70a2f279a467da10d75ad548615dc493bf196ce0f9ba0eca37a5dbed52a7542e57bdea5b6aaaf28acac90ac38b7d56835267adcf73bf3fd459bd1bb43786e6ff142546a98f00dad97e9525ee9d56a72de6af71b6014f4a5e4b67167aa1feae24dc14240fe674617382f473f719caee521ca612d6d07a8847c2dee5125f163909efde157886bef8a236db1e6bd3fadd13d960b858dcd6b27bbb7059becbb91a90a071202974e2090f0ff0d1ee2413bd3403ae78d5dda66e402b00752985c0e8e339cc2a695fb55196e4c8eae4b0fbdc1384d5e8f841d66cdc56096b4525a05898e957a98c1913c9523b20ef479b4c97cc14a210203010001a36a3068301d0603551d0e04160414ccccefcc2960a43bb192b63cfa32628fac25153b300c0603551d13040530030101ff30390604672a07000431302f302d020100300906052b0e03021a050030070605672a0300000414039bf02213ff952836d3dc9ec032fb313a8a5165300d06092a864886f70d0101050500038202010040804afa26c9ce5e30dd4f86747658f5aeb3833378a47a7417194ee952b5b9e00a7462aa68ca78a04c9a8e2c232ed56a1224bfd468d38ad0d89c9fb41f0cde387e5738fc8de24f5e0c9fab3bd2ff7597cba4e36708ffe5c016b548017de9f90aff1be56a69bf7821a8c2a723a986ab7656e80e0cf613dd2a668a64493d1a188790049f4252b74fcbfe47417635efff00763645329bc646855de224b01ee3489698574794557a0f41b14424f3c1fe1a6bbf88fdc1a6da93605e814a99209c486619b50079540fb82c2f4bbca95d5b607f8c87a5e052632abed83b854015fe1eb6653fc54bda7eb57a3529a32e7a986022a3f47d274e2deab4743ce90fa4330f1011bc1301d6e50ed3bfb512a2e14523c0cc086e61b789ab83e3241ee65d07e71f203ecf67c8e7ac306d274b686e4b2a5c020834dbf876e467a3269c3fa232c24ac58118311056aa84ef2d0affb81f77d2bfa558a062e4d74b91758d8980987e6dcb534e5eaff6b2978597b9da5506b924eed7c6381e631b123b95e158acf2df84d55f992f0d555be638db2e3f72e94885cbbb29138f1e3855b9f3b2c43099234e5df248a1120cdc129009905491033c47e5d5c965e0b74b7dec47d3b30b3ead9ed074000eebbd51adc0de2cc0c36afeefdc0ba7fa46df60db9ca659507523697393b2f9fc02d347e671ce1002ee278c84ffac450d135c8332e025a5862c7cf412	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\EE29D6EA98E632C6E527E0906F0280688BDF44DC\Blob = 0b000000010000003e0000004300680061006d006200650072007300690067006e0020005000750062006c006900630020004e006f007400610072007900200052006f006f0074000000090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308030000000100000014000000ee29d6ea98e632c6e527e0906f0280688bdf44dc2000000001000000c2040000308204be308203a6a003020102020100300d06092a864886f70d01010505003078310b300906035504061302455531273025060355040a131e41432043616d65726669726d61205341204349462041383237343332383731233021060355040b131a687474703a2f2f7777772e6368616d6265727369676e2e6f7267311b3019060355040313125075626c6963204e6f7461727920526f6f74301e170d3033303933303136313434395a170d3337303933303136313434395a3078310b300906035504061302455531273025060355040a131e41432043616d65726669726d61205341204349462041383237343332383731233021060355040b131a687474703a2f2f7777772e6368616d6265727369676e2e6f7267311b3019060355040313125075626c6963204e6f7461727920526f6f743082011f300d06092a864886f70d01010105000382010c003082010702820100587a02bc7eec9366edcb114ea7dd0ecb958dc71e376109e700c5d9e9057beafc9eb4d358b61946e468974f816dacae019e9a40386c78447978398fe7e2c4f57a6cff324c53cb478ed6903dac457c27ca42cf7e74d3a9e9334ed0a59865aa500c54861d806a8e706a9d6c422bc73695c09c42112c6868fe6cfe6a66bd5bb2d7a5ce9b5039049da1241fb6106f2e1776e43b507bc079020088db3547e5b11fd927ff6d35d0b96c56f4b5f54f74572d987204c719077f7ebd2d55a2ac8e89b0482b4edf7405db54650635d5713ce13ad934d1af5e07481c1d00742a21050ec11f774e0ae5e293800edc56b4bb06e03f484253f909350965b842733f3c8d4be401a5020103a38201543082015030120603551d130101ff040830060101ff02010c30400603551d1f043930373035a033a031862f687474703a2f2f63726c2e6368616d6265727369676e2e6f72672f7075626c69636e6f74617279726f6f742e63726c301d0603551d0e041604141a5887cccf64c63bf0a2337449645d06c3abe7f9300e0603551d0f0101ff040403020106301106096086480186f8420101040403020007302b0603551d110424302281207075626c69636e6f74617279726f6f74406368616d6265727369676e2e6f7267302b0603551d120424302281207075626c69636e6f74617279726f6f74406368616d6265727369676e2e6f7267305c0603551d20045530533051060b2