hxxps://skygo[.]sky[.]it/installer/SkyGoInstaller[.]exe

Resubmissions

13/05/2024, 15:39

240513-s3p6bacd6z 8

Analysis

max time kernel
172s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
13/05/2024, 15:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://skygo.sky.it/installer/SkyGoInstaller.exe

Score

8^/10

discovery execution

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 9 IoCs

pid	Process
1764	SkyGoInstaller.exe
3980	SkyGoInstaller.exe
552	SkyGoInstaller.tmp
2372	SkyGoInstaller.tmp
1460	Sky Go.exe
1220	Sky Go.exe
4148	Sky Go.exe
4208	Sky Go.exe
5540	Sky Go.exe

Loads dropped DLL 44 IoCs

pid	Process
1460	Sky Go.exe
1460	Sky Go.exe
1460	Sky Go.exe
1460	Sky Go.exe
1460	Sky Go.exe
1460	Sky Go.exe
1460	Sky Go.exe
1220	Sky Go.exe
1220	Sky Go.exe
1220	Sky Go.exe
1220	Sky Go.exe
1220	Sky Go.exe
1220	Sky Go.exe
1220	Sky Go.exe
1220	Sky Go.exe
1220	Sky Go.exe
1220	Sky Go.exe
1220	Sky Go.exe
1220	Sky Go.exe
1220	Sky Go.exe
1220	Sky Go.exe
1220	Sky Go.exe
1220	Sky Go.exe
1220	Sky Go.exe
4148	Sky Go.exe
4148	Sky Go.exe
4148	Sky Go.exe
4148	Sky Go.exe
4148	Sky Go.exe
4148	Sky Go.exe
4148	Sky Go.exe
4208	Sky Go.exe
4208	Sky Go.exe
4208	Sky Go.exe
4208	Sky Go.exe
1220	Sky Go.exe
1220	Sky Go.exe
1220	Sky Go.exe
1220	Sky Go.exe
1220	Sky Go.exe
5540	Sky Go.exe
5540	Sky Go.exe
5540	Sky Go.exe
5540	Sky Go.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4988	powershell.exe
2760	powershell.exe
472	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133600883655124952"	chrome.exe

Modifies registry class 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\skygo\shell	SkyGoInstaller.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\skygo\URL Protocol	Sky Go.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\skygo\shell\open	SkyGoInstaller.tmp
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\skygo\shell\open\command	SkyGoInstaller.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\skygo\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Roaming\\Sky\\Sky Go\\Sky Go.exe %1"	SkyGoInstaller.tmp
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\skygo\shell\open\command	Sky Go.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\skygo	SkyGoInstaller.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\skygo\URL Protocol	SkyGoInstaller.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\skygo\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Roaming\\Sky\\Sky Go\\Sky Go.exe %1"	SkyGoInstaller.tmp
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\skygo	SkyGoInstaller.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\skygo\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Sky\\Sky Go\\Sky Go.exe\" \"%1\""	Sky Go.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3571316656-3665257725-2415531812-1000\{291A7373-5E2B-4647-BCD2-020DDD62CF9C}	Sky Go.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\skygo\shell\open\command	SkyGoInstaller.tmp
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\skygo\shell	SkyGoInstaller.tmp
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\skygo	Sky Go.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\skygo\ = "URL:skygo"	Sky Go.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\skygo\shell\open	SkyGoInstaller.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\skygo\URL Protocol	SkyGoInstaller.tmp

