Analysis
-
max time kernel
2089s -
max time network
2089s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
15-04-2022 08:38
Static task
static1
Behavioral task
behavioral1
Sample
Honeygain_install (1).exe
Resource
win10-20220414-en
windows10_x64
0 signatures
0 seconds
General
-
Target
Honeygain_install (1).exe
-
Size
13.7MB
-
MD5
6d2fb27e84276095fd2beb3d9f741d79
-
SHA1
b1dd139c731e3c633441a2f964bb85cc6bf72767
-
SHA256
7660ad82024cfb2faa8b7bea2cdd85509c1b665dcdd40ec0b7cd6c508bb6c4a1
-
SHA512
a77f9450975fb81cdb81b9a1729114b79b214526193f96da8a89c9cca6170e085498f191f63432420befb9e4ff03cd684d4d10e5300febe365787052b5a4f937
Score
10/10
Malware Config
Signatures
-
Meta Stealer Stealer
Meta Stealer steals passwords stored in browsers, written in C++.
-
Blocklisted process makes network request 2 IoCs
flow pid Process 25 420 rundll32.exe 26 4348 rundll32.exe -
Executes dropped EXE 2 IoCs
pid Process 2000 Honeygain.exe 1876 HoneygainUpdater.exe -
Loads dropped DLL 64 IoCs
pid Process 2648 Honeygain_install (1).exe 1184 MsiExec.exe 1184 MsiExec.exe 1184 MsiExec.exe 1184 MsiExec.exe 1184 MsiExec.exe 1184 MsiExec.exe 1184 MsiExec.exe 1184 MsiExec.exe 1184 MsiExec.exe 1184 MsiExec.exe 1184 MsiExec.exe 948 MsiExec.exe 948 MsiExec.exe 948 MsiExec.exe 948 MsiExec.exe 948 MsiExec.exe 948 MsiExec.exe 948 MsiExec.exe 948 MsiExec.exe 5000 rundll32.exe 5000 rundll32.exe 5000 rundll32.exe 5000 rundll32.exe 5000 rundll32.exe 948 MsiExec.exe 420 rundll32.exe 420 rundll32.exe 420 rundll32.exe 420 rundll32.exe 420 rundll32.exe 420 rundll32.exe 420 rundll32.exe 420 rundll32.exe 948 MsiExec.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 1184 MsiExec.exe 1184 MsiExec.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce Honeygain_install (1).exe Set value (str) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\Windows\CurrentVersion\Run\Honeygain = "C:\\Program Files (x86)\\Honeygain\\Honeygain.exe" Honeygain.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: Honeygain_install (1).exe File opened (read-only) \??\O: Honeygain_install (1).exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\K: Honeygain_install (1).exe File opened (read-only) \??\M: Honeygain_install (1).exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: Honeygain_install (1).exe File opened (read-only) \??\Z: Honeygain_install (1).exe File opened (read-only) \??\I: Honeygain_install (1).exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\J: Honeygain_install (1).exe File opened (read-only) \??\N: Honeygain_install (1).exe File opened (read-only) \??\S: Honeygain_install (1).exe File opened (read-only) \??\W: Honeygain_install (1).exe File opened (read-only) \??\N: Honeygain_install (1).exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: Honeygain_install (1).exe File opened (read-only) \??\M: Honeygain_install (1).exe File opened (read-only) \??\Y: Honeygain_install (1).exe File opened (read-only) \??\H: Honeygain_install (1).exe File opened (read-only) \??\O: Honeygain_install (1).exe File opened (read-only) \??\U: Honeygain_install (1).exe File opened (read-only) \??\X: Honeygain_install (1).exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\V: Honeygain_install (1).exe File opened (read-only) \??\J: Honeygain_install (1).exe File opened (read-only) \??\L: Honeygain_install (1).exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\F: Honeygain_install (1).exe File opened (read-only) \??\H: Honeygain_install (1).exe File opened (read-only) \??\Q: Honeygain_install (1).exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: Honeygain_install (1).exe File opened (read-only) \??\S: Honeygain_install (1).exe File opened (read-only) \??\Q: Honeygain_install (1).exe File opened (read-only) \??\Z: Honeygain_install (1).exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: Honeygain_install (1).exe File opened (read-only) \??\T: Honeygain_install (1).exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: Honeygain_install (1).exe File opened (read-only) \??\E: Honeygain_install (1).exe File opened (read-only) \??\R: Honeygain_install (1).exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: Honeygain_install (1).exe File opened (read-only) \??\X: Honeygain_install (1).exe File opened (read-only) \??\A: Honeygain_install (1).exe File opened (read-only) \??\F: Honeygain_install (1).exe File opened (read-only) \??\P: Honeygain_install (1).exe File opened (read-only) \??\V: Honeygain_install (1).exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: Honeygain_install (1).exe File opened (read-only) \??\P: Honeygain_install (1).exe -
Drops file in Program Files directory 38 IoCs
description ioc Process File created C:\Program Files (x86)\Honeygain\Newtonsoft.Json.dll msiexec.exe File created C:\Program Files (x86)\Honeygain\System.Buffers.dll msiexec.exe File created C:\Program Files (x86)\Honeygain\System.Threading.Tasks.Extensions.dll msiexec.exe File created C:\Program Files (x86)\Honeygain\Honeygain.Core.dll msiexec.exe File created C:\Program Files (x86)\Honeygain\PeanutButter.TinyEventAggregator.dll msiexec.exe File created C:\Program Files (x86)\Honeygain\HoneygainUpdater.exe msiexec.exe File created C:\Program Files (x86)\Honeygain\Microsoft.Threading.Tasks.dll msiexec.exe File created C:\Program Files (x86)\Honeygain\Google.Apis.Auth.dll msiexec.exe File created C:\Program Files (x86)\Honeygain\Google.Apis.dll msiexec.exe File created C:\Program Files (x86)\Honeygain\hgwin.dll msiexec.exe File created C:\Program Files (x86)\Honeygain\Facebook.dll msiexec.exe File created C:\Program Files (x86)\Honeygain\Google.Apis.Auth.PlatformServices.dll msiexec.exe File created C:\Program Files (x86)\Honeygain\Google.Apis.Core.dll msiexec.exe File created C:\Program Files (x86)\Honeygain\System.Diagnostics.DiagnosticSource.dll msiexec.exe File created C:\Program Files (x86)\Honeygain\Honeygain.Common.dll.config msiexec.exe File created C:\Program Files (x86)\Honeygain\Microsoft.Threading.Tasks.Extensions.Desktop.dll msiexec.exe File created C:\Program Files (x86)\Honeygain\Microsoft.DotNet.PlatformAbstractions.dll msiexec.exe File created C:\Program Files (x86)\Honeygain\Countly.dll msiexec.exe File created C:\Program Files (x86)\Honeygain\Sentry.dll msiexec.exe File created C:\Program Files (x86)\Honeygain\Sentry.PlatformAbstractions.dll msiexec.exe File created C:\Program Files (x86)\Honeygain\System.Memory.dll msiexec.exe File created C:\Program Files (x86)\Honeygain\Honeygain.exe msiexec.exe File created C:\Program Files (x86)\Honeygain\Microsoft.Threading.Tasks.Extensions.dll msiexec.exe File created C:\Program Files (x86)\Honeygain\Google.Apis.PlatformServices.dll msiexec.exe File created C:\Program Files (x86)\Honeygain\pt-BR\Honeygain.resources.dll msiexec.exe File created C:\Program Files (x86)\Honeygain\Microsoft.Web.WebView2.WinForms.dll msiexec.exe File created C:\Program Files (x86)\Honeygain\Autofac.dll msiexec.exe File created C:\Program Files (x86)\Honeygain\Honeygain.exe.config msiexec.exe File created C:\Program Files (x86)\Honeygain\System.Numerics.Vectors.dll msiexec.exe File created C:\Program Files (x86)\Honeygain\System.Runtime.CompilerServices.Unsafe.dll msiexec.exe File opened for modification C:\Program Files (x86)\Honeygain\HoneygainUpdater.ini msiexec.exe File created C:\Program Files (x86)\Honeygain\Microsoft.Bcl.AsyncInterfaces.dll msiexec.exe File created C:\Program Files (x86)\Honeygain\Microsoft.Web.WebView2.Core.dll msiexec.exe File created C:\Program Files (x86)\Honeygain\WebView2Loader.dll msiexec.exe File created C:\Program Files (x86)\Honeygain\Sentry.Protocol.dll msiexec.exe File created C:\Program Files (x86)\Honeygain\Honeygain.Proxies.dll msiexec.exe File created C:\Program Files (x86)\Honeygain\Honeygain.Common.dll msiexec.exe File created C:\Program Files (x86)\Honeygain\es\Honeygain.resources.dll msiexec.exe -
Drops file in Windows directory 36 IoCs
description ioc Process File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSICC74.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE2FF.tmp-\hgwin.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIC4FE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSICC74.tmp-\Honeygain.CustomActions.dll rundll32.exe File created C:\Windows\Installer\e56bea3.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIC337.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE2FF.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE2FF.tmp-\Honeygain.Proxies.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIC58C.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIC151.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSICC74.tmp-\hgwin.dll rundll32.exe File opened for modification C:\Windows\Installer\MSID715.tmp-\Honeygain.CustomActions.dll rundll32.exe File opened for modification C:\Windows\Installer\MSID715.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSIE2FF.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\e56bea1.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIE2FF.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSICC74.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSIC29A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC7C0.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{54AC30E4-CAD0-428F-A1E8-4C0B2CDAFBE3} msiexec.exe File opened for modification C:\Windows\Installer\MSID5EB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID715.tmp-\hgwin.dll rundll32.exe File opened for modification C:\Windows\Installer\{54AC30E4-CAD0-428F-A1E8-4C0B2CDAFBE3}\main_icon.exe msiexec.exe File opened for modification C:\Windows\Installer\MSIE2FF.tmp-\Honeygain.CustomActions.dll rundll32.exe File created C:\Windows\Installer\e56bea1.msi msiexec.exe File opened for modification C:\Windows\Installer\MSID715.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID715.tmp-\Honeygain.Proxies.dll rundll32.exe File opened for modification C:\Windows\Installer\MSID715.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File created C:\Windows\Installer\{54AC30E4-CAD0-428F-A1E8-4C0B2CDAFBE3}\main_icon.exe msiexec.exe File opened for modification C:\Windows\Installer\MSICC74.tmp-\Honeygain.Proxies.dll rundll32.exe File opened for modification C:\Windows\Installer\MSICC74.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIE2CE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC3E4.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1F msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e msiexec.exe -
Modifies registry class 25 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4E03CA450DACF8241A8EC4B0C2ADBF3E\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4E03CA450DACF8241A8EC4B0C2ADBF3E\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4E03CA450DACF8241A8EC4B0C2ADBF3E\Clients = 3a0000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4E03CA450DACF8241A8EC4B0C2ADBF3E\Version = "720897" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\87F45A54E3EC37E4A9C35636860D2B76\4E03CA450DACF8241A8EC4B0C2ADBF3E msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4E03CA450DACF8241A8EC4B0C2ADBF3E\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Roaming\\Honeygain\\Honeygain 0.11.1.0\\install\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4E03CA450DACF8241A8EC4B0C2ADBF3E\ProductIcon = "C:\\Windows\\Installer\\{54AC30E4-CAD0-428F-A1E8-4C0B2CDAFBE3}\\main_icon.exe" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\87F45A54E3EC37E4A9C35636860D2B76 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4E03CA450DACF8241A8EC4B0C2ADBF3E\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Roaming\\Honeygain\\Honeygain 0.11.1.0\\install\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4E03CA450DACF8241A8EC4B0C2ADBF3E msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4E03CA450DACF8241A8EC4B0C2ADBF3E\Core msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4E03CA450DACF8241A8EC4B0C2ADBF3E\Language = "1033" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4E03CA450DACF8241A8EC4B0C2ADBF3E\SourceList\PackageName = "Honeygain_install.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4E03CA450DACF8241A8EC4B0C2ADBF3E msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4E03CA450DACF8241A8EC4B0C2ADBF3E\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4E03CA450DACF8241A8EC4B0C2ADBF3E\AuthorizedLUAApp = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4E03CA450DACF8241A8EC4B0C2ADBF3E\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4E03CA450DACF8241A8EC4B0C2ADBF3E\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4E03CA450DACF8241A8EC4B0C2ADBF3E\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4E03CA450DACF8241A8EC4B0C2ADBF3E\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4E03CA450DACF8241A8EC4B0C2ADBF3E\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4E03CA450DACF8241A8EC4B0C2ADBF3E\Updater msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4E03CA450DACF8241A8EC4B0C2ADBF3E\ProductName = "Honeygain" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4E03CA450DACF8241A8EC4B0C2ADBF3E\PackageCode = "54385B18403317E4E923614AF214B4A9" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4E03CA450DACF8241A8EC4B0C2ADBF3E\SourceList\Media\1 = "Disk1;Disk1" msiexec.exe -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\6BA0B098E171EF5AADFE4815807710F4BD6F0B28\Blob = 0300000001000000140000006ba0b098e171ef5aadfe4815807710f4bd6f0b282000000001000000e0010000308201dc30820183a003020102020d0203e57ef53f93fda50921b2a6300a06082a8648ce3d040302305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523431133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3132313131333030303030305a170d3338303131393033313430375a305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523431133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e3059301306072a8648ce3d020106082a8648ce3d03010703420004b8c679d38f6c250e9f2e39191c03a4ae9ae539070916ca63b1b986f88a57c157ce42fa73a1f76542ff1ec100b26e730effc721e518a4aad9713fa8d4b9ce8c1da3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041454b07bad45b8e2407ffb0a6efbbe33c93ca384d5300a06082a8648ce3d04030203470030440220224f7472b960aff1e69ca01605505fc35e3b6e6174efbe01c4be1848596182320220269d546340de376050cfc8d8ed9d82ae3798bca38f4c4ca9342b6ceffb959b26 Honeygain.exe Key created \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\58D1DF9595676B63C0F05B1C174D8B840BC878BD Honeygain.exe Set value (data) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\4313BB96F1D5869BC14E6A92F6CFF63469878237\Blob = 0300000001000000140000004313bb96f1d5869bc14e6a92f6cff6346987823720000000010000003c0500003082053830820320a00302010202110095be16a0f72e46f17b398272fa8bcd96300d06092a864886f70d0101050500303731143012060355040a0c0b54656c6961536f6e657261311f301d06035504030c1654656c6961536f6e65726120526f6f74204341207631301e170d3037313031383132303035305a170d3332313031383132303035305a303731143012060355040a0c0b54656c6961536f6e657261311f301d06035504030c1654656c6961536f6e65726120526f6f7420434120763130820222300d06092a864886f70d01010105000382020f003082020a0282020100c2beeb27f021a3f36926557e9dc55516915cfdef21bf53807a2dd2918c6331f0ec24f0c3a5d2727c106df437b7e5e67c79ea8cb5828bae48b6ac00dc6575ec2a4d5fc187f520652b81a8473e8923953016907fe8570748e719aebf4567b1371b062afedef9ac7d83fb5ebae48f9767be4b8e8d64075738556934363d1348ef4fe2d3661ea4cf1ab75e3633d4b406bd1801fd7784500045f58c5de823bc7efe35e1ed507ba9308d19d3098e68675dbf3c971853bb2962c5ca5e72c1c796d4db2da0b41f6903eceae250f10c3cf0acf3532df01cf5ed6c3939738016c852b023cde03edcdd3c47a0bb358ae298688bbee5bf72eed2faa5ed12edfc9818a92676dc284b10201cd37f16772ded6f80f749bb5305bb5d68c7d4c875163f895a8bf71747d44cf1d289793e4d3d98a861de3a1ed2f85e03e0c1c91c8cd38d4dd39536b3375f63639b3314f02d266b537c898c32c26eec3d210039c9a168e250832eb03a2bf336a0ac2fe46f61c25109393e8b53b9bb67dadc53b97659369d43e520e03d3260852251b7c733bbdd152fa478a6077b8146360486dd7935c7952c3bb0a31735e5731fb45c59efdaea10657b7ad07f9fb3b42a373b708b9b5bb92bb7ecb251129753295ad4f01210dc4f02bb12922f62d43f69437c0dd6fc587501889d58164bdeba90ff470189066af65fb2906ab302a60288bfb3477e2ad9d5fa6878354d0203010001a33f303d300f0603551d130101ff040530030101ff300b0603551d0f040403020106301d0603551d0e04160414f08f593800b3f58f9a960cd5ebfa7baa17e81312300d06092a864886f70d01010505000382020100bee45c624e24f40c08fff0d30c68e49349223f44276fbb6dde8366cea8cc0dfcf59a06e5771491eb9d417b992a84e5fffc21c15df0e41f57b775a9a15f0226ffd7c7f74ede4ff8f71c46c07a4f402c2235f019b1d06b672cb0a8e0c0403735f6845c5ce3af4278fea7c90d50ea0d8476f651ef8353c67aff0e56492e8f7ad60ce62754e34d0a607262cd9107d6a5bfc8996bedc419e6ab4c1138c56f31e26e49c83f768026032629e036f6f62053e3177034179d63681e6becc34d86b813302f5d460d4743d51baa590eb95c8d0648ad74875fc7fc31544113e2c7210e9ee01e0de1c07b438590c58a58c6650a7857f2c6230f01d9204bde0ffb9285752a5c738d6d7b2591caee45ae064b00ccd3b15950da3a883b2943465e972b54ce536f8d4ae796fabf710e428b7cfd28a0d048cadac4814cbba2739326c8eb0cd62688b6c024cfbbbd5beb757de9088e86332c79770969a589fcb3709087768fd322bb42cebd730b20262ad09b3d701e246ccd8776a91796b7cf0d92fb8e18a99849d19efe60447221b919edc2f531f13948889024755416adcef4f869146439fba3b8ba7040c7271cbfc45653fa6365d0f31c0e16f56b86584d18d4e40d8ea59d5b91dc7624503fc62afbd9b79cb5d6e6d0d9e8198b157148adb7ead85988d490bf16b3d9e9ac596154c81cbacac1cae1b9204c8f3a9389a5a0ccbfd3f675a475966d56 Honeygain.exe Key created \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\3BC49F48F8F373A09C1EBDF85BB1C365C7D811B3 Honeygain.exe Key created \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\A14B48D943EE0A0E40904F3CE0A4C09193515D3F Honeygain.exe Set value (data) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 03000000010000001400000047beabc922eae80e78783462a79f45c254fde68b2000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5 Honeygain.exe Set value (data) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F\Blob = 030000000100000014000000925a8f8d2c6d04e0665f596aff22d863e8256f3f2000000001000000f3030000308203ef308202d7a003020102020100300d06092a864886f70d01010b0500308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183300d06092a864886f70d01010b050003820101004b36a6847769dd3b199f6723086f0e61c9fd84dc5fd83681cdd81b412d9f60ddc71a68d9d16e86e18823cf13de43cfe234b3049d1f29d5bff85ec8d5c1bdee926f3274f291822fbd82427aad2ab7207d4dbc7a5512c215eabdf76a952e6c749fcf1cb4f2c501a385d0723ead73ab0b9b750c6d45b78e94ac9637b5a0d08f15470ee3e883dd8ffdef410177cc27a9628533f23708ef71cf7706dec8191d8840cf7d461dff1ec7e1ceff23dbc6fa8d554ea902e74711463ef4fdbd7b2926bba961623728b62d2af6108664c970a7d2adb7297079ea3cda63259ffd68b730ec70fb758ab76d6067b21ec8b9e9d8a86f028b670d4d265771da20fcc14a508db128ba Honeygain.exe Key created \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\1B8EEA5796291AC939EAB80A811A7373C0937967 Honeygain.exe Set value (data) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\F373B387065A28848AF2F34ACE192BDDC78E9CAC\Blob = 030000000100000014000000f373b387065a28848af2f34ace192bddc78e9cac2000000001000000bf050000308205bb308203a3a0030201020208570a119742c4e3cc300d06092a864886f70d01010b0500306b310b3009060355040613024954310e300c06035504070c054d696c616e31233021060355040a0c1a416374616c697320532e702e412e2f30333335383532303936373127302506035504030c1e416374616c69732041757468656e7469636174696f6e20526f6f74204341301e170d3131303932323131323230325a170d3330303932323131323230325a306b310b3009060355040613024954310e300c06035504070c054d696c616e31233021060355040a0c1a416374616c697320532e702e412e2f30333335383532303936373127302506035504030c1e416374616c69732041757468656e7469636174696f6e20526f6f7420434130820222300d06092a864886f70d01010105000382020f003082020a0282020100a7c6c4a529a42cefe518c5b050a36f513b9f0a5ac9c248380ac21ca0187f91b587b9403fdd1d681f0883d52d1e88a0f88f568f6d9902929016d55f086c89d7e1acbc20c2b1e083518a694d00965a6f2fc0447ea30ee491cd58eedcfbc71e4547dd27b908019fa6211df5412d2f4cfd28ade08aad22b456658e86548f934329de394678a33023bacdf07d1357c05dd2836b484cc4ab9f805a5b3abdc9a7223f8027335b0eb78a0c5d073708cb6cd27a47224435c5cccc2e8edd2aedb77d660d5f615122551be346e3e33dd035629adbaf14c85ba1cc891be13026fca09b1f81a7471f04eba33992069f99d3bfd3ea4f509c19fe96871e3c65f6a31824838610e7543ea83a76244f8121c5e30f02f893944720bbfed40ed368b9ddc47a8482e3535479dddb9cd2f2079b2eb6bc3eed856def2511f2971a4261f74a97e88bb11007fa6581b2a239cff73cff18fbc6f15a8b59e202ac7b92d04e144f5945f60c5e285fb0e83f45cfcfaf9b6ffb84d3775a956fac94849eeebcc04a8f4a93f84421e2314561504e10d8e3357c4c19b4de05bfa3069fc8b5cde41fd717060d7a9574550d681afc101b62649d6de095a0c39407570d14e6bd05fbb89fe6df8be2c6e77e96f653c58034502858f01250711730bae67863bcf4b2ad9b2bb2fee1398c5eba0b2094de7b83b8ffe3568db711e93b8cf2b1c15d9da40b4c2bd9b218f5b59f4b0203010001a3633061301d0603551d0e0416041452d8883ac89f7866ed89f37b387094c9020236d0300f0603551d130101ff040530030101ff301f0603551d2304183016801452d8883ac89f7866ed89f37b387094c9020236d0300e0603551d0f0101ff040403020106300d06092a864886f70d01010b050003820201000b7b7287c060a6494c8858e61d88f7146448a6d8580a0e4f1335df351dd4ed0631c8813e6ad5dd3b1a32ee903d11d22ef48ec3632e2366b067be6fb6c0133960aaa23425937552dea79dad0e878952716a163c191d83f89a2965bef43f9ad9f0f35a872171804dcbe0389b3fbbfae0304dcf86d365101918d19702b12b724268aca0bd4e5ada18bf6b9881d0fd9abe5e1548cd1115b9c0295cb4e888f73e36aeb762fd1e62de7078101c485bdabca438ba67ed553e5e57dfd403404c81a4d24f63a709420914fc00a9c280734f2ec040d9117b48ea7a02c0d3eb2801265874c1c073226d9395fd397dbb2ae3f682e32c975f4e1f9194fafe2ca3d8761ab84db2384f9bfa1d48607926e2f3fda9d09ae8708f497ad6e5bd0a0edb2df38dbfebe3a47dcbc79571e8daa37cc5c2f87492041b86aca4225340b6acfe4c76cffb9432c0359f763f6ee5906ea0a626a2b82cbed12b85fda768c8ba012bb16c741db87395e7eeb7c725f0004c00b27eb60b8b1cf3c0509e25b9e008de3666ff37a5d1bb54642cc927b54b927e65ffd32de1b94ebc7fa44121904177a6391fea9ee39fd0666f05ecaa767ebf6b16a0ebb5c7fc92542f2b11272537784c516ab0f3cc585d14f16a4815ffc207b6b18d0f8e5c5046b33dbf01984fb25954473e347b786d56932e73ea662878cd1d14bfa08f2f2eb82e8ef2148acce9b57cfb6c9d0ca5e196 Honeygain.exe Set value (data) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\CA3AFBCF1240364B44B216208880483919937CF7\Blob = 030000000100000014000000ca3afbcf1240364b44b216208880483919937cf72000000001000000bb050000308205b73082039fa00302010202020509300d06092a864886f70d01010505003045310b300906035504061302424d31193017060355040a131051756f5661646973204c696d69746564311b30190603550403131251756f566164697320526f6f742043412032301e170d3036313132343138323730305a170d3331313132343138323333335a3045310b300906035504061302424d31193017060355040a131051756f5661646973204c696d69746564311b30190603550403131251756f566164697320526f6f74204341203230820222300d06092a864886f70d01010105000382020f003082020a02820201009a18ca4b940d002daf03298af00f81c8ae4c19851d089fab294485f32f81ad321e9046bfa386261a1efe7e1c183a5c9c60172a3a748333307d615411cbedabe0e6d2a27ef56b6f18b70a0b2dfde93eef0ac6b310e9dcc24617f85dfda4daff9e495a9ce633e62496f73fba5b2b1c7a35c2d667feab66508b6d28602befd760c3c793bc8d3691f37ff8db1113c49c7776c1aeb7026a817aa94583e205e6b956c194378f48716322ec176507958a4bdf8fc65a0ae5b0e35f5e6b11ab0cf985eb44e9f80473f2e9fe5c988cf573af6bb47ecdd45c022b4c39e1b295952d4287d7d5b39043b76c13f1deddf6c4f8893fd175f592c391d58a88d090ecdc6dde89c26571968b0d03fd9cbf5b16ac92dbeafe797cadebaff716cbdbcd252be51ffb9a9fe251cc3a530c48e60ebdc9b4760652e611138572630304e004362b201902e874a71fb6c95666f07525dc67c10e616088b33ed1a8fca3da1db0d1b12354df44766ded41d8c1b222b6531cdf351ddca1772a31e42df5e5e5dbc8e0ffe580d70b63a0ff33a10fba2c1515ea97b3d2a2b5bef28c961e1a8f1d6ca46137b9867333d797969e237d82a44c81e2a1d1ba675f9507a32711ee16107bbc454a4cb204d2abefd5fd0c51ce506a0831f991da0c8f645c03c33a8b203f6e8d673d3ad6fe7d5b88c95efbcc61dc8b3377d3443235096204921610d89e2747fb3b21e3f8eb1d5b0203010001a381b03081ad300f0603551d130101ff040530030101ff300b0603551d0f040403020106301d0603551d0e041604141a8462bc484c332504d4eed0f603c41946d1946b306e0603551d230467306580141a8462bc484c332504d4eed0f603c41946d1946ba149a4473045310b300906035504061302424d31193017060355040a131051756f5661646973204c696d69746564311b30190603550403131251756f566164697320526f6f74204341203282020509300d06092a864886f70d010105050003820201003e0a164d9f065ba8ae715d2f052f67e6134583c436f6f3c0260c0db547645df8b472c946a50318275589787d76ea9634801720dce783f88dfc07b8da5f4d2e67b284fdd944fc775081e67cb4c90d0b7253f87607074147960cfbe0822693558cfe221f60657c5fe726b3f732909850d4377155f6922178f79579faf82d268766563077a6377833521058ae3f618ef26ab1ef187e4a5963ca8da256d5a72fbc561fcf39c1e2fb0aa8152c7d4d7a63c66c97443cd26fc34a170af890d257a21951a52d9741da074fa950da908d9446e13ef094fd100038f53be840e1b46e561a20cc6f588ded2e458fd6e9933fe7b12cdf3ad6228cdc84bb226fd0f8e4c639e904883cc3baeb557a6d809924f56c01fbf897b0945bebfdd26ff177680d356423acb855a103d14d4219dcf8755956a3f9a84979f8af0eb911a07cb76aed34d0b62662381a870cf8e8fd2ed3907f07912a1dd67e5c858399b038083fe95ef93507e4c9626e577fa75095f7bac89be68ea201c5d666bf7961f33c1ce1b9825c5da0c3e9d848bd19a21114196eb2861b683e48371a88b75d965e9cc7ef276208e291195cd2f121ddba1742829771815331a99ff67d62bf72e1a3931dcc8a265a0938d0ced70d8016b478a53a874c8d8aa5d54697f22c10b9bc5422c0015069439ef4b2ef6df8ecdaf1e3b1efdf918f542a0b25c12619c452100565d58210eac231cd2e Honeygain.exe Key created \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\D69B561148F01C77C54578C10926DF5B856976AD Honeygain.exe Set value (data) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\5F3B8CF2F810B37D78B4CEEC1919C37334B9C774\Blob = 0300000001000000140000005f3b8cf2f810b37d78b4ceec1919c37334b9c77420000000010000007b030000308203773082025fa003020102020100300d06092a864886f70d01010b0500305d310b3009060355040613024a5031253023060355040a131c5345434f4d2054727573742053797374656d7320434f2e2c4c54442e31273025060355040b131e536563757269747920436f6d6d756e69636174696f6e20526f6f74434132301e170d3039303532393035303033395a170d3239303532393035303033395a305d310b3009060355040613024a5031253023060355040a131c5345434f4d2054727573742053797374656d7320434f2e2c4c54442e31273025060355040b131e536563757269747920436f6d6d756e69636174696f6e20526f6f7443413230820122300d06092a864886f70d01010105000382010f003082010a0282010100d0153952b152b3bac55982c45d52ae3a4365804bc7f296bcdb3697d6a6648ca85ef0e30a1cf7df973d4baef65dec21b541abcdb97e769fbef93e3634a03bc1f631114574933d5780c5f98999cae5ab6ad4b5da419010c1d6d64289c2bff43812954c5405f736e445837b1465d6dc0c4dd1de7e0cab3bc415be3a56a65a6f766952a97ab9c8eb6a9a5d52d02d0a6b3516091084d06aca3a06003747e47e574f3f8beb67b888aac5be5355b291c47db9b0851906782edb611afa85f54a91a1e716d58ea239df94b8701f283f8bfc405e63833c832a1a996bcfde596a3bfc6f16d71ffd4a10eb4e82163aac270c53f1add524b06b0350c12d3c16dd4434271a75fb0203010001a3423040301d0603551d0e041604140a85a9776505987c4081f80f972c38f10aec3ccf300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010b050003820101004c3aa344acb945b1c7937ec80b0a42df64ea1cee596c08ba895f6aca4a959e7a8f07c5da457282710e3ad2cc6fa7b4a123bbf6249fcb17fe8ca6cec2d2dbcc8dfc71fc0329c16c5d335f64b6653b896f187678f5dca2481f193f8e93ebf1fa17eecd4ee3041255d6e5e4ddfb3e057ce21d5ec6a7bc974f683af5e92e0a43b6af575c62687cb7fda38a84a0ac62be2b098734f06a01bb9b29563cfe0037cf236cf14eaab67446126c91ee34d5ec9a91e744be903172d54902f602e5f41feb7cd99655a9ffec8af99947ff355a02aa04cb8a5b87712991bda4b47a0dbd9af55723000721173f4a39d105490ba7b63781a55d8caa335e81287ca77d27eb00ae8d37 Honeygain.exe Key created \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\62FFD99EC0650D03CE7593D2ED3F2D32C9E3E54A Honeygain.exe Key created \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\503006091D97D4F5AE39F7CBE7927D7D652D3431 Honeygain.exe Set value (data) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\89D483034F9E9A48805F7237D4A9A6EFCB7C1FD1\Blob = 03000000010000001400000089d483034f9e9a48805f7237d4a9a6efcb7c1fd120000000010000004402000030820240308201e5a003020102020c015448ef21fd97590df5040a300a06082a8648ce3d0403023071310b30090603550406130248553111300f06035504070c08427564617065737431163014060355040a0c0d4d6963726f736563204c74642e3117301506035504610c0e56415448552d3233353834343937311e301c06035504030c15652d537a69676e6f20526f6f742043412032303137301e170d3137303832323132303730365a170d3432303832323132303730365a3071310b30090603550406130248553111300f06035504070c08427564617065737431163014060355040a0c0d4d6963726f736563204c74642e3117301506035504610c0e56415448552d3233353834343937311e301c06035504030c15652d537a69676e6f20526f6f7420434120323031373059301306072a8648ce3d020106082a8648ce3d0301070342000496dc3d8ad8b07b6fc627be4490b1b356157b8e43247d1a8459ee6368b2c65e87d015481ea890adbd53a2dade3a90a6605f6832b58641df875b2c7bc5fe7c7adaa3633061300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e0416041487111508d1aac1780cb1afcec6c990efbf3004c0301f0603551d2304183016801487111508d1aac1780cb1afcec6c990efbf3004c0300a06082a8648ce3d0403020349003046022100b557ddd78a550b36e18644fad4d9688db8dc238a8a0dd42f7dea73ecbf4d6ca8022100cba5b412fae7b5e8cf7e93fcf3358f6f4e5a7cb4bc4eb2fc72aa5b59f9e7dc31 Honeygain.exe Set value (data) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\9FF1718D92D59AF37D7497B4BC6F84680BBAB666\Blob = 0300000001000000140000009ff1718d92d59af37d7497b4bc6f84680bbab6662000000001000000c7020000308202c33082024aa003020102020100300a06082a8648ce3d0403023081aa310b3009060355040613024752310f300d06035504071306417468656e7331443042060355040a133b48656c6c656e69632041636164656d696320616e6420526573656172636820496e737469747574696f6e7320436572742e20417574686f72697479314430420603550403133b48656c6c656e69632041636164656d696320616e6420526573656172636820496e737469747574696f6e732045434320526f6f7443412032303135301e170d3135303730373130333731325a170d3430303633303130333731325a3081aa310b3009060355040613024752310f300d06035504071306417468656e7331443042060355040a133b48656c6c656e69632041636164656d696320616e6420526573656172636820496e737469747574696f6e7320436572742e20417574686f72697479314430420603550403133b48656c6c656e69632041636164656d696320616e6420526573656172636820496e737469747574696f6e732045434320526f6f74434120323031353076301006072a8648ce3d020106052b810400220362000492a041e84b82845ce2f831119986644e09252f9d412f0aae354f7495b251646b8d6be63f7095f0054447a67238507695025a8eae289ef92d4e99ef2c486f4c2529e8d1715bdf1dc17537b4d7fa7b7a429c6a0a565a7c690baa8009246c7ec146a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414b4220b829924010e9cbbe40efdbffb972093992a300a06082a8648ce3d0403020367003064023067ce166238a2ac6245a7a99524c01a279c323bc0c0d5baa9e7f804435385ee5221de9df525833e9e584b2fd767130e21023005e17501de68ed2a1f4d4c09080dec4bad641728e775ce4565722117cb22410e8c1398389a546d9bcae27cea02582291 Honeygain.