b0601040181872e0a02013042304006082b060105050702011634687474703a2f2f6370732e6368616d6265727369676e2e6f72672f6370732f7075626c69636e6f74617279726f6f742e68746d6c300d06092a864886f70d01010505000382010100152829feb822b255bf631f719901e4b3886db775b72f5199914eea69d75db09e7f4a2393b847c67e8ffe7e039e8996523e2fa11bf63d70c33da6de41c344105ea727afb50fe27a93c4bdcc8bfbbcb6734d1f3223a4a37bd0e1835dbfc39ec15448431f292edee5cf4a5cecb39859bb410f8539e606a41cbfa96d9ae429613c9de81d5037b6ac9f30af9ee730ec26fc2a24a1a153a83efd1178d7006d38b2b8acdfd21fbf865805ef1c25c54d391a2c445352c2d720012cc2594fbee4db16d5b35bfa0e0ff66699c2586b97e80c102d2dafcbdd6f23b3979d48467a421302a18d365ff2eed6a198ea377ce9bca1189602b6ca582a1a38d5b271be78a64cf7eac7	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\FEB8C432DCF9769ACEAE3DD8908FFD288665647D	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4313BB96F1D5869BC14E6A92F6CFF63469878237	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\323C118E1BF7B8B65254E2E2100DD6029037F096\Blob = 5300000001000000230000003021301f06092b06010401f022010630123010060a2b0601040182373c0101030200c00b0000000100000012000000470065006f0054007200750073007400000009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303030000000100000014000000323c118e1bf7b8b65254e2e2100dd6029037f0962000000001000000800300003082037c30820264a003020102021018acb56afd69b6153a636cafdafac4a1300d06092a864886f70d01010505003058310b300906035504061302555331163014060355040a130d47656f547275737420496e632e3131302f0603550403132847656f5472757374205072696d6172792043657274696669636174696f6e20417574686f72697479301e170d3036313132373030303030305a170d3336303731363233353935395a3058310b300906035504061302555331163014060355040a130d47656f547275737420496e632e3131302f0603550403132847656f5472757374205072696d6172792043657274696669636174696f6e20417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100beb8157bffd47c7d67ad83647bc842532ddff684082061d601596a9c4411afef76fd957ece6130bb7a835f02bd0166caee158d6fa1309cbda1859e943af356880031cfd8ee6a9602d9ed038cfb756de7eab8551605169af4e05eb188c064855c154d88c7b7bae075e9ad053d9dc78948e0bb28c803e13093645e52c05970223557888af1950a83d7bc31730134edef4671e06b02a835726b979b66e0cb1c795fd81a04681e4702e69d60e2369701dfce3592dfbe67c76d77593b8f9dd6901594bc423410c139f9b1273e7ed68a75c5b2af96d3a2de9be498be7de1e981adb66ffcd70edae034b00d1a77e7e30898ef58fa9c84b736afc2dfacd2f410067071350203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604142cd5504197158bf08f36615b4afb6bd999c93392300d06092a864886f70d010105050003820101005a707f2cddb7344ff58651a926be4bb8aaf1710ddc61c7a0ea341e7a770f0435e8278f6c90bf911624463e4a4ece2b16d50b521dfc1f67a20245314fcef3fa03a7799d536ad9da633af880d7d399e1a5e1bed4557198353abe93eaaead42b2906fe0fc214d3563338949d69b4ecac7e74e0900f7dac7ef99629977b695225e8aa0abf4b87898ca381999c9729e78cd4bacaf19a073122dfcc241ba8191da165a31b7f9b4718012489972735a5953c1635233eda7c9d2390270fae0b1426629aa9b51ed305422145fd9ab1dc1e494f0f8f52bf7eaca7846d6b891fda60d2b1a14013e80f042a095075e6dcdcc4ba4458dab12e8b3de5ae5a07ce80f221d5ae959	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\FD1ED1E2021B0B9F73E8EB75CE23436BBCC746EB\Blob = 0b000000010000001a00000044002d0054005200550053005400200047006d00620048000000090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070308030000000100000014000000fd1ed1e2021b0b9f73e8eb75ce23436bbcc746eb200000000100000099040000308204953082037da0030201020203030e96300d06092a864886f70d0101050500304b310b300906035504061302444531153013060355040a0c0c442d547275737420476d62483125302306035504030c1c442d545255535420526f6f7420436c61737320332043412032303037301e170d3037303531363035323034375a170d3232303531363035323034375a304b310b300906035504061302444531153013060355040a0c0c442d547275737420476d62483125302306035504030c1c442d545255535420526f6f7420436c6173732033204341203230303730820122300d06092a864886f70d01010105000382010f003082010a0282010100ba8dcd355332eea6bd48909af2eae8580f4766a8cc6e