Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04/09/2024, 18:47
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-04_11a07ae5b1c0322d338b600969f36d0f_magniber_metamorfo.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-04_11a07ae5b1c0322d338b600969f36d0f_magniber_metamorfo.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-04_11a07ae5b1c0322d338b600969f36d0f_magniber_metamorfo.exe
-
Size
4.8MB
-
MD5
11a07ae5b1c0322d338b600969f36d0f
-
SHA1
0b51fabe8a2bfff2dcbd13d4b0af7737c926e51f
-
SHA256
f67c9eb3930de4c767f522915503ce71ea4dbf02a003f5d44d1261d5c0db8f0e
-
SHA512
09268b1506524b10b02136bde864a66b93e44bb254179f2c6e3d5b792ba71decbd2f6c899682e88b6144193c8952dad8d9e308a7c016d2d28310a48776d3f56b
-
SSDEEP
98304:+7IyvTgqJ/BZXxkIjPG1f5ehM/Cw/khc5FbKEQ26PVR7m6gZ1MRGNCyI5AxV300e:4bg6BZBkIAhehM/Cw/khc5FbKEV6PVRz
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 6 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A} KB931125.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\ = "RootsUpdate" KB931125.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\IsInstalled = "1" KB931125.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\Version = "28,0,2195,0" KB931125.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\Locale = "*" KB931125.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\ComponentID = "Windows Roots Update" KB931125.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 2024-09-04_11a07ae5b1c0322d338b600969f36d0f_magniber_metamorfo.exe -
Executes dropped EXE 5 IoCs
pid Process 400 KB931125.exe 648 updroots.exe 4172 updroots.exe 5056 updroots.exe 2860 updroots.exe -
Loads dropped DLL 2 IoCs
pid Process 824 2024-09-04_11a07ae5b1c0322d338b600969f36d0f_magniber_metamorfo.exe 400 KB931125.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 2024-09-04_11a07ae5b1c0322d338b600969f36d0f_magniber_metamorfo.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-09-04_11a07ae5b1c0322d338b600969f36d0f_magniber_metamorfo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KB931125.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language updroots.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language updroots.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language updroots.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language updroots.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0048F8D37B153F6EA2798C323EF4F318A5624A9E updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\786A74AC76AB147F9C6A3050BA9EA87EFE9ACE3C updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\688B6EB807E8EDA5C7B17C4393D0795F0FAE155F updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4054DA6F1C3F4074ACED0FECCDDB79D153FB901D updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\293621028B20ED02F566C532D1D6ED909F45002F updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a09000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b060105050703030b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c02000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CABB51672400588E6419F1D40878D0403AA20264\Blob = 0b000000010000006c0000004a006100700061006e002000430065007200740069006600690063006100740069006f006e002000530065007200760069006300650073002c00200049006e0063002e0020005300650063007500720065005300690067006e00200052006f006f0074004300410031000000090000000100000016000000301406082b0601050507030406082b06010505070301030000000100000014000000cabb51672400588e6419f1d40878d0403aa2026420000000010000002d030000308203293082021102085f60585f00000000300d06092a864886f70d01010505003057310b3009060355040613024a50312b3029060355040a13224a6170616e2043657274696669636174696f6e2053657276696365732c20496e632e311b3019060355040313125365637572655369676e20526f6f74434131301e170d3939303931353135303030315a170d3230303931353134353935395a3057310b3009060355040613024a50312b3029060355040a13224a6170616e2043657274696669636174696f6e2053657276696365732c20496e632e311b3019060355040313125365637572655369676e20526f6f7443413130820122300d06092a864886f70d01010105000382010f003082010a028201010094900c4b71291cdaf668797aa4bae7d2cc8dafe84790991fc62aea9763e81fce1757c61ab3a8c77c87ed353580baba6e6dbe17fecc2d1b6cef8a004916e1ee065e4a075dab3dd150b89146d4d4da15d8945c0ecad7dabfa0f7493cc8bbceea26810a142d9c0d37456b41ca578b38f0261f31fccf348e8f77c13fe3ab543c27b4ce324c551362fcfe3a1625cf1b6ba223b7e0ea0269bbf722716d7c0b1993a1979ce391691f68e42f7d106d8f67aec110a2b05e634a97f7e678a9ad26bb54c9dfb4eec59ed325dd136853f98fe8ece5de81d6783eee5040b4013cac15c1823b2e7ff152278b72e0e7dbf98b29c3c34a2b3389ab5c2a07fc7c231e2b4f0822fec10203010001300d06092a864886f70d0101050500038201010055ed6f7b93e545314e68d55581a2081f6cdd09c5781a7057c8df0881ae6677c6750fe4ef498b035c6cff1c90a472b2d31612b206f84686aebfa715db854dfac22d4db3b5b043ef7c7e07db5fb357465176078644fd07eaf1cb4b454d66a73326c4f943aa8d12b3d48d68b6f70279b42d5ad70398042c6999aff4663b64acb2c02bc869549e4c4e48188dce57b53b51e51bd7fa3960db564513bee766d523f67c4800b04cef348d22acb22ed14c38cdfa580306ee3a73870a053acae4afd4c1ee1c857f2516cf27011f848a7708d0d346e820ec9fa48cf1bccdc41236801ec70928afe808bec0d3b23ed72e673da3cebb34fae285cdacce551d455b7885d3857a updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\68ED18B309CD5291C0D3357C1D1141BF883866B1\Blob = 0b000000010000002000000058006300650072007400200045005a0020006200790020004400530054000000090000000100000016000000301406082b0601050507030406082b0601050507030103000000010000001400000068ed18b309cd5291c0d3357c1d1141bf883866b12000000001000000fc030000308203f8308202e0a003020102021100d01e40900000274b0000000100000004300d06092a864886f70d010105050030818c310b3009060355040613025553310d300b0603550408130455746168311730150603550407130e53616c74204c616b65204369747931183016060355040a130f586365727420455a20627920445354311830160603550403130f586365727420455a206279204453543121301f06092a864886f70d010901161263614064696773696774727573742e636f6d301e170d3939303731343136313431385a170d3039303731313136313431385a30818c310b3009060355040613025553310d300b0603550408130455746168311730150603550407130e53616c74204c616b65204369747931183016060355040a130f586365727420455a20627920445354311830160603550403130f586365727420455a206279204453543121301f06092a864886f70d010901161263614064696773696774727573742e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100ad5418deb4bff7ade874aaed8b7c8fc2d4751ad584b9b662fc89efe4976192fb1db8e15a47349e9e0622fbd3ea38cbb88b07f71aa01777075a301cd4293820d72740d8509343bfd218a229760572aa6bb66998ab791e1c65f56a8bfcc516aaa272da60ed4e6e19257a0a1d30e3509b423c44eba1b0201edb027efe3d1fbfd0008adb4076a618a515a757b652c2011798778f8a81c61ab46a2ae6afa9d600accfd815497cdb1ba1fe81fa87f9d390c102c0f9d042e99168255fc6bf8739e995006028bf832cc0e75eb6d73616e7608776e8e727b2250d8b7ae5aa1de559cdce0b0e6fc6c89ce310d98539d3b79bfac6ba7c74d25d7556ab74a4a251bf527cee710203010001a3533051300f0603551d130101ff040530030101ff301f0603551d2304183016801408206c66eb810a6c5cd5b5a63c41dd1c96912777301d0603551d0e0416041408206c66eb810a6c5cd5b5a63c41dd1c96912777300d06092a864886f70d010105050003820101005a87588f2dab76216b540cd9f141f64ecd2b9ee31f9ba32d7fd92b7d58c867a429f5e9ecd5bd963fa373f8c45b367cd0632c34399b48b83d6ff614c59e63e6a7346ed3e833b3c73c186e23ae4392993f98c56930f1363badb93082d6b6591696020b291261b41189f70c2f94908598289c536c7e63dd73f419ff4a81d1b25223fd3c4a34ce5a1be0508aed4f8195d860e7e4c40dbb583e58f74e686f3e67c9cb7a971627ec42611476bb00c5eb083d157f4bb6225d873b90f4f3c0fe37b3e9d9620cc0c359af60bd1f0ddba1341f30c43d8badb01d0493ed5fd5e4bf203004f448e93301d12e902752b39bde3a1caba9977f9bebc28dc26decdc13d346c5797c updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\253F775B0E7797AB645F15915597C39E263631D1\Blob = 0b00000001000000240000004200490054002000410064006d0069006e002d0052006f006f0074002d00430041000000090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b06010505080202030000000100000014000000253f775b0e7797ab645f15915597c39e263631d1200000000100000059050000308205553082043da00302010202043bf381d0300d06092a864886f70d0101050500306c310b3009060355040613026368310e300c060355040a130561646d696e3111300f060355040b1308536572766963657331223020060355040b131943657274696669636174696f6e20417574686f726974696573311630140603550403130d41646d696e2d526f6f742d4341301e170d3031313131353038353130375a170d3231313131303037353130375a306c310b3009060355040613026368310e300c060355040a130561646d696e3111300f060355040b1308536572766963657331223020060355040b131943657274696669636174696f6e20417574686f726974696573311630140603550403130d41646d696e2d526f6f742d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100cbe0af441422fe6a1749f25d9dcf5c02620b80b95abfa855337ba312245e4c6f3b41894e833d9fb3952634a6cc12f4cc9d875e3d0c0d172f85263e2a265973a1a8bc3bebe546b8f3597b20b15e40016dba67b36bebefc5e2f935dd0c6a06b69a289a70b3402976c07146116b43afe55641fbe61c39834db7f6a2b166c9a80db2f077be36c1202732b9ccd75acaf61741364dfbbb5581639c935e836b7fb81577727c7d4d096b5995e6ed30ab4446d91501a55b8965b6e028d92808957e0823b222e8df254c3c68f76ee74bc790fd844126be5c833ad72379b71af80719825a6958c5ff88722bc7bef8d32d3377a71612a88b21c642ae7a64aff2b3c0ed77e4690203010001a38201fd308201f9300f0603551d130101ff040530030101ff3081990603551d2004819130818e30818b06086085740111030100307f302b06082b06010505070202301f1a1d54686973206973207468652041646d696e2d526f6f742d434120435053305006082b060105050702011644687474703a2f2f7777772e696e666f726d6174696b2e61646d696e2e63682f504b492f6c696e6b732f4350535f325f31365f3735365f315f31375f335f315f302e706466307f0603551d1f047830763074a072a070a46e306c311630140603550403130d41646d696e2d526f6f742d434131223020060355040b131943657274696669636174696f6e20417574686f7269746965733111300f060355040b13085365727669636573310e300c060355040a130561646d696e310b3009060355040613026368301d0603551d0e04160414829ffa237320f1978bb24c4dbe42c57f66cd64e83081990603551d2304819130818e8014829ffa237320f1978bb24c4dbe42c57f66cd64e8a170a46e306c310b3009060355040613026368310e300c060355040a130561646d696e3111300f060355040b1308536572766963657331223020060355040b131943657274696669636174696f6e20417574686f726974696573311630140603550403130d41646d696e2d526f6f742d434182043bf381d0300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100784f7a5c2611a72eae9a43ca5c3582467ec8368f7a66b5a932081c0ce46ea1f1c8c1d4e480e78cbd63b10cdff2b93ec20b71406946a36cf45b0f0d2144c72a2b3d1a0bc0a0c1cc88ca1c3fac52b6f667cd4c6dc4be23fd412b046e77a51678e99b5c23cf811a0621636adc2951b23af99bf75db12df50417067f9ce837852dee31bc2e01f8c4eb6b8e34c53939f69498bb1f0e1e112fa88c070a48a28c6a998534b72a6185781a29691f9d25505104ca17c339380771e7d1989bd5d1181596bce2f3c9672bf109b2ce9cf4432601fa576b90a9b1bee835d569fff039154ebc5ff0cf3bf4be233f4566c4b4965dbe8f0ddec76d0942f389f9f13ff5744fdfb865 