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e76200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 Honeygain.exe Set value (data) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f Honeygain.exe Set value (data) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\58E8ABB0361533FB80F79B1B6D29D3FF8D5F00F0\Blob = 03000000010000001400000058e8abb0361533fb80f79b1b6d29d3ff8d5f00f0200000000100000037040000308204333082031ba00302010202030983f3300d06092a864886f70d01010b0500304d310b300906035504061302444531153013060355040a0c0c442d547275737420476d62483127302506035504030c1e442d545255535420526f6f7420436c617373203320434120322032303039301e170d3039313130353038333535385a170d3239313130353038333535385a304d310b300906035504061302444531153013060355040a0c0c442d547275737420476d62483127302506035504030c1e442d545255535420526f6f7420436c61737320332043412032203230303930820122300d06092a864886f70d01010105000382010f003082010a0282010100d3b24acf7a47ef759b23fa3a2fd6504589353ac66bdbfedb0068a8e003111d3750089f4d4a689435b353d19463a72056afde5178ec2a3df34848503e0adf46558b276dc3104d0d915243d887e05d4e36b521ca5f3940045f5b7ecca3c62ba9401ed93684d648f3921e34462024c1a4518e4a1aef503f695d197f45c3c7018f51c923e872aeb4bc56097f12cb1cb1af29900ac955cc0fd3b41aed47355a4aed9c730421d0aabd0c13b500ca266cc46b0c945a9594da509af1ffa52b6631a4c938a0df1d1fb8092ef3a7e86752ab951fe0463ed8a4c3ca5ac53180e8489a9f9469fe19ddd8737c81ca96de8eedb33205658434e6e6fd5710b55f76bf2fb0100dc50203010001a382011a30820116300f0603551d130101ff040530030101ff301d0603551d0e04160414fdda14c49f30de21bd1e4239fcab632349e0f184300e0603551d0f0101ff0404030201063081d30603551d1f0481cb3081c8308180a07ea07c867a6c6461703a2f2f6469726563746f72792e642d74727573742e6e65742f434e3d442d5452555354253230526f6f74253230436c61737325323033253230434125323032253230323030392c4f3d442d5472757374253230476d62482c433d44453f63657274696669636174657265766f636174696f6e6c6973743043a041a03f863d687474703a2f2f7777772e642d74727573742e6e65742f63726c2f642d74727573745f726f6f745f636c6173735f335f63615f325f323030392e63726c300d06092a864886f70d01010b050003820101007f97db30c8dfa49c7d217a8070ce141269881495604401acb2e9304f9b50c266d87e8d30b57031e9e269c7f370db201586d00df0beac017584ce7e9f4dbfb7603b9cf3ca1de25e68d8a39d97e54060d23621fed0b4b817da74a37fd4dfb09802ac6f6b6b2c252472a165ee255ae5e632e7f2dfab49faf3906923db04d9e75c58fc65d497beccfc2e0acc252a3504f8609115753d41ff231f19c86ceb825304a6e44c224d8d8cbace5b73ec6454506dd19c55fb69c336c38cbc3c85a66b0a260de0939860ae7ec624978a615f918e6692098736cd8b9b2d3ef651d450d45928bd83f2cc287b53866dd8268870d7ea91cd3eb9cac0906e5ac65e7465d75cfea3e2 Honeygain.exe Set value (data) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\F517A24F9A48C6C9F8A200269FDC0F482CAB3089\Blob = 030000000100000014000000f517a24f9a48c6c9f8a200269fdc0f482cab308920000000010000004a02000030820246308201cda00302010202100ba15afa1ddfa0b54944afcd24a06cec300a06082a8648ce3d0403033065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204733301e170d3133303830313132303030305a170d3338303131353132303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f742047333076301006072a8648ce3d020106052b810400220362000419e7bcac4465edcdb83f58fb8db157a9442d0515f2ef0bff10749fb562525f667e1fe5dc1b45790bccc6530a9d8d5d02d9a959de025af6952a0e8d384a8a49c6bcc60338075f55da7e096ee27f5ed045200f597610d6a024f02dde36f26c2939a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414cbd0bda9e1980551a14d37a28379ce8d1d2ae484300a06082a8648ce3d0403030367003064023025a48145026b124b75744fc823e370f27572de7c89f0cf9172619e5e10925956b983c710e738e95826367dd5e434863902307c3653f030e562633a99e2b6a33b9b34fa1eda1092715e9113a7dda46e92cc32d6f52166c72fea96636a6545929501b4 Honeygain.exe Key created \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\2F8F364FE1589744215987A52A9AD06995267FB5 Honeygain.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 Honeygain_install (1).exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AFE5D244A8D1194230FF479FE2F897BBCD7A8CB4 Honeygain_install (1).exe Set value (data) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\BA29416077983FF4F3EFF231053B2EEA6D4D45FD\Blob = 030000000100000014000000ba29416077983ff4f3eff231053b2eea6d4d45fd20000000010000006a050000308205663082034ea00302010202100a0142800000014523cf467c00000002300d06092a864886f70d01010b0500304d310b300906035504061302555331123010060355040a13094964656e5472757374312a3028060355040313214964656e5472757374205075626c696320536563746f7220526f6f742043412031301e170d3134303131363137353333325a170d3334303131363137353333325a304d310b300906035504061302555331123010060355040a13094964656e5472757374312a3028060355040313214964656e5472757374205075626c696320536563746f7220526f6f74204341203130820222300d06092a864886f70d01010105000382020f003082020a0282020100b62294fca448afe8476b0afb2776e4f23f8a3b7a4a2c312a8c8db0a9c3316ba877768426b6ac81420d08eb5558bb7af8bc657df2a06d8ba847e962761e11ee0814d1b24416f4ead0fa1e2f5edbcb7341aebc00b04a2b40b2ace13b4bc22d9de4a19bec1a3a1ef008b3d0e42435079f9cb4c9526ddb07ca8fb55bf083f34fc72da5c8adcb9520a4312857585ae48d1b9aab9e0d0cf20a333922390a972ef35377b94445fd84cb362081592d9a6f6d484861ca4cdf53d1af52bc449fab2f6b8372ef7580da06331b5dc8da63c64dcdac6631cdd1de3e871036e1b9a47aef6050b2cbcaa656e037afab34133925e83966e4987aaa12989c5966863eadf1b0ca3e060f7bf0114b37a0446d7bcba88c71f4d5b59136ccf015c62bde5117b1974c503db195597c057d2d21d500bf0167a25e7ba65cf2f722f1900d93dbaa445166cc7d7603eb6aa82a381997760d6b8a61f9bcf6ee76fd702bdd293cf80a1e5b421c8b562f551b1ca12eb5c716e6f8aa3c928e69b601c1b5869d890f0b389454e8eadc9e3d25bc5326edd5ab39aac5404c54abb2b4d9d9f8d772db1cbc6dbd655fef88352a662feef6b365f0338d7c984169460f431c69fa9bb5d0616acdca4bd94c9046ab1559a14754292e83285f1cc2a2ab721700068e45ec8be2333d7fda1944e46272c3df22c6f256d4dd5f9572ed6d5ff748035bfdc52aa0f6732384101b01e70203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414e371e09ed8a742d9db71916b9493ebc3a3d114a3300d06092a864886f70d01010b0500038202010047fadd0ab0119138ad4d5df7e50e975419824887548caa6499d85afe8801c558a599b1235423b76a1d2057e501624117d309db75cb6e549075fe1a9f810ac2ddd7f709d05b7215e41e096a3d33f3219ae6157ead51d50d10ed7d42c08feec09a08d541d65c0e21696e80610e15c0b8cfc5491252ccbe3accd42e3805de35fd1f6fb88068983d4da0ca4065d2737cf58bd90a953fd83f236d1ad12a2419d985b317ef786ea958d123d3c713ed72257f5db17370d07f069709842980611dfa5eff73aca0e389b81c7115c6de317f12dce16d9bafe7e89f75784cab463b9acebf05185d4d153c169a1950049ab29a6f658b525f3c58042825c06661317eb9e075b91aa881d67217b3c5033135117878a2e0e9308c7f80df58df3cba2796e280346de398d36427ac487e28775cc6256125f8850c65fac4322fa59805e4f80b671616c682b83219f9f9b979dc1fcdebafab0edd1bdb45e47ae702e2955dfc69f05369619575790b5e55e6381c94a959339ec87174797f5189b6c86ab830c86a38c36e9ee13716ea05624c5b1247eda7b4b35856c749f37f1268093171f06df84e47fbd685eec5584019a41da7f94b4337dc685a4fcfebc26474deb415d9f454541a2f1cd7977154908ed9209d532b7fab8fe2ea30bc5037eff147b57d7c2c04ec689db4494410f4724b1c64e7fce66b90dd697d69fd0056a5b7acb6adb7ca3e01ef9c Honeygain.exe Key created \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\E252FA953FEDDB2460BD6E28F39CCCCF5EB33FDE Honeygain.exe Set value (data) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\FAB7EE36972662FB2DB02AF6BF03FDE87C4B2F9B\Blob = 030000000100000014000000fab7ee36972662fb2db02af6bf03fde87c4b2f9b20000000010000003c0300003082033830820220a0030201020206200605167002300d06092a864886f70d0101050500303b310b300906035504061302524f3111300f060355040a1308636572745349474e31193017060355040b1310636572745349474e20524f4f54204341301e170d3036303730343137323030345a170d3331303730343137323030345a303b310b300906035504061302524f3111300f060355040a1308636572745349474e31193017060355040b1310636572745349474e20524f4f5420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b733b97ec8254a8eb5dbb4281baa5790e8d122d364bad393e8d4ac8661406a60576854844dbc6a540205ffdf9b9a2aae5d078f4ac3287feffb2bfa79f1c7adf0105324908b66c9a888abaf5aa300e9beba46ee5b737b2c1782815e622ca10265b3bdc52b007ec4fc0333570dede2face5d45d638cd35b6b2c1d09c814aaae4b2015c1d8f5f99c4b1addb8821eb90088280f330a343e69082ae552849ed5bd7a910380efe8f4c5b9b46ea41f5b00874c3d08833b67cd774dfdc84d1430e7539a1254028ea78cb0e2c2e399d8c8b6e161c2f268210e2e365940a04c05ef75d5bf810e2d0ba7a4bfbde3700001a5b28e3d29c733e328798a1c9512fd7deac33b34f0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff0404030201c6301d0603551d0e04160414e08c9bdb2549b3f17c86d6b242870bd06ba0d9e4300d06092a864886f70d010105050003820101003ed21c892e35fcf875dde67f6588f4724cc92cd7324ef3dd197947bd8e3b5b930f504924136b140672ef09d3a1a1e34084c9e71832743c486e0f9f4bd4f71ed39386645497637250d555cffa209302a29bc323934e165576a070796dcd211fcf2f2dbc19e38831f8591a8109c897a674c760c45bcc578eb275fd1b0209db596f729369f73141d68838bf87b2bd1679f9aae4be8825dd6127231cb531070436b41a90bda0747150896dbc14e30f86aef1ab3ec7a009cca348d1e0db64e792b5cfaf7243708bf9c3843c13aa7e929b575393fa70c2910e31f99b675de996385e5fb3734e881567de9e76106220be5569954300394df6eeb05a4e494454585f4283 Honeygain.exe Key created \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\93057A8815C64FCE882FFA9116522878BC536417 Honeygain.exe Set value (data) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\1B8EEA5796291AC939EAB80A811A7373C0937967\Blob = 0300000001000000140000001b8eea5796291ac939eab80a811a7373c09379672000000001000000640500003082056030820348a003020102021478585f2ead2c194be3370735341328b596d46593300d06092a864886f70d01010b05003048310b300906035504061302424d31193017060355040a131051756f5661646973204c696d69746564311e301c0603550403131551756f566164697320526f6f742043412031204733301e170d3132303131323137323734345a170d3432303131323137323734345a3048310b300906035504061302424d31193017060355040a131051756f5661646973204c696d69746564311e301c0603550403131551756f566164697320526f6f74204341203120473330820222300d06092a864886f70d01010105000382020f003082020a0282020100a0be50108ee9f26c40b4049c85b931cadc2de411a9043c1b55c1e758301d24b4c3ef85de8c2ce1c13ddf82e64fad47876cec5b49c14ad5bb8fec87ac7f829a86ec3d03995201d2359eacdaf053c9663cd4ac0201da24d33ba80246afa41ce3f8735876b7f60e900db5f0cfccfaf9c64ce5c386300a8d177e35ebc5dfbb0e9cc08d87e388388567fa3ec7abe0139c051898cf93f5b192b4fc23d3cfd5c42749e09e3c9b08a38b5d2a21e0fc39aa53da7d7ecf1a0953bc5d0504cfa14a8f8b76820da1f8d2c714775b903607819b3e06fa525e63c5a600fea5e9521b52b5923972030962bdb060166ea6dd25c20366ddf304d140e24e8b86f46fe583a027845e04c1f590bd303dc4efa869bc389ba4a496d162da69c00196aecbc45134ea0caaff218e598f4a5ce4619aa7d2e92a788d513d3a15eea2598ea95cdec5f99022e5884571dd91996c7a9f3d3d987c5ef6be1668a05eae0b23fc5a0faa22762dc9a1101de4d3442390889fc62ae6d7f59ab3581e2f3089081b54a2b59823ec08771c955d61d1cb899c5fa24a919aef21aa491608a8bd612831c974ad85f6d9c5b18bd1e510324d5f8b203a3c491f3385590ddbcb0975436973fb6b717df0dfc44c7dc6a32ec89579cb73a28e4e4d24fb5ee404be721ba6272d495a997ad75c0920b77f94b94ff10d1c5e88421b11b7e791db9e6cf46adf8c069803adcc28efa547f3530203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414a397d6f35ea210e1ab459f3c17643cee01709ccc300d06092a864886f70d01010b0500038202010018fa5b75fc3e7ac75f77c7cadfcf5fc312c4405dd432aab86ad7d51515469823a5e6905b18994ce3ad42a382313688cde9fbc40496488b01c78d01cf5b3306964666741d4fedc1b6b9b40d61cc637ed72e778c961c2a23686b855776703313fee14fa6237718fa1a8ce8bd65c9cf3ff4c917dcebc7bcc0042e2d462f6966c31b8ffeec3ed3ca94bf760a250da97b021ca9d03b5f0bc0813a3d64e1bfa72d4ebd4dc4d829c62218d0c5ac7202823faa3aa23a229731dd0863c37514b960282d5b68e016a966822351f5eb53d8319b7be9b79d4beb8816cff95d388a49308fedf1eb19f4771a31184d67546c2f6f65f9db3dec21ec5ef4f48bca606554d17164f4f9a6a38133363371f0a4785f4ead8321de34498de859ac9df2765a36f213f4afe009c7612a6cf7e09daebb864a286f2eeeb479cd9033c3b376faf5f06c9d0190fa9e90f69c72cf47dac31fe4352053f254d1df6183a602e22538de85322d5e7390525d42c4ce3d4be1f919841dd5a250cc41fb4114c3bdd6c95aa363660280bd053a3b479cec00264cf58851bfa8237f1807b00bed8b26a164d3614aeb5c9fdeb3af6703b31fdd6d5d696869ab5e3aec7c69bcc73b854e9e15b9b4154fc3957a58d7c96ce96cb9f329635eb42cf02d3ded5a65e0a95b40c24899816d9e1f062a3c12b48b0f9ba224f0a68dd67ae04bb66496639584c24acd1c2e24873360e5c3 Honeygain.exe Set value (data) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd Honeygain.exe Key created \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\EDE571802BC892B95B833CD232683F09CDA01E46 Honeygain.exe Set value (data) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\8782C6C304353BCFD29692D2593E7D44D934FF11\Blob = 