0912e4a1cb5bdf93b8f6e93939f8c6d8e9cf1a86bca6ae0f8caf0845e3f28e2bc25c592bfa8c36b3701dc8503ca556beeaaee947f6e7490faf7f9426d4021a07b8ba3955ce9fbb223929d835c5990321d8a73863f1e434df47ae9f37f16ca099c222b06d72dc22c93139e856d7a08f3a215b869a4f28f91c76f7cc4f3ff94e778b2a9c8aaa79418ad51cd9396f98c95e45971d099419d95051857273bfac4b9d7434718721160f7eeed2497eca49d3f9922a47484f0f5d5aa1cbd528ecf092c5724346ebb303a6f357254a0a61840a26d6efa6b8d8148d78b9d3b725d14ee35a16aaec9f07ee23107db50203010001a38201803082017c300f0603551d130101ff040530030101ff301d0603551d0e04160414822f362349782042d7b05258a0d674541578bfaa303906082b06010505070101042d302b302906082b06010505073001861d687474703a2f2f75736572732e6f6373702e642d74727573742e6e657430330603551d11042c302a8110696e666f40642d74727573742e6e65748616687474703a2f2f7777772e642d74727573742e6e6574300e0603551d0f0101ff0404030201063081c90603551d1f0481c13081be3081bba081b8a081b586766c6461703a2f2f6469726563746f72792e642d74727573742e6e65742f434e3d442d5452555354253230526f6f74253230436c617373253230332532304341253230323030372c4f3d442d5472757374253230476d62482c433d44453f63657274696669636174657265766f636174696f6e6c697374863b687474703a2f2f7777772e642d74727573742e6e65742f63726c2f642d74727573745f726f6f745f636c6173735f335f63615f323030372e63726c300d06092a864886f70d01010505000382010100550e680a8ddcd9a886600269798d7de990c2d91d1db50ebb7392646314464cd06abba3755d86193861861db88a2234a3b43515b3a9604c54179fb1de5b32e27e6bde4f22f02d1d22049eb64a4fab2c569de3ddecb1264e2ad755c23ebd82d7be55bb45c8295b863c9d3f68444444360d68bfae01a219b54c97fff2963c67b242de0fe1a0974ecae73465ae9582616726732ddd7be7954b0e21aa92ae4cfcc6b3a9e599833239f060c24c51a8c147143589a54d360f9f1b0271418d424a24f8af6e9d0d70868daa62131e038b24f9c3549349851b7576627f22ff49bd76730c3f98ad2ab2fae7c5df74f5ff6931550a3ac0196235c449b92b191df47099eed8dc	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3E84D3BCC544C0F6FA19435C851F3F2FCBA8E814	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1EAC3E5B82476E9D50B1EC67D2CC11E12E0B491\Blob = 0b000000010000001200000050004f005300540061007200430041000000090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b06010505080202030000000100000014000000b1eac3e5b82476e9d50b1ec67d2cc11e12e0b4912000000001000000f6030000308203f2308202daa00302010202043e43934a300d06092a864886f70d01010505003030310b3009060355040613025349310e300c060355040a1305504f5354413111300f060355040b1308504f535441724341301e170d3033303230373130333635385a170d3233303230373131303635385a3030310b3009060355040613025349310e300c060355040a1305504f5354413111300f060355040b1308504f53544172434130820122300d06092a864886f70d01010105000382010f003082010a02820101009becbf7e3bc3f72f0eacc2af434858eb79950d0bb2a4d38b08148abdb789a712f8476364bac5c5a8d22352177a09a302dfce0ea60affd1cb74c94b3eed235cfeae0c2f4d292d743ea05a1736b2db559c4c8a6bc99f60f9c7a05bcbc34a083ce14deba4f37471b4579e80a392002ce8822319c04bb511820e77f277713592a481e5fa192e13777053c82b19b9528128d40f6eebb8186049b1fb7dbf7f992da9e65b192e8c51aecfd8a4f772d7f17e05960c346e5548ec2682aa41fe255c528b967f15e467a420b209ddf09da9f570831c714652224a9b520013e993a976e96c8370b5644a0539a8cfd6639e3015e3c9a29cd3dd60b7063945960225809453530b0203010001a38201123082010e301106096086480186f842010104040302000730520603551d1f044b30493047a045a043a441303f310b3009060355040613025349310e300c060355040a1305504f5354413111300f060355040b1308504f535441724341310d300b0603550403130443524c31302b0603551d1004243022800f32303033303230373130333635385a810f32303233303230373131303635385a300b0603551d0f040403020106301f0603551d230418301680143fbdcd8edfbed16b65443f60ecea422e30701f68301d0603551d0e041604143fbdcd8edfbed16b65443f60ecea422e30701f68300c0603551d13040530030101ff301d06092a864886f67d0741000410300e1b0856362e303a342e3003020490300d06092a864886f70d010105050003820101003edfa7af51089149c5712aa341136c0be98b1a308d11b70b4d56aa4047d339fe79f8ab68ec947b06113b43866273c3ad2ed4931ef3ac37cb1ec3653bb8b73b6e7a93b191716945eb7822ab8ced4ada54b12f349e5e1a93da48ba12da344e1683414d22f371df1e1ed302b8dc5481d21719f0f5291233588b03256b5b40b51c3b1513561fb3492ef6d2846ce4929b139a4b8e8382a81cd6ac66da10b76f7a15e4bada1c6e0c7c6bdc8ff3fa16197c889a1ce3250172d9378ad46f7e8738bc5355498215cabf98a8b13eac4ee0c94a24156ea2d18972d3c70dbaed6502dfaa4cb397636e3e22c6aad93c3c028288f49743a3599de1e2f748495baa96c2daea1906	