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E0B4322EB2F6A568B654538448184A5036874384 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\97817950D81C9670CC34D809CF794431367EF474 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D8C5388AB7301B1B6ED47AE645253A6F9F1A2761\Blob = 5300000001000000230000003021301f060960857401590102010130123010060a2b0601040182373c0101030200c00b0000000100000014000000530077006900730073005300690067006e00000009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303030000000100000014000000d8c5388ab7301b1b6ed47ae645253a6f9f1a27612000000001000000be050000308205ba308203a2a003020102020900bb401c43f55e4fb0300d06092a864886f70d01010505003045310b300906035504061302434831153013060355040a130c53776973735369676e204147311f301d0603550403131653776973735369676e20476f6c64204341202d204732301e170d3036313032353038333033355a170d3336313032353038333033355a3045310b300906035504061302434831153013060355040a130c53776973735369676e204147311f301d0603550403131653776973735369676e20476f6c64204341202d20473230820222300d06092a864886f70d01010105000382020f003082020a0282020100afe4ee7e8b240e126ea9502d16443b92925ccab85d849242132abc655782403e5724cd508b252ab76ffcefa2d0c01f02244a13968f2313e6285800a347c706a784232bbbbd962b7f55cc8bc1571f0e62650fdd3d568a73daae7e6dba811c7e428c2035d9434d84fa84db522cf30e27770b6bbf112f72789f2ed83ee618375a2a72f9da62909295ca1f9ce9b33c2bcbf30113bf5acfc1b50a60bdddb5996453b8a096b36fe22677918ce06210029f340fa4d5923351debe8dba847a603c6adb9f2becdede013f6e4de55086cbb4afed4440c5ca5a8cdad22b7ca8eebea6e50aaa0ea5df0552b755c7225d326a97976313dbc9db79367b853a4ac55289f924e79d77a982ff551ca571692bd10224f2b326d46bda0455e5c10ac76d3037902ae49e14335e161755c55bb5cb348992f19d268fa107d4c6b27850db0c0c0b7c0b8c41d7b9e9dd8c88f7a34db232ccd817dacdb7ce669dd4fd5effbd973e2975e77ea76258af2534a541c73dbc0d50ca03030f085a1f95737862bfaf7214690ea5e5030e788e262842f0070b622010673946faa903cc04387a66ef2083b58c4a568e9100fc8e5c82de88a0c3e2686e7d8def3cdd65f45dac51ef2480aeaa56976ff9ad7dda613f98773ca591b61c8c26da65a2096dc1e254e3b9ca4c4c808f777b609a1edfb6f2481e0eba4e546d98e0e1a21aa27750cfc46392ec47199debe66bcec10203010001a381ac3081a9300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604145b257b96a465517eb839f3c078665ee83ae7f0ee301f0603551d230418301680145b257b96a465517eb839f3c078665ee83ae7f0ee30460603551d20043f303d303b0609608574015901020101302e302c06082b060105050702011620687474703a2f2f7265706f7369746f72792e73776973737369676e2e636f6d2f300d06092a864886f70d0101050500038202010027bae3947cf1aec0de17e6e5d8d5f554b083f4bbcd5e057b4f9f7566af3ce8567efc72783803d92b621b00b9f8e960cdccce518ac750316ee14a7e182f6959b63d64812be38384e622878e7de0ee029961b81ef4b82b88121684c23193389631a6b93b533fc32493565b6992ecc5c1bb3800e3ec17a9b8dcc77c01839f3247ba5222341d327a0956a77c2536a93d4bdac0826f0abb12c8874b2711f91e2dc7933f9edb5f266b52d92e8af114c6448d15a9b7bfbddea61aeeae2dfb487717febbecaf18f52a51f0398497956c6e1bc32bc474607925b00a27dfdf5ed239cf457d424bdfb32c1ec5c65dca553aa09c699a8fdaefb2b03c9f876c122b65701552311a24cf6f3123501f8c4f8f23c37441631c55a814dd3ee05150cff11b30560e92b08285d883cb2264bc2db825d554a2b806eaad92a424a0c186b54a136a47cf2e0b569554cbce9adb6ab4a6b2db4108862777f76aa0426c0b38ced775503292c2df2b302248d0d54138255da4e95d9fc69475d045fd3097438f90ab0ac78673604a692ddea578d706da6a9e4b3e773a20132201d0bf689e63606b354d0b6dbaa13dc093e07f23b355ad72254e46f9d216efb064c1019ee9caa06a980ecfd860f22f49b8e442e1383516f4c86e4ff78156e8baa3be23afaefd6f03e0023b3076fa1b6d41cf01b1e9b8c966f4db26f33aa474f249245bc9b0d057c1fa3e7ae197c9 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\06083F593F15A104A069A46BA903D006B7970991\Blob = 0b00000001000000520000004e00650074004c006f0063006b0020004100720061006e0079002000280043006c00610073007300200047006f006c0064002900200046005101740061006e00fa007300ed0074007600e1006e0079000000090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b0601050507030703000000010000001400000006083f593f15a104a069a46ba903d006b797099120000000010000001904000030820415308202fda003020102020649412ce40010300d06092a864886f70d01010b05003081a7310b30090603550406130248553111300f06035504070c08427564617065737431153013060355040a0c0c4e65744c6f636b204b66742e31373035060355040b0c2e54616ec3ba73c3ad7476c3a16e796b696164c3b36b202843657274696669636174696f6e205365727669636573293135303306035504030c2c4e65744c6f636b204172616e792028436c61737320476f6c64292046c59174616ec3ba73c3ad7476c3a16e79301e170d3038313231313135303832315a170d3238313230363135303832315a3081a7310b30090603550406130248553111300f06035504070c08427564617065737431153013060355040a0c0c4e65744c6f636b204b66742e31373035060355040b0c2e54616ec3ba73c3ad7476c3a16e796b696164c3b36b202843657274696669636174696f6e205365727669636573293135303306035504030c2c4e65744c6f636b204172616e792028436c61737320476f6c64292046c59174616ec3ba73c3ad7476c3a16e7930820122300d06092a864886f70d01010105000382010f003082010a0282010100c4245e73be4b6d14c3a1f4e397906ed230451e3cee67d964e01a8a7fca30ca83e320c1e3f43ad3945f1a7c5b6dbf304f8427f69f1f49bcc6990a90f20ff57f43843763518b7aa570fc7a58cd8e9bedc3466c84705ddaf3019023fc4e30a97ee12763e7ed643ca0b8c93363fe1690ffb0b8fdd7a8c0c094430bb6d559a69e56d0241f7079afdb39540d6575d915419401af5eecf68df1ffad64fe209ad75cebfea61f0864a38b7655ad1e3b28602e8725e8aaaf1fc6644620b7707f3cde48db9653b73977e41ae2c7168476975b2fbb191585f86985f599a7a9f234a7a9b6a603fc6f863d547c76049b6bf9405d0034c72e99759de58803aa4df803d24276c01b020300a88ba345304330120603551d130101ff040830060101ff020104300e0603551d0f0101ff040403020106301d0603551d0e04160414ccfa6793f0b6b8d0a5c01ef353fd8c53df83d796300d06092a864886f70d01010b05000382010100ab7fee1c16a99c3c5100a0c0110805a799e66f018854616ef1b918ad4aadfe814023942ffb757c2f284b622481820bf561f11c6eb86138eb81fa62a13b5a62d39465c4e1e66d82f82f2570b22126c172511f8c2cc38490c35a8fbacff4a765a5eb98d1fb05b2467515236a6f85633080f0d59e1f291cc26cb050595d905b3ba80d30cfbf7d7fcef19d83bdc9466e20a6f96151ba212f7bbea51563a1d49587f19eb9f389f33d85b8b8dbbeb5b929f9da3705004994038444e7bf4331cf758b25d1f4a664f592f6ab05eb3de9a50b3662dacc065f368bb65e31b82afb5ef671df44269ec4e60d91b42e759580516a4b30a6b062a193f19bd8cec463753f5947b1 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E0B4322EB2F6A568B654538448184A5036874384\Blob = 030000000100000014000000e0b4322eb2f6a568b654538448184a5036874384090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b060105050703070b000000010000000e00000045004400490043004f004d0000002000000001000000b9050000308205b53082039da0030201020208618dc7863b018205300d06092a864886f70d010105050030443116301406035504030c0d4143454449434f4d20526f6f74310c300a060355040b0c03504b49310f300d060355040a0c06454449434f4d310b3009060355040613024553301e170d3038303431383136323432325a170d3238303431333136323432325a30443116301406035504030c0d4143454449434f4d20526f6f74310c300a060355040b0c03504b49310f300d060355040a0c06454449434f4d310b300906035504061302455330820222300d06092a864886f70d01010105000382020f003082020a0282020100ff9295e1680676b42cc85848cafd805429556324ff90659b10757bc36adb620201f21886b57c5a38b1e458b9fbd3d82d9fbd3237bf2c156dbeb5f421d21391d907ad0105d6f3bd77ce5f42810af96ae38300a82b2e55136381ca471c7b5c16577a1b8360043a3e65c3cd01dedea4d60cba8eded904ee1756229b8f63fd4d160bb77b778cf925b5d16d99122e4f1ab8e6ea0492ae3d11b951423d87b03185af795a9cfee74e5e924f43fcab3aada5122666b9e20cd798ced458a595400ab7449d13742bc2a5eb22159810d88bc5049f1d8f60e5061b9bcfb979a03da2233f423f6bfa1c037b308dce6cc0bfe61b5fbf67b88419d515ef7bcb90363162c9bc02ab465f9bfe1a6894343d908eadf6e41d097f4a88383fbe67fd3496f51dbc3074cb38eed56cabd4fcf400b7005b8532167633e9d8a3999d0500aa16e6f3817d6f7daa866dad1574d3c4a271aaf4147de732b81fbcd5f14ebd6f170239d70e95423ac7003ee9266311ea0bd14aff189db2d77b2f3ad996fbe81e92ae1355c8d927f6dc481bb024c185e3779d9aa4f30c111d0dc8b414eeb5825709bf20587f2f2223d870cb796cc94bf2a92ac8fc872bd71a50f827e82f43e33abdd85771fdcea6525bf9dd4dede5f66f89edbb939c762175f0924c29f72f9c012efe50469e640c14b3075bc5c2736cf1075c45241435ae83f16a4d897afab3d82d66f03687f52b530203010001a381aa3081a7300f0603551d130101ff040530030101ff301f0603551d23041830168014a6b3e12b2b49b6d773a1aa94f501e773654cac50300e0603551d0f0101ff040403020186301d0603551d0e04160414a6b3e12b2b49b6d773a1aa94f501e773654cac5030440603551d20043d303b30390604551d20003031302f06082b060105050702011623687474703a2f2f6163656469636f6d2e656469636f6d67726f75702e636f6d2f646f63300d06092a864886f70d01010505000382020100ce2c0b525162267d0c27838fc5f6daa0687b4f925eeaa47332115344b244cb9dec0f7942b310a6c70d9dcbb6fa3f3a7ceabf88531b3cf782fa053533e135a857c0e7fd8d4f3f93324f786603770758e995c87e3ed079008cf21b51339bbc94e93a7b6e522d329e23a445fbb62e13b08b18b1ddced51da7427f55befb5bbb47d4fc24cd04ae960515d6acce30f3ca0bc5bae222e0a6ad22e402ee74117f4cff781d35dae60234eb1812617706091663ea18ada2871ff2c7800909754e10a88f3d86b87511c024628a967b4a45e9ec59c5be6b83e6e1e8acb5301efe050780f9e1230d508f0598ff2c5fe83bb6adcf81b52187ca082a232730202bcfed945bacb27ad2c728a18a0b9b4d4a2c6d853f09723c67e2d9dc07baeb657b5a0163d6905b4f17663d7f0b19a3936310522a9f141658e2dca5f4a1168b0e918b81ca9b59fad86b910765555f521faf3afb90dd69a55b9c6d0e2cb6faceaca57c324a6740dc303423ddd7042366f0fc5580a7fb66198235676270395e6fc7ea904044081eb8b2d6dbee59a70d187934bc54185e53ca3451ed450ae68ec782363ea73863a9302c171060929f5587125910c20f676911cc4e1e7e4a9aadaf40a875ac569074b8a09ca5796fdce91ac86905e9bafa03b37ce4e04ec2ce9de8b6460d6e7e573a6794c2cb1f9c774a674e6986439338fbb6db4f8391d4607e4b3e2b380755985ea4 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\409D4BD917B55C27B69B64CB9822440DCD09B889 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2964B686135B5DFDDD3253A89BBC24D74B08C64D updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A0A1AB90C9FC847B3B1261E8977D5FD32261D3CC updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A69A91FD057F136A42630BB1760D2D51120C1650 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\40E78C1D523D1CD9954FAC1A1AB3BD3CBAA15BFC updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 0b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f007200690074007900200013202000470032000000090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070308060a2b0601040182370a030406082b0601050507030606082b0601050507030703000000010000001400000047beabc922eae80e78783462a79f45c254fde68b2000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7FBB6ACD7E0AB438DAAF6FD50210D007C6C0829C\Blob = 