Modifies system certificate store 2 TTPs 32 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD	Sky Go.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	Sky Go.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C	Sky Go.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB	Sky Go.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB\Blob = 040000000100000010000000866912c070f1ecacacc2d5bca55ba1290f0000000100000020000000489ff6233f3d3c5da77604be230745657fe488cb05257da551bfd64c1f179e720b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079002000520053004100000009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b0601050507030862000000010000002000000085666a562ee0be5ce925c1d8890a6f76a87ec16d4d7d5f29ea7419cf20123b69140000000100000014000000dd040907a2f57a7d5253129295ee3880250da6591d00000001000000100000000d48ee33d7f1af8f4b002527f82a344a030000000100000014000000b7ab3308d1ea4477ba1480125a6fbda936490cbb190000000100000010000000787d09f953c59978ecd8d6e44b38e24f2000000001000000e1050000308205dd308203c5a00302010202087b2c9bd316803299300d06092a864886f70d01010b0500307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920525341301e170d3136303231323137333933395a170d3431303231323137333933395a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f726974792052534130820222300d06092a864886f70d01010105000382020f003082020a0282020100f90fdda32b7dcbd02afeec6785a6e72e1bba77e1e3f5afa4ecfa4a5d91c457476b18776b76f2fd93e43d0fc2169e0b66c356949e178385ce56eff216fd0062f5220954e865174e41b9e04f4697aa1bc8b86e625e69b15fdb2a027efc6ccaf341d8edd0e8fc3f6148edb003141d100e4b19e0bb4eec8665ff36f35e67020b9d865561fd7a38edfee21900b76fa1506275743ca0fac82592b46e7a22c7f81ea1e3b2dd9131ab2b1d04ffa54a0437e985a4332bfde2d655347c19a44a68c7b2a8d3b7caa19388ebc197bc8cf91dd922842474c7043d6aa92993ccebb85be1fe5f25aa3458c8c123549d1b9811c3389c7e3d866ca50f40867c02f45c024f28cbae719f0f3ac833fe112535eafcbac5603dd97c18d5b2a9d37578037222ca3ac31fef2ce52ea9fa9e2cb65146fdaf03d6ea6068ea8516366b85e91ec0b3ddc424dc802a81416d943ec8e0c98141009e5ebf7fc50898a2182c4240b3f96f38274b4e80f43d8147e0887cea1cceb5755c512e1c2b7f1a7228e700b5d174c6d7e49fad0793b6533535fc37e4c3f65d16be2173de920af8a0636abc96926a3ef8bc65559bdef50d892604fc251aa62569cbc26dca7ce2595f97acebef2ec8bcd71b593c2bccf219c8936b276319cffce926f8ca719b7f93fe3467844e99ebfcb378093370ba66a676ed1b73eb1aa50dc422132094560a4e2c6c4eb1fdcf9c09baa233ed870203010001a3633061301d0603551d0e04160414dd040907a2f57a7d5253129295ee3880250da659300f0603551d130101ff040530030101ff301f0603551d23041830168014dd040907a2f57a7d5253129295ee3880250da659300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201002018119429fb269d1c1e1e7061f19572937124ad6893588e32af1bb37003fc252b7485903d786af4b98ba5973bb51891bb1ea7f9405b91f95599af1e11d05c1da766e3b194070c3239a6ea1bb079d81d9c7044e38addc4f9951f8a38433f0185a547a73d46b2bce52268f77b9cd82c3e0a21c82d33acbfc581993174c17571c5beb1f02345f49d6bfc19639da3bc04c6180b25bb53890fb38050de45ee447fab94786498d3f628dd87d8706574fb0eb913eba70f61a93296ccdebbed634c18bba940f7a0546e2088717518ea7ab43472e02327775cb690ea862540abef330fcb9f82bea220fbf6b52d1ae6c285b1740ffbc86502a4520147dd4922c1bfd8eb6bac7edeec633315b723088fc60f8d415add8ec5b98fe5453f78dbbad21b40b1fe714d3fe081a2ba5eb4ec15e093dd081f7ee155990b21de939e0afbe6a349bd3630fee777b2a07597b52d8188176520f7da90009fc952cc32ca357cf53d0fd82bd7f5266cc906349616ea70591a3279790bb6887f0f52483dbf6cd8a2442ed14eb77258d3891395fe44abf8d78b1b6e9cbc2ca05bd56a00af5f37e1d5fa100b989c86e7268fcef0ec6e8a570b80e34eb2c0a0636190ba556837746ab692db9fa18622b665270eecb69f4260e467c2b5da410bc4d38b611bbcfa1f912bd744075eba29acd9c5e9ef53485aeb80f1285821cdb00655fb273f539070a9041e5727b9	Sky Go.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	Sky Go.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Sky Go.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Sky Go.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 5c000000010000000400000000080000190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0282000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	Sky Go.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 5c0000000100000004000000000800001900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1368000000010000000800000000409120d035d9017e000000010000000800000000c001b39667d6017f000000010000000e000000300c060a2b0601040182370a03041d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589100b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000006200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd6770739090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d040000000100000010000000410352dc0ff7501b16f0028eba6f45c520000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	Sky Go.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB\Blob = 0f0000000100000020000000489ff6233f3d3c5da77604be230745657fe488cb05257da551bfd64c1f179e720b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079002000520053004100000009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b0601050507030862000000010000002000000085666a562ee0be5ce925c1d8890a6f76a87ec16d4d7d5f29ea7419cf20123b69140000000100000014000000dd040907a2f57a7d5253129295ee3880250da6591d00000001000000100000000d48ee33d7f1af8f4b002527f82a344a030000000100000014000000b7ab3308d1ea4477ba1480125a6fbda936490cbb2000000001000000e1050000308205dd308203c5a00302010202087b2c9bd316803299300d06092a864886f70d01010b0500307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920525341301e170d3136303231323137333933395a170d3431303231323137333933395a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f726974792052534130820222300d06092a864886f70d01010105000382020f003082020a0282020100f90fdda32b7dcbd02afeec6785a6e72e1bba77e1e3f5afa4ecfa4a5d91c457476b18776b76f2fd93e43d0fc2169e0b66c356949e178385ce56eff216fd0062f5220954e865174e41b9e04f4697aa1bc8b86e625e69b15fdb2a027efc6ccaf341d8edd0e8fc3f6148edb003141d100e4b19e0bb4eec8665ff36f35e67020b9d865561fd7a38edfee21900b76fa1506275743ca0fac82592b46e7a22c7f81ea1e3b2dd9131ab2b1d04ffa54a0437e985a4332bfde2d655347c19a44a68c7b2a8d3b7caa19388ebc197bc8cf91dd922842474c7043d6aa92993ccebb85be1fe5f25aa3458c8c123549d1b9811c3389c7e3d866ca50f40867c02f45c024f28cbae719f0f3ac833fe112535eafcbac5603dd97c18d5b2a9d37578037222ca3ac31fef2ce52ea9fa9e2cb65146fdaf03d6ea6068ea8516366b85e91ec0b3ddc424dc802a81416d943ec8e0c98141009e5ebf7fc50898a2182c4240b3f96f38274b4e80f43d8147e0887cea1cceb5755c512e1c2b7f1a7228e700b5d174c6d7e49fad0793b6533535fc37e4c3f65d16be2173de920af8a0636abc96926a3ef8bc65559bdef50d892604fc251aa62569cbc26dca7ce2595f97acebef2ec8bcd71b593c2bccf219c8936b276319cffce926f8ca719b7f93fe3467844e99ebfcb378093370ba66a676ed1b73eb1aa50dc422132094560a4e2c6c4eb1fdcf9c09baa233ed870203010001a3633061301d0603551d0e04160414dd040907a2f57a7d5253129295ee3880250da659300f0603551d130101ff040530030101ff301f0603551d23041830168014dd040907a2f57a7d5253129295ee3880250da659300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201002018119429fb269d1c1e1e7061f19572937124ad6893588e32af1bb37003fc252b7485903d786af4b98ba5973bb51891bb1ea7f9405b91f95599af1e11d05c1da766e3b194070c3239a6ea1bb079d81d9c7044e38addc4f9951f8a38433f0185a547a73d46b2bce52268f77b9cd82c3e0a21c82d33acbfc581993174c17571c5beb1f02345f49d6bfc19639da3bc04c6180b25bb53890fb38050de45ee447fab94786498d3f628dd87d8706574fb0eb913eba70f61a93296ccdebbed634c18bba940f7a0546e2088717518ea7ab43472e02327775cb690ea862540abef330fcb9f82bea220fbf6b52d1ae6c285b1740ffbc86502a4520147dd4922c1bfd8eb6bac7edeec633315b723088fc60f8d415add8ec5b98fe5453f78dbbad21b40b1fe714d3fe081a2ba5eb4ec15e093dd081f7ee155990b21de939e0afbe6a349bd3630fee777b2a07597b52d8188176520f7da90009fc952cc32ca357cf53d0fd82bd7f5266cc906349616ea70591a3279790bb6887f0f52483dbf6cd8a2442ed14eb77258d3891395fe44abf8d78b1b6e9cbc2ca05bd56a00af5f37e1d5fa100b989c86e7268fcef0ec6e8a570b80e34eb2c0a0636190ba556837746ab692db9fa18622b665270eecb69f4260e467c2b5da410bc4d38b611bbcfa1f912bd744075eba29acd9c5e9ef53485aeb80f1285821cdb00655fb273f539070a9041e5727b9	Sky Go.