0300000001000000140000008782c6c304353bcfd29692d2593e7d44d934ff112000000001000000bc030000308203b8308202a0a00302010202100cf08e5c0816a5ad427ff0eb271859d0300d06092a864886f70d01010505003048310b30090603550406130255533120301e060355040a1317536563757265547275737420436f72706f726174696f6e311730150603550403130e5365637572655472757374204341301e170d3036313130373139333131385a170d3239313233313139343035355a3048310b30090603550406130255533120301e060355040a1317536563757265547275737420436f72706f726174696f6e311730150603550403130e536563757265547275737420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aba481e595cdf5f6148ec24fcad4e27895589c41e10d9940241739913366e9bee183af625c89d1fc245b61b3e01111411c1d6ef0b8bbf8dea781baa648c69f1dbdbe8ea9413eb894ed291ad48ed2031d03ef6d0d671c57d706adcac8f5fe0eaf66254804960b5da3ba16c3084fd146f8145cf2c85e01996dfd88cc86a8c16f31426c523e68cbf31934dfbb8718568026c4d0dcc06fdfdea0c29116a064114b44bc1ef6e7fa63de66ac76a471a3ec3694687a77a4b1e70e2f817ae2b57286efa26b8bf00fdbd3593fba72bc44249ce373b3f7af572f42269da974ba0052f24bcd537c470b36850e66a90897163457c166f780e3ed7054c793e02e28155987babb0203010001a3819d30819a301306092b060104018237140204061e0400430041300b0603551d0f040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604144232b616fa04fdfe5d4b7ac3fdf74c401d5a43af30340603551d1f042d302b3029a027a0258623687474703a2f2f63726c2e73656375726574727573742e636f6d2f535443412e63726c301006092b06010401823715010403020100300d06092a864886f70d0101050500038201010030ed4f4ae1583a52725bb5a6a36518a6bb513b77e99dead39f5ce045657b0dca5be27050b2940514ae49c78d41071273947e0c2321fdbc107f60105a72f5980eacecb97fdd7a6f5dd31cf4ff88056942a90571c8b7ac26e82eb48c6aff71dcb8b1df99bc7c21542be458a2bb5729ae9ea9a319260f992e08b0effd69cf991a098de3a79f2bc936347b24b3784c9517a406261eb66452365f6067d99cc505740be76723d208fc88e9ae8b7fe130f4377efdc632da2d9e4430306cee07ded234fcd2ff40f64bf466460654a6f2320a6326306b9bd1dc8b47bae1b9d562d0a2a0f467057829631a6f04d6f8c64ca39ab137b48de5284b1d9e2cc2b868bced02ee31 Honeygain.exe Key created \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\BDB1B93CD5978D45C6261455F8DB95C75AD153AF Honeygain.exe Set value (data) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA\Blob = 0300000001000000140000001f24c630cda418ef2069ffad4fdd5f463a1b69aa2000000001000000220200003082021e308201a4a0030201020211605949e0262ebb55f90a778a71f94ad86c300a06082a8648ce3d040303305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3132313131333030303030305a170d3338303131393033313430375a305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e3076301006072a8648ce3d020106052b810400220362000447450e96fb7d5dbfe939d121f89f0bb6d57b1e923a48591cf062312dc07a28fe1aa75cb3b6cc97e745d458fad1776d43a2c08765340a1f7addeb3c33a1c59d4da46f4195387fc91e84ebd19e49928794870c3a854a669f9d59934d976106864aa3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604143de629489bea07ca21444a26de6eded283d09f59300a06082a8648ce3d0403030368003065023100e56912c96edbc631ba0941e197f8fbfd9ae27d12c9ed7c64d3cb05258b56d9a0e75e5d4e0b839c5b7629a00926216a62023071d2b58f5cea3be1780985a875923bc85cfd48ef0d7422a808e26ec549cec70cbca76169f1f73be12acbf92bf3669037 Honeygain.exe Set value (data) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\0BBEC2272249CB39AADB355C53E38CAE78FFB6FE\Blob = 0300000001000000140000000bbec2272249cb39aadb355c53e38cae78ffb6fe20000000010000001806000030820614308203fca00302010202081b70e9d2ffae6c71300d06092a864886f70d01010b05003051310b30090603550406130245533142304006035504030c394175746f72696461642064652043657274696669636163696f6e204669726d6170726f666573696f6e616c2043494620413632363334303638301e170d3134303932333135323230375a170d3336303530353135323230375a3051310b30090603550406130245533142304006035504030c394175746f72696461642064652043657274696669636163696f6e204669726d6170726f666573696f6e616c204349462041363236333430363830820222300d06092a864886f70d01010105000382020f003082020a0282020100ca966b8eeaf8fbf1a235e07f4cdae0c352d77db610c8025eb3432ac44f6ab2ca1c5d289a78111a695957afb52042e48b0fe6df5ba603922ff511e462d7327138d9040c71ab3d517e0f07df63055ce9bf946fc12982c0b4da51b0c13cbbad374a5ccaf14b360e24abbfc38477fda850f4b1e7c62fd22d598d7a0a4e96695202aa3698ecfcfa14830c371fc992377fd7812de5c4b9e03e34fe67f43e66d1d3f440cf5e62340f70063e20185acef7721b256c93741493a373b10eaa871023595f20051947ed688e9212ca5dfcd62bb2923c20cfe15faf20bea0767f76e5ec1a8661333ee77bb43fa00f8ea2b96a6fb987266f416c88a650fd6a630bf593161b198fb2ed9b9bc990f5010cdf193d0f3e3823c92f8f0cd102fe1b55d64ed08d3caf4fa4f3feaf2ad3059d7908a1cb5731b49cc890b267f41816933afc47d8d17896311fba2b0c5f5d99ad63895a242076d8dffdab4ea622aa9d5ee6278a7d6829a3e78ab8da11bb172d999d132446f7c5e2d89f8e7fc78f746d5ab2e872f5acee2410ad2f14daff2d9a467147be42dfbb01dbf47fd3288f31595bd3c902a6b452ca6e97fb43c508266f8af4bbfd9f28aa0dd545f3133a1dd8c0788f41673c1e9464ae7b0bc5e8d90188391a97866441d53b870c6efa0fc6bd4814bf394dd49e41b68f961d639693d995067831689e37063b808945613923c71b44a315e51cf89230bb0203010001a381ef3081ec301d0603551d0e0416041465cdebab351e003e7ed574c01cb473470e1a642f30120603551d130101ff040830060101ff0201013081a60603551d2004819e30819b3081980604551d200030818f302f06082b060105050702011623687474703a2f2f7777772e6669726d6170726f666573696f6e616c2e636f6d2f637073305c06082b0601050507020230501e4e0050006100730065006f0020006400650020006c006100200042006f006e0061006e006f00760061002000340037002000420061007200630065006c006f006e0061002000300038003000310037300e0603551d0f0101ff040403020106300d06092a864886f70d01010b05000382020100748728022b771f668964ed8f742e461cbba8f8f80b1d83b63aa7e8458a07b7e03e20cbe108db1308f828a135b280b30b51c0d3569a8d334549af49f0e03d077a45135affc897d8d3182c7d96f8dda2654370939015ba90dfe819b0db2c8a600fb76f94071e1da6c985f6bd34f840786210703abe7d4b3981a910d49641bbf85f1c0b1d08f2b1b0897af2f7a0e0c48f8b78b53b58a5238e4f55fe363be00cb7ca2a304120b480cdaefc766673a8ae6ee17cda03e89420e622a3d01f905d2053142657da5497df164410011e88668f723893dd20b734bed7f1ee638e47792806fcf35945256022331ba35fa8ba2ada1a3dcd40ea8cee051595d5a52c202fa79828ee45fcf1b888002c8f42da51d59ce513687145438b9e0b213c4b5c05dc1a9f988edabd229e72cdad0acbcca3679b2874c49bd71a3c0458a6829dadc77b6fff8096e9f88d6abd18901dff491a905237932f3c025d82760b51e716c757f838f9a7cd9b2254ef63b0156d5365034a5e4aa0b2a78e49005938d5c7f48064f56e9550b8117e1570384ab07fd0c43270c019ffc9382d142c66f44244e655761b801557ffc0a7a7aa39aad8d370d02ebaeb946afa5f3486e762b5fd8af0308594c9af24022f6fd6dd67fee3b0554f04984fa44156e293d06ae8d6f3fb65e0ce75c431590cee82c80c60334a19ba8467270fbc425dbd24540dec1d70065fa4bcfa207c55 Honeygain.exe Set value (data) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\7E04DE896A3E666D00E687D33FFAD93BE83D349E\Blob = 0300000001000000140000007e04de896a3e666d00e687d33ffad93be83d349e2000000001000000430200003082023f308201c5a0030201020210055556bcf25ea43535c3a40fd5ab4572300a06082a8648ce3d0403033061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204733301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f742047333076301006072a8648ce3d020106052b8104002203620004dda7d9bb8ab80bfb0b7f21d2f0bebe73f3335d1abc34eadec69bbcd095f6f0ccd00bba615b51467e9e2d9fee8e630c17ec0770f5cf842e40839ce83f416d3badd3a4145936789d0343ee10136c72deae88a7a16bb543ce67dc23ff031ca3e23ea3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414b3db48a4f9a1c5d8ae3641cc1163696229bc4bc6300a06082a8648ce3d0403030368003065023100adbcf26c3f124ad12d39c30a099773f488368c8827bbe6888d5085a763f99e32de66930ff1ccb1098fdd6cabfa6b7fa0023039665bc2648db89e50dca8d549a2edc7dcd1497f1701b8c8868f4e8c882ba89aa98ac5d100bdf854e29ae55b7cb32717 Honeygain.exe Set value (data) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\022D0582FA88CE140C0679DE7F1410E945D7A56D\Blob = 030000000100000014000000022d0582fa88ce140c0679de7f1410e945d7a56d2000000001000000a8050000308205a43082038ca003020102021039ca931cef43f3c68e93c7f46489387e300d06092a864886f70d01010b0500306c310b300906035504061302475231373035060355040a0c2e48656c6c656e69632041636164656d696320616e6420526573656172636820496e737469747574696f6e732043413124302206035504030c1b48415249434120544c532052534120526f6f742043412032303231301e170d3231303231393130353533385a170d3435303231333130353533375a306c310b300906035504061302475231373035060355040a0c2e48656c6c656e69632041636164656d696320616e6420526573656172636820496e737469747574696f6e732043413124302206035504030c1b48415249434120544c532052534120526f6f74204341203230323130820222300d06092a864886f70d01010105000382020f003082020a02820201008bc2e7af659b056796c90d24b9d00e64fccee224182c847f7751cb041136b85eed6971a79ee425099767c147c2cf911636623d3804e15182ffacd2b469dd2eec11a345ee6b6b3b4cbf8c8da41e9d11b9e938f97a0e0c98e2231dd14e63d4e7b84144fb6baf6bda1fd3c591885ba48992d181e68c3958a0d66943a9ad9852586edb0afb6bcf68fae3a45e3a45739807ea5f0272de0ca5b39faea91db71db3fc8a59e76e7265adf530942307f382164b35989c53bb2fcae45ad9c78d1dfc9899fb2ca4826bf02a1f8e0b5f715c5cae427b298981cb03a399ca889e0b40094133dbe6587afdae9970c05a0fd61386712f7669fc90dddb2d6ed1f29bf51a6b9e6f158c7af04b28a0223880246c36a43bf23091f37813cfc13f35abf11d1123b543229e0192b71802e511d182db1500cc6137c12a7c9ae1d0bab35046ee82ac9d31f8fb23e203004870a3092679155360f3385cad38ea81006314b9335edd0bdba045071a3309f84db4a702a669f4c2590588658556ae4bcbe0de3c7d2d1ac8e9fb1fa3614ad62a13ad774c1a189b910f58d80654c597f8aa3f208aa685a677f6a6fc1ce2ee6e94332a8350840ae54f86f85045780081eb5b68e3268dcc7b5c51f4142c40be1a601d7a72611d1f632d88aacea2459008fc6bbeb3502a5afda8481846d6904092900a845e6831f8ebed0dd31dc67d9918555627652e8d45c524eccee30203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604140a4823a660a4920a33ea935bc557ea254dbd12ee300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201003e9048aa6e621525667b0cd58c8b899dd7ed4e07ef9cd0145f5e50bd689690a41411aa686d0935394009daf4092c34a57b598449299774c8071e476df2ce1c5026e39e3d40533ff77f967610c546a5d0204b50f4353b18f4556a411b4706683cbb090862d95f5542aaac5385ac95563656abe4058cc5a8da1fa369bd530fc4ffdccae37ef24c888647461af300f58091a2dc4342949b20f0d1cdb2eb2c53c253784a4f0494419a8f2732c1e54919bff1f2c28ba80a393128b47d62362c4dec1f33b67e776d7e50f09f0ed7118fcf18c5e327fe26ef059dcfcf37c5d07bda3bb016840c3a93d6be17db0f3e0e197809c7a90272224bf73776ba75c485035a63d5b17505c2b9bd94ad8c1599a7937df6c5f3aa74cf0485949800f4e2f9ca2465bfe062afc8c5fab2c99e5648da79fd967615bea38e56c4b334fcbe47f4c1b4a8fcd5308868eecbaec963c476beac3818e15e5ccfae3a2251ebd18bb3f32b33075487fab4b2137bba530462019df1c04feee13ad48b2010fa0257e6efc10bb790469c19298cdc6fa04a696994b72465a0ffac3fce01fb212efd68f89bf2a5cf31385c15aae69700c1df5aa5a739aae9847f3c51a83ad9945b8cbf4f0871e5dba85cd4d2a6fe00a3c616c70fe880ce1c2864741908d342e3ce005d7fb1dc13b0e105cbd120aa86749e39e791fdff5bd6f7ada62f030b6de35754eb7653188d1198ba Honeygain.exe Set value (data) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\E7F3A3C8CF6FC3042E6D0E6732C59E68950D5ED2\Blob = 030000000100000014000000e7f3a3c8cf6fc3042e6d0e6732c59e68950d5ed22000000001000000a10200003082029d30820224a003020102020c08bd85976c9927a48068473b300a06082a8648ce3d040303308191310b30090603550406130255533111300f06035504081308496c6c696e6f69733110300e060355040713074368696361676f3121301f060355040a131854727573747761766520486f6c64696e67732c20496e632e313a30380603550403133154727573747761766520476c6f62616c2045434320503338342043657274696669636174696f6e20417574686f72697479301e170d3137303832333139333634335a170d3432303832333139333634335a308191310b30090603550406130255533111300f06035504081308496c6c696e6f69733110300e060355040713074368696361676f3121301f060355040a131854727573747761766520486f6c64696e67732c20496e632e313a30380603550403133154727573747761766520476c6f62616c2045434320503338342043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200046bda0d753508314705ae459955f111132e4af8103123a37e83d37f28083a261a3acf97821f80b727098fd18e30c40a9b0eac5804abf7367d9423a49b0a8a8babebfd392566f15efe8cae8d41799d0960ce28a9d38a6df3d645d4f298843865a0a3433041300f0603551d130101ff040530030101ff300f0603551d0f0101ff04050303070600301d0603551d0e0416041455a98489d2c132bd18cb6ca6074ec8e79dbe8290300a06082a8648ce3d040303036700306402303701929745127ea0f33ead193a72ddf450930312be44d24f41a48c9c9d1fa3f6c292e74814fe4e9ba59157aec63772bb023067250ab10c5eeea963926fe5900bfe6622ca47fd8a31f783fe7abf10be182b1e8ff6291e9459ef8e2137cb5198a56e4b Honeygain.exe Key created \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\B12E13634586A46F1AB2606837582DC4ACFD9497 Honeygain.exe Key created \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\55A6723ECBF2ECCDC3237470199D2ABE11E381D1 Honeygain.exe Set value (data) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E\Blob = 0300000001000000140000000d44dd8c3c8c1a1a58756481e90f2e2affb3d26e2000000001000000ba010000308201b63082015ba0030201020213066c9fd5749736663f3b0b9ad9e89e7603f24a300a06082a8648ce3d0403023039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412033301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120333059301306072a8648ce3d020106082a8648ce3d030107034200042997a7c6417fc00d9be8011b56c6f252a5ba2db212e8d22ed7fac9c5d8aa6d1f73813b3b986b397c33a5c54e868e8017686245577d44581db337e56708eb66dea3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414abb6dbd7069e37ac3086079170c79cc419b178c0300a06082a8648ce3d0403020349003046022100e08592a317b78df92b06a593ac1a98686172fae1a1d0fb1c7860a64399c5b8c40221009c02eff1949cb396f9ebc62af8b62cfe3a901416d78c6324481cdf307dd5683b Honeygain.exe Set value (data) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\9A44497632DBDEFAD0BCFB5A7B17BD9E56092494\Blob = 0300000001000000140000009a44497632dbdefad0bcfb5a7b17bd9e5609249420000000010000005b050000308205573082033fa003020102020d0203e5aec58d04251aab1125aa300d06092a864886f70d01010c05003047310b300906035504061302555331223020060355040a1319476f6f676c65205472757374205365727669636573204c4c43311430120603550403130b47545320526f6f74205232301e170d3136303632323030303030305a170d3336303632323030303030305a3047310b300906035504061302555331223020060355040a1319476f6f676c65205472757374205365727669636573204c4c43311430120603550403130b47545320526f6f7420523230820222300d06092a864886f70d01010105000382020f003082020a0282020100cedefda6fbecec14343c07065a6c59f71935ddf7c19d55aad3cd3ba49372ef0afa6d9df6f085805ba148529f39c5b7ee28acefcb766814b9dfad016c991fc4221d9ffe7277e02c5bafe404bf4f72a01a3498e83968ec95257b76a1e669b98519bd898cfeaded36ea73bcff83e2cb7dc1d2ce4ab38d059e8b4993dfc15bd06e5ef02e302e82fcfabcb4170a48e5889bc59b6bdeb0cab403f0daf490b86564f75c4cade87e665e99d7b8c23ec8d0139dadeee4457b8955f78a1f62528412b3c24097e38a1f4791a6745ad2f8b1632810b8b309b8567740a2269879c6fedf25ee3ee5a07fd4610f514b3c3f8cdae17074d8c268a1f9c10ce9a1e27fbb553c7606ee6a4ecc9288304d9abd4f0b489a84b598a3d5fb73c15761dd28567513ae878ee70c51091075884cbc8df97b3cd422481f2adceb6bbb44b1cb33713246afad4af18ce8743aace71a227380d230f72542c7223b3b12ad962ec6c37607aa20b7354957e99249e876167231672b967e8aa3c7945622bf6a4b7e0121b22332dfe49a446d595b5df500a01c9bc678978d90ff9bc8aab4af1151395ed9fb67add55b119d329a1bbdd5ba5ba5c9cb25695355275ce0ca36cb8861fb1eb7d0cbee16fbd3a64cde92a5d4e2dff50654de2e9d4bb49330aa81cedd1adc51730d4f70e9e5b616211979b2e6890b7564cad5abbc09c118a1ffd454a1853cfd142403b287d3a4b70203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414bbffca8e239f4f99cadbe268a6a51527171ed90e300d06092a864886f70d01010c050003820201001fcaceddc7bea19fd9274c0bdc1798116a88de3de6715672b29e1a4e9cd52b98245d9b6b7bb0338209bddf2546ea989eb61bfe833cd26261c104edcee0c5c9c8131355e7a863ad8c7b01fe7730e1ce689b05f812ee7931a0414535280a71a4244f8cdc3c82075f66dc7d10fe0c61b30595eee1ae810fa8f8c78f4da82302266b1d835255ceb52f00ca8040e0e174ac60f587809dae3664915db06818ea8a61c977a897c4c9c7a5fc554bf3f07fb9653d2768d0cc6bfa539de1911ac95d1a966d3287ed0320c802ce5abed9eafdb24dc42f1bdf5f7af5f88bc6ee313a255155678d64327be99ec382ba2a2de91eb4e04806a2fc67af1f220273fb200aaf9d544ba1cdff6047b03f5def1b56bd9721962d0ad15e9d3802476cb9f4f62325b8a06a9a2b7708fac4b128902658083ce27eaad73d6fba31880a05eb27b5a149eea045547be62765992021a8a3bcfb1896bb526f0ced83514ce959e22060c5c26592828cf3101f0e8a97be77826d3f8f1d5dbc4927bdcc4f0fe1ce76860423c5c08c125bfddb84a024f148ff647cd0be5c16d1ef99adc01ffbcbaebc3822062664dada970e3f281544a84f00caf09acccf746ab43e3ceb95ecb5d35ad88199e9431837ebb3bbd1586241f366d28faa78955420c35a2e742bd5d1be1869c0acd5a4cf39ba51840365e962c062fed84d5596e2d011fa483411ec9eed051de4c8d61d86cb