0300000001000000140000007fbb6acd7e0ab438daaf6fd50210d007c6c0829c090000000100000074000000307206082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030606082b0601050507030706082b0601050508020206082b06010505070308060a2b0601040182370a0304060a2b0601040182370a030c06082b060105050703090b000000010000001e000000480061006c0063006f006d00200043004100200050004f0020003200000020000000010000001d0200003082021930820182a00302010202030134e2300d06092a864886f70d01010505003037310b3009060355040613025349310f300d060355040a130648616c636f6d311730150603550403130e48616c636f6d20434120504f2032301e170d3034303230373138333333315a170d3139303230373138333333315a3037310b3009060355040613025349310f300d060355040a130648616c636f6d311730150603550403130e48616c636f6d20434120504f203230819f300d06092a864886f70d010101050003818d00308189028181009417f24937303209083cbef537b7746c103bcb22710706b9c6ecda48f39f276d648d55de794750fb68ce7901bea71bf661ad7d310b5320ad31f15bce23faffcc12025a009cfccd6b1252e8acd4333b732610719040bf0388dfbc5f210d8cd68a931fe7ae1554c64ce4996192e0f78d72c7dc621333a33e4929fb84bf703a91210203010001a3333031300f0603551d130101ff040530030101ff30110603551d0e040a040848af5766bfd2c002300b0603551d0f040403020106300d06092a864886f70d01010505000381810090165776b879cefcc4d13700a2cdff38071173130549eddfc1c5cec640d8f702960db76f11843866fb71f71001677c5d7d24daf6643b088048a64ebd44e2b007328f7c8637466fc0830393b5f4f3127ca3e8cbe23a2378fa686ffe58ca0ca757512d6290f9e4a8dcf5cadf0e87516e3775260ed77e788a03a29519b65e910156 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A7F8390BA57705096FD36941D42E7198C6D4D9D5 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\016897E1A0B8F2C3B134665C20A727B7A158E28F\Blob = 030000000100000014000000016897e1a0b8f2c3b134665c20a727b7a158e28f090000000100000036000000303406082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030c0b00000001000000740000004e00650074004c006f0063006b0020004d0069006e006f0073006900740065007400740020004b006f007a006a006500670079007a006f0069002000280043006c0061007300730020005100410029002000540061006e007500730069007400760061006e0079006b006900610064006f0000002000000001000000d5060000308206d1308205b9a00302010202017b300d06092a864886f70d01010505003081c9310b30090603550406130248553111300f06035504071308427564617065737431273025060355040a131e4e65744c6f636b2048616c6f7a617462697a746f6e73616769204b66742e311a3018060355040b131154616e7573697476616e796b6961646f6b31423040060355040313394e65744c6f636b204d696e6f736974657474204b6f7a6a6567797a6f692028436c617373205141292054616e7573697476616e796b6961646f311e301c06092a864886f70d010901160f696e666f406e65746c6f636b2e6875301e170d3033303333303031343731315a170d3232313231353031343731315a3081c9310b30090603550406130248553111300f06035504071308427564617065737431273025060355040a131e4e65744c6f636b2048616c6f7a617462697a746f6e73616769204b66742e311a3018060355040b131154616e7573697476616e796b6961646f6b31423040060355040313394e65744c6f636b204d696e6f736974657474204b6f7a6a6567797a6f692028436c617373205141292054616e7573697476616e796b6961646f311e301c06092a864886f70d010901160f696e666f406e65746c6f636b2e687530820122300d06092a864886f70d01010105000382010f003082010a0282010100c75225b2d83dd4845509a71bbd6cb914f48a02db76fc6a2a78abe577f06ee08c2367dba56499b9dd013e6fef2d9a3c22f05dc957a055417ff2435e5882533165ce1ef226ba00541eafb0bc1ce4528ca032afb737b1536768746750f62d2e64deae2679dfdf9986abab7f85eca0fb80ccf4b80c1e934563b9dcb85b9bed5b39d45f62b0a78e7c66382caab1086317677dccbdb3f1c33fcf5039edd1198315db87122796b7daeae59dbcbaea394f8bef749ae7c5d0d2ea86511ce4fe640828047905ebcac5710e0befabeaec1211a118053269d10c2c1a3d25993fb57cca6db0ae9999fa0860e719c2f2bd51d3ccd302acc1110c80ceabdc949d6ba339533ad685020300c57da38202c0308202bc30120603551d130101ff040830060101ff020104300e0603551d0f0101ff0404030201063082027506096086480186f842010d048202661682026246494759454c454d2120457a656e2074616e7573697476616e792061204e65744c6f636b204b66742e204d696e6f73697465747420537a6f6c67616c74617461736920537a6162616c797a61746162616e206c6569727420656c6a617261736f6b20616c61706a616e206b65737a756c742e2041206d696e6f73697465747420656c656b74726f6e696b757320616c6169726173206a6f67686174617320657276656e796573756c6573656e656b2c2076616c616d696e7420656c666f6761646173616e616b2066656c746574656c652061204d696e6f73697465747420537a6f6c67616c74617461736920537a6162616c797a617462616e2c20617a20416c74616c616e6f7320537a65727a6f646573692046656c746574656c656b62656e20656c6f69727420656c6c656e6f727a65736920656c6a61726173206d6567746574656c652e204120646f6b756d656e74756d6f6b206d656774616c616c6861746f6b20612068747470733a2f2f7777772e6e65746c6f636b2e68752f646f63732f2063696d656e2076616779206b65726865746f6b20617a20696e666f406e65746c6f636b2e6e657420652d6d61696c2063696d656e2e205741524e494e4721205468652069737375616e636520616e642074686520757365206f66207468697320636572746966696361746520617265207375626a65637420746f20746865204e65744c6f636b205175616c69666965642043505320617661696c61626c652061742068747470733a2f2f7777772e6e65746c6f636b2e68752f646f63732f206f7220627920652d6d61696c20617420696e666f406e65746c6f636b2e6e6574301d0603551d0e04160414096a621692b05abb550ecb75323a32e5b221c928300d06092a864886f70d01010505000382010100916a509cdb78819b3f8b42e33bfca6c3ee43e0cff3e2803549457602e2e32f05c5f12ae7c04133c6b69bd03339cdc0dba1ad6c37024c58413bf29792c648a8cde58a398961f95297e9bdf6f99474e8710ebc7786c306cc5a7c4a7e3450302efb7f329a8d3df3205bf86aca86f3314c2c5980027dfe38c930751cb755e3bc9fbaa86d84280575b38b0dc0915421e7a60bb499f55141dccda34722d9c70181c4dc474f26ea1feddbcd0d98f4a39cb473324a9699febc7fc82558f858f376668954a4a63ec4505cba891882754821d24f13e8607e0776db10b551e6aab968aacdf69d907512ea381aca44e8b799a72a68956695abadef89cb60a90612c69447e928 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7639C71847E151B5C7EA01C758FBF12ABA298F7A updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C73026E325FE21916B55C4B53A56B13DCAF3D625 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8782C6C304353BCFD29692D2593E7D44D934FF11\Blob = 53000000010000002600000030243022060c6086480186fd64010102040130123010060a2b0601040182373c0101030200c00b00000001000000140000005400720075007300740077006100760065000000090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080300000001000000140000008782c6c304353bcfd29692d2593e7d44d934ff112000000001000000bc030000308203b8308202a0a00302010202100cf08e5c0816a5ad427ff0eb271859d0300d06092a864886f70d01010505003048310b30090603550406130255533120301e060355040a1317536563757265547275737420436f72706f726174696f6e311730150603550403130e5365637572655472757374204341301e170d3036313130373139333131385a170d3239313233313139343035355a3048310b30090603550406130255533120301e060355040a1317536563757265547275737420436f72706f726174696f6e311730150603550403130e536563757265547275737420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aba481e595cdf5f6148ec24fcad4e27895589c41e10d9940241739913366e9bee183af625c89d1fc245b61b3e01111411c1d6ef0b8bbf8dea781baa648c69f1dbdbe8ea9413eb894ed291ad48ed2031d03ef6d0d671c57d706adcac8f5fe0eaf66254804960b5da3ba16c3084fd146f8145cf2c85e01996dfd88cc86a8c16f31426c523e68cbf31934dfbb8718568026c4d0dcc06fdfdea0c29116a064114b44bc1ef6e7fa63de66ac76a471a3ec3694687a77a4b1e70e2f817ae2b57286efa26b8bf00fdbd3593fba72bc44249ce373b3f7af572f42269da974ba0052f24bcd537c470b36850e66a90897163457c166f780e3ed7054c793e02e28155987babb0203010001a3819d30819a301306092b060104018237140204061e0400430041300b0603551d0f040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604144232b616fa04fdfe5d4b7ac3fdf74c401d5a43af30340603551d1f042d302b3029a027a0258623687474703a2f2f63726c2e73656375726574727573742e636f6d2f535443412e63726c301006092b06010401823715010403020100300d06092a864886f70d0101050500038201010030ed4f4ae1583a52725bb5a6a36518a6bb513b77e99dead39f5ce045657b0dca5be27050b2940514ae49c78d41071273947e0c2321fdbc107f60105a72f5980eacecb97fdd7a6f5dd31cf4ff88056942a90571c8b7ac26e82eb48c6aff71dcb8b1df99bc7c21542be458a2bb5729ae9ea9a319260f992e08b0effd69cf991a098de3a79f2bc936347b24b3784c9517a406261eb66452365f6067d99cc505740be76723d208fc88e9ae8b7fe130f4377efdc632da2d9e4430306cee07ded234fcd2ff40f64bf466460654a6f2320a6326306b9bd1dc8b47bae1b9d562d0a2a0f467057829631a6f04d6f8c64ca39ab137b48de5284b1d9e2cc2b868bced02ee31 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4313BB96F1D5869BC14E6A92F6CFF63469878237\Blob = 0300000001000000140000004313bb96f1d5869bc14e6a92f6cff63469878237090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030806082b060105050703030b000000010000002e000000540065006c006900610053006f006e00650072006100200052006f006f007400200043004100200076003100000020000000010000003c0500003082053830820320a00302010202110095be16a0f72e46f17b398272fa8bcd96300d06092a864886f70d0101050500303731143012060355040a0c0b54656c6961536f6e657261311f301d06035504030c1654656c6961536f6e65726120526f6f74204341207631301e170d3037313031383132303035305a170d3332313031383132303035305a303731143012060355040a0c0b54656c6961536f6e657261311f301d06035504030c1654656c6961536f6e65726120526f6f7420434120763130820222300d06092a864886f70d01010105000382020f003082020a0282020100c2beeb27f021a3f36926557e9dc55516915cfdef21bf53807a2dd2918c6331f0ec24f0c3a5d2727c106df437b7e5e67c79ea8cb5828bae48b6ac00dc6575ec2a4d5fc187f520652b81a8473e8923953016907fe8570748e719aebf4567b1371b062afedef9ac7d83fb5ebae48f9767be4b8e8d64075738556934363d1348ef4fe2d3661ea4cf1ab75e3633d4b406bd1801fd7784500045f58c5de823bc7efe35e1ed507ba9308d19d3098e68675dbf3c971853bb2962c5ca5e72c1c796d4db2da0b41f6903eceae250f10c3cf0acf3532df01cf5ed6c3939738016c852b023cde03edcdd3c47a0bb358ae298688bbee5bf72eed2faa5ed12edfc9818a92676dc284b10201cd37f16772ded6f80f749bb5305bb5d68c7d4c875163f895a8bf71747d44cf1d289793e4d3d98a861de3a1ed2f85e03e0c1c91c8cd38d4dd39536b3375f63639b3314f02d266b537c898c32c26eec3d210039c9a168e250832eb03a2bf336a0ac2fe46f61c25109393e8b53b9bb67dadc53b97659369d43e520e03d3260852251b7c733bbdd152fa478a6077b8146360486dd7935c7952c3bb0a31735e5731fb45c59efdaea10657b7ad07f9fb3b42a373b708b9b5bb92bb7ecb251129753295ad4f01210dc4f02bb12922f62d43f69437c0dd6fc587501889d58164bdeba90ff470189066af65fb2906ab302a60288bfb3477e2ad9d5fa6878354d0203010001a33f303d300f0603551d130101ff040530030101ff300b0603551d0f040403020106301d0603551d0e04160414f08f593800b3f58f9a960cd5ebfa7baa17e81312300d06092a864886f70d01010505000382020100bee45c624e24f40c08fff0d30c68e49349223f44276fbb6dde8366cea8cc0dfcf59a06e5771491eb9d417b992a84e5fffc21c15df0e41f57b775a9a15f0226ffd7c7f74ede4ff8f71c46c07a4f402c2235f019b1d06b672cb0a8e0c0403735f6845c5ce3af4278fea7c90d50ea0d8476f651ef8353c67aff0e56492e8f7ad60ce62754e34d0a607262cd9107d6a5bfc8996bedc419e6ab4c1138c56f31e26e49c83f768026032629e036f6f62053e3177034179d63681e6becc34d86b813302f5d460d4743d51baa590eb95c8d0648ad74875fc7fc31544113e2c7210e9ee01e0de1c07b438590c58a58c6650a7857f2c6230f01d9204bde0ffb9285752a5c738d6d7b2591caee45ae064b00ccd3b15950da3a883b2943465e972b54ce536f8d4ae796fabf710e428b7cfd28a0d048cadac4814cbba2739326c8eb0cd62688b6c024cfbbbd5beb757de9088e86332c79770969a589fcb3709087768fd322bb42cebd730b20262ad09b3d701e246ccd8776a91796b7cf0d92fb8e18a99849d19efe60447221b919edc2f531f13948889024755416adcef4f869146439fba3b8ba7040c7271cbfc45653fa6365d0f31c0e16f56b86584d18d4e40d8ea59d5b91dc7624503fc62afbd9b79cb5d6e6d0d9e8198b157148adb7ead85988d490bf16b3d9e9ac596154c81cbacac1cae1b9204c8f3a9389a5a0ccbfd3f675a475966d56 