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB\Blob = 5c000000010000000400000000100000190000000100000010000000787d09f953c59978ecd8d6e44b38e24f030000000100000014000000b7ab3308d1ea4477ba1480125a6fbda936490cbb1d00000001000000100000000d48ee33d7f1af8f4b002527f82a344a140000000100000014000000dd040907a2f57a7d5253129295ee3880250da65962000000010000002000000085666a562ee0be5ce925c1d8890a6f76a87ec16d4d7d5f29ea7419cf20123b6909000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900200052005300410000000f0000000100000020000000489ff6233f3d3c5da77604be230745657fe488cb05257da551bfd64c1f179e72040000000100000010000000866912c070f1ecacacc2d5bca55ba1292000000001000000e1050000308205dd308203c5a00302010202087b2c9bd316803299300d06092a864886f70d01010b0500307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920525341301e170d3136303231323137333933395a170d3431303231323137333933395a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f726974792052534130820222300d06092a864886f70d01010105000382020f003082020a0282020100f90fdda32b7dcbd02afeec6785a6e72e1bba77e1e3f5afa4ecfa4a5d91c457476b18776b76f2fd93e43d0fc2169e0b66c356949e178385ce56eff216fd0062f5220954e865174e41b9e04f4697aa1bc8b86e625e69b15fdb2a027efc6ccaf341d8edd0e8fc3f6148edb003141d100e4b19e0bb4eec8665ff36f35e67020b9d865561fd7a38edfee21900b76fa1506275743ca0fac82592b46e7a22c7f81ea1e3b2dd9131ab2b1d04ffa54a0437e985a4332bfde2d655347c19a44a68c7b2a8d3b7caa19388ebc197bc8cf91dd922842474c7043d6aa92993ccebb85be1fe5f25aa3458c8c123549d1b9811c3389c7e3d866ca50f40867c02f45c024f28cbae719f0f3ac833fe112535eafcbac5603dd97c18d5b2a9d37578037222ca3ac31fef2ce52ea9fa9e2cb65146fdaf03d6ea6068ea8516366b85e91ec0b3ddc424dc802a81416d943ec8e0c98141009e5ebf7fc50898a2182c4240b3f96f38274b4e80f43d8147e0887cea1cceb5755c512e1c2b7f1a7228e700b5d174c6d7e49fad0793b6533535fc37e4c3f65d16be2173de920af8a0636abc96926a3ef8bc65559bdef50d892604fc251aa62569cbc26dca7ce2595f97acebef2ec8bcd71b593c2bccf219c8936b276319cffce926f8ca719b7f93fe3467844e99ebfcb378093370ba66a676ed1b73eb1aa50dc422132094560a4e2c6c4eb1fdcf9c09baa233ed870203010001a3633061301d0603551d0e04160414dd040907a2f57a7d5253129295ee3880250da659300f0603551d130101ff040530030101ff301f0603551d23041830168014dd040907a2f57a7d5253129295ee3880250da659300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201002018119429fb269d1c1e1e7061f19572937124ad6893588e32af1bb37003fc252b7485903d786af4b98ba5973bb51891bb1ea7f9405b91f95599af1e11d05c1da766e3b194070c3239a6ea1bb079d81d9c7044e38addc4f9951f8a38433f0185a547a73d46b2bce52268f77b9cd82c3e0a21c82d33acbfc581993174c17571c5beb1f02345f49d6bfc19639da3bc04c6180b25bb53890fb38050de45ee447fab94786498d3f628dd87d8706574fb0eb913eba70f61a93296ccdebbed634c18bba940f7a0546e2088717518ea7ab43472e02327775cb690ea862540abef330fcb9f82bea220fbf6b52d1ae6c285b1740ffbc86502a4520147dd4922c1bfd8eb6bac7edeec633315b723088fc60f8d415add8ec5b98fe5453f78dbbad21b40b1fe714d3fe081a2ba5eb4ec15e093dd081f7ee155990b21de939e0afbe6a349bd3630fee777b2a07597b52d8188176520f7da90009fc952cc32ca357cf53d0fd82bd7f5266cc906349616ea70591a3279790bb6887f0f52483dbf6cd8a2442ed14eb77258d3891395fe44abf8d78b1b6e9cbc2ca05bd56a00af5f37e1d5fa100b989c86e7268fcef0ec6e8a570b80e34eb2c0a0636190ba556837746ab692db9fa18622b665270eecb69f4260e467c2b5da410bc4d38b611bbcfa1f912bd744075eba29acd9c5e9ef53485aeb80f1285821cdb00655fb273f539070a9041e5727b9	Sky Go.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1368000000010000000800000000409120d035d9017e000000010000000800000000c001b39667d6017f000000010000000e000000300c060a2b0601040182370a03041d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589100b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000006200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd6770739090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	Sky Go.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	Sky Go.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	Sky Go.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b9992367f000000010000000c000000300a06082b060105050703097a000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d501030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	Sky Go.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb040000000100000010000000285ec909c4ab0d2d57f5086b225799aa0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf9190000000100000010000000ea6089055218053dd01e37e1d806eedf5c0000000100000004000000001000001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa25900000001000000160000005200530041002f0053004800410033003800340000004b0000000100000044000000420032004600410046003700360039003200460044003900460046004200440036003400450044004500330031003700450034003200330033003400420041005f0000002000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95	Sky Go.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	Sky Go.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	Sky Go.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	Sky Go.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0280f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	Sky Go.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Sky Go.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 5c000000010000000400000000080000190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e76200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e650040000000100000010000000324a4bbbc863699bbe749ac6dd1d46242000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	Sky Go.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	Sky Go.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Sky Go.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Sky Go.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Sky Go.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd67707390b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b660537f000000010000000e000000300c060a2b0601040182370a03047e000000010000000800000000c001b39667d60168000000010000000800000000409120d035d901030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	Sky Go.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd67707390b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b660537f000000010000000e000000300c060a2b0601040182370a03047e000000010000000800000000c001b39667d60168000000010000000800000000409120d035d901030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	Sky Go.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 5c000000010000000400000000080000190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c7e00000001000000080000000000042beb77d5017a000000010000000c000000300a06082b060105050703097f000000010000000c000000300a06082b060105050703091d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c990b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703080f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	Sky Go.