Honeygain.exe Key created \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\CTLs Honeygain.exe Key created \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16 Honeygain.exe Key created \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E Honeygain.exe Key created \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\D8C5388AB7301B1B6ED47AE645253A6F9F1A2761 Honeygain.exe Set value (data) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\A3A1B06F2461234AE336A5C237FCA6FFDDF0D73A\Blob = 030000000100000014000000a3a1b06f2461234ae336a5c237fca6ffddf0d73a20000000010000005e0500003082055a30820342a00302010202104fd22b8ff564c8339e4f345866237060300d06092a864886f70d01010b05003047310b300906035504061302434e3111300f060355040a0c08556e6954727573743125302306035504030c1c55434120457874656e6465642056616c69646174696f6e20526f6f74301e170d3135303331333030303030305a170d3338313233313030303030305a3047310b300906035504061302434e3111300f060355040a0c08556e6954727573743125302306035504030c1c55434120457874656e6465642056616c69646174696f6e20526f6f7430820222300d06092a864886f70d01010105000382020f003082020a0282020100a90907281302b099e064aa1e43167a73b191a0753ea8fae338007aec896a200f8bc5b09b33035a86c65886d5c185bb4fc69c404dcabeee6996b8ad81309a7c9205eb052b9a48d0b8763e96c820bbd2b0f18fd8ac4546ffaa6760b4777e6a1f3c1a527a043d073c850d84d01f760af76a14df72e3347c574e56013e79f1aa293b6cfaf88f6d4dc835dfaeebdc24ee7945a785b60588de885d257c97646709d9bf5a150586f3091eec58323311f37764b0761fe41035171bf20eb16ca42aa373fc091f1e32195311e7d9b32c2e762ea1a3de7e6a8809e8f2078af8b2cd10e7e2734093bb08d13fe1fc0b94b325ef7ca6d7d1af9fff969af5917b980b77d47ee807d262b59539e3f3f16d0f0e65848a6354c580b6e09e4b7d4726a701085dd1889ed7c33244fa824a0a68547f385303cca400336451590ba382917a5eec16c2f32ae662da2adb596210254a2a810b470743067087d2fa9311297a484deb94c7704daf67d551b180200101b47a08a6907f4ee0ef074187af6aa55e8bfbcf50b29a54afc389ba582df53098b13672397e4904fd29a74c79e40557db94b916538d46b31d956157567faff0165b61586f3650110bd8ac2b95161a0e1f08cd363465106266d5805f14205f2d0ca0780a68d62cd7e96f2bd24a0593fc9e6f6b67ff88f14ea5694a523705eac6168dd2c499d1822b3bba3575f7515158f3c807dde4b4037f0203010001a3423040301d0603551d0e04160414d9743ae4303d0df712dc7e5a059f1e349af7e114300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186300d06092a864886f70d01010b05000382020100368d97cc42156429379b262cd6fbae15692c6b1a1af75fb6f9074c59eaf3c9c8b9aeccba2e7adcc0f5b02dc03baf9f7005116a9f254f012970e3e50ce1ea5a7cdc49bbc11e2a81f5164b7291c8a231b9aadafc9d1ff35d400213fc4e1c06cab31490541719121af11fd70c695af67178f4947d910b8eec90548ebc6fa14cabfc7464fd719af84107a1cd91e43c9ae09b323973ab2ad569c8789126317de2c730f1fc147877120e13f4dd1694bf4b677b705385cab0bbf3384d2c9039c00dc25d6be9e2e5d5888dd62cbfab1bbeb528871217746efc7dfc8fd08726b01bfbb96cabe29e3d15c13b2e670258919feff8421f2cb768f575adcfb5f6ff117dc2f024a5add3faa03ca9fa5ddca5a0ef44a4bed6e8e5e41396177b063e32edc7b742bc76a3d865382b383551210e0e6f2e341340e12b670c6d4a413018235a325599c917e03cdef6ec79ad2b5819a2ad2c221a958ebe96905d4257c4f91403352b1c2d515708a73ade3fe4c8b40373c2c12680bb0b421fad0daf2672daccbeb3a383580d82c51f4651e39c18cc8d9b8dec49eb7550d58c2859ca7434da8c0b21ab1eea1be5c7fd153ec017aafb236e2646cbfaf9b1726b69cf22840b620facd9190094a2763cd42d9aed049e2d06621037521c85721b27e5ccc631ec37ec63599b0b1d76cc7e329a8895083652bbde765f764949ad7fbd6520b2c9c12b7618769f56b1 Honeygain.exe Key created \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\BCB0C19DE9989270193857E98DA7B45D6EEE0148 Honeygain.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AFE5D244A8D1194230FF479FE2F897BBCD7A8CB4\Blob = 19000000010000001000000082218ffb91733e64136be5719f57c3a1030000000100000014000000afe5d244a8d1194230ff479fe2f897bbcd7a8cb41d0000000100000010000000cb39c3d4272cdf63774e1db810c5a89e140000000100000014000000bbaf7e023dfaa6f13c848eadee3898ecd93232d462000000010000002000000052f0e1c4e58ec629291b60317f074671b85d7ea80d5b07273463534b32b402340b000000010000003a0000005300650063007400690067006f002000280066006f0072006d00650072006c007900200043006f006d006f0064006f002000430041002900000053000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f0000000100000030000000761613f4cd8607508c3d520fbefe68773735fc73746f42a9fd6254ba3b72f0047994e5af57677cf6d2c1965984965df12000000001000000dc050000308205d8308203c0a00302010202104caaf9cadb636fe01ff74ed85b03869d300d06092a864886f70d01010c0500308185310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312b302906035504031322434f4d4f444f205253412043657274696669636174696f6e20417574686f72697479301e170d3130303131393030303030305a170d3338303131383233353935395a308185310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312b302906035504031322434f4d4f444f205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010091e85492d20a56b1ac0d24ddc5cf446774992b37a37d23700071bc53dfc4fa2a128f4b7f1056bd9f7072b7617fc94b0f17a73de3b00461eeff1197c7f4863e0afa3e5cf993e6347ad9146be79cb385a0827a76af7190d7ecfd0dfa9c6cfadfb082f4147ef9bec4a62f4f7f997fb5fc674372bd0c00d689eb6b2cd3ed8f981c14ab7ee5e36efcd8a8e49224da436b62b855fdeac1bc6cb68bf30e8d9ae49b6c6999f878483045d5ade10d3c4560fc32965127bc67c3ca2eb66bea46c7c720a0b11f65de4808baa44ea9f283463784ebe8cc814843674e722a9b5cbd4c1b288a5c227bb4ab98d9eee05183c309464e6d3e99fa9517da7c3357413c8d51ed0bb65caf2c631adf57c83fbce95dc49baf4599e2a35a24b4baa9563dcf6faaff4958bef0a8fff4b8ade937fbbab8f40b3af9e843421e89d884cb13f1d9bbe18960b88c2856ac141d9c0ae771ebcf0edd3da996a148bd3cf7afb50d224cc01181ec563bf6d3a2e25bb7b204225295809369e88e4c65f191032d707402ea8b671529695202bbd7df506a5546bfa0a328617f70d0c3a2aa2c21aa47ce289c064576bf821827b4d5aeb4cb50e66bf44c867130e9a6df1686e0d8ff40ddfbd042887fa3333a2e5c1e41118163ce18716b2beca68ab7315c3a6a47e0c37959d6201aaff26a98aa72bc574ad24b9dbb10fcb04c41e5ed1d3d5e289d9cccbfb351daa747e584530203010001a3423040301d0603551d0e04160414bbaf7e023dfaa6f13c848eadee3898ecd93232d4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201000af1d54684b7ae51bb6cb24d411400934c9ccbe5c054cfa0258e02f9fdb0a20df520983c132dac56a2b0d67e1192e92eba9e2e9a72b1bd19446c6135a29ab41612695a8ce1d73ea41ae82f03f4ae611d101b2aa48b7ac5fe05a6e1c0d6c8fe9eae8f2bba3d99f8d8730958466ea69cf4d727d395da3783721cd373e0a2479903385dd5497900291cc7ec9b201c0724695778b239fc3a84a0b59c7c8dbf2e936227b739da1718aebd3c0968ff849b3cd5d60b03e3579e14f7d1eb4fc8bd8723b7b6494379855cbaeb920ba1c6e868a84c16b11a990ae8532c92bba10918750c65a87bcb23b71ac22885c31bffd02b62efa47b099198678c1401cd68066a6321750380888a6e81c685f2a9a42de7f4a524104783cacdf48d7958b1069be71a2ad99d01d7947ded034acaf0dbe8a9013ef55699c91e8e493dbbe509b9e04f49923d168240cccc59c6e63aed122e693c6c95b1fdaa1d7b7f86be1e0e3246fbfb138f757f4c8b4b4663fe00344070c1c3b9a1dda670e204b341bce98091ea649c7ae12203a99c6e6f0e654f6c87875ef36ea0f975a59b40e853b2279d4ab9c077218dff87f2debc8cef17dfb7490bd1f26e300b1a0e4e76ed11fcf5e956b27dbfc76d0a938ca5d0c0b61dbe3a4e94a2d76e6c0bc28a7cfa20f3c4e4e5cd0da8cb9192b17c85ecb51469660e82e7cdcec82da6517f21c1355385064a5d9fadbb1b5f74 Honeygain_install (1).exe Key created \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\FAB7EE36972662FB2DB02AF6BF03FDE87C4B2F9B Honeygain.exe Set value (data) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\8F6BF2A9274ADA14A0C4F48E6127F9C01E785DD1\Blob = 0300000001000000140000008f6bf2a9274ada14a0c4f48e6127f9c01e785dd12000000001000000a6050000308205a23082038aa00302010202140194301ea20bddf5c5332ab1434471f8d6504d0d300d06092a864886f70d01010c05003069310b3009060355040613024b5231263024060355040a0c1d4e4156455220425553494e45535320504c4154464f524d20436f72702e3132303006035504030c294e4156455220476c6f62616c20526f6f742043657274696669636174696f6e20417574686f72697479301e170d3137303831383038353834325a170d3337303831383233353935395a3069310b3009060355040613024b5231263024060355040a0c1d4e4156455220425553494e45535320504c4154464f524d20436f72702e3132303006035504030c294e4156455220476c6f62616c20526f6f742043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a0282020100b6d4f1935cb540890aab0d905b5063ae909474174572d67b655a294ba756a04bb82f4275e9d97b245a3165ab1717d1333ad911dc403687dfc76ae9265e598a77e3e8489c3116fa3e91b1cac9a3e29fce2153a3023630cb5202e5da325dc3c5e6f9ee11c78bc9441e8493184ab49fe5126469d026856201b6c9021dbe8351bb5cdaf8ad156a99f79254f7345be9bfea298112d4539196b3915addfe907328fb3046b5ca0807c77172c966d33497f68cf4184ae1d03d5a45b669a729fb23ce88d8129c0048a8a60fb33b928d710e74c58bc84cf9f49b8eb83c69ed6f3b502f58edc4b0d01c1b6a0ce2bc44aad8cd145d947861bf0e6eda2abc2f0c0b71a6b3163f9ce6f9cc9f5335e203a0a018bfbbf1bef4d68c870d42f706b9f16ded0494a8feb6d306c64061df9d9df35476ce533a01a69241ec04a38f0da2d509cad6cb9af1ef435dc0aba541cf5c537070c988a62dd46b6173502686610e5f1bc22be28cd5bb9dc10342ba94da5fa9b0cacc4d0aef4769032f22fbf128cebf5d5065a8906db374b008c7aca8d1eb3e9cfc5d1a832e2bcbb5f3449d3aa7176196a271d37096154db74c73ee195cc55b3e41feac75603b1b63ce00ddda089062b4e52dee48a76b179954be874ae3a95e044ceb106d54d6eff1e8f26216cb806bed3dedf51f30a5ae4bc913ed8a0101c9b85158c0663ab1664bc4d5310262e974840cdb4d462d0203010001a3423040301d0603551d0e04160414d29f88dfa1cd2cbdecf53b0101933327b2eb604b300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c0500038202010032ca80b39d3d5406ddd2d22ef0a401210b6748ca6d8ee0c8aa0daa8d21578fc63e7acadb51d452b3d49684a558607fe50b8e1ff5dc0a1581e53bb6b7222f099c1316b16c0c35086dab6372eddcbeecc757e6302071d6d710c11355018c2a43e441f1cf3a7a5392cea203050d38df02bb102ed93bd29b7ac0a1a6f8b531e6f475c9b953997547225a1415c7781bb69de90cf81b76f18584dea1da12efa4e210977a78de0c5197a821408b86bd0df05e4e4b36bb3b201f8a4256e10b1abf7bd022432c448cfbe52ab46c1c1cba94e0137e21e69ac2cbc54264b41e947b0825c871cc87455785d39f296222835197001897776a9892c97c606cdf6c7d4ae4704cc29eb81df7d034c70fccfba7ff03bead7090da0bddc86d975f9a7f093241fdcda2cc5a6d4cf2aa49fe66f8e9d835eb0e281eee482f3ad07909387ca622829395d003bebe02a005dd2022e36f1d883460c6e60ab909750bf007e8699635c7fb23818e3839b8452b4378a2d12c14ff0d287272959b5e09db894498aaa149bb7152f2bff6ff27a136afb8b67788dd3aa46d9b3490dc145d30bfb7eb17e487b771d0a1d77715d442d7f2f331995d9bdd166d3fea0623f846a222ed93f6dd9ae62a87b19854f122f76b45e3e28e761d9a8dc4068d36b714f39d5469b78e3cd5a46d9381b7adf6bd647bc2c96839a0929ccd34869190fa64519dfefeeba5f575de89f772 Honeygain.exe Set value (data) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\3043FA4FF257DCA0C380EE2E58EA78B23FE6BBC1\Blob = 0300000001000000140000003043fa4ff257dca0c380ee2e58ea78b23fe6bbc12000000001000000520200003082024e308201d3a003020102020a3cf607a968700eda8b84300a06082a8648ce3d040303306b310b300906035504061302494e31133011060355040b130a656d5369676e20504b4931253023060355040a131c654d756468726120546563686e6f6c6f67696573204c696d697465643120301e06035504031317656d5369676e2045434320526f6f74204341202d204733301e170d3138303231383138333030305a170d3433303231383138333030305a306b310b300906035504061302494e31133011060355040b130a656d5369676e20504b4931253023060355040a131c654d756468726120546563686e6f6c6f67696573204c696d697465643120301e06035504031317656d5369676e2045434320526f6f74204341202d2047333076301006072a8648ce3d020106052b810400220362000423a50cb82d12f528f3b1b2dde20212809e395f494d9fc925345974ecbb061ce7c072afe8ae2fe141548714a84ab2e87c82e65b6ab5dcb375ce8b06d08623bf46d58e0f3f04f4d71c927ef6a563c2f55f8e2e4fa11819022b320a82647d1693d1a3423040301d0603551d0e041604147c5d028413d4cc8a9b81ce171c2e291e9c486342300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d0403030369003066023100bef361cf02101d649507b8186e8885052f83081790ca1f8a4ce80d1b7ab1add5810947ef3bac08047c5c99b1ed4707d20231009dba55fca94ae8edede67601427bc8f860d98d518b553bfb8c7beb6509c3f896cd47a882f2165577247e121095042ca3 Honeygain.exe Set value (data) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\AFE5D244A8D1194230FF479FE2F897BBCD7A8CB4\Blob = 030000000100000014000000afe5d244a8d1194230ff479fe2f897bbcd7a8cb42000000001000000dc050000308205d8308203c0a00302010202104caaf9cadb636fe01ff74ed85b03869d300d06092a864886f70d01010c0500308185310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312b302906035504031322434f4d4f444f205253412043657274696669636174696f6e20417574686f72697479301e170d3130303131393030303030305a170d3338303131383233353935395a308185310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312b302906035504031322434f4d4f444f205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010091e85492d20a56b1ac0d24ddc5cf446774992b37a37d23700071bc53dfc4fa2a128f4b7f1056bd9f7072b7617fc94b0f17a73de3b00461eeff1197c7f4863e0afa3e5cf993e6347ad9146be79cb385a0827a76af7190d7ecfd0dfa9c6cfadfb082f4147ef9bec4a62f4f7f997fb5fc674372bd0c00d689eb6b2cd3ed8f981c14ab7ee5e36efcd8a8e49224da436b62b855fdeac1bc6cb68bf30e8d9ae49b6c6999f878483045d5ade10d3c4560fc32965127bc67c3ca2eb66bea46c7c720a0b11f65de4808baa44ea9f283463784ebe8cc814843674e722a9b5cbd4c1b288a5c227bb4ab98d9eee05183c309464e6d3e99fa9517da7c3357413c8d51ed0bb65caf2c631adf57c83fbce95dc49baf4599e2a35a24b4baa9563dcf6faaff4958bef0a8fff4b8ade937fbbab8f40b3af9e843421e89d884cb13f1d9bbe18960b88c2856ac141d9c0ae771ebcf0edd3da996a148bd3cf7afb50d224cc01181ec563bf6d3a2e25bb7b204225295809369e88e4c65f191032d707402ea8b671529695202bbd7df506a5546bfa0a328617f70d0c3a2aa2c21aa47ce289c064576bf821827b4d5aeb4cb50e66bf44c867130e9a6df1686e0d8ff40ddfbd042887fa3333a2e5c1e41118163ce18716b2beca68ab7315c3a6a47e0c37959d6201aaff26a98aa72bc574ad24b9dbb10fcb04c41e5ed1d3d5e289d9cccbfb351daa747e584530203010001a3423040301d0603551d0e04160414bbaf7e023dfaa6f13c848eadee3898ecd93232d4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201000af1d54684b7ae51bb6cb24d411400934c9ccbe5c054cfa0258e02f9fdb0a20df520983c132dac56a2b0d67e1192e92eba9e2e9a72b1bd19446c6135a29ab41612695a8ce1d73ea41ae82f03f4ae611d101b2aa48b7ac5fe05a6e1c0d6c8fe9eae8f2bba3d99f8d8730958466ea69cf4d727d395da3783721cd373e0a2479903385dd5497900291cc7ec9b201c0724695778b239fc3a84a0b59c7c8dbf2e936227b739da1718aebd3c0968ff849b3cd5d60b03e3579e14f7d1eb4fc8bd8723b7b6494379855cbaeb920ba1c6e868a84c16b11a990ae8532c92bba10918750c65a87bcb23b71ac22885c31bffd02b62efa47b099198678c1401cd68066a6321750380888a6e81c685f2a9a42de7f4a524104783cacdf48d7958b1069be71a2ad99d01d7947ded034acaf0dbe8a9013ef55699c91e8e493dbbe509b9e04f49923d168240cccc59c6e63aed122e693c6c95b1fdaa1d7b7f86be1e0e3246fbfb138f757f4c8b4b4663fe00344070c1c3b9a1dda670e204b341bce98091ea649c7ae12203a99c6e6f0e654f6c87875ef36ea0f975a59b40e853b2279d4ab9c077218dff87f2debc8cef17dfb7490bd1f26e300b1a0e4e76ed11fcf5e956b27dbfc76d0a938ca5d0c0b61dbe3a4e94a2d76e6c0bc28a7cfa20f3c4e4e5cd0da8cb9192b17c85ecb51469660e82e7cdcec82da6517f21c1355385064a5d9fadbb1b5f74 Honeygain.