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F9DD19266B2043F1FE4B3DCB0190AFF11F31A69D\Blob = 030000000100000014000000f9dd19266b2043f1fe4b3dcb0190aff11f31a69d090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080b000000010000003400000043006f007200720065006f00200055007200750067007500610079006f0020002d00200052006f006f007400200043004100000020000000010000001e0600003082061a30820402a003020102021000ca227908232af0f582b885d363ddf1300d06092a864886f70d0101050500307f310b3009060355040613025559312b3029060355040a0c2241444d494e495354524143494f4e204e4143494f4e414c20444520434f5252454f53311f301d060355040b0c16534552564943494f5320454c454354524f4e49434f533122302006035504030c19436f7272656f20557275677561796f202d20526f6f74204341301e170d3038303731343136353231355a170d3330313233313032353935395a307f310b3009060355040613025559312b3029060355040a0c2241444d494e495354524143494f4e204e4143494f4e414c20444520434f5252454f53311f301d060355040b0c16534552564943494f5320454c454354524f4e49434f533122302006035504030c19436f7272656f20557275677561796f202d20526f6f7420434130820222300d06092a864886f70d01010105000382020f003082020a0282020100b13dd2a725709783780ed732c9660e7823e42a1becc3ef538583bbcacf7eea53996d2755c8d13821406e494dc33df6092b061943a998c9014ef4aa80300755f3f5b77d99b77385d51c65566c0d329b080e34612a40098437c366ed0d4c9c0c78403aecedabcca484f275319540a8aabb93b577986cf2c8e0215a23e442a793c8a81d38cea41a4040bf3c93909b5fd694c1225b46d7c50015d58fc6f7de0baf6e8b058f5b80950ea3bd93cc90f27de3487eb2cd073d1bed149074f3dd341f7ce40359f12dcde0a3a03b212e5caeac080650153135ee5ff91f0d34a5806e62724fe321ba38405d5fdb682a5c34c6083bf67c2ea88dc4b7a6add99bbf19410e483909666e0d3401c5bb071123a4dafe60962847dc8f679b13af7d790e78cdc08c2fbb212cfc74161edec0329dfa783a86ba3ec9780a00d1e4e0c912e25bdcebbb809a3235abf030c30e48842f8d080af62c8c4d3280455508dbcd0da8bf087ab8e7685d9a948995bcfc9a8eb87f3ad86cd5f418ac69e2a4c10bb31fa3829ff38a3c85403809fac2053ee19c89fac3056c088f5d51f47fbbc4f36c01bd3d4fc4198b39d9cacce979880455ab6db8da16456539150518fb0b2c7301ed9452e57d0c013b09a04df13d08816634361744f067f35bf205b6219858d9f4a137d96fe6ef56c4fbbf566202ac3030b602d6d216fc4eea87439a685d88a39146282bbf3915150203010001a3819130818e300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147dbb69eb8861e140cf4723640086a2666bdc8495304c0603551d200445304330410604551d20003039303706082b06010505070201162b687474703a2f2f7777772e636f7272656f2e636f6d2e75792f636f7272656f636572742f6370732e706466300d06092a864886f70d0101050500038202010056df1389be62b70e812173a4d437caedb72f9574d789f84b4781ee67edb829df21a0fc546767c8572c5ba10a75782121caa0a8df6b9cd936028db801c16f8e7b6cc9a4b2c546a9ca4c0281faa37b9d3d48e6ca4066d2449d76e055b9a69ca7d143d8f5a0b49df8f7e5a6a642f302325946722b14ec5e65d5518178ceaa2f8d9689796afb0fc85bcfb4ae90b65fe37c626cb7a6ff9081b59891731230afc7e88102687329bb58753db7d643d5ae4df242b9f0dfda310013dae1b3b6068b5bfdc998b8a213d1ba8fc18a1a9e0fff82be0482e52b933e1eb5a20c1bc61ab073897683bc8e3bbb176d14c38bbe7d1526b5a99c177a507a2debe99994ae9810bdee2a5d5dd68e345bac1e87606b98c7878fd39cb268054907f9a931669cfebfa759e82cf036d4f2a81982c09ea739f9b19834a31ffacdc9192d78deb7fd62f093a3fe005bd60ae4f37e7c9728e105ec05344513ff2913618a274fdbb8d2922127b5887767a87ecf243c87080433738f0bb686f8cfefb2a6241e0b91910050163212d80925da634edddb2dd7e7046be3631fa9fea90163c4ca4c146883bc05ac5916fb6ea1076fbb4bbe6d984876257b4a11965408aca9f337ab83c3d1cd8198c0e54035b89f91e76fe64b20168a537bac3ad1983554d0d4bfae7e9a4b1ee975a325b03be765bf4f95f41dbdc4bac94d8151c23f5ad912f4211bd695ea3d90fea993e2 updroots.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7F88CD7223F3C813818C994614A89C99FA3B5247 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\838E30F77FDD14AA385ED145009C0E2236494FAA\Blob = 0b000000010000003400000054004300200054007200750073007400430065006e00740065007200200043006c00610073007300200032002000430041000000090000000100000016000000301406082b0601050507030406082b06010505070301030000000100000014000000838e30f77fdd14aa385ed145009c0e2236494faa2000000001000000600300003082035c308202c5a003020102020203ea300d06092a864886f70d01010405003081bc310b30090603550406130244453110300e0603550408130748616d627572673110300e0603550407130748616d62757267313a3038060355040a1331544320547275737443656e74657220666f7220536563757269747920696e2044617461204e6574776f726b7320476d624831223020060355040b1319544320547275737443656e74657220436c61737320322043413129302706092a864886f70d010901161a636572746966696361746540747275737463656e7465722e6465301e170d3938303330393131353935395a170d3131303130313131353935395a3081bc310b30090603550406130244453110300e0603550408130748616d627572673110300e0603550407130748616d62757267313a3038060355040a1331544320547275737443656e74657220666f7220536563757269747920696e2044617461204e6574776f726b7320476d624831223020060355040b1319544320547275737443656e74657220436c61737320322043413129302706092a864886f70d010901161a636572746966696361746540747275737463656e7465722e646530819f300d06092a864886f70d010101050003818d0030818902818100da38e8ed3200297183010dbf8c01dcdac6ad39a4a98a2fd58b5c685f50c662f566bdca9122ecaa1d51d73db351b2834e5dcb49b0f04c55e56b2dc7850b301c924e82d4ca02edf76fbedce0e314b80553f29af4568b5a9e8593d1b48256ae4dbba84b5716bcfef8589ef8298db07bcd78c94fac8b670cf19cfbfc579b575c4f0d0203010001a36b3069300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186303306096086480186f842010804261624687474703a2f2f7777772e747275737463656e7465722e64652f67756964656c696e6573301106096086480186f8420101040403020007300d06092a864886f70d0101040500038181008452fb28dfff1f7501bc01be0456976a7442243183f946b1068a89cf962c33bf8cb55f7a72a18506ce86f8058ee8f925cada838c06aceb366d8591340436f442f0f8792e0a485cabcc514f7876a0d9ac19bd2ad169042891ca36102780575bd25cf5c25bab6481637451f497bfcd1228f74d667fa7f01c012678b26647705164 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F17F6FB631DC99E3A3C87FFE1CF1811088D96033\Blob = 0b00000001000000640000005400dc0052004b0054005200550053005400200045006c0065006b00740072006f006e0069006b00200053006500720074006900660069006b0061002000480069007a006d00650074002000530061001f016c0061007900310163003101730031010000090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b06010505070307030000000100000014000000f17f6fb631dc99e3a3c87ffe1cf1811088d960332000000001000000410400003082043d30820325a003020102020101300d06092a864886f70d01010505003081bf313f303d06035504030c3654c39c524b545255535420456c656b74726f6e696b20536572746966696b612048697a6d6574205361c49f6c6179c4b163c4b173c4b1310b3009060355040613025452310f300d06035504070c06416e6b617261315e305c060355040a0c5554c39c524b54525553542042696c676920c4b06c657469c59f696d2076652042696c69c59f696d2047c3bc76656e6c69c49f692048697a6d65746c65726920412ec59e2e20286329204172616cc4b16b2032303037301e170d3037313232353138333731395a170d3137313232323138333731395a3081bf313f303d06035504030c3654c39c524b545255535420456c656b74726f6e696b20536572746966696b612048697a6d6574205361c49f6c6179c4b163c4b173c4b1310b3009060355040613025452310f300d06035504070c06416e6b617261315e305c060355040a0c5554c39c524b54525553542042696c676920c4b06c657469c59f696d2076652042696c69c59f696d2047c3bc76656e6c69c49f692048697a6d65746c65726920412ec59e2e20286329204172616cc4b16b203230303730820122300d06092a864886f70d01010105000382010f003082010a0282010100abb73e0a8cc8a55815e68aef273d4ab4e825d3cd33c220dc19ee883f4d62f0dd13778f61a92ab5d4f2b93158293b2f3f6a9c6f737625ee342080eeeab7f0c40acd2b8694c9e360b14452b25a29b4919783d8b7a6142f2949a2f30506fbb44fdaa16c9a669ff04309caea728feb00d73539d75617471730f4bebf3fc268af3640c1a9f4a9a7e8106b088af7861edc9a2a1506f6a3f0f4e0c714d4517fcfb4db6daf4796179b7771d8a7719d240cf6943f8531124fbaee4e82b8b93e8f23375ecca2aa75f7186f09d3aea7542834fbe1e03b607da0be798986c89f2df90a4bc450a2e7fd7916c77a0b18cfce4cef7dd6076f98f1afb1c17ad78135b8aa17b4e0cb0203010001a3423040301d0603551d0e0416041429c590ab25af11e461bfa3ff886191e60efe9c81300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010505000382010100100ddaf83aec28d1149582b1122c517a4125364c9fec3f1f849d65545ca8160240fa6e1a3784ef729d860a559d5628ac662cd03a5693340725ad08b08fc80f0959ca9d981ce554f8b9457f6a976f88684d4a06263788020eb6c6d67299ce6b77da6231a4561fae5f8d77da5df688fc1ad99eb581f032b8e388d09cf36aa0b99b145935364fcff38e5e5d17ad1595d8ddb2d5156e004eb34bcf6694e4e0cdb505da63578be5b3aadbc02e1c9044db1a5d18a4eebe045b99d5715f55656462d5a29b045986c86277e77c82456a3d17bfec9d750caea36f5ad32f9836f4f0f519ab115dc8a6e32a586a4209c3bd922666320d5d085574ff8c98d00aa6846ad1397d updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3C71D70E35A5DAA8B2E3812DC3677417F5990DF3 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\59AF82799186C7B47507CBCF035746EB04DDB716 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\339B6B1450249B557A01877284D9E02FC3D2D8E9\Blob = 