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB\Blob = 190000000100000010000000787d09f953c59978ecd8d6e44b38e24f030000000100000014000000b7ab3308d1ea4477ba1480125a6fbda936490cbb1d00000001000000100000000d48ee33d7f1af8f4b002527f82a344a140000000100000014000000dd040907a2f57a7d5253129295ee3880250da65962000000010000002000000085666a562ee0be5ce925c1d8890a6f76a87ec16d4d7d5f29ea7419cf20123b6909000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900200052005300410000000f0000000100000020000000489ff6233f3d3c5da77604be230745657fe488cb05257da551bfd64c1f179e722000000001000000e1050000308205dd308203c5a00302010202087b2c9bd316803299300d06092a864886f70d01010b0500307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920525341301e170d3136303231323137333933395a170d3431303231323137333933395a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f726974792052534130820222300d06092a864886f70d01010105000382020f003082020a0282020100f90fdda32b7dcbd02afeec6785a6e72e1bba77e1e3f5afa4ecfa4a5d91c457476b18776b76f2fd93e43d0fc2169e0b66c356949e178385ce56eff216fd0062f5220954e865174e41b9e04f4697aa1bc8b86e625e69b15fdb2a027efc6ccaf341d8edd0e8fc3f6148edb003141d100e4b19e0bb4eec8665ff36f35e67020b9d865561fd7a38edfee21900b76fa1506275743ca0fac82592b46e7a22c7f81ea1e3b2dd9131ab2b1d04ffa54a0437e985a4332bfde2d655347c19a44a68c7b2a8d3b7caa19388ebc197bc8cf91dd922842474c7043d6aa92993ccebb85be1fe5f25aa3458c8c123549d1b9811c3389c7e3d866ca50f40867c02f45c024f28cbae719f0f3ac833fe112535eafcbac5603dd97c18d5b2a9d37578037222ca3ac31fef2ce52ea9fa9e2cb65146fdaf03d6ea6068ea8516366b85e91ec0b3ddc424dc802a81416d943ec8e0c98141009e5ebf7fc50898a2182c4240b3f96f38274b4e80f43d8147e0887cea1cceb5755c512e1c2b7f1a7228e700b5d174c6d7e49fad0793b6533535fc37e4c3f65d16be2173de920af8a0636abc96926a3ef8bc65559bdef50d892604fc251aa62569cbc26dca7ce2595f97acebef2ec8bcd71b593c2bccf219c8936b276319cffce926f8ca719b7f93fe3467844e99ebfcb378093370ba66a676ed1b73eb1aa50dc422132094560a4e2c6c4eb1fdcf9c09baa233ed870203010001a3633061301d0603551d0e04160414dd040907a2f57a7d5253129295ee3880250da659300f0603551d130101ff040530030101ff301f0603551d23041830168014dd040907a2f57a7d5253129295ee3880250da659300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201002018119429fb269d1c1e1e7061f19572937124ad6893588e32af1bb37003fc252b7485903d786af4b98ba5973bb51891bb1ea7f9405b91f95599af1e11d05c1da766e3b194070c3239a6ea1bb079d81d9c7044e38addc4f9951f8a38433f0185a547a73d46b2bce52268f77b9cd82c3e0a21c82d33acbfc581993174c17571c5beb1f02345f49d6bfc19639da3bc04c6180b25bb53890fb38050de45ee447fab94786498d3f628dd87d8706574fb0eb913eba70f61a93296ccdebbed634c18bba940f7a0546e2088717518ea7ab43472e02327775cb690ea862540abef330fcb9f82bea220fbf6b52d1ae6c285b1740ffbc86502a4520147dd4922c1bfd8eb6bac7edeec633315b723088fc60f8d415add8ec5b98fe5453f78dbbad21b40b1fe714d3fe081a2ba5eb4ec15e093dd081f7ee155990b21de939e0afbe6a349bd3630fee777b2a07597b52d8188176520f7da90009fc952cc32ca357cf53d0fd82bd7f5266cc906349616ea70591a3279790bb6887f0f52483dbf6cd8a2442ed14eb77258d3891395fe44abf8d78b1b6e9cbc2ca05bd56a00af5f37e1d5fa100b989c86e7268fcef0ec6e8a570b80e34eb2c0a0636190ba556837746ab692db9fa18622b665270eecb69f4260e467c2b5da410bc4d38b611bbcfa1f912bd744075eba29acd9c5e9ef53485aeb80f1285821cdb00655fb273f539070a9041e5727b9	Sky Go.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Sky Go.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
4556	chrome.exe
4556	chrome.exe
2372	SkyGoInstaller.tmp
2372	SkyGoInstaller.tmp
552	SkyGoInstaller.tmp
552	SkyGoInstaller.tmp
552	SkyGoInstaller.tmp
552	SkyGoInstaller.tmp
552	SkyGoInstaller.tmp
552	SkyGoInstaller.tmp
552	SkyGoInstaller.tmp
552	SkyGoInstaller.tmp
552	SkyGoInstaller.tmp
552	SkyGoInstaller.tmp
1220	Sky Go.exe
1220	Sky Go.exe
4988	powershell.exe
4988	powershell.exe
2760	powershell.exe
2760	powershell.exe
2760	powershell.exe
4988	powershell.exe
3840	chrome.exe
3840	chrome.exe
472	powershell.exe
472	powershell.exe
472	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
2372	SkyGoInstaller.tmp
552	SkyGoInstaller.tmp
4556	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 4328	4556	chrome.exe	83
PID 4556 wrote to memory of 4328	4556	chrome.exe	83
PID 4556 wrote to memory of 1884	4556	chrome.exe	84
PID 4556 wrote to memory of 1884	4556	chrome.exe	84
PID 4556 wrote to memory of 1884	4556	chrome.exe	84
PID 4556 wrote to memory of 1884	4556	chrome.exe	84
PID 4556 wrote to memory of 1884	4556	chrome.exe	84
PID 4556 wrote to memory of 1884	4556	chrome.exe	84
PID 4556 wrote to memory of 1884	4556	chrome.exe	84
PID 4556 wrote to memory of 1884	4556	chrome.exe	84
PID 4556 wrote to memory of 1884	4556	chrome.exe	84
PID 4556 wrote to memory of 1884	4556	chrome.exe	84
PID 4556 wrote to memory of 1884	4556	chrome.exe	84
PID 4556 wrote to memory of 1884	4556	chrome.exe	84
PID 4556 wrote to memory of 1884	4556	chrome.exe	84
PID 4556 wrote to memory of 1884	4556	chrome.exe	84
PID 4556 wrote to memory of 1884	4556	chrome.exe	84
PID 4556 wrote to memory of 1884	4556	chrome.exe	84
PID 4556 wrote to memory of 1884	4556	chrome.exe	84
PID 4556 wrote to memory of 1884	4556	chrome.exe	84
PID 4556 wrote to memory of 1884	4556	chrome.exe	84
PID 4556 wrote to memory of 1884	4556	chrome.exe	84
PID 4556 wrote to memory of 1884	4556	chrome.exe	84
PID 4556 wrote to memory of 1884	4556	chrome.exe	84
PID 4556 wrote to memory of 1884	4556	chrome.exe	84
PID 4556 wrote to memory of 1884	4556	chrome.exe	84
PID 4556 wrote to memory of 1884	4556	chrome.exe	84
PID 4556 wrote to memory of 1884	4556	chrome.exe	84
PID 4556 wrote to memory of 1884	4556	chrome.exe	84
PID 4556 wrote to memory of 1884	4556	chrome.exe	84
PID 4556 wrote to memory of 1884	4556	chrome.exe	84
PID 4556 wrote to memory of 1884	4556	chrome.exe	84
PID 4556 wrote to memory of 1884	4556	chrome.exe	84
PID 4556 wrote to memory of 1604	4556	chrome.exe	85
PID 4556 wrote to memory of 1604	4556	chrome.exe	85
PID 4556 wrote to memory of 392	4556	chrome.exe	86
PID 4556 wrote to memory of 392	4556	chrome.exe	86
PID 4556 wrote to memory of 392	4556	chrome.exe	86
PID 4556 wrote to memory of 392	4556	chrome.exe	86
PID 4556 wrote to memory of 392	4556	chrome.exe	86
PID 4556 wrote to memory of 392	4556	chrome.exe	86
PID 4556 wrote to memory of 392	4556	chrome.exe	86
PID 4556 wrote to memory of 392	4556	chrome.exe	86
PID 4556 wrote to memory of 392	4556	chrome.exe	86
PID 4556 wrote to memory of 392	4556	chrome.exe	86
PID 4556 wrote to memory of 392	4556	chrome.exe	86
PID 4556 wrote to memory of 392	4556	chrome.exe	86
PID 4556 wrote to memory of 392	4556	chrome.exe	86
PID 4556 wrote to memory of 392	4556	chrome.exe	86
PID 4556 wrote to memory of 392	4556	chrome.exe	86
PID 4556 wrote to memory of 392	4556	chrome.exe	86
PID 4556 wrote to memory of 392	4556	chrome.exe	86
PID 4556 wrote to memory of 392	4556	chrome.exe	86
PID 4556 wrote to memory of 392	4556	chrome.exe	86
PID 4556 wrote to memory of 392	4556	chrome.exe	86
PID 4556 wrote to memory of 392	4556	chrome.exe	86
PID 4556 wrote to memory of 392	4556	chrome.exe	86
PID 4556 wrote to memory of 392	4556	chrome.exe	86
PID 4556 wrote to memory of 392	4556	chrome.exe	86
PID 4556 wrote to memory of 392	4556	chrome.exe	86
PID 4556 wrote to memory of 392	4556	chrome.exe	86
PID 4556 wrote to memory of 392	4556	chrome.exe	86
PID 4556 wrote to memory of 392	4556	chrome.exe	86
PID 4556 wrote to memory of 392	4556	chrome.exe	86