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F9B5B632455F9CBEEC575F80DCE96E2CC7B278B7\Blob = 030000000100000014000000f9b5b632455f9cbeec575f80dce96e2cc7b278b7090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b060105050703070b0000000100000018000000410066006600690072006d0054007200750073007400000053000000010000002400000030223020060a2b06010401828f09020130123010060a2b0601040182373c0101030200c02000000001000000500300003082034c30820234a00302010202087777062726a9b17c300d06092a864886f70d01010b05003044310b300906035504061302555331143012060355040a0c0b41666669726d5472757374311f301d06035504030c1641666669726d547275737420436f6d6d65726369616c301e170d3130303132393134303630365a170d3330313233313134303630365a3044310b300906035504061302555331143012060355040a0c0b41666669726d5472757374311f301d06035504030c1641666669726d547275737420436f6d6d65726369616c30820122300d06092a864886f70d01010105000382010f003082010a0282010100f61b4f67072ba115f50622cb1f01b2e373450644492cbb492514d6cec3b7ab2c4fc641329457fa12a75b0ee28f1f1e8619a7aab52db95f0d8ac2af853579322dbb1c6237f2b15b4a3dcacd715fe942be94e8c8def9224864c6e5abc62b6dad05f0fad50bcf9ae5f050a48b3b47a5235b7a7af8333fb8ef9997e320c1d62889cf94fbb945ede3401711d474f00b31e22b266a9b4c57aeac203eba457a05f3bd9b6915ae7d4e2063c435763a0702c937fdc747eee8f1761d7315f297a4b5c87a79d942aa2b7f5cfece264fa3668135af44ba541e1c3032659de63c935e504e7ae33ad46ecc1afbf9d237ae242aab570322280d49757fb728da75bf8ee3dc0e79310203010001a3423040301d0603551d0e041604149d93c6538b5ecaaf3f9f1e0fe59995bc24f6948f300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106300d06092a864886f70d01010b0500038201010058acf4040ecdc00dff0afdd4ba165f29bd7b68995849d2b41d374d7f277d46065d43c6862e3e73b2267d4f93a9b6c42a9aab219714b1de8cd3ab8915d86b24d4f116aed8a45cd47f518eed1801b19363bdbcf861809a9eb1ce4270e2a97d06257d27a1fe6fecb31e24dae34b551a003b35b43bd9d75d30fd811389f2c2062bed67c48ec943b25c6b158902bc62fc4ef2b533aab26fd30aa250e3f63be82e44c2db6638a9335648f16d1b338d0d8c3f60379dd3ca6d7e347e0d9f72768b1b9f72fd5235414502962f1cb29a734921b149474547b4ef6a3411c94d9acc59b7d6029e5a4e65b594ae1bdf29b016f1bf009e073a1764b504b52321990a953b977cef	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\627F8D7827656399D27D7F9044C9FEB3F33EFA9A	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\9078C5A28F9A4325C2A7C73813CDFE13C20F934E\Blob = 0300000001000000140000009078c5a28f9a4325c2a7c73813cdfe13c20f934e090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000004800000053004500520056004900430049004f0053002000440045002000430045005200540049004600490043004100430049004f004e0020002d00200041002e004e002e0043002e0000002000000001000000ff030000308203fb308202e3a003020102020436e58d9e300d06092a864886f70d01010505003081b4310b3009060355040613025559312b3029060355040a132241444d494e495354524143494f4e204e4143494f4e414c20444520434f5252454f53311f301d060355040b1316534552564943494f5320454c454354524f4e49434f53312c302a06035504031323534552564943494f532044452043455254494649434143494f4e202d20412e4e2e432e31293027060a0992268993f22c6401031419636f7272656f5f6365727440636f7272656f2e636f6d2e7579301e170d3939303330393231303830375a170d3039303330393231303830375a3081b4310b3009060355040613025559312b3029060355040a132241444d494e495354524143494f4e204e4143494f4e414c20444520434f5252454f53311f301d060355040b1316534552564943494f5320454c454354524f4e49434f53312c302a06035504031323534552564943494f532044452043455254494649434143494f4e202d20412e4e2e432e31293027060a0992268993f22c6401031419636f7272656f5f6365727440636f7272656f2e636f6d2e757930820122300d06092a864886f70d01010105000382010f003082010a0282010100b22a2fec2b596a439389462a8ae5ecfa05fae2c8de416baf03db005aef4837cf5789fbddc99210de7703951c903ec7b667253b5598efd93cfe26e48a3b44a97437830a772774b8a971addd9713d2caa22eb8ba9dc9be59e8d972f28a85661c475eb48782d60fdf6726a6bd36b1f35d90505176322c3b2faa5f615ee354d5125dff0d8d11c7827a36dfe14c16c474dd2d6aefd0b1f033a7febf376743122e794a94af84fb0711084e309375e90154cec5de1486f0aeae9b72250f4477e2f36caf799c2e49c79e987632169abc00dee0b420059117dd801514ee3641c4218feed9004a19c67161a5115d003be4a7746c3a4a6e83e07a315c2165f80887428767e50203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d01010505000382010100991f49225cf8657f836e90662f02cfb4f6563a6636a1b7920d36c34558364be6ccf15acc73329e9aa8aed376ebeffe802ce31034b2479f1c256ae844b58f4cbe81f3d0c0c10bcd0316a04255564ec1e3b420ad5f9bb6555f481012ef24b3567ccc051bb2c92aa96811927e2fe93f44f1d0c6901b4bddf76122ec69861540b3e2a56a77f3b3f25427da492a6419f439de7c7686d99c72570a34f5f52fd039681bdb45a518e380543b93109014c21401aaa5762d7d0fe456f3ff732a6f8ec1d880fbbb901d1b1a499c0463c4421df36fbbb3494add47ed49ba022d2a8cc70356b9e268d0c1b086b58c4b3aae8d1c88844cfd50af99267608c280ad287955d32de6	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\54F9C163759F19045121A319F64C2D0555B7E073\Blob = 03000000010000001400000054f9c163759f19045121a319f64c2d0555b7e073090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000004e000000430065007200740069007300690067006e0020004100750074006f00720069006400610064006500200043006500720074006900660069006300610064006f00720061002000410043003400000020000000010000006e0200003082026a308201d3a003020102020100300d06092a864886f70d01010405003072310b3009060355040613024252312e302c060355040a132543657274697369676e20436572746966696361646f7261204469676974616c204c7464612e31333031060355040b132a43657274697369676e202d204175746f72696461646520436572746966696361646f7261202d20414334301e170d3939303632373030303030305a170d3138303632373030303030305a3072310b3009060355040613024252312e302c060355040a132543657274697369676e20436572746966696361646f7261204469676974616c204c7464612e31333031060355040b132a43657274697369676e202d204175746f72696461646520436572746966696361646f7261202d2041433430819f300d06092a864886f70d010101050003818d0030818902818100ec83d4cc83903f5fecbec1e9d0c75846591ff1934ab217130bcf2999ab044533e3d15ebebc8e257762dd9b929b310a404579d5f2b3dd6cb940fd987f40a22de9b293bd4bd5c1dee9d1fa71f73f41bcf414afcd6bc8394a9d6065b484d06a41e963ae9b69eab9461cdb18083b624cde41d79e867f137211d4dceade60a5bbdd1b0203010001a310300e300c0603551d13040530030101ff300d06092a864886f70d010104050003818100295d8df6e753bdeca3811641b11ef8243da5b70e3ef37ffb8ec89ea356e71441df2e25dd4eed1240dfd94219c430989499528a23c069b59a827943dc89041f32bf6b8dbe2873294ca3fb54cd63fb5f546b521518a0ea95c70f09a9ef8fbeab6abcd6a806a4e2d27de3f24e10b9c03c2e25a1f293baa18db6af87c699d33ea11f	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E619D25B380B7B13FDA33E8A58CD82D8A88E0515	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3C71D70E35A5DAA8B2E3812DC3677417F5990DF3	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CBA1C5F8B0E35EB8B94512D3F934A2E90610D336	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c13090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f007400200043004100200058003300000020000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DE28F4A4FFE5B92FA3C503D1A349A7F9962A8212\Blob = 0b0000000100000026000000470065006f0054007200750073007400200047006c006f00620061006c002000430041000000090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308030000000100000014000000de28f4a4ffe5b92fa3c503d1a349a7f9962a8212200000000100000058030000308203543082023ca0030201020203023456300d06092a864886f70d01010505003042310b300906035504061302555331163014060355040a130d47656f547275737420496e632e311b30190603550403131247656f547275737420476c6f62616c204341301e170d3032303532313034303030305a170d3232303532313034303030305a3042310b300906035504061302555331163014060355040a130d47656f547275737420496e632e311b30190603550403