Analysis
-
max time kernel
117s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23/05/2024, 21:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0d13f10ee700c117477011784fd404780fa86504a8976f7d1e4e45a00c963fa2.dll
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
0d13f10ee700c117477011784fd404780fa86504a8976f7d1e4e45a00c963fa2.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
0d13f10ee700c117477011784fd404780fa86504a8976f7d1e4e45a00c963fa2.dll
-
Size
5.0MB
-
MD5
a7e65143d36eb40c13d04b26cfce91c7
-
SHA1
192974951ec6158099569c957540cd0b6dc838a2
-
SHA256
0d13f10ee700c117477011784fd404780fa86504a8976f7d1e4e45a00c963fa2
-
SHA512
100f1e2aac82d81f7a45ceddb90680627e3d5f512ffd883dafb9594eaa96123c228add73b0b21aa1920c398922b1032b0895427c04436be54cad7e775247f618
-
SSDEEP
98304:PGuOaRQyiAPGLD8f5eIBOxHQT3xma1BPepZUsx6HTpKVc:hRQyTheIUedVBGpZUg6HTpd
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 4 2464 rundll32.exe 5 2464 rundll32.exe -
Modifies Installed Components in the registry 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A} KB931125.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\ = "RootsUpdate" KB931125.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\IsInstalled = "1" KB931125.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\Version = "28,0,2195,0" KB931125.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\Locale = "*" KB931125.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\ComponentID = "Windows Roots Update" KB931125.exe -
Executes dropped EXE 5 IoCs
pid Process 2392 KB931125.exe 2440 updroots.exe 2840 updroots.exe 2896 updroots.exe 864 updroots.exe -
Loads dropped DLL 16 IoCs
pid Process 2464 rundll32.exe 2464 rundll32.exe 2392 KB931125.exe 2392 KB931125.exe 2392 KB931125.exe 2392 KB931125.exe 2440 updroots.exe 2392 KB931125.exe 2392 KB931125.exe 2840 updroots.exe 2392 KB931125.exe 2392 KB931125.exe 2896 updroots.exe 2392 KB931125.exe 2392 KB931125.exe 864 updroots.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 rundll32.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.app.log KB931125.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2316 2464 WerFault.exe 28 -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0b0000000100000012000000440069006700690043006500720074000000090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B31EB1B740E36C8402DADC37D44DF5D4674952F9\Blob = 53000000010000002400000030223020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c00b000000010000001000000045006e0074007200750073007400000009000000010000005e000000305c06082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030606082b0601050507030706082b0601050508020206082b06010505070308060a2b0601040182370a0304030000000100000014000000b31eb1b740e36c8402dadc37d44df5d4674952f92000000001000000950400003082049130820379a0030201020204456b5054300d06092a864886f70d01010505003081b0310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31393037060355040b13307777772e656e74727573742e6e65742f43505320697320696e636f72706f7261746564206279207265666572656e6365311f301d060355040b1316286329203230303620456e74727573742c20496e632e312d302b06035504031324456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479301e170d3036313132373230323334325a170d3236313132373230353334325a3081b0310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31393037060355040b13307777772e656e74727573742e6e65742f43505320697320696e636f72706f7261746564206279207265666572656e6365311f301d060355040b1316286329203230303620456e74727573742c20496e632e312d302b06035504031324456e747275737420526f6f742043657274696669636174696f6e20417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100b695b64342fac66d2a6f48df944c395705eec37911416836edecfe9a018fa13828fcf71046662e4d1e1ab11a4ec6d1c09588b0c9ff318b3303dbb7837b3e20845eedb25628a7f8e0b9407137c5cb470e972a68c022956215db47d9f5d02bff824bc9ad3ede4cdb9080503f098a8400ec300a3d18cdfbfd2a599a2395172c459e1f6e43796d0c5c98fe48a7c523475c5efd6ee71eb4f66845d186835ba28a8db1e32980fe257188adbebc8fac52964baa518de4133119e84e4d9fdbacb36ad5bc395471ca7a7a7f90dd7d1d80d981bb5926c211fee693e2f780e465fb34370e2980704daf38862e9e7f57af9e17aeeb1ccb28215fb61cd8e7a20422f9d3dad8cb0203010001a381b03081ad300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff302b0603551d1004243022800f32303036313132373230323334325a810f32303236313132373230353334325a301f0603551d230418301680146890e467a4a65380c78666a4f1f74b43fb84bd6d301d0603551d0e041604146890e467a4a65380c78666a4f1f74b43fb84bd6d301d06092a864886f67d0741000410300e1b0856372e313a342e3003020490300d06092a864886f70d0101050500038201010093d430b0d703202ad0f963e8910c0520a95f19ca7b724ed4b1dbd096fb545a192c0c08f7b2bc85a89d7f6d3b52b32adbe7d4848c63f60fcb260191506cf45f14e29374c0139e303a50e3b460c51cf022448d7147acc81ac9e99b9a006013ff707e5f114d491bb315527bc954dabf9d95af6b9ad89ee9f1e4438de211443abfafbd834273528baabba729cff5641c0a4dd1bcaaac9f2ad0ff7f7fda7deab1ed3025c184da34d25b788356ec9c36c326e211f667491d92ab8cfbebff7aee854aa75080f0a75c4a942e5f05993c5241e0cdb463cf0143ba9c83dc8f603bf35ab4b47baeda0b903875ef811d66d2f7577036b3bffc28af7125855b13fe1e7f5ab43c updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B12E13634586A46F1AB2606837582DC4ACFD9497 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\61573A11DF0ED87ED5926522EAD056D744B32371\Blob = 5300000001000000220000003020301e0608608442011a01030330123010060a2b0601040182373c0101030200c00b000000010000002a0000004200750079007000610073007300200043006c0061007300730020003300200043004100200031000000090000000100000020000000301e06082b0601050507030106082b0601050507030206082b0601050507030403000000010000001400000061573a11df0ed87ed5926522ead056d744b32371200000000100000057030000308203533082023ba003020102020102300d06092a864886f70d0101050500304b310b3009060355040613024e4f311d301b060355040a0c14427579706173732041532d393833313633333237311d301b06035504030c144275797061737320436c61737320332043412031301e170d3035303530393134313330335a170d3135303530393134313330335a304b310b3009060355040613024e4f311d301b060355040a0c14427579706173732041532d393833313633333237311d301b06035504030c144275797061737320436c6173732033204341203130820122300d06092a864886f70d01010105000382010f003082010a0282010100a48ed774d92964de5f1f878091ea4e39e619c6440b80d50baf53078b12bde667f002b189f6608ac45bb042d1c021a8cbe19bef6451b6a7cf15f57480680490a058a2e674a653535548633f9256dd244e8ef8ba2bfff3348a9e28d7349fac2fd60ff1a42fbd52b249856d3935f04430934624f3b6e753fbbc61afa9a314fbc21717846ce07c88f8c91c572cf03d7e94bc259384e89a009a4505425780f44eced9ae39f6c853100c653a477b60c2d6fa91c9c6716cbd91873c918649abf30fa06c26765e1cac9b71e58dbc9b211e9cd6387e248015318296b149d362375b880c0a6234fea7487e99b1308b9037951ca81fa52c8df455c8dbdd590ac2ad78a0f48b0203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604143814e6c8f0a9a403f44e3e22a35bf2d6e0ad4074300e0603551d0f0101ff040403020106300d06092a864886f70d010105050003820101000167a38cc9253d13635d166feca13e095c91152a2ad980214f05dcbba589ab13332a9e38b78c6f027263c773771e0906ba3b287ba447c9616b080820fc8a058a1fbcbac6c2fecf6eec133371672e69faa92c3f66c012594d0b54029284bbdb12ef83707078c853fadfc6c6ffdc882f07c0499d325760d3f2f699295fe7aa01ccac33a81c0abb91c403a06fb634f986d3b3765498f44a81b3539d4d40ece5771345af5baa1fd82f4c827bfe2ac458bb4ffc9efd03651a2a0ec3a52016946b79a6a212b4bb1aa4237a5ff0ae8424e4f32bfb8a24a3279865da307576fc1991e8dbeb9b3f32bf40970726baccf394854a7a2793cf9042d4b85b16a6e7cb4003dd79 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\971D3486FC1E8E6315F7C6F2E12967C724342214 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C060ED44CBD881BD0EF86C0BA287DDCF8167478C\Blob = 030000000100000014000000c060ed44cbd881bd0ef86c0ba287ddcf8167478c090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b060105050703070b000000010000002400000044006900670069004e006f00740061007200200052006f006f007400200043004100000053000000010000002800000030263024060e6084100187690101010c0601010130123010060a2b0601040182373c0101030200c020000000010000008e0500003082058a30820372a00302010202100c76da9c910c4e2c9efe15d058933c4c300d06092a864886f70d0101050500305f310b3009060355040613024e4c31123010060355040a1309446967694e6f746172311a301806035504031311446967694e6f74617220526f6f742043413120301e06092a864886f70d0109011611696e666f40646967696e6f7461722e6e6c301e170d3037303531363137313933365a170d3235303333313138313932315a305f310b3009060355040613024e4c31123010060355040a1309446967694e6f746172311a301806035504031311446967694e6f74617220526f6f742043413120301e06092a864886f70d0109011611696e666f40646967696e6f7461722e6e6c30820222300d06092a864886f70d01010105000382020f003082020a0282020100acb058c100bdd821080b2b9afe6e5630059f1b779010415cc30d8711778e81f1ca7ce98c6aed387435bbdadff9bbc00937b49673817d331a9839f7936f957f3db9b17587ba5148e88b703e9504c5d8b6c316d988b0b1871d70da86b40f148b7acf10d17436a2127b77864a79e67bdf021168a54e86ae34589b2413785622251e018b4b5171fb82cc599669885a6853c5b90d0237cb4bbc664a907e2a0b0507ed165f559075d846c91b83e208bef123cc991dd62a0f8320155827822efae222c249b1b901816a9d6d9d407768764e212a6d8440854e76997c82f3f3b70259d426011b8edfad5306d1ae18dde2b23acbd788388eac5b29b919d398f91803cf488286660b1b690fc9eb38887a261a054c92d724d496f2ac522da347d552f63ffece840670a6aa3ea2f2b656341857a2e4816de7caf06ad3c7916b0283417c15ef6b9a645ee3d03ce5b1eb7b5d86fbcbe67749cda365dcf7b99cb8e40b5f93cfcc301a321cce1c6395a5f9eae1748b9ee92ba9307ba0181f0e180be55ba9d3d16c1e07678f914ba98abcd266aa930188b291fa315cd5a6c1520809cd0a63a2d322a6e8a1d9390697f56e8d02908c147b3f80cd1b9cbac4587223afb6569fc67a423329073f82c9e61f050dcd4c28368bd3c83e1cc688ef5eee8964e91debda897e32a669d1ddcc889fd1d0c96621dc0667c5947a9a6d624c7dcce06480b29e478ea30203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604148868bfe08e35c43b386b62f7283b8481c80cd74d300d06092a864886f70d010105050003820201003b028dcb3c30e86ea0adf273b35f9e25130405d3f6e38bbb0b79ce53dee496c5d1af73bcd5c3d040557c407fcd1b5f09d5f27c9f681dbb5dce7a39c28cd6987bc58355a8d57d40cae01ef7895e635da113c25d8ab68a7c00f323c3ed855f7176f06863aa45213948617836dcf14393d425c7f28065e153027551fc7a3aef37ab8428570cd8d4d499566ce3a2fe5984b431e833f86494945197ab39c54beddadd800b6f7c290dc48e8a720de75314b260413d849131683d2744dbe5def4fa6345c84c3e98f53f41ba4ecb370dba6698f1ddcb9f5cf75436826b2cbc13619742f878bbccc8a29fcaf068bd6b1db2df8d6f079dda8e67c7471ecab9bf2a4291b7635366f142a3e1f45a4d586bb5e4a433ad5c701ddce0f2eb7314919a03c1ea0065bc07fccf1211222caea0bd3ae0a22ad859e929d31835a4ac115f19b5b51bff224a5cc67ae417ef20a9a7f43fad8aa79a04259d0eca37e650fd8c4229049aecb9cf4b72bde20836af232f62e5ca01d370db7c82232c16310cc63607907ab11f6758c43b585989b08c8c50b3d886cb68a3c40ae7694b20cec11e564b95a92368d830d8c3ebb05551cde5fd2bb8f5bb119f5354f634198c790936ca611725170b8298730c7774c3d50dc7a8124cc7a75471472e2c1a7dc9e32b3b48de2784a76336b37d8fa06439240d3d7b87af665c741b4b73b2e58cf08699b8e5c5df84c1b7eb updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4F555CE20DCD3364E0DC7C41EFDD40F50356C122\Blob = 