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://skygo.sky.it/installer/SkyGoInstaller.exe
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9fad2ab58,0x7ff9fad2ab68,0x7ff9fad2ab78
  2⤵
  PID:4328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1820 --field-trial-handle=1884,i,2854447651558655576,1121014458810963365,131072 /prefetch:2
  2⤵
  PID:1884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1884,i,2854447651558655576,1121014458810963365,131072 /prefetch:8
  2⤵
  PID:1604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2232 --field-trial-handle=1884,i,2854447651558655576,1121014458810963365,131072 /prefetch:8
  2⤵
  PID:392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3000 --field-trial-handle=1884,i,2854447651558655576,1121014458810963365,131072 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3020 --field-trial-handle=1884,i,2854447651558655576,1121014458810963365,131072 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4608 --field-trial-handle=1884,i,2854447651558655576,1121014458810963365,131072 /prefetch:8
  2⤵
  PID:2508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4756 --field-trial-handle=1884,i,2854447651558655576,1121014458810963365,131072 /prefetch:8
  2⤵
  PID:4124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4776 --field-trial-handle=1884,i,2854447651558655576,1121014458810963365,131072 /prefetch:8
  2⤵
  PID:4468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4956 --field-trial-handle=1884,i,2854447651558655576,1121014458810963365,131072 /prefetch:8
  2⤵
  PID:2272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4732 --field-trial-handle=1884,i,2854447651558655576,1121014458810963365,131072 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4988 --field-trial-handle=1884,i,2854447651558655576,1121014458810963365,131072 /prefetch:8
  2⤵
  PID:3992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5032 --field-trial-handle=1884,i,2854447651558655576,1121014458810963365,131072 /prefetch:8
  2⤵
  PID:3120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5084 --field-trial-handle=1884,i,2854447651558655576,1121014458810963365,131072 /prefetch:8
  2⤵
  PID:460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 --field-trial-handle=1884,i,2854447651558655576,1121014458810963365,131072 /prefetch:8
  2⤵
  PID:2508
- C:\Users\Admin\Downloads\SkyGoInstaller.exe
  "C:\Users\Admin\Downloads\SkyGoInstaller.exe"
  2⤵
  - Executes dropped EXE
  PID:1764
- - C:\Users\Admin\AppData\Local\Temp\is-8MC5L.tmp\SkyGoInstaller.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-8MC5L.tmp\SkyGoInstaller.tmp" /SL5="$F0034,57866133,434176,C:\Users\Admin\Downloads\SkyGoInstaller.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    PID:552
  - - C:\Users\Admin\AppData\Roaming\Sky\Sky Go\Sky Go.exe
      "C:\Users\Admin\AppData\Roaming\Sky\Sky Go\Sky Go"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      PID:1220
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "chcp"
        5⤵
        