131247656f547275737420476c6f62616c20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100dacc186330fdf417231a567e5bdf3c6c38e471b77891d4bca1d84cf8a843b603e94d21070888da582f663929bd05788b9d38e805b76a7e71a4e6c460a6b0ef80e489280f9e25d6ed83f3ada691c798c9421835149dad9846922e4fcaf18743c11695572d50ef892d807a57adf2ee5f6bd2008db914f8141535d9c046a37b72c891bfc9552bcdd0973e9c2664ccdfce831971ca4ee6d4d57ba919cd55dec8ecd25e3853e55c4f8c2dfe502336fc66e6cb8ea4391900b7950239910b0efe382ed11d059af64d3e6f0f071daf2c1e8f6039e2fa36531339d45e262bdb3da814bd32eb180328520471e5ab333de138bb073684629c79ea1630f45fc02be8716be4f90203010001a3533051300f0603551d130101ff040530030101ff301d0603551d0e04160414c07a98688d89fbab05640c117daa7d65b8cacc4e301f0603551d23041830168014c07a98688d89fbab05640c117daa7d65b8cacc4e300d06092a864886f70d0101050500038201010035e3296ae52f5d548e2950949f991a14e48f782a6294a227679ed0cf1a5e47e9c1b2a4cfdd411a054e9b4bee4a6f5552b324a1370aeb64762a2e2cf3fd3b7590bffa71d8c73d37d2b5059562b9a6de893d367b38774897aca6208f2ea6c90cc2b2994500c7ce11512222e0a5eab615480964ea5e4f74f7053ec78a520cdb15b4bd6d9be5c6b15468a9e36990b69aa50fb8b93f207dae4ab5b89ce41db6abe694a5c1c783addbf527870e046cd5ffdda05ded8752b72b1502ae39a66a74e9dac4e7bc4d341ea95c4d335f92092f88665d7797c71d7613a9d5e5f116091135d5acdb2471702c98560bd917b4d1e3512b5e75e8d5d0dc4f34edc2056680a1cbe633	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DF646DCB7B0FD3A96AEE88C64E2D676711FF9D5F\Blob = 030000000100000014000000df646dcb7b0fd3a96aee88c64e2d676711ff9d5f090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b060105050703070b00000001000000480000005400570043004100200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790020003200000020000000010000007f0500003082057b30820363a003020102020101300d06092a864886f70d01010b0500305f310b300906035504061302545731123010060355040a0c0954414957414e2d43413110300e060355040b0c07526f6f74204341312a302806035504030c215457434120526f6f742043657274696669636174696f6e20417574686f72697479301e170d3038303832383037343731335a170d3330313233313135353935395a305f310b300906035504061302545731123010060355040a0c0954414957414e2d43413110300e060355040b0c07526f6f74204341312a302806035504030c215457434120526f6f742043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a0282020100cb010c6481bb504899f31cd920b08ba48712f7ae4fce5e73cba88615e21cf9996306da1cd60abcfe94bade6081689cb2f24b7701dab71bc6f9f560902078fc314a3e3577c01a1e8c59557855704192099b024ac36fac0b98e9b2527d9a7fbf5d1f038742fdc31cea633065d1b58e9c695a6bee338dafbafa632450892dc9051e6ceb8e5e8e0148a180c338452b4e1ff422c2f82e4a767eeace9cd1188757f6b6faedcc90558e80ca35b9da646516cce96451593efb8ace80b0a5924563fd9b9600bc5c5e868ec549df14a8c9919b78f71c8c2686689af981c3817b3d33db105e3d0469d666e0ae39dc89e2e626fb517f7ba8096b872638cdd98d2d9e3dcab1f32b9bfd46ed81dbcf8521bec045c9e589dd7697bfb48144293bb7981734f2b8aa9ab07b415526c13cb4249796ad1b8f3671b72bf3b6830230fab20a13bc4bb60ff9a39d636e2250d328dc5f36073c29ac4568ea22405d3f09c70a328fcab4e5e8d7d7ca8b64ff6f6525ec0d74a8b51c1a26e628b272cecdfac4244a3712e2d8b709ceac2e273dc214ebea308c37ca73198589b3bbfb38431d79a5a58b1924a0a612521afed157c19d127b9d95d66c7b4a1dc1ae15024d2c63a075273ffef20020324ae5b1ac2e13e048a6f44e91540cd974583e1175edfa9cc2aabb487fcbf65f5c26b009877ac4fd9c7eaf336742571653fef13d4340528ab635714ffc013ce50203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414c8445afe7ffda99b8635bee2a5f619fb5ebf6f59300d06092a864886f70d01010b05000382020100128bddd5089d286f08f189566d4007abfbe108a804a4bed77d85ae5a58b6674c0169cdac8b368e5cfd3b3601f9d5a17b287a4c8493cdc40b19f01204894d8feda0992585bb2c95996c30ed6d046fe62bfb8910bb4c930cbe93d5d60984930070cfcec5781aed5554df2f0e5958f83585ae4ff821d292de21ba99d197f1609eac4443a760af89e251d23989109415cf04d22182efcaed69154f19abbc936a9901e002d11c3a9d31caf5fbc4f64d9abb208c3f6f71327f274b447f8151e9931b620ea4875f3ddd5440b924976257958ec71091a798c5584250a9961ce54ab6b6b2dc4e91f280d291e85008d31640890f6813aec35c57171317ed331db2ea91f6aa2e71444089b2e066bdb1bd173d4d3d0f57392565046a2a83db38b5cebfe400d74d283790a8a9a6e4b155f0cacfe30c6a2f4796b7d4e4efc837033c7feb81928a2a69981d013b488a2d6bafe5cfb2b4ddd6677a80010b045725b665420f49e123ca40aac22cfc85af6518aa0731db2daeebc371e668df3797f99a3ff1255ef0df57e9fc12e039068774dd63936b81c4f3e0db0914d8bfbf406f71812668f7a58517405203be5c9314e541521577bc35a147732a0c975c8cde313c638cf09b5f544fd2e25b6c3c1cc3e7346673a641a32032447bcdeabc6997fd437031bc3282a26598a3402f6a46f400502e55e0db7a4ee06dc868e154e8958318befacd8f1d66	