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AFE5D244A8D1194230FF479FE2F897BBCD7A8CB4\Blob = 0f0000000100000030000000761613f4cd8607508c3d520fbefe68773735fc73746f42a9fd6254ba3b72f0047994e5af57677cf6d2c1965984965df1090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003a0000005300650063007400690067006f002000280066006f0072006d00650072006c007900200043006f006d006f0064006f002000430041002900000062000000010000002000000052f0e1c4e58ec629291b60317f074671b85d7ea80d5b07273463534b32b40234140000000100000014000000bbaf7e023dfaa6f13c848eadee3898ecd93232d41d0000000100000010000000cb39c3d4272cdf63774e1db810c5a89e030000000100000014000000afe5d244a8d1194230ff479fe2f897bbcd7a8cb42000000001000000dc050000308205d8308203c0a00302010202104caaf9cadb636fe01ff74ed85b03869d300d06092a864886f70d01010c0500308185310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312b302906035504031322434f4d4f444f205253412043657274696669636174696f6e20417574686f72697479301e170d3130303131393030303030305a170d3338303131383233353935395a308185310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312b302906035504031322434f4d4f444f205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010091e85492d20a56b1ac0d24ddc5cf446774992b37a37d23700071bc53dfc4fa2a128f4b7f1056bd9f7072b7617fc94b0f17a73de3b00461eeff1197c7f4863e0afa3e5cf993e6347ad9146be79cb385a0827a76af7190d7ecfd0dfa9c6cfadfb082f4147ef9bec4a62f4f7f997fb5fc674372bd0c00d689eb6b2cd3ed8f981c14ab7ee5e36efcd8a8e49224da436b62b855fdeac1bc6cb68bf30e8d9ae49b6c6999f878483045d5ade10d3c4560fc32965127bc67c3ca2eb66bea46c7c720a0b11f65de4808baa44ea9f283463784ebe8cc814843674e722a9b5cbd4c1b288a5c227bb4ab98d9eee05183c309464e6d3e99fa9517da7c3357413c8d51ed0bb65caf2c631adf57c83fbce95dc49baf4599e2a35a24b4baa9563dcf6faaff4958bef0a8fff4b8ade937fbbab8f40b3af9e843421e89d884cb13f1d9bbe18960b88c2856ac141d9c0ae771ebcf0edd3da996a148bd3cf7afb50d224cc01181ec563bf6d3a2e25bb7b204225295809369e88e4c65f191032d707402ea8b671529695202bbd7df506a5546bfa0a328617f70d0c3a2aa2c21aa47ce289c064576bf821827b4d5aeb4cb50e66bf44c867130e9a6df1686e0d8ff40ddfbd042887fa3333a2e5c1e41118163ce18716b2beca68ab7315c3a6a47e0c37959d6201aaff26a98aa72bc574ad24b9dbb10fcb04c41e5ed1d3d5e289d9cccbfb351daa747e584530203010001a3423040301d0603551d0e04160414bbaf7e023dfaa6f13c848eadee3898ecd93232d4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201000af1d54684b7ae51bb6cb24d411400934c9ccbe5c054cfa0258e02f9fdb0a20df520983c132dac56a2b0d67e1192e92eba9e2e9a72b1bd19446c6135a29ab41612695a8ce1d73ea41ae82f03f4ae611d101b2aa48b7ac5fe05a6e1c0d6c8fe9eae8f2bba3d99f8d8730958466ea69cf4d727d395da3783721cd373e0a2479903385dd5497900291cc7ec9b201c0724695778b239fc3a84a0b59c7c8dbf2e936227b739da1718aebd3c0968ff849b3cd5d60b03e3579e14f7d1eb4fc8bd8723b7b6494379855cbaeb920ba1c6e868a84c16b11a990ae8532c92bba10918750c65a87bcb23b71ac22885c31bffd02b62efa47b099198678c1401cd68066a6321750380888a6e81c685f2a9a42de7f4a524104783cacdf48d7958b1069be71a2ad99d01d7947ded034acaf0dbe8a9013ef55699c91e8e493dbbe509b9e04f49923d168240cccc59c6e63aed122e693c6c95b1fdaa1d7b7f86be1e0e3246fbfb138f757f4c8b4b4663fe00344070c1c3b9a1dda670e204b341bce98091ea649c7ae12203a99c6e6f0e654f6c87875ef36ea0f975a59b40e853b2279d4ab9c077218dff87f2debc8cef17dfb7490bd1f26e300b1a0e4e76ed11fcf5e956b27dbfc76d0a938ca5d0c0b61dbe3a4e94a2d76e6c0bc28a7cfa20f3c4e4e5cd0da8cb9192b17c85ecb51469660e82e7cdcec82da6517f21c1355385064a5d9fadbb1b5f74 Honeygain_install (1).exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AFE5D244A8D1194230FF479FE2F897BBCD7A8CB4\Blob = 5c00000001000000040000000010000019000000010000001000000082218ffb91733e64136be5719f57c3a1030000000100000014000000afe5d244a8d1194230ff479fe2f897bbcd7a8cb41d0000000100000010000000cb39c3d4272cdf63774e1db810c5a89e140000000100000014000000bbaf7e023dfaa6f13c848eadee3898ecd93232d462000000010000002000000052f0e1c4e58ec629291b60317f074671b85d7ea80d5b07273463534b32b402340b000000010000003a0000005300650063007400690067006f002000280066006f0072006d00650072006c007900200043006f006d006f0064006f002000430041002900000053000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f0000000100000030000000761613f4cd8607508c3d520fbefe68773735fc73746f42a9fd6254ba3b72f0047994e5af57677cf6d2c1965984965df10400000001000000100000001b31b0714036cc143691adc43efdec182000000001000000dc050000308205d8308203c0a00302010202104caaf9cadb636fe01ff74ed85b03869d300d06092a864886f70d01010c0500308185310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312b302906035504031322434f4d4f444f205253412043657274696669636174696f6e20417574686f72697479301e170d3130303131393030303030305a170d3338303131383233353935395a308185310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312b302906035504031322434f4d4f444f205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010091e85492d20a56b1ac0d24ddc5cf446774992b37a37d23700071bc53dfc4fa2a128f4b7f1056bd9f7072b7617fc94b0f17a73de3b00461eeff1197c7f4863e0afa3e5cf993e6347ad9146be79cb385a0827a76af7190d7ecfd0dfa9c6cfadfb082f4147ef9bec4a62f4f7f997fb5fc674372bd0c00d689eb6b2cd3ed8f981c14ab7ee5e36efcd8a8e49224da436b62b855fdeac1bc6cb68bf30e8d9ae49b6c6999f878483045d5ade10d3c4560fc32965127bc67c3ca2eb66bea46c7c720a0b11f65de4808baa44ea9f283463784ebe8cc814843674e722a9b5cbd4c1b288a5c227bb4ab98d9eee05183c309464e6d3e99fa9517da7c3357413c8d51ed0bb65caf2c631adf57c83fbce95dc49baf4599e2a35a24b4baa9563dcf6faaff4958bef0a8fff4b8ade937fbbab8f40b3af9e843421e89d884cb13f1d9bbe18960b88c2856ac141d9c0ae771ebcf0edd3da996a148bd3cf7afb50d224cc01181ec563bf6d3a2e25bb7b204225295809369e88e4c65f191032d707402ea8b671529695202bbd7df506a5546bfa0a328617f70d0c3a2aa2c21aa47ce289c064576bf821827b4d5aeb4cb50e66bf44c867130e9a6df1686e0d8ff40ddfbd042887fa3333a2e5c1e41118163ce18716b2beca68ab7315c3a6a47e0c37959d6201aaff26a98aa72bc574ad24b9dbb10fcb04c41e5ed1d3d5e289d9cccbfb351daa747e584530203010001a3423040301d0603551d0e04160414bbaf7e023dfaa6f13c848eadee3898ecd93232d4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201000af1d54684b7ae51bb6cb24d411400934c9ccbe5c054cfa0258e02f9fdb0a20df520983c132dac56a2b0d67e1192e92eba9e2e9a72b1bd19446c6135a29ab41612695a8ce1d73ea41ae82f03f4ae611d101b2aa48b7ac5fe05a6e1c0d6c8fe9eae8f2bba3d99f8d8730958466ea69cf4d727d395da3783721cd373e0a2479903385dd5497900291cc7ec9b201c0724695778b239fc3a84a0b59c7c8dbf2e936227b739da1718aebd3c0968ff849b3cd5d60b03e3579e14f7d1eb4fc8bd8723b7b6494379855cbaeb920ba1c6e868a84c16b11a990ae8532c92bba10918750c65a87bcb23b71ac22885c31bffd02b62efa47b099198678c1401cd68066a6321750380888a6e81c685f2a9a42de7f4a524104783cacdf48d7958b1069be71a2ad99d01d7947ded034acaf0dbe8a9013ef55699c91e8e493dbbe509b9e04f49923d168240cccc59c6e63aed122e693c6c95b1fdaa1d7b7f86be1e0e3246fbfb138f757f4c8b4b4663fe00344070c1c3b9a1dda670e204b341bce98091ea649c7ae12203a99c6e6f0e654f6c87875ef36ea0f975a59b40e853b2279d4ab9c077218dff87f2debc8cef17dfb7490bd1f26e300b1a0e4e76ed11fcf5e956b27dbfc76d0a938ca5d0c0b61dbe3a4e94a2d76e6c0bc28a7cfa20f3c4e4e5cd0da8cb9192b17c85ecb51469660e82e7cdcec82da6517f21c1355385064a5d9fadbb1b5f74 Honeygain_install (1).exe Key created \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 Honeygain.exe Set value (data) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\0FF9407618D3D76A4B98F0A8359E0CFD27ACCCED\Blob = 0300000001000000140000000ff9407618d3d76a4b98f0a8359e0cfd27accced2000000001000000b9030000308203b53082029da003020102021076b1205274f0858746b3f8231af6c2c0300d06092a864886f70d01010b0500306d310b30090603550406130243483110300e060355040a1307574953654b657931223020060355040b13194f4953544520466f756e646174696f6e20456e646f72736564312830260603550403131f4f4953544520574953654b657920476c6f62616c20526f6f74204742204341301e170d3134313230313135303033325a170d3339313230313135313033315a306d310b30090603550406130243483110300e060355040a1307574953654b657931223020060355040b13194f4953544520466f756e646174696f6e20456e646f72736564312830260603550403131f4f4953544520574953654b657920476c6f62616c20526f6f7420474220434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d817b71c4a242ad697b1cae21efb7d38ef98f5b239984e27b8115d7bd22594888215266a1b31bba85b21212bd80f4e9f5af1b15ae479d632232be153cc99455c7b4fadbcbf874a0b4b975aa8f648ec7d7b0dcd2106df9e15fd418a48b720f4a17a1b57d45d50ffba67d823991fc83fe3deff6f5b77b16b6eb8c964f7e1ca41460e2971d0b923fcc9815f4ef76fdfbf84ad7364bbb7428e69f6d4761d7e9da7b8578a516772d7d4a8b89554407303f6eaf4ebfe2842773f9d231bb2b63d8014074c2e4ff7d50a160dbd6643377e234379c34086f54c29da8e9aad0da50487881e85e3e953d59bc88b036378ebe0194a6ebb2f6b33645893ad69bf8f1bef8248c70203010001a351304f300b0603551d0f040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414350fc836635ee2a3ecf93b6615ce5152e3919a3d301006092b06010401823715010403020100300d06092a864886f70d01010b05000382010100404cfb87b29981907e9dc5b0b026cd887b2b328d6eb8217158977dae3714af3ee7f79ae27df671989904aa437478a3e349613e738c4d94e0f971c4b6160e53781fd6a2872f023981293caf15982130fe2890008cd1e1cbfa5ec8fdf810463ba27842911774550ade50674d66d1a7fffdd9c0b5a8a38ace66f50f43cda72b577b63466aaa2e52d8f4ede16dad29907848bae123aaa389ecb5ab96c0b44ba21d979e7af26e4071df68f1654dce7c05df5365a9a5f0b197047015460398d4d2bf54b4a0587d526fda562662d4d8db89316f1cf022c2d3621c35cd4c6915541a9098deeb1e5fca77c7cb8e3d43699c9a58d0243bdf1b40967e35ad81c74e71ba8813 Honeygain.exe Key created \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\E011845E34DEBE8881B99CF61626D1961FC3B931 Honeygain.exe Key created \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\CRLs Honeygain.exe Key created \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE Honeygain.exe Key created \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\DAFAF7FA6684EC068F1450BDC7C281A5BCA96457 Honeygain.exe Key created \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\6A92E4A8EE1BEC964537E3295749CD96E3E5D260 Honeygain.exe Set value (data) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\B561EBEAA4DEE4254B691A98A55747C234C7D971\Blob = 030000000100000014000000b561ebeaa4dee4254b691a98a55747c234c7d97120000000010000006d0500003082056930820351a00302010202090092b888dbb08ac163300d06092a864886f70d01010b05003052310b300906035504061302534b311330110603550407130a4272617469736c61766131133011060355040a130a446973696720612e732e3119301706035504031310434120446973696720526f6f74205232301e170d3132303731393039313533305a170d3432303731393039313533305a3052310b300906035504061302534b311330110603550407130a4272617469736c61766131133011060355040a130a446973696720612e732e3119301706035504031310434120446973696720526f6f7420523230820222300d06092a864886f70d01010105000382020f003082020a0282020100a2a3c40009d6855d2d6d14f6c2c3739e35c271557e81fbab4650e0c17c4978e6ab79583cdaff7c1c9fd89702783e6b4104e941bdbe032c45f62f64d4ab5da3473d649be9689ac6cc1b3fbabeb28b34022e985519fc8c6faa5fda4cce4d0321a3d8d234935696cb4c0c00163c5f1acdc8c76ca6add331a7bce8e5e166d6d2fb03b44165c910ae0e0563c6806a6930fdd2ee90ef0d27df9f9573f4e125da6c16de413834ea8bfcd1e80414612d417eacc7774ecb5154fb5e92181b045a68c6c9c4fab713a098b7112bb7d657cc7c9e17d1cb25fe864e242e560c784d9e0112a62ba701656e7c621d8484dfeac06bb5a52a9583c353110c731d0bb24690d1423ace406e95adffc694ad6e97848e7d6f9e8a800d496d73e27b921ec3f3c1f3eb2e056fd91bcf377604c8b45ae417a7cbdd761fd01976e82c05b3d69c34d896dc61879105e4440833c1dab90865d4aeb2360debba38ba0ce59b9eeb8d66dd99cfd68941f604928a29296d6b3a1ce7757d02710ef3c0e7bdcb19dd9d60b2c26660b6b104eec9e686b99a6640a8e711ed8145038bf66759e8c10611bdddcf80024f6540785c4750c89be61f817be444a85b859ae2de5ad5c7f93a44664be432547ce46c9cb30e3d17a2b23412d67eb2a849bbd17a2840bea2161fdfe4371f1173fb900a6543a20d7cf8060155337db00db8f4f5aea542577c36118c7b5ec4039d8c799d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414b599f8afb094f5e320d60aadce4e56a42e6e42ed300d06092a864886f70d01010b0500038202010026065e70e76533c8826ed99c173a1b7a66b201f6783b695e2feaff4ef928c3982a614cb424128a7d6d1114f79cb5cae6bc9e278e4c19c8a9bd7ac0d7360e6d85726ea8c6a26df6fa73637fbc6e79081c9d8a9f1a8a53a6d8bbd93555b111c5a903b3563bb98493225e7ec1f612528bea2c67bcfe364cf5b8cfd1b349923bd3290e991b96f761b83bc42bb6786cb4236ff0fdd3b25e751f9995a8acf6dae1c5317bfbd146b3d2bc67b46254ba09f763b093a29af9e9522e8b6012abfcf56056ef105c8bc41a42dc835b640ecbb5bcd64fc17c3c6e8d136dfb7beb30d0dc4dafc5d5b6a54c5b71c9e831bee8380648a11ae2ead2de1239581aff800e8275e6b7c9076c0eefff38f19871c4b77f0e15d02569bd229d2bed05f64647acedc0f0d43be2ecee965b90134e1e563aebb0ef96bb962311baf24386746495c82875df1d35bad23783385338363bcf6ce9f96b0ed0fb04e84f77d7650178860c7a3e2162f17f63710cc99f44dba827a275be6e813ed7c0eb1b980f705c34b28accc08518eb6e7ab3f75aa107bfa94292f3602297e414a1079b4e76c08e7dfda425c747edff1f73acccc3a5e96f0a8e9b65c25085b5a3a05312cc558761f381ae104661bd4421b8c23d74cf7e2435fa1c070e9b3d22caef312f8cac12bdef4028fc29679fb2134f6624c45319e91e2915efe66db07f2d67fdf36c1b7546a3e54a17e9a4d70b Honeygain.exe Set value (data) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\6631BF9EF74F9EB6C9D5A60CBA6ABED1F7BDEF7B\Blob = 0300000001000000140000006631bf9ef74f9eb6c9d5a60cba6abed1f7bdef7b2000000001000000210400003082041d30820305a00302010202104e812d8a8265e00b02ee3e350246e53d300d06092a864886f70d0101050500308181310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312730250603550403131e434f4d4f444f2043657274696669636174696f6e20417574686f72697479301e170d3036313230313030303030305a170d3239313233313233353935395a308181310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312730250603550403131e434f4d4f444f2043657274696669636174696f6e20417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100d0408b8b72e3911bf751c11b540498d3a9bfc1e68a5d3b87fbbb88ce0de32f3f0696f0a2295099aedb3ba157b0745171cded42914d41fea9c8d86a867744bb596697505eb4d42c7044cfda379542693c30c471b352f0214da1d8ba397c1c9ea3249df2831698aa167c439b155bb7ae3491fed4622618469a3febc1f9f19057ebac7a0d8bdb72306a66d5e046a370dc68d9ff04488977deb5e9fb676d41e9bc39bd32d96202f1b1a83d6e379ce22fe2d3a2268bc6b8554388e1233ea5d224396a47ab00d4a1b3a925fe0d3fa71dbad351c10ba4daac38ef55502405654693344f2d8dadc6d42119d28eca056171077347e58a1912bd044dce4e9ca548acbb26f70203010001a3818e30818b301d0603551d0e041604140b58e58bc64c1537a440a930a921be47365a56ff300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff30490603551d1f04423040303ea03ca03a8638687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f43657274696669636174696f6e417574686f726974792e63726c300d06092a864886f70d010105050003820101003e989e9bf61be9d739b778ae1d721849d387e44382eb3fc9aaf5a8b5ef557c215265f9d50de16cf43e8c9373912e02c44e07716fc08f386108a81e810ac02f202f418b91dc4845bcf1c6deba766b33c8002d31464cede79dcf8894ff33c056e8248626b8d83838df2a6bdd12ccc73f47174ca2c2069609d6dbfe3f3c4641df58e2560f3c3bc11c9335d93852aceec8ec2e304e9435b4241f4b7869daf20238cc955293f07025599c2067c4eef98b5761f492767d3f848d55b7e8e5acd5f1f51956a65afb901caf93ebe51cd467975d040ebe0b83a61783b93012a0c5331505b90dfbc70576e3d84a8dfc3417a3c62128be3045311ec778be586138ac3be20165 Honeygain.exe Key created \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\SystemCertificates\honeygain\Certificates\89DF74FE5CF40F4A80F9E3377D54DA91E101318E Honeygain.