        PID:3204
      - C:\Windows\SysWOW64\chcp.com
        
        chcp
        6⤵
        
        PID:444
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "chcp"
        5⤵
        
        PID:1992
      - C:\Windows\SysWOW64\chcp.com
        
        chcp
        6⤵
        
        PID:2384
    - - C:\Users\Admin\AppData\Roaming\Sky\Sky Go\Sky Go.exe
        
        "C:\Users\Admin\AppData\Roaming\Sky\Sky Go\Sky Go.exe" --type=gpu-process --no-sandbox --ignore-gpu-blacklist --supports-dual-gpus=false --gpu-driver-bug-workarounds=7,10,20,24,43,76 --disable-gl-extensions="GL_KHR_blend_equation_advanced GL_KHR_blend_equation_advanced_coherent" --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor=Microsoft --gpu-driver-version=10.0.19041.868 --gpu-driver-date=6-21-2006 --service-request-channel-token=7509BF7E9F5E586927DD0FA0ED538730 --mojo-platform-channel-handle=1776 /prefetch:2
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:4148
    - - C:\Users\Admin\AppData\Roaming\Sky\Sky Go\Sky Go.exe
        
        "C:\Users\Admin\AppData\Roaming\Sky\Sky Go\Sky Go.exe" --type=renderer --no-sandbox --primordial-pipe-token=A06749278AAC564349D5F475BCE33F32 --lang=en-US --app-path="C:\Users\Admin\AppData\Roaming\Sky\Sky Go\resources\app.asar" --enable-plugins --node-integration=true --webview-tag=true --no-sandbox --preload="C:\Users\Admin\AppData\Roaming\Sky\Sky Go\resources\app.asar\node_modules\@qgo\sky-go-electron-videoguard\preload.js" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553 --service-request-channel-token=A06749278AAC564349D5F475BCE33F32 --renderer-client-id=6 --mojo-platform-channel-handle=2452 /prefetch:1
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4208
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "chcp"
        6⤵
        
        PID:4232
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp
        7⤵
        
        PID:4116
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "chcp"
        6⤵
        
        PID:5028
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:4116
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp
        7⤵
        
        PID:4720
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4988
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2760
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
        5⤵
        
        PID:4116
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
        5⤵
        
        PID:1400
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
        5⤵
        
        PID:4608
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
        6⤵
        
        PID:3980
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:472
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:1400
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
        5⤵
        
        PID:2028
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
        5⤵
        
        PID:2476
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
        6⤵
        
        PID:4608
    - - C:\Users\Admin\AppData\Roaming\Sky\Sky Go\Sky Go.exe
        
        "C:\Users\Admin\AppData\Roaming\Sky\Sky Go\Sky Go.exe" --type=renderer --no-sandbox --primordial-pipe-token=2A9421250B1DB7FD14A3712C334C5D0D --lang=en-US --app-path="C:\Users\Admin\AppData\Roaming\Sky\Sky Go\resources\app.asar" --enable-plugins --node-integration=true --webview-tag=true --no-sandbox --preload="C:\Users\Admin\AppData\Roaming\Sky\Sky Go\resources\app.asar\node_modules\@qgo\sky-go-electron-videoguard\preload.js" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553 --service-request-channel-token=2A9421250B1DB7FD14A3712C334C5D0D --renderer-client-id=8 --mojo-platform-channel-handle=4956 /prefetch:1
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5540
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "chcp"
        6⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp
        7⤵
        
        PID:5720
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "chcp"
        6⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp
        7⤵
        
        PID:5788
- C:\Users\Admin\Downloads\SkyGoInstaller.exe
  "C:\Users\Admin\Downloads\SkyGoInstaller.exe"
  2⤵
  - Executes dropped EXE
  PID:3980
- - C:\Users\Admin\AppData\Local\Temp\is-7RRSV.tmp\SkyGoInstaller.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-7RRSV.tmp\SkyGoInstaller.tmp" /SL5="$50200,57866133,434176,C:\Users\Admin\Downloads\SkyGoInstaller.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    PID:2372
  - - C:\Users\Admin\AppData\Roaming\Sky\Sky Go\Sky Go.exe
      "C:\Users\Admin\AppData\Roaming\Sky\Sky Go\Sky Go"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1460
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "chcp"
        5⤵
        
        PID:2272
      - C:\Windows\SysWOW64\chcp.com
        
        chcp
        6⤵
        
        PID:4136
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "chcp"
        5⤵
        
        PID:472
      - C:\Windows\SysWOW64\chcp.com
        
        chcp
        6⤵
        
        PID:5072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1564 --field-trial-handle=1884,i,2854447651558655576,1121014458810963365,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3840

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:5100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
11b798b9f99772c2fc5672ef7f89b3eb

SHA1
cc389b617a8b21c2dcbce2e34f3bb6562c94e228

SHA256
c1e99c88e669097cd9111bd0db773708a0d41c9f9e1f51d96f8b69a613d3bfef

SHA512
2d714df30ec358066fa0d6743d20c46960e745e1aad88d73c9f1898e6963178bf48cc07a00a406f3f0ac80de40f71592cec68be9b7015bd95a095c5262ff04f7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
5b41346e9b8420f5b34cf3585b658ae3

SHA1
1568522d3986b51ef630c439860711145ae741a3

SHA256
1931af8c56e09e6055f887f9237a69f44410ce8e443ec9e2b57612c02de924c6

SHA512
4d8c2f3c40ee90cae65ca38b062bdf9365abc04c8e39a94d1ac790b76cec4b06dff4260e19ab879cd7cd75a6806f2f2f4872a2dfff894d772a0f79df45e32229

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
521B

MD5
526603080ca099f6cf0246d69890f2bb

SHA1
e32c5b760d8d340c1ee3c5f053079d754288b049

SHA256
406b9448ae7e381293b4febc2bad89b958613deafd2fc18744ee3657b044210b

SHA512
816d63bf5326b036b257c54dcab830ac5fb640f208745778b04d91baff491d4b3561efc65ff3fb251799d7f180366db0a36446e55e8b771ddcb33285e6dcbd06

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
eec15b3c09af19d6988827ae68c8d590

SHA1
fd406f7c0ecd23a4be07cb34a5f02b248665766c

SHA256
8f8b566dc38bc91f177cfdf91a9c54cc9998cfa1c779516ae1620195841cb6e6

SHA512
5fb27443a50908a832cd3407429c83df53da08973481d67078d85d5118268e7be6242d9b555afec31ce65ebee9b3e8e527ada79624cb0a187e1cc4395cd19b77

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d9fa219a-0357-4cec-8db3-201c6c6e8646.tmp