0300000001000000140000004f555ce20dcd3364e0dc7c41efdd40f50356c12209000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b060105050703090b000000010000002200000043004500520054004900430041004d00410052004100200053002e0041002e0000002000000001000000d1050000308205cd308204b5a003020102020100300d06092a864886f70d0101050500308192312430220603550407131b426f676f74612041562043616c6c65203236204e203638442d3335310b300906035504061302434f31423040060355040a1339456e74696461642064652043657274696669636163696f6e204469676974616c204162696572746120436572746963616d61726120532e412e3119301706035504031310434552544943414d41524120532e412e301e170d3035303232333137313033375a170d3135303232333137313033375a308192312430220603550407131b426f676f74612041562043616c6c65203236204e203638442d3335310b300906035504061302434f31423040060355040a1339456e74696461642064652043657274696669636163696f6e204469676974616c204162696572746120436572746963616d61726120532e412e3119301706035504031310434552544943414d41524120532e412e30820122300d06092a864886f70d01010105000382010f003082010a0282010100f089afa72bf13e5e196ca98cdcd9e14cbe45c725f7bb875df2971995a8c51de8dc407ddcf7ce0850d62984b667e90105c371e47bca31df6972dfb107ea790e908c60a47fb5c6dbc382d0ad96c68aa527746d669e233e79c2741385ea30cd4018ccfe137d15f261fb57f57beaa2b93f6c6d0429080785c90ee57fca7aee112e42eeab6cdc383b7abf3330a30224fd3d9f20737e017c3c2f524c8f2972fe7942c708fe1f1b9df5a2106cd8b04e89afed5f9e2e744176dcffbb132f470247ca2be5091835c7bcc35ab73257d221493455d7647ef66b1caecd20d1ff60971255f9c188737c7abcbc99ed80697c58074462401483917524cedcb4c8e6abbbf168c2c70203010001a382022a30820226300f0603551d130101ff040530030101ff301d0603551d0e0416041452c97f765df5e1f422cd7de5676e8db76a9212793081bf0603551d230481b73081b4801452c97f765df5e1f422cd7de5676e8db76a921279a18198a48195308192312430220603550407131b426f676f74612041562043616c6c65203236204e203638442d3335310b300906035504061302434f31423040060355040a1339456e74696461642064652043657274696669636163696f6e204469676974616c204162696572746120436572746963616d61726120532e412e3119301706035504031310434552544943414d41524120532e412e820100300b0603551d0f04040302010630090603551d110402300030090603551d1204023000301106096086480186f8420101040403020007304306096086480186f842010d04361634434552544943414d41524120532e412e2043657274696669636174696f6e20417574686f72697479204365727469666963617465303d0603551d1f043630343032a030a02e862c687474703a2f2f7777772e636572746963616d6172612e636f6d2f636572746963616d61726163612e63726c303b06096086480186f8420104042e162c687474703a2f2f7777772e636572746963616d6172612e636f6d2f636572746963616d61726163612e63726c303b06096086480186f8420103042e162c687474703a2f2f7777772e636572746963616d6172612e636f6d2f636572746963616d61726163612e63726c300d06092a864886f70d0101050500038201010011a35f53682c2f38d314fbab33b84ce2a1d1220c7f18a9514d16df1e1fbfb3b297086317346ef5fc6efdaef466f3bda2d9b8396afce629d5dfd8c18a7804a2b05f661dd2e4d614bb2edf1e3cac1b40126c957ced5aec3c6b209b1696b002c17cccd101ae2b4dd3ffd02d0580b431fc11ceb47b5cf58b4bf04682ce5d62d9f0239e547df99ef1626dda816468452195ef0f5ab24b5db6ce5633d4f2fa5867911aed2f03d5edaaa07dd9c73797a28409e781b8cf665d065d312091011fd3608cb6d577f15a727940a227f81bc404d2fd36d43f68c76cefb0aa4cca3907d2099f6e9215e29176fd63333eb8bafb1d558107074c48e173472181fd319229cacd5afc updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A3E31E20B2E46A328520472D0CDE9523E7260C6D\Blob = 0b000000010000002c00000044005300540020002800420061006c00740069006d006f0072006500200045005a0029002000430041000000090000000100000016000000301406082b0601050507030406082b06010505070301030000000100000014000000a3e31e20b2e46a328520472d0cde9523e7260c6d20000000010000000604000030820402308202eaa003020102020437826d48300d06092a864886f70d01010505003075310b300906035504061302555331243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311c301a0603550403131342616c74696d6f726520455a2062792044535431223020060a0992268993f22c640103141263614064696773696774727573742e636f6d301e170d3939303730363230353635335a170d3039303730333139353635335a3075310b300906035504061302555331243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311c301a0603550403131342616c74696d6f726520455a2062792044535431223020060a0992268993f22c640103141263614064696773696774727573742e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100bcccb33d4379b847f915b76e26b14c929879edc570f33ae9d5dd03f42a3f608c96e5471602f736b2f19e2688f59e42659e0fae7fe3ccb16e21f5f1882274d61fb277043932ba47b535c0135d0172a30543cc4eda269a87a86163f466a7c31546ead1d1ea30c3bb716a9bc14386c1391fc65660021bfc883aa099bb8cd77861d05e578f913b808b6effc965810a39bb90132035483fa5e1bf2dc171838520ed2087cbb6fe198c04dded295ddf0a12ce8956f21f5a193158b6fd6336eac923dea79197276572996cc77a44c45fbe9b1f1eca9e581ca6aa236ae3061b9224d857220950159046f0835eb6804c12813d666f04553a886bd0ef568750a0b9d6551b9d0203010001a38199308196300f0603551d130101ff040530030101ff305b0603551d2004543052305006096086480186f92f00003043304106082b060105050702011635687474703a2f2f7777772e64696773696774727573742e636f6d2f4453545f54525553545f4350535f763939303730312e68746d6c30110603551d0e040a04084cd762ce894ede2430130603551d23040c300a80084cd762ce894ede24300d06092a864886f70d010105050003820101007c028914385f831be6c6585bf34cc21cf6db27772ddcce1b13502f12478aca9cb3026727c41f32dfe0c25444a02518e32ff4ac2d66e4cc875eab097dd394a9d57d5948abee297c087b0738dd2bb22f1ee0cde79710ffc608065d3f81f436fec60e0dc16b7a509de7375ca059475dac18953f859edc73580400a44ce421b7ee90ba2afc58e309b07017b4aa66a3fa8939f403438322024374b3ddb5c9062996c7b993385fe00b65e27c7c19c35573e8cc0e060808c9a40571512a2c7d03170ecc8ee05da2d0777772b1661b748def08735358bd20dbf91b01a210d192fec3b2a574722ee6ec3dfc5a2fa86986bb6e40e16657842389af3164e78fe17a65a00b86 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\78E9DD0650624DB9CB36B50767F209B843BE15B3\Blob = 03000000010000001400000078e9dd0650624db9cb36b50767f209b843be15b3090000000100000016000000301406082b0601050507030406082b060105050703020b000000010000001200000056006500720069005300690067006e0000002000000001000000400200003082023c308201a50210325033cf50d156f35c81ad655c4fc825300d06092a864886f70d0101020500305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732031205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479301e170d3936303132393030303030305a170d3230303130373233353935395a305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732031205075626c6963205072696d6172792043657274696669636174696f6e20417574686f7269747930819f300d06092a864886f70d010101050003818d0030818902818100e519bf6da356612d994871f667deb98debb79e86800a910efa3825af468882e573a8a09b245d0d1fcc656e0cb0d0568418879a069b10a173dfb458396b6ec1f615d5a8a83faa12068d31ac7fb034d78f34678809cd1411e24e4556691f780280dadc479129bb36c9635cc5e0d72d877ba1b732b07b30ba2a2f31aaeea367dadb0203010001300d06092a864886f70d0101020500038181004b4466606864e4981bf3b072e695897cdd7bb395c01d2ed8d819d02d343dc6509a10868caa3f3ba804fc375295c3d9c9dbcdf28606c4b11bf0828830428e17501c647ab83e99497497fcac0243fb960c5604250c7c7c879d24a7d8f03229b5a4df5da24cc51632a842f645a6b636b9e0bf653693c2d2d76bdcde59d6a235f845 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3BC49F48F8F373A09C1EBDF85BB1C365C7D811B3\Blob = 0b000000010000006e0000004a006100700061006e002000430065007200740069006600690063006100740069006f006e002000530065007200760069006300650073002c00200049006e0063002e0020005300650063007500720065005300690067006e00200052006f006f00740043004100310031000000090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b060105050703070300000001000000140000003bc49f48f8f373a09c1ebdf85bb1c365c7d811b32000000001000000710300003082036d30820255a003020102020101300d06092a864886f70d01010505003058310b3009060355040613024a50312b3029060355040a13224a6170616e2043657274696669636174696f6e2053657276696365732c20496e632e311c301a060355040313135365637572655369676e20526f6f7443413131301e170d3039303430383034353634375a170d3239303430383034353634375a3058310b3009060355040613024a50312b3029060355040a13224a6170616e2043657274696669636174696f6e2053657276696365732c20496e632e311c301a060355040313135365637572655369676e20526f6f744341313130820122300d06092a864886f70d01010105000382010f003082010a0282010100fd77aaa51c90053bcb4c9b338b5a1445a4e79016d1df57d22110a417fddfacd61fa7e4db7cf7ecdfb803da9458fd5d727c8c3f5f0167741596e3023c87dbaecb018ec2f366c68545f402c63ab562b2affa9cbfa4e6d4803098f30db6938fa9d4d836f2b0fc8aca2ca115339531dac01bf2ee629986633fbfdd932a83a876b9131fb7ce4e42858f22e72e1af29509b205b5444e77a120bda9f24e0a7d50adf5050d454f4671fd283e53fb04d82dd7651d4a1bfacf3bb0319a356ec88b06d30091f29408654cb13406007a89e2f0c70359cfd5d6e8a732b3e6984086c5cd27128bcc7bceb7113c626007233e2b406e9480096db6b36f776f350850fb0287c53e890203010001a3423040301d0603551d0e041604145bf84d4fb2a586d43ad2f1639aa0be09f657b7de300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010505000382010100a0a13816662ea7561f219c06fa1dedb922c53826d84e4feca37f79de4621a187778f07089ab2a4c5af0f32980b7c6629b69b7d25524943ab4c2e2b6e7a70af160ee3026cfb42e6189d45d855c8e83bdde7e1f42e0b1c345c6c584afb8c88505f951cbfedab22b565b385ba9e0fb8ade57a1b8a503a1dbd0dbc7b54500bb942af55a01881ad6599efbee49cbfc485ab41b2546fdc25cded78e28e0c8d0949dd637b5a69960221a8bd5259e97d35cbc852ca7f81fed96bd3f711ed25dff8e7f9a4fa729784530da5d03218517659146c0febec5f808c754383c38598ff4c9e2d0de47783934eb596078b28139b8c198d41274940eedee6234439dca122d6ba03f2 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\971D3486FC1E8E6315F7C6F2E12967C724342214\Blob = 0b000000010000002800000056002e012000520065006700690073007400720073012000430065006e0074007200610073000000090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308030000000100000014000000971d3486fc1e8e6315f7c6f2e12967c72434221420000000010000008e0600003082068a30820472a003020102021003a3a457b5f0f3864a1163e898ff169c300d06092a864886f70d0101050500308198310b3009060355040613024c54312d302b060355040a132456492052656769737472752043656e74726173202d20492e6b2e20313234313130323436312e302c060355040b132552656769737472752043656e74726f20536572746966696b6176696d6f2043656e74726173312a30280603550403132156492052656769737472752043656e7472617320524353432028526f6f74434129301e170d3038303732313131343734365a170d3234303732313131343734365a308198310b3009060355040613024c54312d302b060355040a132456492052656769737472752043656e74726173202d20492e6b2e20313234313130323436312e302c060355040b132552656769737472752043656e74726f20536572746966696b6176696d6f2043656e74726173312a30280603550403132156492052656769737472752043656e7472617320524353432028526f6f7443412930820222300d06092a864886f70d01010105000382020f003082020a0282020100c899f222c7b387152ea7cb4d46ab6797cf0f737703f7647c76483220f4a3d8599d14a91fa01e910e0dadf5fe6792911320214d0a556e71faac17cb00fd0e500233dba9d8bd611afde01057b155796019b454799efb8030e2c842c9520208d8ac2fc371415402f5818a12e36902a587a1707d05bea562bf05b00896476f7f938aade0acd342debde68f14e57328a0039b41fae53ef739742e64f49f4bc0f57899546be51520fce9327240ab6575bc3c4634d2f81061c70c78c77cc01151d10536fbf89cff2db8e5712d49f05748b3938e9cfb3ac94b6d31d752d556e9842e91d4021db2800581c580ca29c13467b9af043043f6af4247defc012ee8429cbeb20b14e434dcddad53847ad80356d1c20cd49729f84cf2b51cdf9d83ae5f5a254ba2b028e5bf5a0bd09ca89c702a6d0e2ee127bfad0b6f11d3f8462df497444bcab0c8e6366f22ba8ee4529516ec446ad4501e9828f968a4bade9e30eda2c952a1c9358a40e18d9b9bfdf1468ba4c74f7060518df292a9ceba8c2f49521267d0f5ab0425407403e2d8ada1745861b7b50ef37f252c1163aff112c3f4a4739a64aceea6068ff2bc9cac28a95c15d333add036c821706bbc2a1fd5abb8015876fc3b114dfbf21c482411fd4d8f1929ae6be86d5eb2a10d78ced2638374b4cd294cbf9b70884f120d45e7be0f65c4d63824e44a158bd16aeabb36a1a190a553c8a5d6650203010001a381cd3081ca300e0603551d0f0101ff040403020106302f06082b06010505070103042330213008060604008e460101300b060604008e46010302010a3008060604008e460104300f0603551d130101ff040530030101ff301d0603551d0e04160414bc733e2f9c910cbb8fcd77993ecc85e4cc586811301006092b0601040182371501040302010030450603551d20043e303c303a060b2b0601040181f137010101302b302906082b06010505070201161d687474703a2f2f7777772e726373632e6c742f7265706f7369746f7279300d06092a864886f70d0101050500038202010019782c51135fbc994e5ca701fcdeb6fea91d8631117b7a998ab38892a560d2046339bcaf8ed8f12b457232293c2de2d9d83d74fa473587dc100036413dedaa7eb2ccc41ae931b4f591d1844ae7f5dccf46670299afb877fa7eed216f962314713fd058beaadb432c37a01d066934f04f8f75eeb3d201bbec1ce98fa989eff8d41b410299bef05fba8e2cc22170de5181d8f7bcb8c33383c397ca0973c4e977c872f45cad0f0d8aeaedd20a01ceeb579d15f02915ef599cafac9282700c98d8229d2f9835a9d18a89bcd59d55c22e9e072546f6924d50fa3d89f2df93bf9394d0d9af57a3f366e68ef1e8a01b1806935a2c890d36c4fa20b3dc28f56aee8f319b5938d84e6aa02321e486abe5fb60a3d1cd5a2c4249a60e55242535fdd23aaf6b58a691465f69cbbd7e269bde08bd1eec9ea6f89c75a44036954b224fc6b67d7251bce3c268cdcde58bbec0c24f9b6e65ce16b70888c787deff328ccbeb4241acfbd7cf0143f86fc0d60bf0f792e9cb455d64b1f7ca3cbb890896c9da0ee1712a0feca4422de36a0f4747b053a6d685509730d78c2e5f4622d0acce3c5e9c1e7283fd0ca7f81732bb61dee34f2f188e82b5871b7405304abf6a1e483c5428b15d9d925f9b10e32e228aafdd36647f1376478335951a948ff5c4536d39bdd58bf5cacf1843050193a436de30d214f3b064b5cace95f7ba74ec8a733e52d35e5300 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\786A74AC76AB147F9C6A3050BA9EA87EFE9ACE3C\Blob = 030000000100000014000000786a74ac76ab147f9c6a3050ba9ea87efe9ace3c090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b060105050703070b00000001000000420000004300680061006d00620065007200730020006f006600200043006f006d006d006500720063006500200052006f006f00740020002d0020003200300030003800000053000000010000002700000030253023060d2b0601040181872e0a0e02010230123010060a2b0601040182373c0101030200c02000000001000000530700003082074f30820537a003020102020900a3da427ea4b1aeda300d06092a864886f70d01010505003081ae310b3009060355040613024555314330410603550407133a4d616472696420287365652063757272656e742061646472657373206174207777772e63616d65726669726d612e636f6d2f61646472657373293112301006035504051309413832373433323837311b3019060355040a131241432043616d65726669726d6120532e412e31293027060355040313204368616d62657273206f6620436f6d6d6572636520526f6f74202d2032303038301e170d3038303830313132323935305a170d3338303733313132323935305a3081ae310b3009060355040613024555314330410603550407133a4d616472696420287365652063757272656e742061646472657373206174207777772e63616d65726669726d612e636f6d2f61646472657373293112301006035504051309413832373433323837311b3019060355040a131241432043616d65726669726d6120532e412e31293027060355040313204368616d62657273206f6620436f6d6d6572636520526f6f74202d203230303830820222300d06092a864886f70d01010105000382020f003082020a0282020100af00cb70372b805a4a3a6c78947da37f1a1ff635d5bddbcb0d44723e26b29052ba633b28586fa5b36d94a6f3dd640c55f6f6e7f22222805ee162c6b629e1816cf2bfe57d326a54a0321959fe1f8bd73d608685246fe311b3773e209635216bb308d9702e64f7849253d60eb0908a8ae3878d06d3bd900ee299a11b860eda9a0abb0b61500652f19e7f76eccb0fd01e0dcf99303d1cc4451058acd6d3e8d7e5eac5010777d651e6037f8a48a54d6875b9e9bc9e4e1971f5324b9c6d60190bfbcc9d75dcbf26cd8f93783979735e250eca5ceb771207cb6441477293ab50c3eb09766434d239b77611090d7645c4a9ae3d6aafb57d652f945810ec5c7caf7ee2b618d9d09b4e5a49dfa9660bcc3cc6787ca79c1de3ce8e53be05de600f6be51adb3fe3e121c929c1f1eb079c521b0144513c7b25d7c4e552545d2507ca1620b8ade441ee7a08fe996f83a69102b06c36556ae77df596e6ca81d697f19483e9edb0b16b12691eacfb5da9c598e9b45b587abe3da2443a6359d40b25de1b4fbde5019ecdd229d59f17190a6fbf0c90d3095fd9e38a35cc795a4d193792b7c4c1adaff479249ab2010bb1af5c96f38032fb5c3d98f1a03f4adebeaf942ed9559a176e609d636cb863c9ae815c1835e090bbbe3c4f3722b97eebcf9e7721a63d3881fb48da313d2be389f5d0b5bd7ee050c41289b3239a103185dbae6fef38331876110203010001a382016c3082016830120603551d130101ff040830060101ff02010c301d0603551d0e04160414f924ac0fb2b5f879c0fa60881bc4d94d029e17193081e30603551d230481db3081d88014f924ac0fb2b5f879c0fa60881bc4d94d029e1719a181b4a481b13081ae310b3009060355040613024555314330410603550407133a4d616472696420287365652063757272656e742061646472657373206174207777772e63616d65726669726d612e636f6d2f61646472657373293112301006035504051309413832373433323837311b3019060355040a131241432043616d65726669726d6120532e412e31293027060355040313204368616d62657273206f6620436f6d6d6572636520526f6f74202d2032303038820900a3da427ea4b1aeda300e0603551d0f0101ff040403020106303d0603551d200436303430320604551d2000302a302806082b06010505070201161c687474703a2f2f706f6c6963792e63616d65726669726d612e636f6d300d06092a864886f70d010105050003820201009012af2235c2a339f02edee9b5e9787c48be3f7d45925ee9dab119fc163c9fb45b669e6ae7c3b95d88e80fadcf230fde253a5ecc4fa5c1b52dac24d25807dea2cf69846033e8100d13a923d085e58e7ba69e3d72137233f5aa7dc6631f08f4fe017f24cf2b2c5409dee22b6d92c6394f16ea3c7e7a46d4456a46a8eb758256a7aba07c681333f69d30f06f273924232a90fd902935f293df34a5c6f7f8ef8c0f624a7caed3f554f88db69a568716823a33ab5a2208f782baea2ee0479ab4b545a3053bd9dc2e45403beadc7fe83bebd1ec26d835a430c53aac579eb376a5207bf91e4a056201a628756097920d6e3e4d37430d92159c1822cd5199a0291a3c5f8a32335b30c7892f47980fa303c6f6f1acdf32f0d9811ae49cbdf68014f0d12cb985f5d8a3b1c8a521e51c1397ee0ebddf29a9ef34535bd3e46a138406b63202c452ae22d2dcb221421ada40f029c9ec0a0c5ce2d0bacc48d3370acc120a8a79b03d037f694bf434207db334ea8e4b64f53efdb32367150d04b8f02dc109513cb26c15f0a523d78374e4e52ec9fe982742c6abc69eb0d05b38a59b50de7e1898b5453bf679b4e8f71a7b0683fbd08bdabbc7bd18ab086f3c806b403f1919ba658ae6bed55cd336d7ef4052246038670431ec8ff382c6deb955f33b31915adcb50815ad76250a0d7b2e87e20ca606bc26106d379decdd788c7c80c5f0d97748d0 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\55C86F7414AC8BDD6814F4D86AF15F3710E104D0 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\99A69BE61AFE886B4D2B82007CB854FC317E1539\Blob = 53000000010000002400000030223020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c00b000000010000001000000045006e0074007200750073007400000009000000010000005e000000305c06082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030606082b0601050507030706082b0601050508020206082b06010505070308060a2b0601040182370a030403000000010000001400000099a69be61afe886b4d2b82007cb854fc317e15392000000001000000dc040000308204d830820441a0030201020204374ad243300d06092a864886f70d01010505003081c3310b300906035504061302555331143012060355040a130b456e74727573742e6e6574313b3039060355040b13327777772e656e74727573742e6e65742f43505320696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313a303806035504031331456e74727573742e6e657420536563757265205365727665722043657274696669636174696f6e20417574686f72697479301e170d3939303532353136303934305a170d3139303532353136333934305a3081c3310b300906035504061302555331143012060355040a130b456e74727573742e6e6574313b3039060355040b13327777772e656e74727573742e6e65742f43505320696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313a303806035504031331456e74727573742e6e657420536563757265205365727665722043657274696669636174696f6e20417574686f7269747930819d300d06092a864886f70d010101050003818b0030818702818100cd288334541b89f30faf379131ffaf3160c9a8e8b21068ed9fe79336f10a64bb47f504173f23474dc5271981260c54720d882dd91f9a129fbcb371d380193f47667b8c3528d2b90adf24da9cd65079817a5ad337f7c24ad829922664d1e4986c3a008af5349b65f8ede310fffdb84958dca0de82396b81b1161961b954b6e643020103a38201d7308201d3301106096086480186f8420101040403020007308201190603551d1f048201103082010c3081dea081dba081d8a481d53081d2310b300906035504061302555331143012060355040a130b456e74727573742e6e6574313b3039060355040b13327777772e656e74727573742e6e65742f43505320696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313a303806035504031331456e74727573742e6e657420536563757265205365727665722043657274696669636174696f6e20417574686f72697479310d300b0603550403130443524c313029a027a0258623687474703a2f2f7777772e656e74727573742e6e65742f43524c2f6e6574312e63726c302b0603551d1004243022800f31393939303532353136303934305a810f32303139303532353136303934305a300b0603551d0f040403020106301f0603551d23041830168014f0176213553db3ff0a006bfb508497f3ed62d01a301d0603551d0e04160414f0176213553db3ff0a006bfb508497f3ed62d01a300c0603551d13040530030101ff301906092a864886f67d074100040c300a1b0456342e3003020490300d06092a864886f70d01010505000381810090dc3002fa6474c2a70aa57c218d3417a8fb470eff257c8d130afbe498b5ef8cf8c5100df792bef1c3d5d5956a04bb2cce263665c831c6e7ee3fe35775847a11ef464f18f4d398bba88732ba72f63ce23d9fd71dd9c360438c580e22962f62a32c1fbaad05efab327887a0547319b55c05f9523e6d2d450bf70a93eaed06f9b2 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\36B12B49F9819ED74C9EBC380FC6568F5DACB2F7 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8782C6C304353BCFD29692D2593E7D44D934FF11 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AB16DD144ECDC0FC4BAAB62ECF0408896FDE52B7 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\42EFDDE6BFF35ED0BAE6ACDD204C50AE86C4F4FA updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C9A8B9E755805E58E35377A725EBAFC37B27CCD7 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4\Blob = 0300000001000000140000008cf427fd790c3ad166068de81e57efbb932272d4090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b060105050703070b000000010000001800000045006e00740072007500730074002e006e0065007400000053000000010000002400000030223020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c02000000001000000420400003082043e30820326a00302010202044a538c28300d06092a864886f70d01010b05003081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d204732301e170d3039303730373137323535345a170d3330313230373137353535345a3081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100ba84b672db9e0c6be299e93001a776ea32b895411ac9da614e5872cffef68279bf7361060aa527d8b35fd3454e1c72d64e32f2728a0ff78319d06a808000451eb0c7e79abf1257271ca3682f0a87bd6a6b0e5e65f31c77d5d4858d7021b4b332e78ba2d5863902b1b8d247cee4c949c43ba7defb547d57bef0e86ec279b23a0b55e250981632135c2f7856c1c294b3f25ae4279a9f24d7c6ecd09b2582e3ccc2c445c58c977a066b2a119fa90a6e483b6fdbd4111942f78f07bff5535f9c3ef4172ce669ac4e324c6277eab7e8e5bb34bc198bae9c51e7b77eb553b13322e56dcf703c1afae29b67b683f48da5af624c4de058ac64341203f8b68d946324a4710203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604146a72267ad01eef7de73b6951d46c8d9f901266ab300d06092a864886f70d01010b05000382010100799f1d96c6b6793f228d87d3870304606a6b9a2e59897311ac43d1f513ff8d392bc0f2bd4f708ca92fea17c40b549ed41b9698333ca8ad62a20076ab59696e061d7ec4b9448d98af12d461db0a194647f3ebf763c1400540a5d2b7f4b59a36bfa98876880455042b9c877f1a373c7e2da51ad8d4895ecabdac3d6cd86dafd5f3760fcd3b8838229d6c939ac43dbf821b653fa60f5daafce5b215cab5adc6bc3dd084e8ea0672b04d393278bf3e119c0ba49d9a21f3f09b0b3078dbc1dc8743febc639acac5c21cc9c78dff3b125808e6b63dec7a2c4efb8396ce0c3c69875473a473c293ff5110ac155401d8fc05b189a17f74839a49d7dc4e7b8a486f8b45f6 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D29F6C98BEFC6D986521543EE8BE56CEBC288CF3 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AEC5FB3FC8E1BFC4E54F03075A9AE800B7F7B6FA updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\9FC796E8F8524F863AE1496D381242105F1B78F5 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5D003860F002ED829DEAA41868F788186D62127F\Blob = 