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A9E9780814375888F20519B06D2B0D2B6016907D	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F9B5B632455F9CBEEC575F80DCE96E2CC7B278B7	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DF646DCB7B0FD3A96AEE88C64E2D676711FF9D5F	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\75E0ABB6138512271C04F85FDDDE38E4B7242EFE\Blob = 03000000010000001400000075e0abb6138512271c04f85fddde38e4b7242efe090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c02000000001000000be030000308203ba308202a2a003020102020b0400000000010f8626e60d300d06092a864886f70d0101050500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523231133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3036313231353038303030305a170d3231313231353038303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523231133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100a6cf240ebe2e6f28994542c4ab3e21549b0bd37f8470fa12b3cbbf875fc67f86d3b2305cd6fdadf17bdce5f86096099210f5d053defb7b7e7388ac52887b4aa6ca49a65ea8a78c5a11bc7a82ebbe8ce9b3ac962507974a992a072fb41e77bf8a0fb5027c1b96b8c5b93a2cbcd612b9eb597de2d006865f5e496ab5395e8834ecbc780c0898846ca8cd4bb4a07d0c794df0b82dcb21cad56c5b7de1a02984a1f9d39449cb24629120bcdd0bd5d9ccf9ea270a2b7391c69d1bacc8cbe8e0a0f42f908b4dfbb0361bf6197a85e06df26113885c9fe0930a51978a5aceafabd5f7aa09aa60bddcd95fdf72a960135e0001c94afa3fa4ea070321028e82ca03c29b8f0203010001a3819c308199300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604149be20757671c1ec06a06de59b49a2ddfdc19862e30360603551d1f042f302d302ba029a0278625687474703a2f2f63726c2e676c6f62616c7369676e2e6e65742f726f6f742d72322e63726c301f0603551d230418301680149be20757671c1ec06a06de59b49a2ddfdc19862e300d06092a864886f70d01010505000382010100998153871c68978691ece04ab8440bab81ac274fd6c1b81c4378b30c9afcea2c3c6e611b4d4b29f59f051d26c1b8e983006245b6a90893b9a9334b189ac2f887884edbdd71341ac154da463fe0d32aab6d5422f53a62cd206fba2989d7dd91eed35ca23ea15b41f5dfe564432de9d539abd2a2dfb78bd0c080191c45c02d8ce8f82da4745649c505b54f15de6e44783987a87ebbf3791891bbf46f9dc1f08c358c5d01fbc36db9ef446d7946317e0afea982c1ffefab6e20c450c95f9d4d9b178c0ce501c9a0416a7353faa550b46e250ffb4c18f4fd52d98e69b1e8110fde88d8fb1d49f7aade95cf2078c26012db25408c6afc7e4238406412f79e81e1932e	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0747220199CE74B97CB03D79B264A2C855E933FF	updroots.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 4948	1076	b5d35117240f2342dec45eee36d06bb7bc5b434c8c98085d83f11be2ac0ed5b0.exe	85
PID 1076 wrote to memory of 4948	1076	b5d35117240f2342dec45eee36d06bb7bc5b434c8c98085d83f11be2ac0ed5b0.exe	85
PID 1076 wrote to memory of 4948	1076	b5d35117240f2342dec45eee36d06bb7bc5b434c8c98085d83f11be2ac0ed5b0.exe	85
PID 4948 wrote to memory of 3728	4948	KB931125.exe	86
PID 4948 wrote to memory of 3728	4948	KB931125.exe	86
PID 4948 wrote to memory of 3728	4948	KB931125.exe	86
PID 4948 wrote to memory of 4184	4948	KB931125.exe	87
PID 4948 wrote to memory of 4184	4948	KB931125.exe	87
PID 4948 wrote to memory of 4184	4948	KB931125.exe	87
PID 4948 wrote to memory of 4884	4948	KB931125.exe	88
PID 4948 wrote to memory of 4884	4948	KB931125.exe	88
PID 4948 wrote to memory of 4884	4948	KB931125.exe	88
PID 4948 wrote to memory of 1704	4948	KB931125.exe	89
PID 4948 wrote to memory of 1704	4948	KB931125.exe	89
PID 4948 wrote to memory of 1704	4948	KB931125.exe	89