Filesize
6KB

MD5
97c02ddfe30fe5ad54f166573750d814

SHA1
37dc4bc097a97af5b680e44e631f448786f3b362

SHA256
1eb9addb2a08a09a09ea270047f6f09032228c1126cfd468d412eeae040400c9

SHA512
90cc2f36da9bba47d5391a581461db59c5c8a582c682bd50603122bb4e644041d3d33ea7a104937f16e7140c8df7699ea33907f0b7405e38fe5d9850881a8189

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
130KB

MD5
c7c823933e378108fdc6f9676462c635

SHA1
658da31d6378c9c4bf8b0d0860ee42057490bdab

SHA256
63ad78448db6dcb787cde759125442a261439e799310a42d4e4ea8a2764dca70

SHA512
b64b25b2220ad315492ad86e753d50c40562609184ab3a64c5ea5f07e7f4afa3b5303d89bb08d0654d11b9e03f3bea10faf3a0b29693984efeae17777e843ad2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
130KB

MD5
ffe95aa0fd07f26ec819401a5255adf4

SHA1
d587e08489a71c2e54665bfcb88600d7016cab12

SHA256
a6b752223273289b8a3e3b2ee06f9d8002e0aedbd93d4af397837c0b42185118

SHA512
b4fa293808febd7b5a4e4052ed571e0f322505193fa639823067405b7c854c2babab3ebcc5046734f4093c40948fc774201b98464311fceb7045478969604085

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
130KB

MD5
31f3ac9339e7c65c4c75e80a4842936e

SHA1
81aa6c5acb13b41e5ffeb3dd3bf8be8159fedae5

SHA256
920f4e5db607724e7f7aa3c078a23245306de89f0a5b15a2a8f836c44cf7952c

SHA512
8af2ea75261f52a210a3e32f176512f184c5170db5a42928aa3412fcf2523c07a7a58953c767c9f6254ac4b3a66ba8cb1ab384d28f3ebbfbbbed8dd987b939f2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
101KB

MD5
ab4358bc5f9e463339d9bf26d713d231

SHA1
47b29508ad15b3013ea604a4b4fec68001992438

SHA256
625720cf72bcb572e1b4893bde1858f9c017be46b89de9cf117f4c3f05251807

SHA512
f703d530b78406c192ecb685f1e5aeba1e3041acdaeb10ff3f251c4c2b38c21d7fa2afb627c71200cf7945cd12aef0f27fb68a0b414c2d817739e1e87c7fc804

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57ffeb.TMP

Filesize
94KB

MD5
5c002f48ebcbf822faad0aa6a97c13cd

SHA1
b433732ac5d4fc71f438200d37e16de8180958b7

SHA256
35e2f753679bebe62af42f426da52e1816437bd3fa6b21bd0898d391c67f1d2b

SHA512
a281c1dc18baf220ba987c432320414fd9f12c65bb74343aec7780e1b440863bbaaa2f99d162f2e62beba80380dd66151c7fcf92c658b978b9a57a602e3945b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\2fae2f7d-669b-4bc6-bb85-0b84d4ac28d4.tmp.node

Filesize
1.8MB

MD5
9d21f773587bbb42c487be9c45e3874b

SHA1
ca5c24ad9fdde5495bb55dced7ab7ddd46f2dc76

SHA256
5a1164f19e676f1ff16fbb41ff4693c7045dd70914007b526a22359fa188425d

SHA512
69c6b59b72c430114f2129ca0a67270b3f6246389f59368bcf2e0d5b4e0db48bbfc787b954b4656d33ec1c653a23bee44cf804756612219bb76c59ff6b5dee19

Download Submit
C:\Users\Admin\AppData\Local\Temp\5fbb98db-a898-4732-95c0-f4982bdaed6c.tmp.node

Filesize
141KB

MD5
3b5086c8f73d8ae7957cf3e1e5b1fa27

SHA1
f329fdf65af65f7480673f56e7fa2a0316b26bdb

SHA256
df8b0dd865c24ee63fb07f6bc475546ac34ae4726157aaf65d5ee76e63ffa6b2

SHA512
dc4a7f046d5d3d7358a81c0dc349182de78d69eab05b9111e3c9089fb85eedd1f8468c8e9d7409ec336ecfd4218079f844596a93a3c803d802b3e74ce091a912

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l52jkyp3.aae.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\f18c1832-e91a-4647-a90e-d09621ac5f79.tmp.node

Filesize
132KB

MD5
9720e927474d3017b6caa962374c0a28

SHA1
360ed22798ad06ed2d3ab1c8913d5f4b767c32d0

SHA256
879c532a1d68e6a5fe08a81473c7d7f5074a02988a7767f7f4e356c3ed282497

SHA512
7b8bff6ec084cbce9ac78379ed8a9b9f058c1989df60406c454cbec2063df0de9fd9cc9a2fcdfe83f4d9f37d3d591c5b27da925f0ea28040f06c5b96b811f682

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-8MC5L.tmp\SkyGoInstaller.tmp

Filesize
1.4MB

MD5
37d177e1e49b9384da165742cf7c804f

SHA1
8fd61a8801fa8cb21ed6589e6ab0661372fb9637

SHA256
3e1d341217aa4c09273e78db8645192dc332a813249bbc7a56caee81069f0529

SHA512
a924fb1c83c60da6f2a5d9ad14d8413f443345821f368123c18e2b018aca6ae0b719c0ea34264aca7e82532147f4a9a8f1abe366400d47e6fef8315c1c1330c8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
6KB

MD5
c8bb751f3429622d09cf35dd7ac4f32b

SHA1
27942c913e7ac2cf91162d95f941b4b0b40899bc

SHA256
47c3d0d85e1d74dfd6fc577b6f7d10e6005416673af162e5bf07092e99837662

SHA512
ecc931bc04fab857def7de9ffe7d0170b6f4cc6553cda05cb3971f3a33ab17c4f3ba4c526e77c6ca123af65ea534eb34e864c15721d469442ed194fc1d78fe4b

Download Submit
C:\Users\Admin\AppData\Roaming\Sky Go\Service Worker\CacheStorage\9c04b5a79c17d80ef286402ab9101193b9bdac96\2be9ae9e-ffb1-48a8-be14-cde58dce6562\index-dir\temp-index