030000000100000014000000339b6b1450249b557a01877284d9e02fc3d2d8e9090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080b00000001000000300000004300680061006d006200650072007300690067006e00200047006c006f00620061006c00200052006f006f00740000002000000001000000c9040000308204c5308203ada003020102020100300d06092a864886f70d0101050500307d310b300906035504061302455531273025060355040a131e41432043616d65726669726d61205341204349462041383237343332383731233021060355040b131a687474703a2f2f7777772e6368616d6265727369676e2e6f72673120301e06035504031317476c6f62616c204368616d6265727369676e20526f6f74301e170d3033303933303136313431385a170d3337303933303136313431385a307d310b300906035504061302455531273025060355040a131e41432043616d65726669726d61205341204349462041383237343332383731233021060355040b131a687474703a2f2f7777772e6368616d6265727369676e2e6f72673120301e06035504031317476c6f62616c204368616d6265727369676e20526f6f7430820120300d06092a864886f70d01010105000382010d00308201080282010100a270a2d09f42ae5b17c7d87dcf1483fc4fc9a1b713af8ad79e3e040a928b6056fab4322f884da16008f4b7094ea0492f49d6d3df9d975a9f940470ec3f59d9b7cc668b9852280902dfc52f848d7a9777bfec409d2572abb53f3298fbb7b7fc7284e53587f955faa31f0e6f2e28dd69a0d94210c6f8b544c2d0437fdbbce4a23c6a55780a77a9d8ea1932b72ffe5c3f1beeb198eccaad7a6945e3960f55f6e6ed75ea65e83256934689a8258a6506ee6bbf7907d0f1b7afed2c4d92bbc0a85fa7677d04f2150870ac92d67d04d233fb4cb60b0bfb1ac9c48d03a97e5cf250ab12a5a1cf4850a5efd2c81a13fab07fb1821c776a0f5fdc0b958fef437ee6450925020103a38201503082014c30120603551d130101ff040830060101ff02010c303f0603551d1f043830363034a032a030862e687474703a2f2f63726c2e6368616d6265727369676e2e6f72672f6368616d6265727369676e726f6f742e63726c301d0603551d0e04160414439c369fb09e304dc6ce5fad10abe503a5faa914300e0603551d0f0101ff040403020106301106096086480186f8420101040403020007302a0603551d1104233021811f6368616d6265727369676e726f6f74406368616d6265727369676e2e6f7267302a0603551d1204233021811f6368616d6265727369676e726f6f74406368616d6265727369676e2e6f7267305b0603551d20045430523050060b2b0601040181872e0a01013041303f06082b060105050702011633687474703a2f2f6370732e6368616d6265727369676e2e6f72672f6370732f6368616d6265727369676e726f6f742e68746d6c300d06092a864886f70d010105050003820101003c3b7091f904542791e1ededfe687f615de541654f32f11805946a1cde1f70db3e7b320234b50c6ca18a7ca5f48fffd4d8ad17d52d04d13f5880e2815988bec0e3469324fe90bd26a2302de89726573589749618f615e2af2419560202b2ba0f14eac68a66c18645558bbe92be9ca404c7493c9ee8297a89d7feafff68f5a51790bdac99cca58657096746dbd616c246f1e4a950f58fd19215d35f3ec600493a6e58b2d1d1270d25c832f82011cd7d32334894544cdddc79c4309feb8eb855b5d7885cc56a243db2d3050351c607efcc1472743d6e72ce18288c4aa077e5092b454447acb7677f018a055a93bea1c1fff8e70e67a44749765d75901af5268ff0 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\273EE12457FDC4F90C55E82B56167F62F532E547 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CFDEFE102FDA05BBE4C78D2E4423589005B2571D updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\56E0FAC03B8F18235518E5D311CAE8C24331AB66\Blob = 03000000010000001400000056e0fac03b8f18235518e5d311cae8c24331ab66090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080b000000010000003c000000530077006900730073005300690067006e00200050006c006100740069006e0075006d00200047003200200052006f006f00740020004300410000002000000001000000c5050000308205c1308203a9a00302010202084eb200670c035d4f300d06092a864886f70d01010505003049310b300906035504061302434831153013060355040a130c53776973735369676e204147312330210603550403131a53776973735369676e20506c6174696e756d204341202d204732301e170d3036313032353038333630305a170d3336313032353038333630305a3049310b300906035504061302434831153013060355040a130c53776973735369676e204147312330210603550403131a53776973735369676e20506c6174696e756d204341202d20473230820222300d06092a864886f70d01010105000382020f003082020a0282020100cadfa202e2daf8fc0716b1de60aade965c641fc72f7ecf67fa4442d6766395aeebaf72208a454786627886d6203926f4aea3fd23e7a59cb5222119b7379322c0509c827bd4d504445ccbb4c29f92be24d87b6722e2695fe50578d487d97170332553b4873b299028369a55443068a483977f0d1e9c76ff159d6097008d8a8503ec80beea2c6e105192cc7ed5a333d8d649de582aaff616eb4b7b903297b9ba9d58f1f85749041ea25d0670dd71dbf9dd8b9a1b8ccf3da34dcecb7cf6bb9ca0fa09ce2362b2e90d1fe272288f9fac68207d6f3ba88531097f0bc7e865e9e3780e0967308b3482fb5de0cc9d816d62ee081e042c4e9becfea94f5ffd6978ef091fa1b4bffaf3ef901e4c058b1eea7a917ac3d7e5fb30bc6c1b105898f71a5fd029320313464d616a854c52742f061f7b11e28497c699f36d7fd767837e1368d871285ad8cedde810149afe6d23876e8e5a703cd58d0900a7aabcb031376dc884141e5bbd4563206b4b748cbddb3a0ec1cf5a168fa598f27689b213123b0b7777acbbe53c294a9272ca611a2b5e4ce2837477fa35487a854d8d9a53c4df78ca9791482b452b01f71c1aa2ed18ba0abd83fa6fbc8d57933bd4d4a6ce1ef1a0b1ceabfd2b289a4f1bd7c372dba4c4bf5d4cf5dd7b9669ee6880e6e798ba36b7fe6eed2bbd20f86519da55097e25dcfe616272f97e1802ef63b4d0fbafe53b638c678f0203010001a381ac3081a9300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041450afcc078715476f38c5b465d1de95aae9df9ccc301f0603551d2304183016801450afcc078715476f38c5b465d1de95aae9df9ccc30460603551d20043f303d303b0609608574015901010101302e302c06082b060105050702011620687474703a2f2f7265706f7369746f72792e73776973737369676e2e636f6d2f300d06092a864886f70d010105050003820201000885a6f5160cfc441ac163e0f9554608fc701c4228968eb7c5c141754e097179e56d96ca4ba58860d03074b8ca08dcb4309e4007166b65957701aea4b7350b81da7115a97417387b58caf92ffbc065768d5b01b97dde823d64b8be1474a30a54d32c95181735f5516b3f8fa2966139786b4be5a6a0f853df51109362e7802fe2d1e0bc8e36467733ecb8fb8e9a2c894d31110f269e04bbb7048d0bf2b9fc5a9d3b16b72fc898abfe8a50592ea33bfc295d8bc14bc9e28a131db1bfbb421d52dd4ed8145e10c63107ef7127f71b3909dc82ea8bb395865efdf5da5d31a6e031b694e6444974c516e5f71f036128c5c8cb12a0424bf96b88088db43218f3759fc47f004f05959ca31702c3b3539baa2039292b66fa9daf5eb392d2b5a6e11af92d41698114b4b4b5ed893dcefba99d354244b11c147381cf2a01359a31d52d8f6d84df804d57e33fc58475da89c630bbeb8fcb2208a0aeaaf1036c3a4b4d09a50e72c6566b21424e23251468ae760a7c0c077064f99a2ff6053926c60c8f197f435e6ef45b152fdb615de6672f3f0894f960b49831da74f18493714d5ffb6058d1fbc4c16d89a2bb201f9d7191cb329b133d3e7d925235ac9294a2d318c27cc7eaaf760516dd6727c27e1c072221f3400a1b34074413c2846a8edf195abf7feb1de21a38d15caf47926b80b530a5c98dd8ab31811fdfc26637d393a985867965d2 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3BC0380B33C3F6A60C86152293D9DFF54B81C004 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\67248980DE775D2C9B04E40307940BADB351F395 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D8A6332CE0036FB185F6634F7D6A066526322827\Blob = 030000000100000014000000d8a6332ce0036fb185f6634f7d6a066526322827090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b060105050703070b0000000100000018000000410066006600690072006d0054007200750073007400000053000000010000002400000030223020060a2b06010401828f09020330123010060a2b0601040182373c0101030200c020000000010000004a050000308205463082032ea00302010202086d8c1446b1a60aee300d06092a864886f70d01010c05003041310b300906035504061302555331143012060355040a0c0b41666669726d5472757374311c301a06035504030c1341666669726d5472757374205072656d69756d301e170d3130303132393134313033365a170d3430313233313134313033365a3041310b300906035504061302555331143012060355040a0c0b41666669726d5472757374311c301a06035504030c1341666669726d5472757374205072656d69756d30820222300d06092a864886f70d01010105000382020f003082020a0282020100c412dfa95ffe41ddddf59f8ae3f6ace13c789abcd8f07f7aa0332adc8d205bae2d6fe793d936706a68cf8e51a3855b6704a010246f5d2882c19757d8482913b6e1be914ddf850c53189a1e24a24f8ff0a2850bcbf4297fd2a458ee264dc9aaa87b9ad9fa38de445715e5f88cc8d948e20d16271d1ec8838525b7baaa5541cc03224b2d918d8be689af66c7e9ff2be93cacdad2b3c3e1689c89f87a0056def455956cfbba64dd628bdf0b7732eb62cc269a9bbbaa62834cb4067a30c829bfed064d97b91cc4312bd55fbc5312179c9957296677612131072e25499d18f2eef32b718cb5ba39074977fcef2e9290058d2d2f777bef43bf35bb9ad8f973a72cf2d057ee284e265f8f9068092fb8f8dc06e92e9a3e51a7d122c40aa738486cb3f9ff7dab8657e3bad6857877ba43ea487ff6d8be236d1ebfd1366c585cf1eea419541af503d276e6e18cbd3cb3d3484be2c8f87f92a876469c42653ea41ec107035a462db897f3b7d5b25521efbadc4c0097fb14952733bfe8434746d2089916603b9a7ed2e6ed38eaec011e3c48564909c74c37009e880ec073e16f66e97247303e10e50b03c99a42006cc5947e61c48adf7f821a0b59c4593277b3bc60695639fdb4067b2cd66436d9bd48ed841f7ea5228f2ab842f482b7d45390784e2d1afd816f44d73b01749642e000e22e6beac5ee72acbbbffeeaaaa8f8dcf6b2798ab6670203010001a3423040301d0603551d0e041604149dc067a60c22d926f545aba665521127d845ac63300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106300d06092a864886f70d01010c05000382020100b3574d10624e3ae4aceab81caf3223c8b3495a519c76288d79aa574617d5f552f6b744e80844bf1884d20b80cdc512fd005505618741dcb5249e3cc4d8c8fb709e2f7896832036de7c0f691388a575369808a6c6dfaccee358d6b73edebaf3eb3440d8a281f5783f2fd5a5fcd9a2d45e040e17adfe41f0e5b272fa44823342e82d58f7568c623fba42b09c0c5c7e2e65265c534f00b2787ea10d992d8db81d8ea2c4b0fd60d030a48ec80462a9c4ed35de7a97ed0e385e922f9370a5a99c6fa77d131d7ec60848b15e67eb510825e9e6256b5229919cd239730857de9906b45b9d1006e1c200a8b81c4a020a14d0c141cafb8c35217d8238f2a95491193593946d6a3ac5b2d0bb898693e89bc90f3aa77ab8a1f07846fafc372fe58a84f3dffe04d9a168a02f24e2099506d595cae12496eb7cf69305bbed73e92dd17539d7e724dbd84e5f438f9ed01439bf557048995731b49cee4a980396301f6006ee1b23fe8160231a476285a5cc1934806fb3ac1ae39ff07b48add501d967b6a97293ea2d66b5b2b8e43d3cb2ef4c8ceaeb07bfab359a5586bc18a6b5a85eb4836c6b6940d39fdcf1c3696bb9e16d09f4f1aa50760a7a7d7a17a1559642993109dd60118d05307ee68e46d19d14dac717e405968cc424b51bcf1407b240f8a39e4186bc04d06b96c82a8034fdbfef06a3dd58c5853d3e8ffe9e29e0b6b80968191c1843 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B72FFF92D2CE43DE0A8D4C548C503726A81E2B93\Blob = 0b000000010000001c000000440053005400200052006f006f007400430041002000580031000000090000000100000016000000301406082b0601050507030406082b06010505070301030000000100000014000000b72fff92d2ce43de0a8d4c548c503726a81e2b932000000001000000dc030000308203d8308202c0021100d01e408b0000027c0000000200000001300d06092a864886f70d01010505003081a9310b3009060355040613027573310d300b0603550408130455746168311730150603550407130e53616c74204c616b65204369747931243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e3111300f060355040b13084453544341205831311630140603550403130d44535420526f6f7443412058313121301f06092a864886f70d010901161263614064696773696774727573742e636f6d301e170d3938313230313138313835355a170d3038313132383138313835355a3081a9310b3009060355040613027573310d300b0603550408130455746168311730150603550407130e53616c74204c616b65204369747931243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e3111300f060355040b13084453544341205831311630140603550403130d44535420526f6f7443412058313121301f06092a864886f70d010901161263614064696773696774727573742e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100d2c626b6e7a53dc1c468d5506f53c56f491309b8af2c488d146aa3175f5af9d32e752fd82862d1932ffc4dd4ab87e508c799e7923f75bdeb25b415c19b193dd2448dd774206d37028f69935b8ac4199df4b20efc166cb9b1059283d1852c60943e4555a0d9ab0821e660e83b74f299505168d0032db180bea3d852b044cd434a708e588595e14e2cd62d416fd684e7c89844ca47db2c24a56926cf6bb82762c3f4c97a9223ed136782ae452e45e57e723f859d946210e63c91a1ad7700e015ecf38480727a8e6e6097c724591034835be1a5a469b657351c7859c6d32f3a7367ee94ca04130562067023b3f47cee45d9640b5b49aaa443ce26c444126cb8dd790203010001300d06092a864886f70d01010505000382010100a237b23f69fbd7867954493195332bf3d1091449626086a5b011e250c21d06573e2de83364be9baaad5f1b4dd49995a28b9ac96272b569ead958ab35ed15a243d6b6bc07796564737dd779ca7bd55a51c6e15304968d38cfa317ac39716b01c38b533c63e9ee79c0e4be9232647ab31f979462bdeab2201595fb97f2782f63364038e3460f1dddac95cae74b907bb14ba9d4c5eb9adaaad5a39414468d2d1ff33ad6933af63e79fce8e6b075edee3dc970c75daa814b46251cc76c15e3954e0faa3237940a172492138458d2636f2bf7e65b620b1317b00d524cfefe6f5ce2916e1dfda462d768fa8e7a4fd208da93dcf092117ad0dc72930c7393628568d0f4 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DA40188B9189A3EDEEAEDA97FE2F9DF5B7D18A41 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\ACED5F6553FD25CE015F1F7A483B6A749F6178C6\Blob = 030000000100000014000000aced5f6553fd25ce015f1f7a483b6a749f6178c609000000010000004a000000304806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030706082b06010505070306060a2b0601040182370a030406082b060105050703080b000000010000005c0000004e00650074004c006f0063006b0020004b006f007a006a006500670079007a006f0069002000280043006c006100730073002000410029002000540061006e007500730069007400760061006e0079006b006900610064006f0000002000000001000000810600003082067d30820565a00302010202020103300d06092a864886f70d01010405003081af310b30090603550406130248553110300e0603550408130748756e676172793111300f06035504071308427564617065737431273025060355040a131e4e65744c6f636b2048616c6f7a617462697a746f6e73616769204b66742e311a3018060355040b131154616e7573697476616e796b6961646f6b313630340603550403132d4e65744c6f636b204b6f7a6a6567797a6f692028436c6173732041292054616e7573697476616e796b6961646f301e170d3939303232343233313434375a170d3139303231393233313434375a3081af310b30090603550406130248553110300e0603550408130748756e676172793111300f06035504071308427564617065737431273025060355040a131e4e65744c6f636b2048616c6f7a617462697a746f6e73616769204b66742e311a3018060355040b131154616e7573697476616e796b6961646f6b313630340603550403132d4e65744c6f636b204b6f7a6a6567797a6f692028436c6173732041292054616e7573697476616e796b6961646f30820122300d06092a864886f70d01010105000382010f003082010a0282010100bc748c0fbb4cf4371ea90582d8e6e16c70ea78b56ed138440da883ce5dd2d6d581c5d44be75b947026db3b9d6a4c62f771f364d6613b3deb73a337d9cfea8c923bcdf707dc667497f44522ddf45ce0bf6df3be6533e4153abfdb98905538c4eda655630bb07804f4e36ec13f8efc51781f929e83c2fed9b0a9c9bc5a00ffa9a89874fbf62c3e15390db60455a80e982042b3b125ad7e9a6f5d53b1ab0cfcebe0f37ab3a8b3ff46f663a2d83a987bb6ac85ffb0254f7463e71307a50a8f05f7c0646f7ea7278096ded42e8660c76b2b5e737b17e7913f640cd84b22342b9b32f2481f9fa10a847ae2c2ad973d8ed5c1f956a350e9c6b4fa98a2ee95e62a038cdf0203010001a382029f3082029b300e0603551d0f0101ff04040302000630120603551d130101ff040830060101ff020104301106096086480186f84201010404030200073082026006096086480186f842010d048202511682024d46494759454c454d2120457a656e2074616e7573697476616e792061204e65744c6f636b204b66742e20416c74616c616e6f7320537a6f6c67616c7461746173692046656c746574656c656962656e206c6569727420656c6a617261736f6b20616c61706a616e206b65737a756c742e204120686974656c65736974657320666f6c79616d617461742061204e65744c6f636b204b66742e207465726d656b66656c656c6f737365672d62697a746f73697461736120766564692e2041206469676974616c697320616c616972617320656c666f6761646173616e616b2066656c746574656c6520617a20656c6f69727420656c6c656e6f727a65736920656c6a61726173206d6567746574656c652e20417a20656c6a61726173206c656972617361206d656774616c616c6861746f2061204e65744c6f636b204b66742e20496e7465726e657420686f6e6c61706a616e20612068747470733a2f2f7777772e6e65746c6f636b2e6e65742f646f63732063696d656e2076616779206b65726865746f20617a20656c6c656e6f727a6573406e65746c6f636b2e6e657420652d6d61696c2063696d656e2e20494d504f5254414e5421205468652069737375616e636520616e642074686520757365206f662074686973206365727469666963617465206973207375626a65637420746f20746865204e65744c6f636b2043505320617661696c61626c652061742068747470733a2f2f7777772e6e65746c6f636b2e6e65742f646f6373206f7220627920652d6d61696c20617420637073406e65746c6f636b2e6e65742e300d06092a864886f70d01010405000382010100482446f7ba566ffac82803404ee531396b266b537fdbdfdff3713d26c0140ec6677b23a80c73dd01bbc6ca6e373955d5c78c56200e280a0ed22aa4b04952c63807febe0a098cd198cfcada1431a14fd239fc0f112c43c3ddab93c7553e477c181a00dcf37bd8f27f526c20f40b5f6952f4eef8b22960ebe34931210dd6b51041e241096ce21a9a564b7702f6a09b9a2787e8552971c2909f45781ae115643dd00ed8a0769faec5d02eead60f56ec647f5a9b145801277e1350c76b2ae6683cbf5ca00a1be10e7ae9e280c3e9e9f6fd6c119ed0e528272b543242148275e64af02b6675638ca2fb043e830e9b36f018e42620c38cf02807ad3c176688b5fdb688 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8025EFF46E70C8D472246584FE403B8A8D6ADBF5 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CFE4313DBA05B8A7C30063995A9EB7C247AD8FD5\Blob = 0b00000001000000200000006900700073004300410020004d00610069006e00200052006f006f0074000000090000000100000040000000303e06082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a0304030000000100000014000000cfe4313dba05b8a7c30063995a9eb7c247ad8fd52000000001000000f2050000308205ee308204d6a003020102020100300d06092a864886f70d01010505003081ae310b3009060355040613024553310f300d060355040813064d6164726964310f300d060355040713064d6164726964312f302d060355040a13264950532043657274696669636174696f6e20417574686f7269747920732e6c2e206970734341310e300c060355040b13056970734341311b3019060355040313126970734341204d61696e20434120526f6f74311f301d06092a864886f70d01090116106d61696e30314069707363612e636f6d301e170d3039303930373134353433365a170d3239313232353134353433365a3081ae310b3009060355040613024553310f300d060355040813064d6164726964310f300d060355040713064d6164726964312f302d060355040a13264950532043657274696669636174696f6e20417574686f7269747920732e6c2e206970734341310e300c060355040b13056970734341311b3019060355040313126970734341204d61696e20434120526f6f74311f301d06092a864886f70d01090116106d61696e30314069707363612e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100953025b27d224cda3f16c267df65cceb459247659eac76cf6c6ac9ce03cda3c33872e36da56ba55287e662a5fb017def6744cbb641ef0b607d4afd22eda1e3f49db24260ce360d295979ee62077ab9134dc4633597b6a6f5068ced19653f8c26347feee829968bab7c768014c427519c63bf2a9486188f909e85fd1ad97470d07fec1da42c7a51c58114ab55b36295830f83486886b7ef3f068b8ea568c2a359a699504b0dbc5c7215e0b2458b1e59c92a4f5bd6a2bfc17fbda8a6a27d7c2904e11bba42c16cced9bbba54303d2787c19cb80fb2db5f44809a6a434d16d3dcc470a88e98681ce232c3b147208b0b6a8a9fff55c18fbd76792e789b3008702e6f0203010001a38202133082020f301d0603551d0e0416041461ed398d6b3ce136c6cfdb41fc1b435157cb4d6b3081db0603551d230481d33081d0801461ed398d6b3ce136c6cfdb41fc1b435157cb4d6ba181b4a481b13081ae310b3009060355040613024553310f300d060355040813064d6164726964310f300d060355040713064d6164726964312f302d060355040a13264950532043657274696669636174696f6e20417574686f7269747920732e6c2e206970734341310e300c060355040b13056970734341311b3019060355040313126970734341204d61696e20434120526f6f74311f301d06092a864886f70d01090116106d61696e30314069707363612e636f6d820100300c0603551d13040530030101ff300b0603551d0f04040302010630470603551d250440303e06082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070308060a2b0601040182370a0304301b0603551d110414301281106d61696e30314069707363612e636f6d301b0603551d120414301281106d61696e30314069707363612e636f6d303a0603551d1f04333031302fa02da02b8629687474703a2f2f63726c6d61696e30312e69707363612e636f6d2f63726c2f6d61696e30312e63726c303606082b06010505070101042a3028302606082b06010505073001861a687474703a2f2f63726c6d61696e30312e69707363612e636f6d300d06092a864886f70d01010505000382010100469c0f62b6da3d1c693ebe22c1e97e20efc9eefac6109e655d4fb844b3d42169564f727e62de9b49879de3c860ad6fb006371d40e17d3ad013d697e28776f71f4dd3832d0ab98859d221cfe6c0768fb5496bf93ccd5e2ba9e9a42913cf0afa9d932ddb38e1722a0d3b2f7097bdd9b304b1a26efa6f84cf60713b9ae385d87fb80d321ba0fa05641668243b9bf8cc2a00117fc02adc3de929947102a3186e2c0c3005ce98964d1af65163a146f42f8f511f3dae8752fdc03b93c88c72d171c899ea7da40c8c9f31877af7db95f0bf6f45cfac85dfd1465e6542934a1017741805025a4c9237e1e22d430aba9aaa444c87cdc494dc6f1b6ac7129264b700f8254d updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4F99AA93FB2BD13726A1994ACE7FF005F2935D1E\Blob = 0300000001000000140000004f99aa93fb2bd13726a1994ace7ff005f2935d1e090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b060105050703070b000000010000007e0000004300680069006e006100200049006e007400650072006e006500740020004e006500740077006f0072006b00200049006e0066006f0072006d006100740069006f006e002000430065006e007400650072002000450056002000430065007200740069006600690063006100740065007300200052006f006f007400000053000000010000002400000030223020060a2b0601040181e90c010a30123010060a2b0601040182373c0101030200c02000000001000000fb030000308203f7308202dfa0030201020204489f0001300d06092a864886f70d010105050030818a310b300906035504061302434e31323030060355040a0c294368696e6120496e7465726e6574204e6574776f726b20496e666f726d6174696f6e2043656e7465723147304506035504030c3e4368696e6120496e7465726e6574204e6574776f726b20496e666f726d6174696f6e2043656e7465722045562043657274696669636174657320526f6f74301e170d3130303833313037313132355a170d3330303833313037313132355a30818a310b300906035504061302434e31323030060355040a0c294368696e6120496e7465726e6574204e6574776f726b20496e666f726d6174696f6e2043656e7465723147304506035504030c3e4368696e6120496e7465726e6574204e6574776f726b20496e666f726d6174696f6e2043656e7465722045562043657274696669636174657320526f6f7430820122300d06092a864886f70d01010105000382010f003082010a02820101009b7e73eebd3b78aa644341f550df94f22eb28d4a8e4654d22112c839324206e983d59f52ede567033b54c18c9999cce9c00fff0dd98411b2b8d1cb5bdc1ef9683164e19bfa74eb68b92095f7c60f8d47ac5a06dd61abe2ecd89f172d9cca3c35975571cd4385b14716f52c538076cfd30064bd4099ddccd8dbc49fd6135f41838bf90d879256346c1a100b17d55a1c9758843c841a2e5c91346e195f7f1769c565ef6b21c6d5503abf61b9058def6f343ab26f1463bf163b9ba92afdb72b386606c52ce2aa671e45a78d046642f68f2bef8820698f328c1473da2b869163229af2a7dbce898bab5dc714c15b306a1fb1b79e2e810102edcf965e63dba8e638b70203010001a3633061301f0603551d230418301680147c724b39c7c0db62a54f9baa183492a2ca838259300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147c724b39c7c0db62a54f9baa183492a2ca838259300d06092a864886f70d010105050003820101002ac3c743378fddada4b20ceedc146d8f28a49849cb0c80eaf3ed2366757dc5d3216779d173c5b503b758ac0c542fc656130f31da06e7653b1d6f36dbc81df9fd8006caa33d6616a89d4c167dc09546b551e4e21fd7ea064d638d968cefe73357423aeb8cc179c84d767ddef6b1b781e0a0f9a17846171a5698f04e3dab1cedec39dc0748f763fe06aec2a45c6a5b3288c5c73385ac664247c2582499e1e53ee5752c8e43d65d3c781ea895822950d1d116baefc1be7ad9b4d8cc1e4c46e177b131abbd2ac8ce8f6ea15d7f037534e4ad8945545ebeae28a5bb3f7879eb73b30a0dfdbec9f756acf6b7ed2f9b2129c738b695c404f2c32dfd142a9099b907cc9f updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0446C8BB9A6983C95C8A2E5464687C1115AAB74A updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AB48F333DB04ABB9C072DA5B0CC1D057F0369B46 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4054DA6F1C3F4074ACED0FECCDDB79D153FB901D\Blob = 0b000000010000001e000000440053005400200041004300450053002000430041002000580036000000090000000100000016000000301406082b0601050507030406082b060105050703010300000001000000140000004054da6f1c3f4074aced0feccddb79d153fb901d20000000010000000d04000030820409308202f1a00302010202100d5e990ad69db778ecd807563b8615d9300d06092a864886f70d0101050500305b310b30090603550406130255533120301e060355040a13174469676974616c205369676e61747572652054727573743111300f060355040b13084453542041434553311730150603550403130e4453542041434553204341205836301e170d3033313132303231313935385a170d3137313132303231313935385a305b310b30090603550406130255533120301e060355040a13174469676974616c205369676e61747572652054727573743111300f060355040b13084453542041434553311730150603550403130e445354204143455320434120583630820122300d06092a864886f70d01010105000382010f003082010a0282010100b93df52cc994dc758a955d63e884777666b959915c46dd923e9ff90e03b43d6192bd2326b563ee92d29ed63cc80d905f6481b1a8080d4cd8f9d3052852b40125c5951c0c7e3e108475cfc1199163cfe8a89188b94352bb80b155898b31fad0b776be413d309aa422251773e81ee2d3ac2abd5b3821d52a4bd7557de33a55bdd76d6b02576be6477c08c882badea7873da16db83056c2b302815f2df5e29a301828b866d3cb01966fea8a4555d6e09dff672b1702a64e1a6a110b7eb77be798d68c766fc13bdb50937ee5d08e1f37b8bdbac69f6ce97c33f2323c2647fa272402c97e1d5b8842136a357c7d35e92e66917293d53226c474f553a3b35d9af609cb0203010001a381c83081c5300f0603551d130101ff040530030101ff300e0603551d0f0101ff0404030201c6301f0603551d11041830168114706b692d6f70734074727573746473742e636f6d30620603551d20045b30593057060a608648016503020101013049304706082b06010505070201163b687474703a2f2f7777772e74727573746473742e636f6d2f6365727469666963617465732f706f6c6963792f414345532d696e6465782e68746d6c301d0603551d0e041604140972064e18430fe5d6ccc36a8b317b788fa883b8300d06092a864886f70d01010505000382010100a3d88ed6b2dbce05e732cd01d30403e576e4562b9c9990e808306cdf7d3deee5bfb524408449e1d128aec4c23a533088f1f5776e51cafaff99af245f1ba0fdf2ac84cadfa9f05f042ead16bf219710813de3ff878d32dc94e5478a5e6a13c994953dd2eec83495d080d4ad320880543ce0bd5253d7527cb2693f7f7acf6a74cafa042a9c4c5a06a5e920ad45660f69f1ddbfe9e3328bfae0c1864d723c2ed893780a2af8d8d2273d19895f5a7b8a3bcc0cda51aec70bf72bb03705ecbc5723e238d29b68f35612884f427cb831c4b5dbe4c82134e9481135eefac79257c59f34e4c7f6f70e0b4c9c68787b7131c7eb1ee06741f3b7a0a7cde57a33366afa9a2b updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5F43E5B1BFF8788CAC1CC7CA4A9AC6222BCC34C6\Blob = 53000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b000000010000002e0000004300790062006500720074007200750073007400200047006c006f00620061006c00200052006f006f0074000000090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030806082b060105050703040300000001000000140000005f43e5b1bff8788cac1cc7ca4a9ac6222bcc34c62000000001000000a5030000308203a130820289a003020102020b0400000000010f85aa2d48300d06092a864886f70d0101050500303b31183016060355040a130f437962657274727573742c20496e63311f301d060355040313164379626572747275737420476c6f62616c20526f6f74301e170d3036313231353038303030305a170d3231313231353038303030305a303b31183016060355040a130f437962657274727573742c20496e63311f301d060355040313164379626572747275737420476c6f62616c20526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100f8c8bcbd14506613fff0d379ec23f2b71ac78e85f11273a619aa10db9ca265745a773e517d56f6dc23b6d4ed5f58b1374dd5490e6ef56a87d6d28cd227c6e2ff369f9865a0134ec62a649bd59012cf1406f43be3d428bee80ef8ab4e48946d8e9531105ceda22dbdd53a6db21cbb60c0464b01f549ae7e468ad0748da10c02ceeefce78fb86b66f37f4400bf6625142bdd10301d07963f4df66bb88fb77b0ca538ebde47dbd55d39fc88a7f3d72a74f1e85aa23b9f50baa68c4535c2506595dc6382efddbf774d9c62c9637316d0290f49a948f0b3aab76cc5a73039405daec4e25d2653f0ce1c230861a89419ba046240ec1f387077120671a730185d2527a50203010001a381a53081a2300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414b6087b0d7accac204c8656325ecfab6e852d7057303f0603551d1f043830363034a032a030862e687474703a2f2f777777322e7075626c69632d74727573742e636f6d2f63726c2f63742f6374726f6f742e63726c301f0603551d23041830168014b6087b0d7accac204c8656325ecfab6e852d7057300d06092a864886f70d0101050500038201010056ef0a23a0544e9597c9f889da45c1d4a30025f41f13abb7a3855869c230add8158a2de3c9cd815af873235aa77c05f3fd223b0ed106c4db364c73048ee5b022e4c5f32ea5d923e3b84e4a20a76e02249f2260677b8b1d7209c5315ce9799f80473dada10b07143d47ff03691a0c0b44e76325a77fb2c9b87684ed23f67d07ab457ed3dfb3bfe98ab6cda8a2672b52d5b765f0394c63a0917993520f54dd83bb9fd18fa75373c3cbff30ec7c04b8d8441f935f710922b76e3eea1c034e9d1a2061fb8137ec5efc0a45abd7e71755d0a0ea609ba6f6e38c5b29c20660149d2d974ca993159d61c4015f48d658bd5631124e11c821e0b3119165dbb4a68838ce55 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\61573A11DF0ED87ED5926522EAD056D744B32371\Blob = 5300000001000000220000003020301e0608608442011a01030330123010060a2b0601040182373c0101030200c00b000000010000002a0000004200750079007000610073007300200043006c0061007300730020003300200043004100200031000000090000000100000020000000301e06082b0601050507030106082b0601050507030206082b0601050507030403000000010000001400000061573a11df0ed87ed5926522ead056d744b32371200000000100000057030000308203533082023ba003020102020102300d06092a864886f70d0101050500304b310b3009060355040613024e4f311d301b060355040a0c14427579706173732041532d393833313633333237311d301b06035504030c144275797061737320436c61737320332043412031301e170d3035303530393134313330335a170d3135303530393134313330335a304b310b3009060355040613024e4f311d301b060355040a0c14427579706173732041532d393833313633333237311d301b06035504030c144275797061737320436c6173732033204341203130820122300d06092a864886f70d01010105000382010f003082010a0282010100a48ed774d92964de5f1f878091ea4e39e619c6440b80d50baf53078b12bde667f002b189f6608ac45bb042d1c021a8cbe19bef6451b6a7cf15f57480680490a058a2e674a653535548633f9256dd244e8ef8ba2bfff3348a9e28d7349fac2fd60ff1a42fbd52b249856d3935f04430934624f3b6e753fbbc61afa9a314fbc21717846ce07c88f8c91c572cf03d7e94bc259384e89a009a4505425780f44eced9ae39f6c853100c653a477b60c2d6fa91c9c6716cbd91873c918649abf30fa06c26765e1cac9b71e58dbc9b211e9cd6387e248015318296b149d362375b880c0a6234fea7487e99b1308b9037951ca81fa52c8df455c8dbdd590ac2ad78a0f48b0203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604143814e6c8f0a9a403f44e3e22a35bf2d6e0ad4074300e0603551d0f0101ff040403020106300d06092a864886f70d010105050003820101000167a38cc9253d13635d166feca13e095c91152a2ad980214f05dcbba589ab13332a9e38b78c6f027263c773771e0906ba3b287ba447c9616b080820fc8a058a1fbcbac6c2fecf6eec133371672e69faa92c3f66c012594d0b54029284bbdb12ef83707078c853fadfc6c6ffdc882f07c0499d325760d3f2f699295fe7aa01ccac33a81c0abb91c403a06fb634f986d3b3765498f44a81b3539d4d40ece5771345af5baa1fd82f4c827bfe2ac458bb4ffc9efd03651a2a0ec3a52016946b79a6a212b4bb1aa4237a5ff0ae8424e4f32bfb8a24a3279865da307576fc1991e8dbeb9b3f32bf40970726baccf394854a7a2793cf9042d4b85b16a6e7cb4003dd79 updroots.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3B1EFD3A66EA28B16697394703A72CA340A05BD5 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\61573A11DF0ED87ED5926522EAD056D744B32371 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B865130BEDCA38D27F69929420770BED86EFBC10 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 0b00000001000000140000005500530045005200540072007500730074000000090000000100000022000000302006082b0601050507030306082b06010505070308060a2b0601040182370a0304030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d4620000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D2EDF88B41B6FE01461D6E2834EC7C8F6C77721E\Blob = 0b0000000100000038000000430065007200740050006c0075007300200043006c006100730073002000330020005000720069006d006100720079002000430041000000090000000100000016000000301406082b0601050507030406082b06010505070301030000000100000014000000d2edf88b41b6fe01461d6e2834ec7c8f6c77721e2000000001000000950300003082039130820279a003020102021059dfac7e8a661511e58824ceefa9bca9300d06092a864886f70d0101050500303d310b30090603550406130246523111300f060355040a130843657274706c7573311b301906035504031312436c6173732033205072696d617279204341301e170d3939303730373137303830305a170d3139303730363233353935395a303d310b30090603550406130246523111300f060355040a130843657274706c7573311b301906035504031312436c6173732033205072696d61727920434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b794306ed04cd97e5e60e56fbb26ca526f6b6c8599a50bef001a6f1b4d58b51807fadd7bf8cb2c52ddfc9cb88d52e9b9b20b7cf58f5b99480958decd4895862589053427300b57b60c776329cb6caa3eb99951120d987076474cf949962208f96beaaa0036a315a71c1e9f8cca5a797b21da891f637e799250090428adcee36d04494a99b13f4509785820ef8dfe80c804ed292ca0588d840225973fa013d77b8b23e39fb8c7b84240381b924abd4a9455c756150d8177cc9fa237892b5b850d8b77f8c48bfb10cb94c7e91a5612976614c4bbd77d6d021bbf71622618e9498afaa3dee184ad80ca4ae2228c6a086183b222c7098838565dd131abf0099f13590203010001a3818c308189300f0603551d13040830060101ff02010a300b0603551d0f040403020106301d0603551d0e041604146a643676509c4ef4f74f15f50ded332560eccb20301106096086480186f842010104040302010630370603551d1f0430302e302ca02aa0288626687474703a2f2f7777772e63657274706c75732e636f6d2f43524c2f636c617373332e63726c300d06092a864886f70d010105050003820101009aa13e38aee152d2450dd1e98363ad8c80f493c3b8c23a229727b251863ed2f297de7cbbd7964053ca52aa8a6c63ccba718ae2f0f0108a17b04f8fc6ef0e31305a8dad04c7ab8c5f1a08cf9a179946be8e6b4a6a7f0147692518f84e3c4a042b06f210003dff3ea5e80ecf703886bbc58e0cd6e24b4b66f3735f80b53bf11229ea73bc689e1c60f7f3aa42d816c868de730b3f40c17777541d94572901935b98c36b04fa7c298dac47f0fe55154baf7123f5c3ce0167932680acf4828ac41b404adcc6390a6e63b6644d7ace90aa99bd36fd59fc2ffc45bede8e3359fa8a0b0f30364de35bb5d69650d7bffe85dcdab4822bcc1b083ff19a4eb5e18f08612416 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\43F9B110D5BAFD48225231B0D0082B372FEF9A54\Blob = 03000000010000001400000043f9b110d5bafd48225231b0d0082b372fef9a54090000000100000016000000301406082b0601050507030406082b060105050703010b0000000100000048000000460061006200720069006300610020004e006100630069006f006e0061006c0020006400650020004d006f006e00650064006100200079002000540069006d0062007200650000002000000001000000fd020000308202f930820262a003020102020436f11b19300d06092a864886f70d01010505003036310b3009060355040613024553310d300b060355040a1304464e4d5431183016060355040b130f464e4d5420436c6173652032204341301e170d3939303331383134353631395a170d3139303331383135323631395a3036310b3009060355040613024553310d300b060355040a1304464e4d5431183016060355040b130f464e4d5420436c617365203220434130819d300d06092a864886f70d010101050003818b0030818702818100983fad1936933d3efe764214fd356ff1faad227a58e346d05dc65af9622d8f315efeb430fe5074acd69d1de062c649dd14127d710bac06c13fd70687e09089d6e5e303b2f227b19f33c8aa6b364aa3c43f79419d89462f2b3e63d4385691aa1db10d42754df3874ee30f4dccb46cbf621387ead09b8eb6e2ff19f49409d59661020103a382011430820110301106096086480186f842010104040302000730580603551d1f0451304f304da04ba049a4473045310b3009060355040613024553310d300b060355040a1304464e4d5431183016060355040b130f464e4d5420436c6173652032204341310d300b0603550403130443524c31302b0603551d1004243022800f31393939303331383134353631395a810f32303139303331383134353631395a300b0603551d0f040403020106301f0603551d23041830168014409a7644977407c4ac14cb1e8d4f3a457c30d761301d0603551d0e04160414409a7644977407c4ac14cb1e8d4f3a457c30d761300c0603551d13040530030101ff301906092a864886f67d074100040c300a1b0456342e3003020490300d06092a864886f70d010105050003818100614ca07c59635b66f8ee6513ce438047b9b235c9c884c76b736045e49d379df58e25b9f9aaaacae3f8439c2fa08905b14532942a1e038d5da6decf5795dadf26605fcbdf951eb8ce08d8f88ac94fa9687593e32f054c646002a2421e6f866865550ed8436ff291313ea3473c2805af45b69d224c267b4b7d5b15f91946df085d updroots.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B12E13634586A46F1AB2606837582DC4ACFD9497\Blob = 0b00000001000000120000004300650072007400690067006e006100000009000000010000005c000000305a06082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b0601050507030906082b0601050507030606082b0601050507030706082b06010505080202030000000100000014000000b12e13634586a46f1ab2606837582dc4acfd94972000000001000000ac030000308203a830820290a003020102020900fedce3010fc948ff300d06092a864886f70d01010505003034310b300906035504061302465231123010060355040a0c094468696d796f7469733111300f06035504030c084365727469676e61301e170d3037303632393135313330355a170d3237303632393135313330355a3034310b300906035504061302465231123010060355040a0c094468696d796f7469733111300f06035504030c084365727469676e6130820122300d06092a864886f70d01010105000382010f003082010a0282010100c868f1c9d6d6b3347526821eecb4beea5ce126ed114761e1a27c16784021e4609e5ac863e1c4b19692ff186d6923e12b62f7dde2362f9107b948cf0eec79b62ce7344b700825a33c871b19f281070f389019d311fe86b4f2d15e1e1e96cd806cce3b3193b6f2a0d0a995127da59acc6bc884568a33a9e722155316f0cc17ec575fe9a20a9809dee35f9c6fdc48e3850b155aa6ba9fac48e309b2f7f432de5e34be1c785d425bce0e228f4d90d77d3218b30b2c6abf8e3f141189200e7714b53d940887f7251ed5b26000ec6f2a28256e2a3e186317253f3e442016f626c825ae054ab4e7632cf38c16537e5cfb111a08c146629f22b8f1c28d69dcfa3a5806df0203010001a381bc3081b9300f0603551d130101ff040530030101ff301d0603551d0e041604141aedfe413990b42459be01f252d545f65a39dc1130640603551d23045d305b80141aedfe413990b42459be01f252d545f65a39dc11a138a4363034310b300906035504061302465231123010060355040a0c094468696d796f7469733111300f06035504030c084365727469676e61820900fedce3010fc948ff300e0603551d0f0101ff040403020106301106096086480186f8420101040403020007300d06092a864886f70d0101050500038201010085031e9271f642afe1a3619eebf3c00ff2a5d4da95e6d6be68363d7e6e1f4c8aefd10f216d5ea55263ce12f8ef2ada6feb37fe1302c7cb3b3e226bda612e7fd4723ddd30e11e4c40198c0fd79cd183307b9859dc7dc6b90c294ca133a2eb673a6584d396e2ed7645708fb52bdef923d6496e3c14b5c69f351e50d0c18f6a70440262cbae1d6841a7aa57e853aa07d206f6d514060b9103752c6c72b561959a0d8bb90de7f5df54cddee6d8d609089763e5c12eb0b74426c026c0af55309e3bd5362a1904f45c1effcf2cb7ffd0fd874011d51123bb48c021a9a4282dfd15f8b04e2bf4305b21fc119134be41ef7b9d9775ff9795c096582feabb46d7bbe4d92e updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C4674DDC6CE2967FF9C92E072EF8E8A7FBD6A131 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A9628F4B98A91B4835BAD2C1463286BB66646A8C updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\6252DC40F71143A22FDE9EF7348E064251B18118\Blob = 0300000001000000140000006252dc40f71143a22fde9ef7348e064251b1811809000000010000003e000000303c06082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030806082b060105050703090b000000010000000e000000430065007200740075006d0000002000000001000000100300003082030c308201f4a0030201020203010020300d06092a864886f70d0101050500303e310b300906035504061302504c311b3019060355040a1312556e697a65746f2053702e207a206f2e6f2e311230100603550403130943657274756d204341301e170d3032303631313130343633395a170d3237303631313130343633395a303e310b300906035504061302504c311b3019060355040a1312556e697a65746f2053702e207a206f2e6f2e311230100603550403130943657274756d20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ceb1c12ed34f7ccd25ce183e4fc48c6f806a73c85b51f89bd2dcbb005cb1a0fc7503ee81f088ee2352e9e615338dac2d09c576f92b398089e4974b90a5a878f873437ba461b0d858cce16c667e9cf3095e556384d5a8eff3b12e3068b3c43cd8ac6e8d995a904e34dc369a8f818850b76d964209f3d795830d414bb06a6bf8fc0f7e629f67c4ed265f10260f084ff0a45728ce8fb8ed45f66eee255daa6e39bee4932fd947a072ebfaa65bafca533fe20ec69656116ef7e966a926d87f9553ed0a8588ba4f29a5428c5eb6fc852000aa680ba11a85019cc446638288b622b1eefeaa46597ecf352cd5b6da5df748331454b6ebd96fcecd88d6ab1bda963b1d590203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d01010505000382010100b88dceefe714bacfeeb044926cb4393ea2846eadb82177d2d4778287e6204181eee2f811b763d11737be1976241c041a4ceb3daa676f2dd4cdfe653170c51ba6020aba607b6d58c29a49fe63320b6be33ac0acab3bb0e8d309518c1083c634e0c52be01ab66014276c32778cbcb27298cfcdcc3fb9c8244214d657fce62643a91de58090ce0354283ef73fd3f84ded6a0a3a93139b3b142313639c3fd1872779e54c51e301ad855d1a3bb1d57310a4d3f2bc6e64f55a5690a8c70e4c740f2e713bf7c847f4696f15f2115e831e9c7c52aefd02da12a8596718dbbc70dd9bb169ed80ce8940486a0e35ca29661521942ce8602a9b854a40f36b8a24ec06162c73 updroots.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 824 wrote to memory of 400 824 2024-09-04_11a07ae5b1c0322d338b600969f36d0f_magniber_metamorfo.exe 85 PID 824 wrote to memory of 400 824 2024-09-04_11a07ae5b1c0322d338b600969f36d0f_magniber_metamorfo.exe 85 PID 824 wrote to memory of 400 824 2024-09-04_11a07ae5b1c0322d338b600969f36d0f_magniber_metamorfo.exe 85 PID 400 wrote to memory of 648 400 KB931125.exe 87 PID 400 wrote to memory of 648 400 KB931125.exe 87 PID 400 wrote to memory of 648 400 KB931125.exe 87 PID 400 wrote to memory of 4172 400 KB931125.exe 88 PID 400 wrote to memory of 4172 400 KB931125.exe 88 PID 400 wrote to memory of 4172 400 KB931125.exe 88 PID 400 wrote to memory of 5056 400 KB931125.exe 89 PID 400 wrote to memory of 5056 400 KB931125.exe 89 PID 400 wrote to memory of 5056 400 KB931125.exe 89 PID 400 wrote to memory of 2860 400 KB931125.exe 90 PID 400 wrote to memory of 2860 400 KB931125.exe 90 PID 400 wrote to memory of 2860 400 KB931125.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-04_11a07ae5b1c0322d338b600969f36d0f_magniber_metamorfo.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-04_11a07ae5b1c0322d338b600969f36d0f_magniber_metamorfo.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\{9A70E771-2C7F-44ae-8BCF-17A165961603}-TemporaryCache\KB931125.exe"C:\Users\Admin\AppData\Local\Temp\{9A70E771-2C7F-44ae-8BCF-17A165961603}-TemporaryCache\KB931125.exe"2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe authroots.sst3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
PID:648
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe updroots.sst3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
PID:4172
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe -l roots.sst3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
PID:5056
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe -d delroots.sst3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2860
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Pre-OS Boot
1Bootkit
1Defense Evasion
Modify Registry
2Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
89KB
MD5a64e4b204d44548eeb5c3d86eca2ad70
SHA1e3245bf6dbb2e56d71a9cbad2697aa4fa0df6bbe
SHA256985a5603ebf94539ac11549999f83b5e6dc008180994898c5daa6fd31ae1e9dc
SHA512dca4099318954bab5f1204645be0d0e8fea0c2e97ee95496fa884fbed627e376358623fa94c39bf0abe97d07d46a7e6c5e1081496cdd1987e07e595995a46cd5
-
Filesize
73KB
MD5bb49ccc10926cdb601eba81afef749a2
SHA1a4766c9aea8d211e9632148fd4b625cece195be9
SHA256f013ee3b7fede9a95844e83e83ee298d38cba6efce5a5cafcd8b95255c32f86c
SHA51294c2809727039d1ed07a3742a4b2f9300e865ea7c49bc1fcf547a30238eeecc88d8dd06a2d4f3112317f948908b9af082b50f412a41a2bcb48d5e30d6d8ecbba
-
Filesize
9KB
MD57b32871e409608ff887b6cf4d87debb0
SHA1191f9ea1298ee52dbd6f977b3584109a064f57b9
SHA2563f01268547364d2d60a0f65b46757cccfd9225fc39d581846a8fbffdb5756ff2
SHA512534a384f7946db4083e639b8e02d83ac97293c60630b8811a84c85e0330e9c293f05f5cf71e0f3580551e7923bc5a3bfb7f0406432ca3cdb7efeb4a950ac5e8a
-
Filesize
7KB
MD59e5de0fd1f90486a66dee4bfe89a78d7
SHA190e3188ef63495aaa71c85d4ff0f23253c834b40
SHA2568b95ff56d61586582864d05563762615c8705779578dca3c98a303c3b1f4122e
SHA51260006fa6f57e4d280642d51055f85f8d27b913ce71373de5b928c515c77647295030ab73ab4a55024de4a40c18f200909f49ffb52c26cf554835fc3d4cc348f1
-
Filesize
1KB
MD5421e60325404f5f29ac04c9b9d59096b
SHA1aace2fd74d799e8af5c8d5b2646361bb67a1620c
SHA256571a8da5298aacc37700c747ee5d72b5a7797835140e7a4d4f895e9604574d77
SHA51286693975b1b187ee65b0a23b1f3f8e05d1a3f61e7e47b060f938fe1602bbad96021847b709e64c2d5a295b72f10f4db587a11a1e7ca0a0b64c3bed7fa683b1d2
-
Filesize
5KB
MD59c18ae971cbffb096952177f6804ea31
SHA1bb255dd1bd9bb39cdbb8671af66054432c686828
SHA2562703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb
SHA51221086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c
-
Filesize
320KB
MD52d9b4498c847715418160bfd7e7c8a2d
SHA1e0873091d476d2566aa6fc988cb364247c95dc97
SHA256c49c05b701c390c679e5e3226ec621f22a08155b1065fcfc37b509f648f03b41
SHA512dcf3208cdd1e4353f82823f796d735c1209f149f183eea827a90753ec55509a1c460a16c120e07c12a5eacf0e67d2661c25638491ecf4403e25d6508983e519b
-
Filesize
1.1MB
MD5f0fef6362d4886e85a186a5e3766650a
SHA165843b7052a4d1b84762479d79445c46834e18b5
SHA25615b9fe7d408cbf2204039087526e7df947df57b42ea479e303b682e956638816
SHA5123f6dfd701cf62b77219f8825a2257c4bd7d44ebafc5654b06abaf906ced2571f4eeb04fe22ae6136c14bddebddb12555aa6efd322e779443d57bb122ea786043
-
C:\Users\Admin\AppData\Local\Temp\{9A70E771-2C7F-44ae-8BCF-17A165961603}-TemporaryCache\KB931125.exe
Filesize349KB
MD54a4d72d34f9da1fc5019e0748fcde2f5
SHA1f54752ec63369522f37e545325519ee434cdf439
SHA25683b660f3f3eaddd4b388ed3f806f7444f03429fb63fc1f8db3d86294914a05ca
SHA51295986ffbf51483a0d1a256028847c7ee6ac73ffd62f6d838309a69e1833f719a7cfed5422815f4d4a49dbd599c449f8db8f60273136720cb1da5f8b0eb24cb33