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1184 MsiExec.exe 1184 MsiExec.exe 1184 MsiExec.exe 1184 MsiExec.exe 948 MsiExec.exe 948 MsiExec.exe 4804 msiexec.exe 4804 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 4804 msiexec.exe Token: SeCreateTokenPrivilege 2648 Honeygain_install (1).exe Token: SeAssignPrimaryTokenPrivilege 2648 Honeygain_install (1).exe Token: SeLockMemoryPrivilege 2648 Honeygain_install (1).exe Token: SeIncreaseQuotaPrivilege 2648 Honeygain_install (1).exe Token: SeMachineAccountPrivilege 2648 Honeygain_install (1).exe Token: SeTcbPrivilege 2648 Honeygain_install (1).exe Token: SeSecurityPrivilege 2648 Honeygain_install (1).exe Token: SeTakeOwnershipPrivilege 2648 Honeygain_install (1).exe Token: SeLoadDriverPrivilege 2648 Honeygain_install (1).exe Token: SeSystemProfilePrivilege 2648 Honeygain_install (1).exe Token: SeSystemtimePrivilege 2648 Honeygain_install (1).exe Token: SeProfSingleProcessPrivilege 2648 Honeygain_install (1).exe Token: SeIncBasePriorityPrivilege 2648 Honeygain_install (1).exe Token: SeCreatePagefilePrivilege 2648 Honeygain_install (1).exe Token: SeCreatePermanentPrivilege 2648 Honeygain_install (1).exe Token: SeBackupPrivilege 2648 Honeygain_install (1).exe Token: SeRestorePrivilege 2648 Honeygain_install (1).exe Token: SeShutdownPrivilege 2648 Honeygain_install (1).exe Token: SeDebugPrivilege 2648 Honeygain_install (1).exe Token: SeAuditPrivilege 2648 Honeygain_install (1).exe Token: SeSystemEnvironmentPrivilege 2648 Honeygain_install (1).exe Token: SeChangeNotifyPrivilege 2648 Honeygain_install (1).exe Token: SeRemoteShutdownPrivilege 2648 Honeygain_install (1).exe Token: SeUndockPrivilege 2648 Honeygain_install (1).exe Token: SeSyncAgentPrivilege 2648 Honeygain_install (1).exe Token: SeEnableDelegationPrivilege 2648 Honeygain_install (1).exe Token: SeManageVolumePrivilege 2648 Honeygain_install (1).exe Token: SeImpersonatePrivilege 2648 Honeygain_install (1).exe Token: SeCreateGlobalPrivilege 2648 Honeygain_install (1).exe Token: SeCreateTokenPrivilege 2648 Honeygain_install (1).exe Token: SeAssignPrimaryTokenPrivilege 2648 Honeygain_install (1).exe Token: SeLockMemoryPrivilege 2648 Honeygain_install (1).exe Token: SeIncreaseQuotaPrivilege 2648 Honeygain_install (1).exe Token: SeMachineAccountPrivilege 2648 Honeygain_install (1).exe Token: SeTcbPrivilege 2648 Honeygain_install (1).exe Token: SeSecurityPrivilege 2648 Honeygain_install (1).exe Token: SeTakeOwnershipPrivilege 2648 Honeygain_install (1).exe Token: SeLoadDriverPrivilege 2648 Honeygain_install (1).exe Token: SeSystemProfilePrivilege 2648 Honeygain_install (1).exe Token: SeSystemtimePrivilege 2648 Honeygain_install (1).exe Token: SeProfSingleProcessPrivilege 2648 Honeygain_install (1).exe Token: SeIncBasePriorityPrivilege 2648 Honeygain_install (1).exe Token: SeCreatePagefilePrivilege 2648 Honeygain_install (1).exe Token: SeCreatePermanentPrivilege 2648 Honeygain_install (1).exe Token: SeBackupPrivilege 2648 Honeygain_install (1).exe Token: SeRestorePrivilege 2648 Honeygain_install (1).exe Token: SeShutdownPrivilege 2648 Honeygain_install (1).exe Token: SeDebugPrivilege 2648 Honeygain_install (1).exe Token: SeAuditPrivilege 2648 Honeygain_install (1).exe Token: SeSystemEnvironmentPrivilege 2648 Honeygain_install (1).exe Token: SeChangeNotifyPrivilege 2648 Honeygain_install (1).exe Token: SeRemoteShutdownPrivilege 2648 Honeygain_install (1).exe Token: SeUndockPrivilege 2648 Honeygain_install (1).exe Token: SeSyncAgentPrivilege 2648 Honeygain_install (1).exe Token: SeEnableDelegationPrivilege 2648 Honeygain_install (1).exe Token: SeManageVolumePrivilege 2648 Honeygain_install (1).exe Token: SeImpersonatePrivilege 2648 Honeygain_install (1).exe Token: SeCreateGlobalPrivilege 2648 Honeygain_install (1).exe Token: SeCreateTokenPrivilege 2648 Honeygain_install (1).exe Token: SeAssignPrimaryTokenPrivilege 2648 Honeygain_install (1).exe Token: SeLockMemoryPrivilege 2648 Honeygain_install (1).exe Token: SeIncreaseQuotaPrivilege 2648 Honeygain_install (1).exe Token: SeMachineAccountPrivilege 2648 Honeygain_install (1).exe -
Suspicious use of FindShellTrayWindow 43 IoCs
pid Process 2648 Honeygain_install (1).exe 2648 Honeygain_install (1).exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe -
Suspicious use of SendNotifyMessage 41 IoCs
pid Process 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe 2000 Honeygain.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2000 Honeygain.exe 2000 Honeygain.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 4804 wrote to memory of 1184 4804 msiexec.exe 69 PID 4804 wrote to memory of 1184 4804 msiexec.exe 69 PID 4804 wrote to memory of 1184 4804 msiexec.exe 69 PID 2648 wrote to memory of 4884 2648 Honeygain_install (1).exe 70 PID 2648 wrote to memory of 4884 2648 Honeygain_install (1).exe 70 PID 2648 wrote to memory of 4884 2648 Honeygain_install (1).exe 70 PID 4804 wrote to memory of 948 4804 msiexec.exe 73 PID 4804 wrote to memory of 948 4804 msiexec.exe 73 PID 4804 wrote to memory of 948 4804 msiexec.exe 73 PID 948 wrote to memory of 5000 948 MsiExec.exe 74 PID 948 wrote to memory of 5000 948 MsiExec.exe 74 PID 948 wrote to memory of 5000 948 MsiExec.exe 74 PID 948 wrote to memory of 420 948 MsiExec.exe 75 PID 948 wrote to memory of 420 948 MsiExec.exe 75 PID 948 wrote to memory of 420 948 MsiExec.exe 75 PID 948 wrote to memory of 4348 948 MsiExec.exe 77 PID 948 wrote to memory of 4348 948 MsiExec.exe 77 PID 948 wrote to memory of 4348 948 MsiExec.exe 77 PID 2000 wrote to memory of 1876 2000 Honeygain.exe 83 PID 2000 wrote to memory of 1876 2000 Honeygain.exe 83 PID 2000 wrote to memory of 1876 2000 Honeygain.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\Honeygain_install (1).exe"C:\Users\Admin\AppData\Local\Temp\Honeygain_install (1).exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\Honeygain_install (1).exe"C:\Users\Admin\AppData\Local\Temp\Honeygain_install (1).exe" /i "C:\Users\Admin\AppData\Roaming\Honeygain\Honeygain 0.11.1.0\install\Honeygain_install.msi" AI_EUIMSI=1 SHORTCUTDIR="C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Honeygain" APPDIR="C:\Program Files (x86)\Honeygain" SECONDSEQUENCE="1" CLIENTPROCESSID="2648" AI_MORE_CMD_LINE=12⤵
- Enumerates connected drives
- Modifies system certificate store
PID:4884
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding BCE802010F3116851D21E0A77A11F2E2 C2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1184
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F6FE2492EDD08553B9CC788043D6B3D02⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSICC74.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240569546 93 Honeygain.CustomActions!Honeygain.CustomActions.CustomAction.InitEventParams3⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:5000
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSID715.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240572312 97 Honeygain.CustomActions!Honeygain.CustomActions.CustomAction.SendStartEvent3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in Windows directory
PID:420
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSIE2FF.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240575281 101 Honeygain.CustomActions!Honeygain.CustomActions.CustomAction.SendFinishEvent3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in Windows directory
PID:4348
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:3744
-
C:\Program Files (x86)\Honeygain\Honeygain.exe"C:\Program Files (x86)\Honeygain\Honeygain.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Program Files (x86)\Honeygain\HoneygainUpdater.exe"C:\Program Files (x86)\Honeygain\HoneygainUpdater.exe" /silentall -nofreqcheck -nogui2⤵
- Executes dropped EXE
PID:1876
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_79CFD3DF2894C4BFDA2ADFD6675FA18B
Filesize727B
MD52ab4a000a6fa197ddfa198e15a14fe27
SHA10bee6b06d40fa13bc18812267a1a1a288705f858
SHA25653c1e2dc9d36e67ffcabe811a82e144b8215f8147b2b7b59c1cae08be2e5fb61
SHA512967c1d99db9fdad0c54a52be1bc768e6fe996e5b72d85c2f2598a960e7f317cd8c7394f2ff08b280cd62421fdc843b4e12af3ec9d632614f951ba660f3135ef5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D11549FC90445E1CE90F96A21958A17_C82A74FFB2A57350BAF03147F5C60071
Filesize510B
MD56c2d12f539b8f4e4d980d15803d6dff5
SHA107ada9193b9dcb43d0553e31ba401a73fcdcbeb2
SHA2567e86552c312f05bc0ba07b6cb5be7047862666d7f6eb83878376655629119601
SHA512e09b8d535a6721955b4caa568d2e377324c3ec15049a763ef959328193eb8fde2455ffc2409424d5451d01bb89e08936ad44e20e01562605170d815631b109d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5080DC7A65DB6A5960ECD874088F3328_79CFD3DF2894C4BFDA2ADFD6675FA18B
Filesize404B
MD5d46c9f3bcbb996c65e1cef57013fb309
SHA12b3415be7a89c596f9c0acfdc55db9bba4691a9c
SHA2566a814f15770b76e6463c65c190b20b8ebf294f1d3b2fcf0147520e6e619f278f
SHA5129ca4ad878d6828018cc03661f4dd2bc7dc8ac18feddd85f7ac93c28b40c64080d445c377965a9e88c104bd6e468cd04af09068f05883cb477a266f403d06619a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D11549FC90445E1CE90F96A21958A17_C82A74FFB2A57350BAF03147F5C60071
Filesize396B
MD568200b19802c885953280eb0d39a191b
SHA11211cf525eea92f68820540a380be4449c023c6c
SHA2563ed9f640a3843f62d865103b27ab617aae01d855be7ff7724ed4f9001f0fa7e8
SHA5121f9919aae57d45405d790905c68faa83fdaf9dfc77689a082cfbfd35546cc2d6e0a6eb72ffc29cc58906863e3578eb64e3fb629bdc5d00a5dd245a3564cc0600
-
Filesize
84B
MD57fc5a7b6d84ea69b4630cbd3cf93eead
SHA1a585e4306707a46f768b28626033400f38eaea0e
SHA25637c53da934378c8c6e7f8880911c5fd774722d57105703c58aa17a7bd7299572
SHA512d6c29a51743ce795e3606d827497ca68d5285b605ad08ec28eb87a59ee75358f5fcc3f30808c1e2ccc2c8c3b0e6bd752916c175627ba727e5d43f3bafdf9b7c7
-
Filesize
84B
MD57fc5a7b6d84ea69b4630cbd3cf93eead
SHA1a585e4306707a46f768b28626033400f38eaea0e
SHA25637c53da934378c8c6e7f8880911c5fd774722d57105703c58aa17a7bd7299572
SHA512d6c29a51743ce795e3606d827497ca68d5285b605ad08ec28eb87a59ee75358f5fcc3f30808c1e2ccc2c8c3b0e6bd752916c175627ba727e5d43f3bafdf9b7c7
-
C:\Users\Admin\AppData\Local\AdvinstAnalytics\5cda59d65f3c52452a06a98e\0.11.1.0\{F43C21D0-FDE6-4E4C-BE59-5999AFCC341B}.session
Filesize5KB
MD5fca752e0c51d012062f141c37149c8e6
SHA1904795bc89b6916a50d033922df12317d5d4bb6f
SHA25637c3138fc021470d7413353ada71e79d4e1a41c314b0b6290bc6ba2b8c5c1ee5
SHA5128c9f7e306398e3a25bceb8bdfabe2df519cb399347a484d32a5eadbed62bdb1bceb7418537bef81651823a0da73deb0947c14d2258efa52ff6f679bf74279184
-
C:\Users\Admin\AppData\Local\AdvinstAnalytics\5cda59d65f3c52452a06a98e\0.11.1.0\{F43C21D0-FDE6-4E4C-BE59-5999AFCC341B}.session
Filesize14KB
MD57bf74946610c10a4e831fdff9161a06d
SHA1bdd5f825f1408bc21db30dcfa62272f6fb000292
SHA2562e73d110c54cac528e368c6e9ccf900c94c7afbcacccc90f4e11530423db4115
SHA5127515d0620967cfc73422a08b4081f7f7db46cd9892d0bcd6d92599418661594f3aa83e7995019f0dad14faad9fd7367900d80c61da4a466d22740e91e7ff1ba3
-
Filesize
651B
MD547c6667a0d9d4bdb4e5215578054c0d6
SHA156f494a719ad3cf29723458166d9831719941fa4
SHA256b2526c381832cbe24e8f0d14bb7dbf8e9ab753e087a2f9b7d6b8e36065672355
SHA5127af086ffeee540b70efd190db4b77867356452d2b22904665d6fb53fa0b3749cba6f0613cb96134bed91ba2fa80bf4cced1d8af28679d27f230748fc0d38e5e5
-
Filesize
436KB
MD55788efa607d26332d6d7f5e6a1f6bd6f
SHA1e7749843cc3e89bc81649087de4ad44c93d48bc6
SHA2569fc2608c9e5ef5a88dd91c82660fa297144ba6bbf4602140d638de7233a4625d
SHA512ce472ca4f956da4160cfd9b9051455974e24dd8b23a0b7b197afd1f7552e37980809e523bedc0d4c2f4c9cb6ef300b221e6404e6e6a1b789b67756550ddd2104
-
Filesize
875KB
MD501ab8034f722cbac50b8bcfc36e5b2e8
SHA1b25868af5713e37c398b712f19692edd7db2d858
SHA256e5c41b1af4d865b1b4b09a9fcb99a1f6eb2b2a75b148f4390298aff1ea348689
SHA51225e24e4d691b1fecc6991997ace400682bb812d48374f95a14e21a9045d7905f4630f4672e88b41afd7933b11fb81c10935e49aba337b15924cfc7e814ca2558
-
Filesize
436KB
MD55788efa607d26332d6d7f5e6a1f6bd6f
SHA1e7749843cc3e89bc81649087de4ad44c93d48bc6
SHA2569fc2608c9e5ef5a88dd91c82660fa297144ba6bbf4602140d638de7233a4625d
SHA512ce472ca4f956da4160cfd9b9051455974e24dd8b23a0b7b197afd1f7552e37980809e523bedc0d4c2f4c9cb6ef300b221e6404e6e6a1b789b67756550ddd2104
-
Filesize
436KB
MD55788efa607d26332d6d7f5e6a1f6bd6f
SHA1e7749843cc3e89bc81649087de4ad44c93d48bc6
SHA2569fc2608c9e5ef5a88dd91c82660fa297144ba6bbf4602140d638de7233a4625d
SHA512ce472ca4f956da4160cfd9b9051455974e24dd8b23a0b7b197afd1f7552e37980809e523bedc0d4c2f4c9cb6ef300b221e6404e6e6a1b789b67756550ddd2104
-
Filesize
436KB
MD55788efa607d26332d6d7f5e6a1f6bd6f
SHA1e7749843cc3e89bc81649087de4ad44c93d48bc6
SHA2569fc2608c9e5ef5a88dd91c82660fa297144ba6bbf4602140d638de7233a4625d