C:\Users\Admin\AppData\Local\Temp\b5d35117240f2342dec45eee36d06bb7bc5b434c8c98085d83f11be2ac0ed5b0.exe
"C:\Users\Admin\AppData\Local\Temp\b5d35117240f2342dec45eee36d06bb7bc5b434c8c98085d83f11be2ac0ed5b0.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Users\Admin\AppData\Local\Temp\{B761BD9E-98A8-4c1c-8634-D59D1BD1A9C6}-TemporaryCache\KB931125.exe
  "C:\Users\Admin\AppData\Local\Temp\{B761BD9E-98A8-4c1c-8634-D59D1BD1A9C6}-TemporaryCache\KB931125.exe"
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4948
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe authroots.sst
    3⤵
    - Executes dropped EXE
    - Modifies system certificate store
    PID:3728
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe updroots.sst
    3⤵
    - Executes dropped EXE
    - Modifies system certificate store
    PID:4184
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe -l roots.sst
    3⤵
    - Executes dropped EXE
    - Modifies system certificate store
    PID:4884
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe -d delroots.sst
    3⤵
    - Executes dropped EXE
    PID:1704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ADVPACK.DLL

Filesize
89KB

MD5
a64e4b204d44548eeb5c3d86eca2ad70

SHA1
e3245bf6dbb2e56d71a9cbad2697aa4fa0df6bbe

SHA256
985a5603ebf94539ac11549999f83b5e6dc008180994898c5daa6fd31ae1e9dc

SHA512
dca4099318954bab5f1204645be0d0e8fea0c2e97ee95496fa884fbed627e376358623fa94c39bf0abe97d07d46a7e6c5e1081496cdd1987e07e595995a46cd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\authroots.sst

Filesize
73KB

MD5
bb49ccc10926cdb601eba81afef749a2

SHA1
a4766c9aea8d211e9632148fd4b625cece195be9

SHA256
f013ee3b7fede9a95844e83e83ee298d38cba6efce5a5cafcd8b95255c32f86c

SHA512
94c2809727039d1ed07a3742a4b2f9300e865ea7c49bc1fcf547a30238eeecc88d8dd06a2d4f3112317f948908b9af082b50f412a41a2bcb48d5e30d6d8ecbba

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\delroots.sst

Filesize
9KB

MD5
7b32871e409608ff887b6cf4d87debb0

SHA1
191f9ea1298ee52dbd6f977b3584109a064f57b9

SHA256
3f01268547364d2d60a0f65b46757cccfd9225fc39d581846a8fbffdb5756ff2

SHA512
534a384f7946db4083e639b8e02d83ac97293c60630b8811a84c85e0330e9c293f05f5cf71e0f3580551e7923bc5a3bfb7f0406432ca3cdb7efeb4a950ac5e8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\roots.sst

Filesize
7KB

MD5
9e5de0fd1f90486a66dee4bfe89a78d7

SHA1
90e3188ef63495aaa71c85d4ff0f23253c834b40

SHA256
8b95ff56d61586582864d05563762615c8705779578dca3c98a303c3b1f4122e

SHA512
60006fa6f57e4d280642d51055f85f8d27b913ce71373de5b928c515c77647295030ab73ab4a55024de4a40c18f200909f49ffb52c26cf554835fc3d4cc348f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rootsupd.inf

Filesize
1KB

MD5
421e60325404f5f29ac04c9b9d59096b

SHA1
aace2fd74d799e8af5c8d5b2646361bb67a1620c

SHA256
571a8da5298aacc37700c747ee5d72b5a7797835140e7a4d4f895e9604574d77

SHA512
86693975b1b187ee65b0a23b1f3f8e05d1a3f61e7e47b060f938fe1602bbad96021847b709e64c2d5a295b72f10f4db587a11a1e7ca0a0b64c3bed7fa683b1d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe

Filesize
5KB

MD5
9c18ae971cbffb096952177f6804ea31

SHA1
bb255dd1bd9bb39cdbb8671af66054432c686828

SHA256
2703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb

SHA512
21086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.sst

Filesize
320KB

MD5
2d9b4498c847715418160bfd7e7c8a2d

SHA1
e0873091d476d2566aa6fc988cb364247c95dc97

SHA256
c49c05b701c390c679e5e3226ec621f22a08155b1065fcfc37b509f648f03b41

SHA512
dcf3208cdd1e4353f82823f796d735c1209f149f183eea827a90753ec55509a1c460a16c120e07c12a5eacf0e67d2661c25638491ecf4403e25d6508983e519b

Download Submit
C:\Users\Admin\AppData\Local\Temp\{41151D70-B52E-4e11-8D91-FEB4E8A07924}-TemporaryCache\7z.dll

Filesize
1.1MB

MD5
f0fef6362d4886e85a186a5e3766650a

SHA1
65843b7052a4d1b84762479d79445c46834e18b5

SHA256
15b9fe7d408cbf2204039087526e7df947df57b42ea479e303b682e956638816

SHA512
3f6dfd701cf62b77219f8825a2257c4bd7d44ebafc5654b06abaf906ced2571f4eeb04fe22ae6136c14bddebddb12555aa6efd322e779443d57bb122ea786043

Download Submit
C:\Users\Admin\AppData\Local\Temp\{B761BD9E-98A8-4c1c-8634-D59D1BD1A9C6}-TemporaryCache\KB931125.exe

Filesize
349KB

MD5
4a4d72d34f9da1fc5019e0748fcde2f5

SHA1
f54752ec63369522f37e545325519ee434cdf439

SHA256
83b660f3f3eaddd4b388ed3f806f7444f03429fb63fc1f8db3d86294914a05ca

SHA512
95986ffbf51483a0d1a256028847c7ee6ac73ffd62f6d838309a69e1833f719a7cfed5422815f4d4a49dbd599c449f8db8f60273136720cb1da5f8b0eb24cb33

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads