I'm assuming, as there is a live PE executable modification payload listed, and Windows is supposed to throw warnings for unverified / unsigned updates and inst

I'm assuming, as there is a live PE executable modification payload listed, and Windows is supposed to throw warnings for unverified / unsigned updates and installers, that the CA infrastructure is already compromised. Either that or most Windows users still just habitually click through security warnings, which I sincerely hope is no longer the case.