0300000001000000140000005d003860f002ed829deaa41868f788186d62127f090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020b000000010000003800000053007400610072006600690065006c006400200054006500630068006e006f006c006f006700690065007300200049006e0063002e00000053000000010000004800000030463021060b6086480186fd6e0107180230123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107180230123010060a2b0601040182373c0101030200c02000000001000000820400003082047e30820366a003020102020100300d06092a864886f70d01010505003081cf310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313a3038060355040b1331687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f313630340603550403132d537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479301e170d3038303630323030303030305a170d3239313233313233353935395a3081cf310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313a3038060355040b1331687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f313630340603550403132d537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100f2cc562a4de616375a97ea6d3538d1109bdbb8dca9040995332e09c5007b1a78428fc8f4058efed268831e4e99cd17db473e50f389d2e7dc98fb05f8aad663f4544dc17103b01f1b76b31a343073f128326083fdb49cd7b6d222377c19aa3bde1310696e5c06d36fa3f2665a764248af80d154593dd4b9d4dbedb9ab3999f4ee62abe178727bd8388d40b6ccdc120070438569d818e3ca57729fb4df3ffc22a84252f5775b99f0562d2670163612c2279e57a67cd023f179dca3935828383d9fad3643ee37fbf8f943adc856f294125e42eb73b8130dcba6d586b9aa286a5403a13f0f29eb0900e83f5ea27f173da12bf8bed0751da484e3ab1765065200afb10203010001a3633061300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414b4c67f1a43cc9b755d2fc44bf28b9810e9f15110301f0603551d23041830168014b4c67f1a43cc9b755d2fc44bf28b9810e9f15110300d06092a864886f70d01010505000382010100ac80bbc425050b58a4e47e297eafbc3bec2dc0442ef991e0d23b3227902df680095cc2ab6524da381046c449d2fd9aab28487788c6e96fd14791d5354f1409a85b40071d7c7156cb8942d4bf61c022f72edfabf372438b40e894ebb026dad113d3abd0362d2e3a95b3772e1539180c69baaa80edf1534e339b6804e2a0302ed7d15dd4a6669d84e6e7bb3c89bb369dfc17a93d552b8afb9bc44c84ffdfd2be691b74b0a8f6eab09cb22974814c683a9a7f732539f513e0669169d4574bb7eead45e02cc388d3be9449891fff70d55b6d3913b01dcb98e667630d63f6fbc3d7617283883f707e53c99e8954d64f7f7d71b9aef1608b7760ecf8bffa6aa39c0122 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\086418E906CEE89C2353B6E27FBD9E7439F76316\Blob = 030000000100000014000000086418e906cee89c2353b6e27fbd9e7439f76316090000000100000040000000303e06082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070308060a2b0601040182370a030c0b000000010000003800000056004100530020004c0061007400760069006a006100730020005000610073007400730020005300530049002800520043004100290000002000000001000000ad070000308207a930820591a0030201020210630686a7c53765a54390a86a58ccd432300d06092a864886f70d010105050030818f310b3009060355040613024c5631353033060355040a132c564153204c617476696a6173205061737473202d205669656e2e7265672e4e722e343030303330353237393031233021060355040b131a536572746966696b6163696a61732070616b616c706f6a756d69312430220603550403131b564153204c617476696a6173205061737473205353492852434129301e170d3036303931333039323231305a170d3234303931333039323735375a30818f310b3009060355040613024c5631353033060355040a132c564153204c617476696a6173205061737473202d205669656e2e7265672e4e722e343030303330353237393031233021060355040b131a536572746966696b6163696a61732070616b616c706f6a756d69312430220603550403131b564153204c617476696a617320506173747320535349285243412930820222300d06092a864886f70d01010105000382020f003082020a02820201009bb8f9fd61552f4fa4a514b52e8eb9248facfbb1543f40ff4fc5e586687b5393fb358235a8502e9452a0db833e75da1570ac09cfee8249ad3649b9b4718bb400a14206ca080a6397b608fceeb4dc98781982c9f87f643eaac9feb18debb064f5bcf3c43e3a90ea4e8e3f1b19bc6a83c3913c6c55fb0a52c0e8e15d778533c549dfec6abfbf6c37fe8e49a21518ce8b8e6b1e38a3306f88817e7256441ac47a390ff6c48f96d4b2eb004e5cdebbe73bb7e62405936b4de69144bfee981bc7851b11417b2236a7be3ee87a37dc18de909d8fcdb2d79a3fe2177f5b0ce1ef3f663d6e24e4b0cec30c886c94da38257c5239e37314b30045639a0c42405e04c6f77264cec96e33b3e4d36d249537937ef2005d198b1ff34373a89f45d206a9ecb442bbfaee0cc74f3f511fd1afd0ac187f878122fea9dd07966d7cf84ed94d3a5069d5417ec5da74d88e73e57e83e1c31981b7bdbf408ebe2e9aa20caa4e022ebb2ae1085d3103c9ac27b0afdcd5c8147d409d558921f990ccd4c9604173abe8cdd83a55390a8299fe9bf5f53c1c91cbc0fa4654ae21fc2aac5c7bde7a9771fd6c6bcd489aa4db817c18372f907d6194bd17c95cb6541677ca094aaae9bc4f9475015a56bc92d28fb9d797de567401f7167149b1f518469941ee62e1b32c65756929724303f89b1ffa38f49eec40108eac97d5b033be9f18dc2df74178544a6244e70203010001a38201fd308201f9300e0603551d0f0101ff040403020106301806082b06010505070103040c300a3008060604008e460101300f0603551d130101ff040530030101ff301d0603551d0e04160414ccc3f566ff73ac385a961b2189b8814c1fcb5e25301006092b06010401823715010403020100308201890603551d20048201803082017c30820178060b2b0601040181c459010102308201673082013806082b060105050702023082012a1e82012600530069007300200069007200200073006500720074006900660069006b006100740073002c0020006b006f00200069007a0064006500760069007300200056004100530020004c0061007400760069006a00610073002000500061007300740073002c0020006e006f00640072006f00730069006e006f007400200061007400620069006c0073007400690062007500200045006c0065006b00740072006f006e00690073006b006f00200064006f006b0075006d0065006e007400750020006c0069006b0075006d0061006d00200075006e0020004500690072006f0070006100730020005000610072006c0061006d0065006e0074006100200064006900720065006b0074006900760061006900200031003900390039002f00390033002f0045004b302906082b06010505070201161d687474703a2f2f7777772e652d6d652e6c762f7265706f7369746f7279300d06092a864886f70d010105050003820201001f284a35902163680a2f78afa31e822697a33f2719d24ba3427a0613655bc104cbeb7d7cef94f2f189f5b7df52022169d2ea9634e5a0cf97b89c550e1085a3145e2c05f8b53a76f3f97ab8deb60c2769f2cb94910b1db9d58e6f992fcdf21956393a4856f001ff8275b6b2fdd1d4f5f263574c4da17ecc10ba0469eff414fcb3971f45ee6f4a287fd1c627bcc7a3a96b7bed82136fabde0ffb71eb5c111aa92cd0309ffc363756ef95e9bab713b6ae9f0261ad9eec6b046f369f0f99f7c2c9c84c28b928d421d79e54d5c0cef48ee455947b8f24c638fcab7aa456773da845ef6492a4d04a7ebb738bf40d5273b83a485e4380d3a9707762ffc7281c731e43e627245b49b9e636a48efdc52d2f7aa579127ad721b2256dc80fa2c3614be548e257ba9ff28a21dddb64f0da19dfcec09b8039c277776315537284faa48f073786217d50fa3d6a37db910e37b3fdce0bca7b61d09c749c7d38686de97b1dd6f12ab4ef3b60527705e602c25f8c5bbcf07db773c7916bb22ab363a334d5abad257147ff1a3e7ab68d9576c3eea6cd03096cee456798cf994876c1ce8a749a6852013422c8ede2140b84bd6e108cb1729bbee808d757d57feab4013d4ee4e2e867e78c7ee9e74211ef9546c891d6be271780193498e7c6df1efc215f9e863dbc7ef09cbd729ef447825b7167f3fadc544ca85cd859c7d0070e133327bcf469f06b21 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A69A91FD057F136A42630BB1760D2D51120C1650\Blob = 030000000100000014000000a69a91fd057f136a42630bb1760d2d51120c1650090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080b000000010000003a00000054004300200054007200750073007400430065006e00740065007200200043006c006100730073002000340020004300410020004900490000002000000001000000ba030000308203b63082029ea003020102020e05c00001000241d0060a4dce7510300d06092a864886f70d01010505003076310b3009060355040613024445311c301a060355040a1313544320547275737443656e74657220476d624831223020060355040b1319544320547275737443656e74657220436c6173732034204341312530230603550403131c544320547275737443656e74657220436c6173732034204341204949301e170d3036303332333134313032335a170d3235313233313232353935395a3076310b3009060355040613024445311c301a060355040a1313544320547275737443656e74657220476d624831223020060355040b1319544320547275737443656e74657220436c6173732034204341312530230603550403131c544320547275737443656e74657220436c617373203420434120494930820122300d06092a864886f70d01010105000382010f003082010a0282010100b5cd4c9cadae51bb7c48c50d29867a14add9503d0972200d14b663c6fe589ee0215ef38f2219dc4e9120cd6f8829a2b3c1ac2a72ba8b54b8405ff2aaf84386c2305ccca75d7fc60849e40e392f8e18d691dd23167980db6c481dbcc1df281063d181e3dddf2f7975a21b78f29401e6106279cba07d02c034827bc7c0ad1d4cd76a96765bbf268448fd87f6840aaa920799483c61bc4e8558c7972dfd814aa1c69b12f54250d1643e8968822270ddf5fae328422f4e32f3b3a3368a6ad6625cacfa016db4e0722e9568b4f1930cc68a82d21d53ea7ce03f42b7125ab8cddaa50667cba1777da596f0921e670e1d4246e6f9edfb47537f5704461f465fc7aee08f0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604141feabb3e251b06bda5dd62057ec64c5abfe80f43300d06092a864886f70d0101050500038201010058a42b9b4cf7e4a492a49c6598196222fc7232e9045dc4c4702d5a46de4c478a25b9a2ddeeea12af488def2b67db3bcc34982af70847ff22af7bf1f4ebe23802331875281b9e7665ac880372f238471d8cf59f0a88531014bb80e50cb35d8d17ee1e191c868d1467788c92cb1e2149f77fd318bf9c79f85d0879b5aa6a4d92366cbc79eb0e3d798ad8f6a356705ddedb4f79d27ad2955c862765bea0d307814055dd10cbe04b8882c0907d38e7bf96e197ba9aab420fd39fd89e153311cbf78279f5b5c0415692e1df5503ad48cfd3f22eb1c72d564c64742a31cedc75a95447a4a7427209e7e102a647b204cd4213e1610ce0783a2220a21c60428687f7a5e6 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5F43E5B1BFF8788CAC1CC7CA4A9AC6222BCC34C6 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\60D68974B5C2659E8A0FC1887C88D246691B182C\Blob = 0b00000001000000580000005300650063007200e90074006100720069006100740020004700e9006e00e900720061006c0020006400650020006c00610020004400e900660065006e007300650020004e006100740069006f006e0061006c0065000000090000000100000074000000307206082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030606082b0601050507030706082b0601050508020206082b06010505070308060a2b0601040182370a0304060a2b0601040182370a030c06082b0601050507030903000000010000001400000060d68974b5c2659e8a0fc1887c88d246691b182c20000000010000000604000030820402308202eaa00302010202053911451094300d06092a864886f70d0101050500308185310b3009060355040613024652310f300d060355040813064672616e6365310e300c0603550407130550617269733110300e060355040a1307504d2f5347444e310e300c060355040b13054443535349310e300c060355040313054947432f413123302106092a864886f70d010901161469676361407367646e2e706d2e676f75762e6672301e170d3032313231333134323932335a170d3230313031373134323932325a308185310b3009060355040613024652310f300d060355040813064672616e6365310e300c0603550407130550617269733110300e060355040a1307504d2f5347444e310e300c060355040b13054443535349310e300c060355040313054947432f413123302106092a864886f70d010901161469676361407367646e2e706d2e676f75762e667230820122300d06092a864886f70d01010105000382010f003082010a0282010100b21fd1d062c5333bc0048688b3dcf888f7fddf43df7a8d9a495cf64eaacc1cb9a1eb2789f246e93b4a71d51d8e2dcfe6adab6350c7540b6e12c99036c6d82fda91aa68c572fe170ab2177e79b5328870ca70c0964a8ee455cd1d2794bfce722aec5cf97320febdf72e8967b8bb477312f7d135693af20ab9aeff464246a2bfa1851af9bfe4ff4985f7a37086321c5d9f60f7a9ada5ffcfd134f97d5b17c6dcd60e286bc2ddf1f533689d4efc877c3612d6a380e8430d556194ea643747ea77cad0b25805c35d7eb1a846903156ce702a96b230b877e679c0bd293bfd94774cbd20cd4125e02ec71bbbeea40441d25dad126a8a9b47fbc9dd4640e19d3c33d0b50203010001a3773075300f0603551d130101ff040530030101ff300b0603551d0f04040302014630150603551d20040e300c300a06082a817a0179010101301d0603551d0e04160414a3052f186050c2890add2b214fff8e4ea8303136301f0603551d23041830168014a3052f186050c2890add2b214fff8e4ea8303136300d06092a864886f70d0101050500038201010005dc26d8fa77154468fc2f663a74e05de429ff060713844aabcf6da01f5194f849cb743614bc15dddb892fdd8fa05d7cf512eb9f9e38a447ccb396d9be9c25ab037e330f95810dfd16e088be37f06c5dd0319b322b5d1765939860bc6e8fb1a83c1ed91cf3a92642f9641dc2e792f6f41e5aaa19525dafe8a2f760a0f68df089f56ee00a050195c98b200aba5afc9a2c3cbdc3b7c95d7825053f56149b0cdafb3a48fe97695eca1086f74e9604084decb0be5ddc3b8e4fc1fd9a36349a4c547e1703489508111c076f85087e5d4dc49ddbfbaeceb2d1b3b8836c1db2b379f1d870997ef01302ce5edd51d3df3681a11b782f71b3f1594c461828ab85d260565a updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\FEB8C432DCF9769ACEAE3DD8908FFD288665647D\Blob = 53000000010000002400000030223020060a2a83088c9b1b6485510130123010060a2b0601040182373c0101030200c00b00000001000000360000005300450043004f004d002000540072007500730074002000530079007300740065006d007300200043004f0020004c00540044000000090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070308030000000100000014000000feb8c432dcf9769aceae3dd8908ffd288665647d2000000001000000810300003082037d30820265a003020102020100300d06092a864886f70d01010505003060310b3009060355040613024a5031253023060355040a131c5345434f4d2054727573742053797374656d7320434f2e2c4c54442e312a3028060355040b1321536563757269747920436f6d6d756e69636174696f6e20455620526f6f74434131301e170d3037303630363032313233325a170d3337303630363032313233325a3060310b3009060355040613024a5031253023060355040a131c5345434f4d2054727573742053797374656d7320434f2e2c4c54442e312a3028060355040b1321536563757269747920436f6d6d756e69636174696f6e20455620526f6f7443413130820122300d06092a864886f70d01010105000382010f003082010a0282010100bc7fec579b24e0fe9cba4279a9888afa80e0f5072943ea8e0a34368d1cfaa7b53978ff9775f72fe4aa6b048444caa6e2688efd5550620fa4710ece07382d428550ad3c966f8bd5a20ecfde49893dd6642e38e51e6cb5578a9eef480ecd7a69168744b590e4069daea104975879ef204a826b8c22bfec1f0fe98471edf10ee4b81813cc56365dd19a1e516b396e607688340bf3b3d1b09dca61e2641dc14607b863dd1e3365b38e0955523db5bdff07ebad6155182ca969984aaa40c53314657400f991deaf0348c54054dc0f84906820c59296dc2ee50245aac05f54f86dea49cf5d6c4bafef9ac2565cc63556426a305fc2abf6e23d3fb3c9118f314cd79f490203010001a3423040301d0603551d0e04160414354af54daf3fd78238acab716517758c9d5593e6300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010505000382010100a887e9ecf840675dc3c166c7404b97fc8713905ac4efa0ca5f8bb7a7b7f1d6b564b78ab3b81bccdafbac668841cee8fce4db1e88a6ed27501b0230244679fe048770974073d1c0c157199a69a52799ab9d6284f651c12cc92315d828b7ab2513b546e18602ff268cc488921d56fe1967f255e480a36b9cab77e151710d20db109adbbd767907779928ad9a5edab14f442c358ea596c7fd83f058c679d6987ca88dfe863e071692e17be71dec33767e422e4a85f9918968840381a59b9abee337c554ab563b182d41a40cf842db99a0e0726fbb5de1164f530a64f94ef4bf4e54bd786c88eabf9c1324c27069a27f0fc83cad08c9b09840a32ae78883ed778f74 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CEA9890D85D80753A626286CDAD78CB566D70CF2 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3E42A18706BD0C9CCF594750D2E4D6AB0048FDC4\Blob = 0300000001000000140000003e42a18706bd0c9ccf594750d2e4d6ab0048fdc4090000000100000056000000305406082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070308060a2b0601040182370a0304060a2b0601040182370a030c06082b060105050703090b000000010000001200000053006900670065006e002d0043004100000020000000010000001d0400003082041930820301a00302010202043b3cf9c9300d06092a864886f70d0101050500303d310b3009060355040613027369311b3019060355040a131273746174652d696e737469747574696f6e733111300f060355040b1308736967656e2d6361301e170d3031303632393231323734365a170d3231303632393231353734365a303d310b3009060355040613027369311b3019060355040a131273746174652d696e737469747574696f6e733111300f060355040b1308736967656e2d636130820122300d06092a864886f70d01010105000382010f003082010a0282010100b0e565b2c0ac6496f2881bb3ed9ee402c64f2b88ce2e8a518075af105bf2cb38669ba20e6d344796a59211aff63547a277220cce168862aad3496e18bc2e44d8bec69ec21a19ac418efc300702f2c66ad45b2300ef4134d8a47363df2292338401a58df3835cfab8d47a35dfecf86d0fe04cedad9c3a7d86d6a50894be7d7a111ffe853f545a8863879ca5b1a74ecdb74473afcf8a496b1fe3cdd7494d5a2b17e65c76b3bb72b96f27d29b891588df105f7621016ac715310ad19c58f82816056dd94ed9a1d70720cb4b26894d92b2a7ba96e8e3588f229c01965ac4f7314d0b49b5e17861e2541806bb9e54347e0c3eebeeb5801fdd16841d6838666773f8910203010001a382011f3082011b301106096086480186f8420101040403020007305f0603551d1f045830563054a052a050a44e304c310b3009060355040613027369311b3019060355040a131273746174652d696e737469747574696f6e733111300f060355040b1308736967656e2d6361310d300b0603550403130443524c31302b0603551d1004243022800f32303031303632393231323734365a810f32303231303632393231353734365a300b0603551d0f040403020106301f0603551d23041830168014717b8a061f310555ab60127747201e038818ec89301d0603551d0e04160414717b8a061f310555ab60127747201e038818ec89300c0603551d13040530030101ff301d06092a864886f67d0741000410300e1b0856352e303a342e3003020490300d06092a864886f70d0101050500038201010000ba6334f31818eeae7e8d92c735f5c213d4d600aa213216d6d05bfa29b08dfa177792f9a5b6f6f9873f060f20ee623d34f7a92fc7a93bd027884cacddc9a9e55a5885d712353ddcb0825b72f4bb73b7fbfe3821980480b288620f1eac3a16a9e6b30af615104503a397e2cdac10dcf9001ebf736c43ec772216062f9683897bb0b853444108dc801f05db19097687be359d4e214bb493c1683a9d5f36fea1ae302c4bde78243a58d61643ef9d99388b2a98fe30d1c2ead6af25d5a5760bb9ef40392ef6ebdf325e1d7d87b544cc0239d2269572d86f8543a88f0ea346ced7cee8b956a9f88917121f4349067a32e73fbe6f79bed633d74c3c28fc12f1767618 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\086418E906CEE89C2353B6E27FBD9E7439F76316 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C8EC8C879269CB4BAB39E98D7E5767F31495739D\Blob = 030000000100000014000000c8ec8c879269cb4bab39e98d7e5767f31495739d09000000010000002a000000302806082b0601050507030306082b0601050507030106082b0601050507030206082b060105050703040b000000010000001200000056006500720069005300690067006e00000020000000010000001e0400003082041a30820302021100eca0a78b6e756a01cfc47ccc2f945ed7300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203139393920566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732034205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204733301e170d3939313030313030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203139393920566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732034205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473330820122300d06092a864886f70d01010105000382010f003082010a0282010100adcba51169c659abf18fb5190f56ceccb51f20e49e26254be073658959ded083e4f50fb5bbadf17ce821fce4e80cee7c4522197692b413b7205b09fa61aea8f2a58d85c22ad6de6636d29b02f4a892607c9c69b48f241ed08652f6329c41581e22bdcd456295086ed066dd53a2ccf010dc54738b04a14633335c1740b99e4dd3f3be5583e8b1898e5a7c9a9622903b8825f2d25388020c0b78f2e637174b304607e4806da6d8962ee82cf811b3380d66a69beac9235bdb8ee2f3138e1a592daa02f0eca48766dcc13ff5d8b9f4ec82c6d23d951de5c04f84c9d9a34428066ad745acf06b6aef4e5ff811821e3863346650d43e9373fa30c366adff932d97ef030203010001300d06092a864886f70d010105050003820101008ffa256b4f5be4a44e2755ab2215593ccab50ad44adbabdda15f53c5a05739c2ce472bbe3ac856bfc2d927103ab1053cc07731bb3ad3057b6d9a1c308c80cb93932a83ab055182020011676bf38861475f0393d55b0de0f1d4a1323585b23adbb082abd1cb0abc4f8c5bc54b003b1f2a82a67e3685dc7e3c6700b5e43b52e0a8eb5d15f9c66df0ad1d0e85b7a99a73145a5b8f4128c0d5e82d4da45ecdaad9edcedcd8d53c421d17c1125d4538c338f3fc852e834648b2d7205f92368fe7790f985e99e8f0d0a4bbf553bd2ace59b0af6e7f6cbbd21e00b021edf8416282b9d8b2c4bb4650f331c58f01a874ebf57827dae7f76643f39e833e20aac3356091ce updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\409D4BD917B55C27B69B64CB9822440DCD09B889 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CFF360F524CB20F1FEAD89006F7F586A285B2D5B updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E70715F6F728365B5190E271DEE4C65EBEEACAF3\Blob = 0b000000010000004600000041007500730074007200690061002000540065006c0065006b006f006d002d0043006f006e00740072006f006c0020004b006f006d006d0069007300730069006f006e00000009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070309030000000100000014000000e70715f6f728365b5190e271dee4c65ebeeacaf320000000010000001c0400003082041830820300a003020102020100300d06092a864886f70d0101050500305d310b300906035504061302415431233021060355040a131a54656c656b6f6d2d436f6e74726f6c2d4b6f6d6d697373696f6e312930270603550403132054656c656b6f6d2d436f6e74726f6c2d4b6f6d6d697373696f6e20546f702031301e170d3032303932343132343030305a170d3035303932343132343030305a305d310b300906035504061302415431233021060355040a131a54656c656b6f6d2d436f6e74726f6c2d4b6f6d6d697373696f6e312930270603550403132054656c656b6f6d2d436f6e74726f6c2d4b6f6d6d697373696f6e20546f70203130820122300d06092a864886f70d01010105000382010f003082010a028201010095b13a9aee1a9b2544635081e648da4808e3d57565ca4ad6df683325582ece9e956d41ab3cb2aef4bb62ad9a7af5dadc7821fc0347fcf2482afad52f412b9835b3b2361dbaa933eb41de32936bff11e83b4014e8cc71a5841422be68bc92a3f440a2e5da6c7c537e99d279d40cdd7707f06f954ed7bc53fbe4f3d9dad41de6f802f65fb09c2e5bde2e0a2e0561dabc0541df7cb44d985a40666b8278d81dda95c1beb7107abd2562165c92189e1b9f83fdb2acf8e38352762a749b56eabc10288fdfd9efcc960be781cc788d02ec74b0bfbe2d17ad8ef21f0fae725d105937da4f62cbbc6ffa114529dde3699d4860f97563e12fba597c25df5c2a43e68ec8110203010001a381e23081df301d0603551d0e0416041465cd574ebb9dd3ffa6bcbb79209de9e04653ed0b30370603551d1f0430302e302ca02aa0288626687474703a2f2f7777772e7369676e617475722e7274722e61742f63757272656e742e63726c300c0603551d240405300380010030560603551d20044f304d304b06092a2800150001000100303e303c06082b060105050702011630687474703a2f2f7777772e7369676e617475722e7274722e61742f64652f6469726563746f72792f6370732e68746d6c300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020204300d06092a864886f70d0101050500038201010050477ca049b1c8fe1d672da4f64d2037ae90ee9ba141e1abf6ed68d1324b0c1c63df882b8b66f0340c7f882de1c0461bf8fa32ba9bbba8622878120534da8df696e1fed7be372c0452b5e9b84145792b914a72a0a40ede39d973f9a9da43cfacc25ea20f913194d44d2191b72df116950ff98f4d59cd3575526f0157fa441fec91d70728de28df89f9ed32ad8543fa56f3fc2bb564c17030c800d67c743290e683006b7123ca56a23922ac79141b031793e3a8989b6ac756af00f1d7dd0fc2c0a7e2665e3de479fe6ca8cf6ae7a9ff0cbba7101cce7f31b3db919364be316cb3f8785fe7ebb5c42a61851dc4b583cc994c3a0470efe456da0701ca15cf8e6772 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AB16DD144ECDC0FC4BAAB62ECF0408896FDE52B7\Blob = 0b000000010000004c00000049002e004300410020005000720076006e00ed00200063006500720074006900660069006b0061000d016e00ed0020006100750074006f007200690074006100200061002e0073002e00000009000000010000003e000000303c06082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309030000000100000014000000ab16dd144ecdc0fc4baab62ecf0408896fde52b72000000001000000320400003082042e30820316a003020102020313d620300d06092a864886f70d01010505003063310b300906035504061302435a3129302706035504031320492e4341202d205374616e6461726420726f6f7420636572746966696361746531293027060355040a13205072766e6920636572746966696b61636e69206175746f7269746120612e732e301e170d3038303430313030303030305a170d3138303430313030303030305a3063310b300906035504061302435a3129302706035504031320492e4341202d205374616e6461726420726f6f7420636572746966696361746531293027060355040a13205072766e6920636572746966696b61636e69206175746f7269746120612e732e30820122300d06092a864886f70d01010105000382010f003082010a0282010100d12d15c4394c6aa1c4e5f32bb4fda916e9b8518f3791d9a7d39790b6706987f5af59d2624158d5f3958d0215fa669cc12114d81fadfa2a6c7456a162e1f1b0adb8fed2a3e091a1b5ae53ad8da40d0f5960972afca32e73352373cca8a6a1146dbf89c38438f36459cc31f3e0f927600a3c41056f5a52f08f6e526eec5e886fe0408c21475722e9386ee6faf324b4aeaf2f733f80d5328f8cd98419d860cedb698d3eaf02afaedeaf50f5cfe6b36118c4e0ddf04e4a660d7a7320b7e4d493864761d84fca3a8eabc23fc62217a35d9d20c6c50e2469c8a67d6606cd46e633e1437493f58362d2b0452201a476bdeb5193586cfa1aa19f7580dad800e2f1884d3f0203010001a381ea3081e7300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414eb37a4beb96f6017fbd3ff2d60e1041eafcfc6d33081a40603551d2004819c308199308196060c2b0601040181b8480101000130818530818206082b0601050507020230761a7454656e746f20636572746966696b6174206a6520767964616e206a616b6f206b76616c6966696b6f76616e792073797374656d6f767920636572746966696b6174207620736f756c616475207365207a616b6f6e656d203232372f323030302053622e207620706c61746e656d207a6e656e692e300d06092a864886f70d01010505000382010100172258aa2f185502a14c3649374b9b73baae63360e8b2b844537ccfae067f7a0736a676856bc61a8349a28ba662c619b8b1cf804708c86e341ef94790ddd348704eeb59e316b39f47e58e5f2b0044da9572549e00bd5e4ec7d0e3e3b01e08cfc529093e6f2b0abf53177ccd1c94382ab0f2eb4f998ae3ee344f4a4036955da5c8edbc1b9ace498d5761546a12e5a0c2260a0c2eb707f7103b068d33164cdeacb4b5589823e5c66cb1a089847c2ded92e384c05fd2d8cfae32225b992fdd6b22dcaa2349cdf49efd584012c92ff05410a67c6426b9ecbd89f90bc0d0f107dc766bdea7307e018ea5181b445403c0fa12237150185a92e7c0e5f5dce6a93bed9be updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C18211328A92B3B23809B9B5E2740A07FB12EB5E updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F4914F7D874951DDDAE02C0BEFD3A2D82755185\Blob = 