SHA512ce472ca4f956da4160cfd9b9051455974e24dd8b23a0b7b197afd1f7552e37980809e523bedc0d4c2f4c9cb6ef300b221e6404e6e6a1b789b67756550ddd2104
-
Filesize
436KB
MD55788efa607d26332d6d7f5e6a1f6bd6f
SHA1e7749843cc3e89bc81649087de4ad44c93d48bc6
SHA2569fc2608c9e5ef5a88dd91c82660fa297144ba6bbf4602140d638de7233a4625d
SHA512ce472ca4f956da4160cfd9b9051455974e24dd8b23a0b7b197afd1f7552e37980809e523bedc0d4c2f4c9cb6ef300b221e6404e6e6a1b789b67756550ddd2104
-
Filesize
777KB
MD50b34f587a33cd91ae3a465aa201544be
SHA17b5e8b8deb034a8830ff85653a467f260c2bd3d2
SHA256ecd63718847708ac207679cf35179b8404975b35b72d3d448c97da423b8cc275
SHA512badbb2f4ea18dd760836ac2d48342957c312e8fefbb99baf9f6bf687556ecc193080d1d00a093a2cd5357c14a03cdaa9b2a4c8cedd92f40fb7558bc14a8afec6
-
Filesize
575KB
MD58c1a778e0754301c97a660dbf3e8303b
SHA1f489c45cde796de0d23ee862948f5e50379dee60
SHA256000b773a448b107cbf3268fea3a0eec388daa71c5f911979c5d21f0cd8d6da54
SHA512010e76ed659f73cc263ce9b2d2635d775b296c10e53ba133fba6aacde02ed409b19f4c4e2ba6df7730ddc8669c818e99773f25854a1916ccf8acf9e459482fea
-
Filesize
875KB
MD501ab8034f722cbac50b8bcfc36e5b2e8
SHA1b25868af5713e37c398b712f19692edd7db2d858
SHA256e5c41b1af4d865b1b4b09a9fcb99a1f6eb2b2a75b148f4390298aff1ea348689
SHA51225e24e4d691b1fecc6991997ace400682bb812d48374f95a14e21a9045d7905f4630f4672e88b41afd7933b11fb81c10935e49aba337b15924cfc7e814ca2558
-
Filesize
777KB
MD50b34f587a33cd91ae3a465aa201544be
SHA17b5e8b8deb034a8830ff85653a467f260c2bd3d2
SHA256ecd63718847708ac207679cf35179b8404975b35b72d3d448c97da423b8cc275
SHA512badbb2f4ea18dd760836ac2d48342957c312e8fefbb99baf9f6bf687556ecc193080d1d00a093a2cd5357c14a03cdaa9b2a4c8cedd92f40fb7558bc14a8afec6
-
Filesize
436KB
MD55788efa607d26332d6d7f5e6a1f6bd6f
SHA1e7749843cc3e89bc81649087de4ad44c93d48bc6
SHA2569fc2608c9e5ef5a88dd91c82660fa297144ba6bbf4602140d638de7233a4625d
SHA512ce472ca4f956da4160cfd9b9051455974e24dd8b23a0b7b197afd1f7552e37980809e523bedc0d4c2f4c9cb6ef300b221e6404e6e6a1b789b67756550ddd2104
-
Filesize
4.8MB
MD524ac212b92e947241dc1b8ff873a2838
SHA1c677d851592ef12f5179abef9088edeea126dbfb
SHA2562969c9c669269600dafaeeb9be810748dc93fd9c808d13b5a6b1762b17ac8c12
SHA512385fde0a29d1f8d6ede4bc0538fcb36d5f5c2ea9721dc59a8134d026ddfafdbb4f3e50d1fdeb97c89148e33b67ba6a7a219b1377c46524fb314d8ecfe6dd3e0c
-
Filesize
4.1MB
MD50d634fd7e55941f7df5f420a72e5d8be
SHA158553abe1ecf9fc726be11e9d82e22d258e3901b
SHA2565b4543e3d6cc322da44834e3dd1892dd6359cc3068d6d5423a7c2372ee42be82
SHA512b9f283fb2e263e4e689b10929947649eaac5af50b6c30ff1f3564a4edad10277fb8de9ad954f93ef970bfb583db479fc81a9a543d22f783d79aade810de2c968
-
Filesize
436KB
MD55788efa607d26332d6d7f5e6a1f6bd6f
SHA1e7749843cc3e89bc81649087de4ad44c93d48bc6
SHA2569fc2608c9e5ef5a88dd91c82660fa297144ba6bbf4602140d638de7233a4625d
SHA512ce472ca4f956da4160cfd9b9051455974e24dd8b23a0b7b197afd1f7552e37980809e523bedc0d4c2f4c9cb6ef300b221e6404e6e6a1b789b67756550ddd2104
-
Filesize
436KB
MD55788efa607d26332d6d7f5e6a1f6bd6f
SHA1e7749843cc3e89bc81649087de4ad44c93d48bc6
SHA2569fc2608c9e5ef5a88dd91c82660fa297144ba6bbf4602140d638de7233a4625d
SHA512ce472ca4f956da4160cfd9b9051455974e24dd8b23a0b7b197afd1f7552e37980809e523bedc0d4c2f4c9cb6ef300b221e6404e6e6a1b789b67756550ddd2104
-
Filesize
575KB
MD58c1a778e0754301c97a660dbf3e8303b
SHA1f489c45cde796de0d23ee862948f5e50379dee60
SHA256000b773a448b107cbf3268fea3a0eec388daa71c5f911979c5d21f0cd8d6da54
SHA512010e76ed659f73cc263ce9b2d2635d775b296c10e53ba133fba6aacde02ed409b19f4c4e2ba6df7730ddc8669c818e99773f25854a1916ccf8acf9e459482fea
-
Filesize
777KB
MD50b34f587a33cd91ae3a465aa201544be
SHA17b5e8b8deb034a8830ff85653a467f260c2bd3d2
SHA256ecd63718847708ac207679cf35179b8404975b35b72d3d448c97da423b8cc275
SHA512badbb2f4ea18dd760836ac2d48342957c312e8fefbb99baf9f6bf687556ecc193080d1d00a093a2cd5357c14a03cdaa9b2a4c8cedd92f40fb7558bc14a8afec6
-
Filesize
436KB
MD55788efa607d26332d6d7f5e6a1f6bd6f
SHA1e7749843cc3e89bc81649087de4ad44c93d48bc6
SHA2569fc2608c9e5ef5a88dd91c82660fa297144ba6bbf4602140d638de7233a4625d
SHA512ce472ca4f956da4160cfd9b9051455974e24dd8b23a0b7b197afd1f7552e37980809e523bedc0d4c2f4c9cb6ef300b221e6404e6e6a1b789b67756550ddd2104
-
Filesize
575KB
MD58c1a778e0754301c97a660dbf3e8303b
SHA1f489c45cde796de0d23ee862948f5e50379dee60
SHA256000b773a448b107cbf3268fea3a0eec388daa71c5f911979c5d21f0cd8d6da54
SHA512010e76ed659f73cc263ce9b2d2635d775b296c10e53ba133fba6aacde02ed409b19f4c4e2ba6df7730ddc8669c818e99773f25854a1916ccf8acf9e459482fea
-
Filesize
777KB
MD50b34f587a33cd91ae3a465aa201544be
SHA17b5e8b8deb034a8830ff85653a467f260c2bd3d2
SHA256ecd63718847708ac207679cf35179b8404975b35b72d3d448c97da423b8cc275
SHA512badbb2f4ea18dd760836ac2d48342957c312e8fefbb99baf9f6bf687556ecc193080d1d00a093a2cd5357c14a03cdaa9b2a4c8cedd92f40fb7558bc14a8afec6
-
Filesize
1.8MB
MD5330f56f3fb5d56ab41d92db847a85e0a
SHA1d5057005281adf24b8b3f6eb469851454e9d000a
SHA256399316fe296f92ef9e7d6d1dc26fbc0b7cf5947fa5eae0e83e629e42c5d00660
SHA512afe4a01d2fb69768bb64b121e5a91a5ae7e38223b21841b228180d4596de654be94b48c247000f28e78b0eb916264f4d1f1f08acb363a21402b4b21848cdb43b
-
Filesize
1.8MB
MD5330f56f3fb5d56ab41d92db847a85e0a
SHA1d5057005281adf24b8b3f6eb469851454e9d000a
SHA256399316fe296f92ef9e7d6d1dc26fbc0b7cf5947fa5eae0e83e629e42c5d00660
SHA512afe4a01d2fb69768bb64b121e5a91a5ae7e38223b21841b228180d4596de654be94b48c247000f28e78b0eb916264f4d1f1f08acb363a21402b4b21848cdb43b
-
Filesize
777KB
MD50b34f587a33cd91ae3a465aa201544be
SHA17b5e8b8deb034a8830ff85653a467f260c2bd3d2
SHA256ecd63718847708ac207679cf35179b8404975b35b72d3d448c97da423b8cc275
SHA512badbb2f4ea18dd760836ac2d48342957c312e8fefbb99baf9f6bf687556ecc193080d1d00a093a2cd5357c14a03cdaa9b2a4c8cedd92f40fb7558bc14a8afec6
-
Filesize
436KB
MD55788efa607d26332d6d7f5e6a1f6bd6f
SHA1e7749843cc3e89bc81649087de4ad44c93d48bc6
SHA2569fc2608c9e5ef5a88dd91c82660fa297144ba6bbf4602140d638de7233a4625d
SHA512ce472ca4f956da4160cfd9b9051455974e24dd8b23a0b7b197afd1f7552e37980809e523bedc0d4c2f4c9cb6ef300b221e6404e6e6a1b789b67756550ddd2104
-
Filesize
875KB
MD501ab8034f722cbac50b8bcfc36e5b2e8
SHA1b25868af5713e37c398b712f19692edd7db2d858
SHA256e5c41b1af4d865b1b4b09a9fcb99a1f6eb2b2a75b148f4390298aff1ea348689
SHA51225e24e4d691b1fecc6991997ace400682bb812d48374f95a14e21a9045d7905f4630f4672e88b41afd7933b11fb81c10935e49aba337b15924cfc7e814ca2558
-
Filesize
436KB
MD55788efa607d26332d6d7f5e6a1f6bd6f
SHA1e7749843cc3e89bc81649087de4ad44c93d48bc6
SHA2569fc2608c9e5ef5a88dd91c82660fa297144ba6bbf4602140d638de7233a4625d
SHA512ce472ca4f956da4160cfd9b9051455974e24dd8b23a0b7b197afd1f7552e37980809e523bedc0d4c2f4c9cb6ef300b221e6404e6e6a1b789b67756550ddd2104
-
Filesize
436KB
MD55788efa607d26332d6d7f5e6a1f6bd6f
SHA1e7749843cc3e89bc81649087de4ad44c93d48bc6
SHA2569fc2608c9e5ef5a88dd91c82660fa297144ba6bbf4602140d638de7233a4625d
SHA512ce472ca4f956da4160cfd9b9051455974e24dd8b23a0b7b197afd1f7552e37980809e523bedc0d4c2f4c9cb6ef300b221e6404e6e6a1b789b67756550ddd2104
-
Filesize
436KB
MD55788efa607d26332d6d7f5e6a1f6bd6f
SHA1e7749843cc3e89bc81649087de4ad44c93d48bc6
SHA2569fc2608c9e5ef5a88dd91c82660fa297144ba6bbf4602140d638de7233a4625d
SHA512ce472ca4f956da4160cfd9b9051455974e24dd8b23a0b7b197afd1f7552e37980809e523bedc0d4c2f4c9cb6ef300b221e6404e6e6a1b789b67756550ddd2104
-
Filesize
436KB
MD55788efa607d26332d6d7f5e6a1f6bd6f
SHA1e7749843cc3e89bc81649087de4ad44c93d48bc6
SHA2569fc2608c9e5ef5a88dd91c82660fa297144ba6bbf4602140d638de7233a4625d
SHA512ce472ca4f956da4160cfd9b9051455974e24dd8b23a0b7b197afd1f7552e37980809e523bedc0d4c2f4c9cb6ef300b221e6404e6e6a1b789b67756550ddd2104
-
Filesize
777KB
MD50b34f587a33cd91ae3a465aa201544be
SHA17b5e8b8deb034a8830ff85653a467f260c2bd3d2
SHA256ecd63718847708ac207679cf35179b8404975b35b72d3d448c97da423b8cc275
SHA512badbb2f4ea18dd760836ac2d48342957c312e8fefbb99baf9f6bf687556ecc193080d1d00a093a2cd5357c14a03cdaa9b2a4c8cedd92f40fb7558bc14a8afec6
-
Filesize
575KB
MD58c1a778e0754301c97a660dbf3e8303b
SHA1f489c45cde796de0d23ee862948f5e50379dee60
SHA256000b773a448b107cbf3268fea3a0eec388daa71c5f911979c5d21f0cd8d6da54
SHA512010e76ed659f73cc263ce9b2d2635d775b296c10e53ba133fba6aacde02ed409b19f4c4e2ba6df7730ddc8669c818e99773f25854a1916ccf8acf9e459482fea
-
Filesize
875KB
MD501ab8034f722cbac50b8bcfc36e5b2e8
SHA1b25868af5713e37c398b712f19692edd7db2d858
SHA256e5c41b1af4d865b1b4b09a9fcb99a1f6eb2b2a75b148f4390298aff1ea348689
SHA51225e24e4d691b1fecc6991997ace400682bb812d48374f95a14e21a9045d7905f4630f4672e88b41afd7933b11fb81c10935e49aba337b15924cfc7e814ca2558
-
Filesize
777KB
MD50b34f587a33cd91ae3a465aa201544be
SHA17b5e8b8deb034a8830ff85653a467f260c2bd3d2
SHA256ecd63718847708ac207679cf35179b8404975b35b72d3d448c97da423b8cc275
SHA512badbb2f4ea18dd760836ac2d48342957c312e8fefbb99baf9f6bf687556ecc193080d1d00a093a2cd5357c14a03cdaa9b2a4c8cedd92f40fb7558bc14a8afec6
-
Filesize
436KB
MD55788efa607d26332d6d7f5e6a1f6bd6f
SHA1e7749843cc3e89bc81649087de4ad44c93d48bc6
SHA2569fc2608c9e5ef5a88dd91c82660fa297144ba6bbf4602140d638de7233a4625d
SHA512ce472ca4f956da4160cfd9b9051455974e24dd8b23a0b7b197afd1f7552e37980809e523bedc0d4c2f4c9cb6ef300b221e6404e6e6a1b789b67756550ddd2104
-
Filesize
436KB
MD55788efa607d26332d6d7f5e6a1f6bd6f
SHA1e7749843cc3e89bc81649087de4ad44c93d48bc6
SHA2569fc2608c9e5ef5a88dd91c82660fa297144ba6bbf4602140d638de7233a4625d
SHA512ce472ca4f956da4160cfd9b9051455974e24dd8b23a0b7b197afd1f7552e37980809e523bedc0d4c2f4c9cb6ef300b221e6404e6e6a1b789b67756550ddd2104
-
Filesize
436KB
MD55788efa607d26332d6d7f5e6a1f6bd6f
SHA1e7749843cc3e89bc81649087de4ad44c93d48bc6
SHA2569fc2608c9e5ef5a88dd91c82660fa297144ba6bbf4602140d638de7233a4625d
SHA512ce472ca4f956da4160cfd9b9051455974e24dd8b23a0b7b197afd1f7552e37980809e523bedc0d4c2f4c9cb6ef300b221e6404e6e6a1b789b67756550ddd2104
-
Filesize
575KB
MD58c1a778e0754301c97a660dbf3e8303b
SHA1f489c45cde796de0d23ee862948f5e50379dee60
SHA256000b773a448b107cbf3268fea3a0eec388daa71c5f911979c5d21f0cd8d6da54
SHA512010e76ed659f73cc263ce9b2d2635d775b296c10e53ba133fba6aacde02ed409b19f4c4e2ba6df7730ddc8669c818e99773f25854a1916ccf8acf9e459482fea
-
Filesize
777KB
MD50b34f587a33cd91ae3a465aa201544be
SHA17b5e8b8deb034a8830ff85653a467f260c2bd3d2
SHA256ecd63718847708ac207679cf35179b8404975b35b72d3d448c97da423b8cc275
SHA512badbb2f4ea18dd760836ac2d48342957c312e8fefbb99baf9f6bf687556ecc193080d1d00a093a2cd5357c14a03cdaa9b2a4c8cedd92f40fb7558bc14a8afec6
-
Filesize
436KB
MD55788efa607d26332d6d7f5e6a1f6bd6f
SHA1e7749843cc3e89bc81649087de4ad44c93d48bc6
SHA2569fc2608c9e5ef5a88dd91c82660fa297144ba6bbf4602140d638de7233a4625d
SHA512ce472ca4f956da4160cfd9b9051455974e24dd8b23a0b7b197afd1f7552e37980809e523bedc0d4c2f4c9cb6ef300b221e6404e6e6a1b789b67756550ddd2104
-
Filesize
575KB
MD58c1a778e0754301c97a660dbf3e8303b
SHA1f489c45cde796de0d23ee862948f5e50379dee60
SHA256000b773a448b107cbf3268fea3a0eec388daa71c5f911979c5d21f0cd8d6da54
SHA512010e76ed659f73cc263ce9b2d2635d775b296c10e53ba133fba6aacde02ed409b19f4c4e2ba6df7730ddc8669c818e99773f25854a1916ccf8acf9e459482fea
-
Filesize
777KB
MD50b34f587a33cd91ae3a465aa201544be
SHA17b5e8b8deb034a8830ff85653a467f260c2bd3d2
SHA256ecd63718847708ac207679cf35179b8404975b35b72d3d448c97da423b8cc275
SHA512badbb2f4ea18dd760836ac2d48342957c312e8fefbb99baf9f6bf687556ecc193080d1d00a093a2cd5357c14a03cdaa9b2a4c8cedd92f40fb7558bc14a8afec6
-
Filesize
1.8MB
MD5330f56f3fb5d56ab41d92db847a85e0a
SHA1d5057005281adf24b8b3f6eb469851454e9d000a
SHA256399316fe296f92ef9e7d6d1dc26fbc0b7cf5947fa5eae0e83e629e42c5d00660
SHA512afe4a01d2fb69768bb64b121e5a91a5ae7e38223b21841b228180d4596de654be94b48c247000f28e78b0eb916264f4d1f1f08acb363a21402b4b21848cdb43b
-
Filesize
1.8MB
MD5330f56f3fb5d56ab41d92db847a85e0a
SHA1d5057005281adf24b8b3f6eb469851454e9d000a
SHA256399316fe296f92ef9e7d6d1dc26fbc0b7cf5947fa5eae0e83e629e42c5d00660
SHA512afe4a01d2fb69768bb64b121e5a91a5ae7e38223b21841b228180d4596de654be94b48c247000f28e78b0eb916264f4d1f1f08acb363a21402b4b21848cdb43b
-
Filesize
9KB
MD5b955fac391971547d01ba7c761405fb2
SHA1faca86fd994d658fa55ef3e91c585d2440cc34a5
SHA256b390ab45655ab0e38930013218476fe54735dbd321147e821e0d639f59cf0693
SHA5120d776782fba137e49216f5aa635b8a5809b615417a40eea3d5acfa56ecf919d655591555a8d147df87440abcf27d065c052df6ad3d6f6a144c490648e46bea91
-
Filesize
9KB
MD5b955fac391971547d01ba7c761405fb2
SHA1faca86fd994d658fa55ef3e91c585d2440cc34a5
SHA256b390ab45655ab0e38930013218476fe54735dbd321147e821e0d639f59cf0693
SHA5120d776782fba137e49216f5aa635b8a5809b615417a40eea3d5acfa56ecf919d655591555a8d147df87440abcf27d065c052df6ad3d6f6a144c490648e46bea91
-
Filesize
179KB
MD51a5caea6734fdd07caa514c3f3fb75da
SHA1f070ac0d91bd337d7952abd1ddf19a737b94510c
SHA256cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca
SHA512a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1
-
Filesize
179KB
MD51a5caea6734fdd07caa514c3f3fb75da
SHA1f070ac0d91bd337d7952abd1ddf19a737b94510c
SHA256cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca
SHA512a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1
-
Filesize
1.8MB
MD5330f56f3fb5d56ab41d92db847a85e0a
SHA1d5057005281adf24b8b3f6eb469851454e9d000a
SHA256399316fe296f92ef9e7d6d1dc26fbc0b7cf5947fa5eae0e83e629e42c5d00660
SHA512afe4a01d2fb69768bb64b121e5a91a5ae7e38223b21841b228180d4596de654be94b48c247000f28e78b0eb916264f4d1f1f08acb363a21402b4b21848cdb43b
-
Filesize
1.8MB
MD5330f56f3fb5d56ab41d92db847a85e0a
SHA1d5057005281adf24b8b3f6eb469851454e9d000a
SHA256399316fe296f92ef9e7d6d1dc26fbc0b7cf5947fa5eae0e83e629e42c5d00660
SHA512afe4a01d2fb69768bb64b121e5a91a5ae7e38223b21841b228180d4596de654be94b48c247000f28e78b0eb916264f4d1f1f08acb363a21402b4b21848cdb43b
-
Filesize
9KB
MD5b955fac391971547d01ba7c761405fb2
SHA1faca86fd994d658fa55ef3e91c585d2440cc34a5
SHA256b390ab45655ab0e38930013218476fe54735dbd321147e821e0d639f59cf0693
SHA5120d776782fba137e49216f5aa635b8a5809b615417a40eea3d5acfa56ecf919d655591555a8d147df87440abcf27d065c052df6ad3d6f6a144c490648e46bea91
-
Filesize
9KB
MD5b955fac391971547d01ba7c761405fb2
SHA1faca86fd994d658fa55ef3e91c585d2440cc34a5
SHA256b390ab45655ab0e38930013218476fe54735dbd321147e821e0d639f59cf0693
SHA5120d776782fba137e49216f5aa635b8a5809b615417a40eea3d5acfa56ecf919d655591555a8d147df87440abcf27d065c052df6ad3d6f6a144c490648e46bea91
-
Filesize
179KB
MD51a5caea6734fdd07caa514c3f3fb75da
SHA1f070ac0d91bd337d7952abd1ddf19a737b94510c
SHA256cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca
SHA512a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1
-
Filesize
179KB
MD51a5caea6734fdd07caa514c3f3fb75da
SHA1f070ac0d91bd337d7952abd1ddf19a737b94510c
SHA256cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca
SHA512a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1