0300000001000000140000001f4914f7d874951dddae02c0befd3a2d8275518509000000010000003e000000303c06082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030806082b060105050703090b0000000100000026000000510075006f0056006100640069007300200052006f006f00740020004300410020003300000053000000010000002600000030243022060c2b06010401be58000264010230123010060a2b0601040182373c0101030200c02000000001000000a10600003082069d30820485a003020102020205c6300d06092a864886f70d01010505003045310b300906035504061302424d31193017060355040a131051756f5661646973204c696d69746564311b30190603550403131251756f566164697320526f6f742043412033301e170d3036313132343139313132335a170d3331313132343139303634345a3045310b300906035504061302424d31193017060355040a131051756f5661646973204c696d69746564311b30190603550403131251756f566164697320526f6f74204341203330820222300d06092a864886f70d01010105000382020f003082020a0282020100cc574216549ce698d3d34deefeedc79f43394a65b3e8168834db0d599174cf92b80440ad024b31abbc8d9168d8200e1a01e21a7b4e175de28ab73f991acdeb61abc265a61fb7b7bdb78ffcfd708f0ba067be01a259cf71e60f2976ffb15679452b1f9e7a54e8a3293568a4014f0fa42e37ef1bbfe38f10a872ab5857e75486c8c9f35bda2cda5d8e6e3ca33edafb82e5ddf25cb205336f8a36ced0134effbf4a0c344ca6c321bd500455ebb1bb9dfb451e6415de55018c0276b5cba13f4269bc2fbd68431656892a376191fda6ae4ec0cb146594374b9206ef04d0c89c88db0b7b81afb13d2ac4653a78b6eedc80b1d2d3999c3aee6b5a6bb38db7d5ce9cc2bea54b2f16b19e683b066fae7d9ff8deeccc29a798a325432feff15f26e1884df85e6ed7d9146e193369a73b848993c4535513a1517840f8b8c9a2ee7bba5242839e14ed05525a5956a797fc9d3f0a29d8dc4f910e13bcde95a4df8b99beac9b3388efb581af1bc62253c8f6c7ee9714b0c57c7852c8f0ce6e776084a6e92a7620ed5801173093e91a8be07363d96a9294494eb4ad4a85c4a32230fc09ed682273a6880c552158c5e13a9f2addcae190e0d973ab6c80b8e80b6493a09c8c19ffb3d20cec9126878ab3a2e1708f2c0ae5cd6d6851ebda3f057f8b32e6135c6bfe5f40e222c8b4b4644fd6ba7d483ea8690cd7bb8671c973b83f3b9d254bdaff40eb0203010001a382019530820191300f0603551d130101ff040530030101ff3081e10603551d200481d93081d63081d306092b06010401be5800033081c530819306082b060105050702023081861a8183416e7920757365206f66207468697320436572746966696361746520636f6e737469747574657320616363657074616e6365206f66207468652051756f566164697320526f6f74204341203320436572746966696361746520506f6c696379202f2043657274696669636174696f6e2050726163746963652053746174656d656e742e302d06082b060105050702011621687474703a2f2f7777772e71756f7661646973676c6f62616c2e636f6d2f637073300b0603551d0f040403020106301d0603551d0e04160414f2c013e082433efbee2f673296355cdbb8cb02d0306e0603551d23046730658014f2c013e082433efbee2f673296355cdbb8cb02d0a149a4473045310b300906035504061302424d31193017060355040a131051756f5661646973204c696d69746564311b30190603550403131251756f566164697320526f6f742043412033820205c6300d06092a864886f70d010105050003820201004fada02c4cfac0f26ff76655ab2334eee729dac35bb6b083d9d0d0e221fbf360a73b5d605327a29bf608222ae7bfa072e59c246a31b1907a27db84118927a6775a38d7bfac86fcee5d83bc06c6d1776b0f6d242f4b7a6ca70796cae3849fad888b1dab168d5b6617d916f48b80d2ddf8b276c3fc3813aa0cde42692b6ef33ceb8027dbf5a6440d9f5a55590bd50d5248c5ae9ff22f80c5ea32503512972ec1e1fff1238851389ff2665676e70f5197a5520c4d495195363dbfa24b0c101d86994caaf3721193e4eaf69bdaa85da74db79e02ae7300c8da2303e8f9ea1974620094cb2220be94a759b5826abe99797aa9f24a2452f774fdba4ee6a81d026eb10d8044c1aed323375fbb857c2b922ee87ea58bdd99e1bf276f2d5daa7b87fe0add4bfc8ef526e46e70426e33ec319e7b93c1e4c9691a3dc06b4e226deeab584dc6d041c12bea4f12875eeb45d86cf59802d3a0d8558a069919a2a077d1309eaccc75ee83f5b06239cf6c57e24cd2910b0e75281b9abffd1a43f1ca77fb3b8f61b869281642045e702a1c21d88fe1bd235b2d744092d963190d73dd69bc6247bce0742bb2eb7dbe411bb5c046c5a122cb5f4ec12892de18bad52a28bb118b1793989960945c23cf5a27975e0b050693371e3b6936eba99e611d8f32da8e0cd6743e7b0924da017747c43bcd348c99f5cae1256133b2591be26ed73757b60da912da updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A7F8390BA57705096FD36941D42E7198C6D4D9D5\Blob = 030000000100000014000000a7f8390ba57705096fd36941d42e7198c6d4d9d5090000000100000020000000301e06082b0601050507030206082b0601050507030406082b060105050703080b000000010000003e000000530065007200610073006100200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020004900000020000000010000001504000030820411308202f9a003020102020829d77adf92aa4a46300d06092a864886f70d01010505003062310b300906035504061302425231143012060355040a130b53657261736120532e412e31143012060355040b130b5365726173612043412049312730250603550403131e53657261736120436572746966696361746520417574686f726974792049301e170d3034313132363134303234355a170d3234313132313134313234355a3062310b300906035504061302425231143012060355040a130b53657261736120532e412e31143012060355040b130b5365726173612043412049312730250603550403131e53657261736120436572746966696361746520417574686f72697479204930820122300d06092a864886f70d01010105000382010f003082010a0282010100d0bbdcb6e8b3be8c1c6d45dd942b8af3e173d86bbc8613c953db78d8635ebb5737a5881c2e80136b39ac989ed979b1ed27b100aa41727e8d55a944f30fb99849edb84f460f4cbc7f1120b099f2728f5f764505ccebc063c6c13dae9116b8720a39cea15cb647f967d7e5ee6221c6f275960e527acbdd634e89e23b3ba83fa8aec1a4547df30370d68e106c19d613c97f86e02861990f331efbccd6bafd1a79df4d444cad903762badf8e3b30b5d72902b0b0a4fc795f4c02c1f1753219e47689598e61df4b903c31ec7953a26ed60bf463776cba58db52559afc8eadafc898a5e119eef1e9844b927d887fba8a53cc9cf0b582a259bf91f35011a3ea99d1e41d0203010001a381ca3081c730270603551d250420301e06082b0601050507030406082b0601050507030206082b06010505070308305c0603551d1f045530533051a04fa04d864b687474703a2f2f7777772e636572746966696361646f6469676974616c2e636f6d2e62722f7265706f7369746f72696f2f73657261736163612f63726c2f5365726173614341492e63726c301d0603551d0e04160414f838ee5c6eedab96a045eb360fdcd9ab3a3158fd300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106300d06092a864886f70d0101050500038201010066d436e62d70fd928808a930aae021aab75067adc0c86c20931771c8aec8696b2cdd13bb7ce24c09b9d6d9b3196b57b06f7547ee759828e8a2dc2fd5e06a26298e3b7911b2d6690ab20ed64d307f35b94a5e9007a2e7257bcefb2aee72289ae80f5a916338b595be643aea18d29cfe64a7e6fa1c5287a58405bc597f3173ec1f0af36711f293201331954e25f9d2be131be32e928a859e5dcf851a52dba2e850e00514e14f8ac8cdb6a5e158035aa5789a8340f81235685dcc8701f9a712ad38f7b5f3ed30b73e8b6eea6ec99ec71b6b9d587c8c1efc1b6ffb72f8744ec55a9e00b9f7ffdbf04deaeac89a48cf2028270353260b9c572ad9e3335f3a5f607282 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CFF810FB2C4FFC0156BFE1E1FABCB418C68D31C5 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E70715F6F728365B5190E271DEE4C65EBEEACAF3 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\70179B868C00A4FA609152223F9F3E32BDE00562 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\FD1ED1E2021B0B9F73E8EB75CE23436BBCC746EB\Blob = 0b000000010000001a00000044002d0054005200550053005400200047006d00620048000000090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070308030000000100000014000000fd1ed1e2021b0b9f73e8eb75ce23436bbcc746eb200000000100000099040000308204953082037da0030201020203030e96300d06092a864886f70d0101050500304b310b300906035504061302444531153013060355040a0c0c442d547275737420476d62483125302306035504030c1c442d545255535420526f6f7420436c61737320332043412032303037301e170d3037303531363035323034375a170d3232303531363035323034375a304b310b300906035504061302444531153013060355040a0c0c442d547275737420476d62483125302306035504030c1c442d545255535420526f6f7420436c6173732033204341203230303730820122300d06092a864886f70d01010105000382010f003082010a0282010100ba8dcd355332eea6bd48909af2eae8580f4766a8cc6e0912e4a1cb5bdf93b8f6e93939f8c6d8e9cf1a86bca6ae0f8caf0845e3f28e2bc25c592bfa8c36b3701dc8503ca556beeaaee947f6e7490faf7f9426d4021a07b8ba3955ce9fbb223929d835c5990321d8a73863f1e434df47ae9f37f16ca099c222b06d72dc22c93139e856d7a08f3a215b869a4f28f91c76f7cc4f3ff94e778b2a9c8aaa79418ad51cd9396f98c95e45971d099419d95051857273bfac4b9d7434718721160f7eeed2497eca49d3f9922a47484f0f5d5aa1cbd528ecf092c5724346ebb303a6f357254a0a61840a26d6efa6b8d8148d78b9d3b725d14ee35a16aaec9f07ee23107db50203010001a38201803082017c300f0603551d130101ff040530030101ff301d0603551d0e04160414822f362349782042d7b05258a0d674541578bfaa303906082b06010505070101042d302b302906082b06010505073001861d687474703a2f2f75736572732e6f6373702e642d74727573742e6e657430330603551d11042c302a8110696e666f40642d74727573742e6e65748616687474703a2f2f7777772e642d74727573742e6e6574300e0603551d0f0101ff0404030201063081c90603551d1f0481c13081be3081bba081b8a081b586766c6461703a2f2f6469726563746f72792e642d74727573742e6e65742f434e3d442d5452555354253230526f6f74253230436c617373253230332532304341253230323030372c4f3d442d5472757374253230476d62482c433d44453f63657274696669636174657265766f636174696f6e6c697374863b687474703a2f2f7777772e642d74727573742e6e65742f63726c2f642d74727573745f726f6f745f636c6173735f335f63615f323030372e63726c300d06092a864886f70d01010505000382010100550e680a8ddcd9a886600269798d7de990c2d91d1db50ebb7392646314464cd06abba3755d86193861861db88a2234a3b43515b3a9604c54179fb1de5b32e27e6bde4f22f02d1d22049eb64a4fab2c569de3ddecb1264e2ad755c23ebd82d7be55bb45c8295b863c9d3f68444444360d68bfae01a219b54c97fff2963c67b242de0fe1a0974ecae73465ae9582616726732ddd7be7954b0e21aa92ae4cfcc6b3a9e599833239f060c24c51a8c147143589a54d360f9f1b0271418d424a24f8af6e9d0d70868daa62131e038b24f9c3549349851b7576627f22ff49bd76730c3f98ad2ab2fae7c5df74f5ff6931550a3ac0196235c449b92b191df47099eed8dc updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\FAB7EE36972662FB2DB02AF6BF03FDE87C4B2F9B\Blob = 0b000000010000002200000063006500720074005300490047004e00200052006f006f0074002000430041000000090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b06010505070307030000000100000014000000fab7ee36972662fb2db02af6bf03fde87c4b2f9b20000000010000003c0300003082033830820220a0030201020206200605167002300d06092a864886f70d0101050500303b310b300906035504061302524f3111300f060355040a1308636572745349474e31193017060355040b1310636572745349474e20524f4f54204341301e170d3036303730343137323030345a170d3331303730343137323030345a303b310b300906035504061302524f3111300f060355040a1308636572745349474e31193017060355040b1310636572745349474e20524f4f5420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b733b97ec8254a8eb5dbb4281baa5790e8d122d364bad393e8d4ac8661406a60576854844dbc6a540205ffdf9b9a2aae5d078f4ac3287feffb2bfa79f1c7adf0105324908b66c9a888abaf5aa300e9beba46ee5b737b2c1782815e622ca10265b3bdc52b007ec4fc0333570dede2face5d45d638cd35b6b2c1d09c814aaae4b2015c1d8f5f99c4b1addb8821eb90088280f330a343e69082ae552849ed5bd7a910380efe8f4c5b9b46ea41f5b00874c3d08833b67cd774dfdc84d1430e7539a1254028ea78cb0e2c2e399d8c8b6e161c2f268210e2e365940a04c05ef75d5bf810e2d0ba7a4bfbde3700001a5b28e3d29c733e328798a1c9512fd7deac33b34f0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff0404030201c6301d0603551d0e04160414e08c9bdb2549b3f17c86d6b242870bd06ba0d9e4300d06092a864886f70d010105050003820101003ed21c892e35fcf875dde67f6588f4724cc92cd7324ef3dd197947bd8e3b5b930f504924136b140672ef09d3a1a1e34084c9e71832743c486e0f9f4bd4f71ed39386645497637250d555cffa209302a29bc323934e165576a070796dcd211fcf2f2dbc19e38831f8591a8109c897a674c760c45bcc578eb275fd1b0209db596f729369f73141d68838bf87b2bd1679f9aae4be8825dd6127231cb531070436b41a90bda0747150896dbc14e30f86aef1ab3ec7a009cca348d1e0db64e792b5cfaf7243708bf9c3843c13aa7e929b575393fa70c2910e31f99b675de996385e5fb3734e881567de9e76106220be5569954300394df6eeb05a4e494454585f4283 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\209900B63D955728140CD13622D8C687A4EB0085 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3F85F2BB4A62B0B58BE1614ABB0D4631B4BEF8BA updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\24A40A1F573643A67F0A4B0749F6A22BF28ABB6B\Blob = 03000000010000001400000024a40a1f573643a67f0a4b0749f6a22bf28abb6b090000000100000016000000301406082b0601050507030406082b060105050703030b000000010000001200000056006500720069005300690067006e00000020000000010000004402000030820240308201a9021003c78f37db9228df3cbb1aad82fa6710300d06092a864886f70d010102050030613111300f06035504071308496e7465726e657431173015060355040a130e566572695369676e2c20496e632e31333031060355040b132a566572695369676e20436f6d6d65726369616c20536f667477617265205075626c697368657273204341301e170d3936303430393030303030305a170d3034303130373233353935395a30613111300f06035504071308496e7465726e657431173015060355040a130e566572695369676e2c20496e632e31333031060355040b132a566572695369676e20436f6d6d65726369616c20536f667477617265205075626c69736865727320434130819f300d06092a864886f70d010101050003818d0030818902818100c3d3696552019454ab28c66218b35455c54487454a3bc27ed8d3d7c880868dd80cf1169ccc6ba929b28f767392c8c562a63ced1e0575f013006c144dd4989007be697381b8624e311ed1fcc90ceb7d90bfaeb44751ec6fce643502d67d670577e28fd951d7fb9719bc3ed77781c643ddf2dddfcaa3838bcb41c13d224848a6190203010001300d06092a864886f70d010102050003818100b5bcb0756a89a286bd6478c3a732757211aa26021760304ce3483419b9524a511880fe532d7bd5318cc5659941412ff2ae637ae8739915901a1f7a8b41d08e3ad0cd383444d075f8ea71c481193817354aaec53e32e621b805c093e1c7385cd8f793386490ed54cecad3d3d05fef049bde0282dd8829b1c34fa5cd7164313c3c updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8782C6C304353BCFD29692D2593E7D44D934FF11\Blob = 53000000010000002600000030243022060c6086480186fd64010102040130123010060a2b0601040182373c0101030200c00b00000001000000140000005400720075007300740077006100760065000000090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080300000001000000140000008782c6c304353bcfd29692d2593e7d44d934ff112000000001000000bc030000308203b8308202a0a00302010202100cf08e5c0816a5ad427ff0eb271859d0300d06092a864886f70d01010505003048310b30090603550406130255533120301e060355040a1317536563757265547275737420436f72706f726174696f6e311730150603550403130e5365637572655472757374204341301e170d3036313130373139333131385a170d3239313233313139343035355a3048310b30090603550406130255533120301e060355040a1317536563757265547275737420436f72706f726174696f6e311730150603550403130e536563757265547275737420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aba481e595cdf5f6148ec24fcad4e27895589c41e10d9940241739913366e9bee183af625c89d1fc245b61b3e01111411c1d6ef0b8bbf8dea781baa648c69f1dbdbe8ea9413eb894ed291ad48ed2031d03ef6d0d671c57d706adcac8f5fe0eaf66254804960b5da3ba16c3084fd146f8145cf2c85e01996dfd88cc86a8c16f31426c523e68cbf31934dfbb8718568026c4d0dcc06fdfdea0c29116a064114b44bc1ef6e7fa63de66ac76a471a3ec3694687a77a4b1e70e2f817ae2b57286efa26b8bf00fdbd3593fba72bc44249ce373b3f7af572f42269da974ba0052f24bcd537c470b36850e66a90897163457c166f780e3ed7054c793e02e28155987babb0203010001a3819d30819a301306092b060104018237140204061e0400430041300b0603551d0f040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604144232b616fa04fdfe5d4b7ac3fdf74c401d5a43af30340603551d1f042d302b3029a027a0258623687474703a2f2f63726c2e73656375726574727573742e636f6d2f535443412e63726c301006092b06010401823715010403020100300d06092a864886f70d0101050500038201010030ed4f4ae1583a52725bb5a6a36518a6bb513b77e99dead39f5ce045657b0dca5be27050b2940514ae49c78d41071273947e0c2321fdbc107f60105a72f5980eacecb97fdd7a6f5dd31cf4ff88056942a90571c8b7ac26e82eb48c6aff71dcb8b1df99bc7c21542be458a2bb5729ae9ea9a319260f992e08b0effd69cf991a098de3a79f2bc936347b24b3784c9517a406261eb66452365f6067d99cc505740be76723d208fc88e9ae8b7fe130f4377efdc632da2d9e4430306cee07ded234fcd2ff40f64bf466460654a6f2320a6326306b9bd1dc8b47bae1b9d562d0a2a0f467057829631a6f04d6f8c64ca39ab137b48de5284b1d9e2cc2b868bced02ee31 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\9158C5EF987301A8903CFDAB03D72DA1D88909C9 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D23209AD23D314232174E40D7F9D62139786633A updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\30779E9315022E94856A3FF8BCF815B082F9AEFD updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D6DAA8208D09D2154D24B52FCB346EB258B28A58 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742CDF1594049CBF17A2046CC639BB3888E02E33\Blob = 0b000000010000004e0000004300650072007400690070006f0073007400200045002d005400720075007300740020005000720069006d0061007200790020005100750061006c00690066006900650064002000430041000000090000000100000040000000303e06082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070308060a2b0601040182370a030c030000000100000014000000742cdf1594049cbf17a2046cc639bb3888e02e332000000001000000e2030000308203de308202c6a003020102020b040000000001055264c425300d06092a864886f70d0101050500305c310b3009060355040613024245311c301a060355040a13134365727469706f737420732e612e2f6e2e762e312f302d060355040313264365727469706f737420452d5472757374205072696d617279205175616c6966696564204341301e170d3035303732363130303030305a170d3230303732363130303030305a305c310b3009060355040613024245311c301a060355040a13134365727469706f737420732e612e2f6e2e762e312f302d060355040313264365727469706f737420452d5472757374205072696d617279205175616c696669656420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ae20d278db9aa0729c0452252c6d52d8d7278933a0e1b2d5fb30756b2d7f1c678e0ee71f12df177918bbb41b6ff83d751b9e6737f0f1fa0f75ed869d0304a128702d3cb26ba07351e335a974a5083e948527362aaa7264fc77ee76941c72ebbf32c777036a25820905af5f603c7fac1bbc92e83c7459cef17c542d38ae96f0ac6fa1330c215a01ba23205ba08602d553dc491fa832b3af3b463bb6ef9f39b3380be77a8af628f9a76f5029c879588b49d2a5d8857e56f1691578441135d7a5543eab6625d2dbe318f12e2be27123093764434274329677de97a2e996869c254409d4019d517e33b70944e580970d645b771897a54ba99e109d87fa56a7cf0a7d0203010001a381a030819d300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414f078f9077710bbdc1ea1ae79fb3010dbc634f81730480603551d200441303f303d060903900e0701000102003030302e06082b060105050702011622687474703a2f2f7777772e652d74727573742e62652f4350532f514e636572747320301106096086480186f8420101040403020007300d06092a864886f70d010105050003820101006ce1d85f7458e97049d6ca0d2c58daca64b6514fc3066401e98a731d9ecf4678bf3b8586e23d4a18942a81776f82f86ff4ee22fc9d18217260bb18808295fbf9f795248166c1b5c3b5d2b6768b3b815cb8a10e2b01148b800940eef8604c19e417cd2701b3631205a408c9b4bf9e504eb5de0f92336675d03de7237cea25717cfe3e2e3679a1e529502335059578bb9f7964dc5748272ce25c33cdc2bb7e6877a72fa3491772e100846b7d7aaf390b2cd5d85764326c840a6a763ad3accd9db1e737dcec0c2fc55760df88f543b1016426b4278210b2a350ef97e67fbf9187b3db90a92ae27a346c7349f4e88d2e6b8adda18a7f63d0bf581eafcc3f92502dd1 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5922A1E15AEA163521F898396A4646B0441B0FA9\Blob = 0b00000001000000400000004f004900530054004500200057004900530065004b0065007900200047006c006f00620061006c00200052006f006f0074002000470041002000430041000000090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080300000001000000140000005922a1e15aea163521f898396a4646b0441b0fa92000000001000000f5030000308203f1308202d9a0030201020210413d72c7f46b1f81437df1d22854df9a300d06092a864886f70d010105050030818a310b30090603550406130243483110300e060355040a1307574953654b6579311b3019060355040b1312436f7079726967687420286329203230303531223020060355040b13194f4953544520466f756e646174696f6e20456e646f72736564312830260603550403131f4f4953544520574953654b657920476c6f62616c20526f6f74204741204341301e170d3035313231313136303334345a170d3337313231313136303935315a30818a310b30090603550406130243483110300e060355040a1307574953654b6579311b3019060355040b1312436f7079726967687420286329203230303531223020060355040b13194f4953544520466f756e646174696f6e20456e646f72736564312830260603550403131f4f4953544520574953654b657920476c6f62616c20526f6f7420474120434130820122300d06092a864886f70d01010105000382010f003082010a0282010100cb4fb3009b3d36ddf9d1496a6b10491fecd82bb2c6f832812943954c9a1923211545dee3c81c51555bae93e837ff2b6be9d4eabe2adda8512bd766c3615c6002c8f5ce727b3bb8f24e65089acda46a19c101bb73a6d7f6c3ddcdbca48bb59961b801a2a3d44dd4053d91adf8b4087164af70f11c6b7ef6c3779d24737be40c8ce1d936e1998b05990bed453109cac200dbf772a096aa9587d08ec7b661730d76668cdc1bb463a29f7f931330f1a127dbd9ff2c558891a0e04f07b028568c181b97448e89dde0176ee72aef8f390a318482d84014492e7a41e4a7fee364ccc159714b2c21a75b7de01dd12e819bc3d868f7bd961bac70b116140bdb60b92601050203010001a351304f300b0603551d0f040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b3037eae36bcb079d1dc9426b611be21b2698694301006092b06010401823715010403020100300d06092a864886f70d010105050003820101004ba1ff0b876eb3f9c143b148f328c01d2ec90941fa94001ca4a4ab494f8f3d1eef4d6fbdbca4f6f22630c910ca1d88fb74191f8545bdb06c51f9367edbf54c323a414f5b47cfe80b2db6c4199d74c547c63b6a0fac14db3cf4739ca905df00dc7478faf83560590213187cbcfb4db0206d43bb60307a67335cc599d1f82d395273fb8caa97255c72d9081eab4e3ce381319f03a6fbc0fe298855da84d55003b6e284a3a636aa113a01e1184bd64468b33df9537484b34691469600b7802cb6e1e310e2dba2e7288f019662163e00e31ca5368118a24c5276c011a36ee61dbae35abe3653c53e758f8669295853b59cbb6f9f5cc518ecdd2fe198c9fcbedf0a0d updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3B1EFD3A66EA28B16697394703A72CA340A05BD5\Blob = 0b00000001000000540000004d006900630072006f0073006f0066007400200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003100300000000300000001000000140000003b1efd3a66ea28b16697394703a72ca340a05bd52000000001000000f1050000308205ed308203d5a003020102021028cc3a25bfba44ac449a9b586b4339aa300d06092a864886f70d01010b0500308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f726974792032303130301e170d3130303632333231353732345a170d3335303632333232303430315a308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f72697479203230313030820222300d06092a864886f70d01010105000382020f003082020a0282020100b9089e28e4e4ec064e5068b341c57bebaeb68eaf81ba22441f6534694cbe704017f2167be279fd86ed0d39f41ba8ad92901ecb3d768f5ad9b591102e3c058d8a6d2454e71fed56ad83b4509c15a51774885920fc08c58476d368d46f2878ce5cb8f3509044ffe3635fbea19a2c961504d607fe1e8421e0423111c4283694cf50a4629ec9d6ab7100b25b0ce696d40a2496f5ffc6d5b71bd7cbb72162af12dca15d37e31afb1a4698c09bc0e7631f2a0893027e1e6a8ef29f1889e42285a2b1845740fff50ed86f9cede2453101cd17e97fb08145e3aa214026a172aaa74f3c01057eee8358b15e06639962917882b70d930c246ab41bdb27ec5f95043f934a30f59718b3a7f919a793331d01c8db22525cd725c946f9a2fb875943be9b62b18d2d86441a46ac78617e3009faae89c4412a2266039139459cc78b0ca8ca0d2ffb52ea0cf76333239dfeb01fad67d6a75003c6047063b52cb1865a43b7fbaef96e296e21214126068cc9c3eeb0c28593a1b985d9e6326c4b4c3fd65da3e5b59d77c39cc055b77400e3b838ab839750e19a42241dc6c0a330d11a5ac85234f773f1c7181f33ad7aeccb4160f3239420c24845ac5c51c62e80c2e27715bd8587ed369d9691ee00b5a370ec9fe38d80688376baaf5d70522216e266fbbab3c5c2f73e2f77a6cadec1a6c6484cc3375123d327d7b84e7096f0a14476af78cf9ae166130203010001a351304f300b0603551d0f040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414d5f656cb8fe8a25c6268d13d94905bd7ce9a18c4301006092b06010401823715010403020100300d06092a864886f70d01010b05000382020100aca5968cbfbbaea6f6d7718743315688fd1c32715b35b7d4f091f2af37e214f1f30226053e16147f14bab84ffb89b2b2e7d409cc6db95b3b64657066b7f2b15adf1a02f3f551b8676d79f3bf567be484b92b1e9b409c2634f947189869d81cd7b6d1bf8f61c267c4b5ef60438e101b3649e420caada7c1b1276509f8cdf55b2ad08433f3ef1ff2f59c0b589337a075a0de72de6c752a6622f58c0630569f40b930aa40771582d78becc0d3b2bd83c5770c1eaeaf1953a04d79719f0faf30ce67f9d62ccc22417a07f2974218ce59791055de6f10e4b8da836640160968235b972e269a02bb578cc5b8ba69623280899ea1fdc0927c7b2b3319842a63c5006862fa9f478d997a453aa7e9edee6942b5f3819b4756107bfc7036841873eaeff9974d9e3323dd260bba2ab73f44dc8327ffbd61592b11b7ca4fdbc58b0c1c31ae32f8f8b942f77fdc619a76b15a04e1113d6645b71871bec92485d6f3d4ba41345d122d25b98da613486d4bb0077d99930961817457268aab69e3e4d9c788cc24d8ec52245c1ebc9114e296deeb0ada9edd5fb35bdbd482ecc620508725403afbc7eecdfe33e56ec3840955032539c0e9355d6531a8f6bfa009cd29c7b336322edc95f383c15acf8b8df6eab321f8a4ed1e310eb64c11ab600ba412232217a3366482910412e0ab6f1ecb500561b440ff598671d1d533697ca9738a38d7640cf169 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\00EA522C8A9C06AA3ECCE0B4FA6CDC21D92E8099\Blob = 03000000010000001400000000ea522c8a9c06aa3ecce0b4fa6cdc21d92e8099090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000006c0000004a006100700061006e002000430065007200740069006600690063006100740069006f006e002000530065007200760069006300650073002c00200049006e0063002e0020005300650063007500720065005300690067006e00200052006f006f007400430041003200000020000000010000002d030000308203293082021102085f60585f00000000300d06092a864886f70d01010505003057310b3009060355040613024a50312b3029060355040a13224a6170616e2043657274696669636174696f6e2053657276696365732c20496e632e311b3019060355040313125365637572655369676e20526f6f74434132301e170d3939303931353135303030315a170d3230303931353134353935395a3057310b3009060355040613024a50312b3029060355040a13224a6170616e2043657274696669636174696f6e2053657276696365732c20496e632e311b3019060355040313125365637572655369676e20526f6f7443413230820122300d06092a864886f70d01010105000382010f003082010a0282010100967b92233f60df093c588008e3630997e8e40b7561d4cd0ea3f2e31e43ba83ffba815c2fc8de908b4c0e2f29f907d68eb3a628af822a7bc2b4664c71f40c741ab8db1ae86837a9f9a1a26e1c28cd6c263c8f2a339e9dcbb479c4d9643d95c633a847fbe50709dcf66db825424cc3fb4aed5b2ed407a8e593102493586e7dc1d01ecfe929d7d0bc5f4cf01516c3d8c2cee35b175b948b286b1467243bf452ec0d6e7c4eb49902dbc9f30f82ab01f48cde1670c6bc170761ff114084ea2c1b7a3ab0036107aa968dd0dab9838ee49d516975716481b48855dc1083ce2da5f53096612e3b0afc875f9c5c8275131ed398d1edc9ed72161c0c06dc59207ef05deff70203010001300d06092a864886f70d0101050500038201010069e05670ff335ac8e1c8d3ac302173484e22e23228cbbc173a8d7e38d1f9b73f3085328d57fc1f407f3f7a74ec120964c1fddcfc1c35bcf10bb4eaa15cde2b2990820316ca9ec4bbb0928d9556529932c0909b5543e4f34d7651ad6c3c5c9dc2417d8d4cf0a9ac3abe20270597704668b664f82599e995c38e3ae9c1e21ac022b16dadb0ee9f2cec74c3c1642c926f96680b0157e88699afe788c859606eb25604ab54b85d181676cdda1e74904b9b4611970981f3cef2619903f3e96e484c3fdbbc80db8120febd5c46ff4ee7af4dfebc4480e3096e677a25fb57e73ce655a5a20186283f7f5febf4eb1a8455319f24f0c9f6694c145213b3f9241a17d91870 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\36863563FD5128C7BEA6F005CFE9B43668086CCE updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\101DFA3FD50BCBBB9BB5600C1955A41AF4733A04\Blob = 0b000000010000003c00000053007400610061007400200064006500720020004e0065006400650072006c0061006e00640065006e00200052006f006f0074002000430041000000090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308030000000100000014000000101dfa3fd50bcbbb9bb5600c1955a41af4733a042000000001000000be030000308203ba308202a2a00302010202040098968a300d06092a864886f70d01010505003055310b3009060355040613024e4c311e301c060355040a1315537461617420646572204e656465726c616e64656e312630240603550403131d537461617420646572204e656465726c616e64656e20526f6f74204341301e170d3032313231373039323334395a170d3135313231363039313533385a3055310b3009060355040613024e4c311e301c060355040a1315537461617420646572204e656465726c616e64656e312630240603550403131d537461617420646572204e656465726c616e64656e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a028201010098d2b551117a81a61498716dbecce7131bd6270e7ab36a181cb6615ad56109bfde9013c767eeddf3dac50c129e35553e2c2788406bf7dcdd2261f5c2c70ef5f6d576534d8f8cbc187637859de8ca49c7d24f981309a23e22889c7fd6f21065b4ee5f18d517e3f8c5fde29da2ef530e8577a20fe13047ee00e7337d44671a0b51e88ba09e50986834521f2e6d01f26045f231eba9316829bb7a419ec6197f94b45139037fb2dea7329bb4478e6fb44aaee5afb1dcb01b61bc9972dee489b77a265dda33495b529c0ef58aadc3b83de8066ac2d52a0b6c7b84bd5605cb866592ec442bb08eb9dc700b46daadbc638839fadb6afe23fabce448f4672b6a111021490203010001a3819130818e300c0603551d13040530030101ff304f0603551d200448304630440604551d2000303c303a06082b06010505070201162e687474703a2f2f7777772e706b696f766572686569642e6e6c2f706f6c69636965732f726f6f742d706f6c696379300e0603551d0f0101ff040403020106301d0603551d0e04160414a87debbc63a474137400ec96e0d334c12cbf6cf8300d06092a864886f70d0101050500038201010005848755743661c1bbd1d4c615a813b49fa4febbee15b42f060c29f2a892a4610dfcab5c085b51132b4dc22a61c8f80958fc2d02b2397d996681bf6e5c9545206ce679a7d1d81c29fcc2202751c8f17c5d346769851130c600d2d7f3d37cb6f0315728128273e9332fa655b40b9194479cfabb7a4232e8ae7e2dc8bcac14bfd90fd95bfcc1f97a95e17d7e96fc71b0c24cc8df4534c9ce0df29c6408d03bc329c5b2ed9004c1b12991c5306fc1a97233ccfe5d16172c1169e77efec58308dfbcdc223a2e20692339566067908b2e7639fb118897f67cbd4bb8201667058de23bc1723f949537c75db99ed893a1178fff0c6615c1247c327c031d3ba158453293 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0456F23D1E9C43AECB0D807F1C0647551A05F456 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0409565B77DA582E6495AC0060A72354E64B0192 updroots.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 2392 KB931125.exe Token: SeRestorePrivilege 2392 KB931125.exe Token: SeRestorePrivilege 2392 KB931125.exe Token: SeRestorePrivilege 2392 KB931125.exe Token: SeRestorePrivilege 2392 KB931125.exe Token: SeRestorePrivilege 2392 KB931125.exe Token: SeRestorePrivilege 2392 KB931125.exe -
Suspicious use of WriteProcessMemory 46 IoCs
description pid Process procid_target PID 2248 wrote to memory of 2464 2248 rundll32.exe 28 PID 2248 wrote to memory of 2464 2248 rundll32.exe 28 PID 2248 wrote to memory of 2464 2248 rundll32.exe 28 PID 2248 wrote to memory of 2464 2248 rundll32.exe 28 PID 2248 wrote to memory of 2464 2248 rundll32.exe 28 PID 2248 wrote to memory of 2464 2248 rundll32.exe 28 PID 2248 wrote to memory of 2464 2248 rundll32.exe 28 PID 2464 wrote to memory of 2392 2464 rundll32.exe 29 PID 2464 wrote to memory of 2392 2464 rundll32.exe 29 PID 2464 wrote to memory of 2392 2464 rundll32.exe 29 PID 2464 wrote to memory of 2392 2464 rundll32.exe 29 PID 2464 wrote to memory of 2392 2464 rundll32.exe 29 PID 2464 wrote to memory of 2392 2464 rundll32.exe 29 PID 2464 wrote to memory of 2392 2464 rundll32.exe 29 PID 2392 wrote to memory of 2440 2392 KB931125.exe 30 PID 2392 wrote to memory of 2440 2392 KB931125.exe 30 PID 2392 wrote to memory of 2440 2392 KB931125.exe 30 PID 2392 wrote to memory of 2440 2392 KB931125.exe 30 PID 2392 wrote to memory of 2440 2392 KB931125.exe 30 PID 2392 wrote to memory of 2440 2392 KB931125.exe 30 PID 2392 wrote to memory of 2440 2392 KB931125.exe 30 PID 2392 wrote to memory of 2840 2392 KB931125.exe 31 PID 2392 wrote to memory of 2840 2392 KB931125.exe 31 PID 2392 wrote to memory of 2840 2392 KB931125.exe 31 PID 2392 wrote to memory of 2840 2392 KB931125.exe 31 PID 2392 wrote to memory of 2840 2392 KB931125.exe 31 PID 2392 wrote to memory of 2840 2392 KB931125.exe 31 PID 2392 wrote to memory of 2840 2392 KB931125.exe 31 PID 2392 wrote to memory of 2896 2392 KB931125.exe 32 PID 2392 wrote to memory of 2896 2392 KB931125.exe 32 PID 2392 wrote to memory of 2896 2392 KB931125.exe 32 PID 2392 wrote to memory of 2896 2392 KB931125.exe 32 PID 2392 wrote to memory of 2896 2392 KB931125.exe 32 PID 2392 wrote to memory of 2896 2392 KB931125.exe 32 PID 2392 wrote to memory of 2896 2392 KB931125.exe 32 PID 2392 wrote to memory of 864 2392 KB931125.exe 33 PID 2392 wrote to memory of 864 2392 KB931125.exe 33 PID 2392 wrote to memory of 864 2392 KB931125.exe 33 PID 2392 wrote to memory of 864 2392 KB931125.exe 33 PID 2392 wrote to memory of 864 2392 KB931125.exe 33 PID 2392 wrote to memory of 864 2392 KB931125.exe 33 PID 2392 wrote to memory of 864 2392 KB931125.exe 33 PID 2464 wrote to memory of 2316 2464 rundll32.exe 35 PID 2464 wrote to memory of 2316 2464 rundll32.exe 35 PID 2464 wrote to memory of 2316 2464 rundll32.exe 35 PID 2464 wrote to memory of 2316 2464 rundll32.exe 35
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0d13f10ee700c117477011784fd404780fa86504a8976f7d1e4e45a00c963fa2.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0d13f10ee700c117477011784fd404780fa86504a8976f7d1e4e45a00c963fa2.dll,#12⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\{E2287C07-620A-429c-9643-89E1DB40BFB5}.tmp\KB931125.exe"C:\Users\Admin\AppData\Local\Temp\{E2287C07-620A-429c-9643-89E1DB40BFB5}.tmp\KB931125.exe"3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe authroots.sst4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
PID:2440
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe updroots.sst4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
PID:2840
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe -l roots.sst4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
PID:2896
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe -d delroots.sst4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:864
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 3083⤵
- Program crash
PID:2316
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
73KB
MD5bb49ccc10926cdb601eba81afef749a2
SHA1a4766c9aea8d211e9632148fd4b625cece195be9
SHA256f013ee3b7fede9a95844e83e83ee298d38cba6efce5a5cafcd8b95255c32f86c
SHA51294c2809727039d1ed07a3742a4b2f9300e865ea7c49bc1fcf547a30238eeecc88d8dd06a2d4f3112317f948908b9af082b50f412a41a2bcb48d5e30d6d8ecbba
-
Filesize
9KB
MD57b32871e409608ff887b6cf4d87debb0
SHA1191f9ea1298ee52dbd6f977b3584109a064f57b9
SHA2563f01268547364d2d60a0f65b46757cccfd9225fc39d581846a8fbffdb5756ff2
SHA512534a384f7946db4083e639b8e02d83ac97293c60630b8811a84c85e0330e9c293f05f5cf71e0f3580551e7923bc5a3bfb7f0406432ca3cdb7efeb4a950ac5e8a
-
Filesize
7KB
MD59e5de0fd1f90486a66dee4bfe89a78d7
SHA190e3188ef63495aaa71c85d4ff0f23253c834b40
SHA2568b95ff56d61586582864d05563762615c8705779578dca3c98a303c3b1f4122e
SHA51260006fa6f57e4d280642d51055f85f8d27b913ce71373de5b928c515c77647295030ab73ab4a55024de4a40c18f200909f49ffb52c26cf554835fc3d4cc348f1
-
Filesize
1KB
MD5421e60325404f5f29ac04c9b9d59096b
SHA1aace2fd74d799e8af5c8d5b2646361bb67a1620c
SHA256571a8da5298aacc37700c747ee5d72b5a7797835140e7a4d4f895e9604574d77
SHA51286693975b1b187ee65b0a23b1f3f8e05d1a3f61e7e47b060f938fe1602bbad96021847b709e64c2d5a295b72f10f4db587a11a1e7ca0a0b64c3bed7fa683b1d2
-
Filesize
320KB
MD52d9b4498c847715418160bfd7e7c8a2d
SHA1e0873091d476d2566aa6fc988cb364247c95dc97
SHA256c49c05b701c390c679e5e3226ec621f22a08155b1065fcfc37b509f648f03b41
SHA512dcf3208cdd1e4353f82823f796d735c1209f149f183eea827a90753ec55509a1c460a16c120e07c12a5eacf0e67d2661c25638491ecf4403e25d6508983e519b
-
Filesize
89KB
MD5a64e4b204d44548eeb5c3d86eca2ad70
SHA1e3245bf6dbb2e56d71a9cbad2697aa4fa0df6bbe
SHA256985a5603ebf94539ac11549999f83b5e6dc008180994898c5daa6fd31ae1e9dc
SHA512dca4099318954bab5f1204645be0d0e8fea0c2e97ee95496fa884fbed627e376358623fa94c39bf0abe97d07d46a7e6c5e1081496cdd1987e07e595995a46cd5
-
Filesize
5KB
MD59c18ae971cbffb096952177f6804ea31
SHA1bb255dd1bd9bb39cdbb8671af66054432c686828
SHA2562703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb
SHA51221086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c
-
Filesize
1.1MB
MD5a6d0784011092569848b236a769aa90e
SHA1fb53f64a54bc4e09f512b6b183f7f37d0a9b418c
SHA2561cad6f2cb62cc06974d417d73b0e2eb1503cc2e9054a060ad179cc425fa4959a
SHA512dd37421471bb120ca7edef135dabd3f1ac2edfdef71519c5182948ca44417b536adf8681a3432d1f41650fff24ea9eba9115da3ade5b7abe6e3d73f685a23fc9
-
Filesize
349KB
MD54a4d72d34f9da1fc5019e0748fcde2f5
SHA1f54752ec63369522f37e545325519ee434cdf439
SHA25683b660f3f3eaddd4b388ed3f806f7444f03429fb63fc1f8db3d86294914a05ca
SHA51295986ffbf51483a0d1a256028847c7ee6ac73ffd62f6d838309a69e1833f719a7cfed5422815f4d4a49dbd599c449f8db8f60273136720cb1da5f8b0eb24cb33