Filesize
48B

MD5
352b281a81fc6caa0d3449cf3aee8e87

SHA1
ae8d60eb1712185cb7b17aa50910a77dadfffa74

SHA256
eba1845a5f736aee83561b541695b2be46948d0564c59695d7259273844d7d55

SHA512
9f53626144ebc13d40faca439a156180ddba127ca891f4d801091e78edf4109d3c690005826b5951fe1ee191d23805e76727bcd6d1f6d5a59f964f8e0a0a4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Sky Go\Service Worker\CacheStorage\9c04b5a79c17d80ef286402ab9101193b9bdac96\2be9ae9e-ffb1-48a8-be14-cde58dce6562\index-dir\the-real-index~RFe59c848.TMP

Filesize
48B

MD5
8334bd7146b64281500159f349087ee6

SHA1
b4c2f675e8ec12ceb7ef8633403605b15b422a1b

SHA256
3a26d5e5b33fe756e64bca30e71ef384ea6ebc30edc7c9bc9dd8c8c053ccff0a

SHA512
917c7c5fbf80381fd1753ae5aeb0a997201da2aa0dbf14aa865871238550630b06c8bcdddb616d9117e810af49fbc9c33eb8d46a2e52b0889a64a917b56ad887

Download Submit
C:\Users\Admin\AppData\Roaming\Sky Go\Service Worker\CacheStorage\9c04b5a79c17d80ef286402ab9101193b9bdac96\index.txt.tmp

Filesize
92B

MD5
144b391814f57867ffeadb39a359e5ed

SHA1
63ee1d8350d0406e8cbd1c9a5c9d796b5213cb8c

SHA256
071bf266749a9a91c7d6369242465242acf09646ea24792db5fc3c16866514b7

SHA512
5395f697e3efd261624661f75c703b1475e4587926b33f32ddf6966629fd8a17759f7b076d6631924d4382dc3a81932293a84a727e159212572155a647c1696f

Download Submit
C:\Users\Admin\AppData\Roaming\Sky Go\Service Worker\CacheStorage\9c04b5a79c17d80ef286402ab9101193b9bdac96\index.txt~RFe59c605.TMP

Filesize
90B

MD5
9c925c9763cd19010b5c9171b5888ad5

SHA1
070698fd1931730d9c584b1df56fbbe7218df548

SHA256
eee506e478b05ca3301d4eb97e000a50c1b0c94cb18e21833b467dfe49db2b6a

SHA512
cff67d3e6d0cb60d920653446fdcb694bb05d505c5af33d7039957b32e846605a432dbfd7a0de95b5dbf6ef2251433130aa20f92f432b3d964ec623147bede4d

Download Submit
C:\Users\Admin\AppData\Roaming\Sky Go\Service Worker\CacheStorage\d34286a3700f04a8036a4a41197caf9823f55284\5081b5c9-355c-4030-a480-78a977d0ced7\index-dir\temp-index

Filesize
48B

MD5
055b4e4f4af792a7407d8fc8d564aaac

SHA1
c0fcdef9204a3eca856994d095b1f893d3f1b3ea

SHA256
cc28680da46e7cbdf1440ab605ff8b2bda2b3d3860f0d91cefb4d899389bb0b5

SHA512
ec5079a94bfc46333bf35656582061192a1db1006df9a58f310befc7fc22af474229ab4cb694e0032ff2a73a2a4d9f74a36803c8560dcb3354f63f6ec02d5c65

Download Submit
C:\Users\Admin\AppData\Roaming\Sky Go\Service Worker\CacheStorage\d34286a3700f04a8036a4a41197caf9823f55284\5081b5c9-355c-4030-a480-78a977d0ced7\index-dir\the-real-index~RFe59e833.TMP

Filesize
48B

MD5
047ebd4af345cd73d4733ef8b2aff967

SHA1
093ca7615ee8d43183a59e30df037f5f644d98ba

SHA256
806f01512dd5829358f41f70a1166e55b5c890f873f2c6e52012286bcbe91d60

SHA512
4b195a61ed7661ea748872bdb5738fa2b005ba5c70f9bc7d68ef962db36fb63db8aa0661d870ef2465d16313726b4b1b1dfa4afd937a8492a2fe4f976b3fe27f

Download Submit
C:\Users\Admin\AppData\Roaming\Sky Go\Service Worker\CacheStorage\d34286a3700f04a8036a4a41197caf9823f55284\69066fa4-e6c2-45a0-a972-b3f75e245675\index-dir\temp-index

Filesize
48B

MD5
1f3617ac0b79d7ec2e6a61ac47ca32e5

SHA1
c7b165d7a65808037ad09cf28dc0221bf1f7617e

SHA256
e37e32a62a0690f194acfec611c198ffbc370e5e3d2bdd24ff0d1cc56796c4a2

SHA512
753f58c12e064f7395625e29fb390fc36ae9e9b643cafc718b67ea6ff989cfdf100d5bfec63cc21d0bc81dbc625efb4ae949ebd0eee2d3c60fd265a9b46d27cb

Download Submit
C:\Users\Admin\AppData\Roaming\Sky Go\Service Worker\CacheStorage\d34286a3700f04a8036a4a41197caf9823f55284\69066fa4-e6c2-45a0-a972-b3f75e245675\index-dir\the-real-index~RFe59e824.TMP

Filesize
48B

MD5
dccb0194d2273fbfeb2be6d2acd81897

SHA1
15cf468c4a3a55ef0e38d3b2c7a0e306039effb5

SHA256
04b50099baec5936f647c3dfdd337c30b6f5c651fba1de091fa7da4fc5a20a27

SHA512
f8e3c85b3e84d3f5b03f3f85e68d9377ae491211fe933d83cc20d3aaff36e31f0520d72b94f192877e7afd92c03ed784a77e43b2f44f1ac11d692b631e6ff789

Download Submit
C:\Users\Admin\AppData\Roaming\Sky Go\Service Worker\CacheStorage\d34286a3700f04a8036a4a41197caf9823f55284\index.txt

Filesize
74B

MD5
b335c79469e2b67498964b6817b91838

SHA1
0819f79cf16a1263da7ffb7604c474435d71f3ee

SHA256
fed926b40f7940e00ef7e60e22f8f83fcec7284e6147f5eee1c260d4ae033035

SHA512
03422a834e4ff62b2d811a71706871eb2bb8d9a09f225e9489f16006302389ef5e05d825b09867c70e6dc43dc2b713b575ae59dcc819c4d23222fa6f40d8be10

Download Submit
C:\Users\Admin\AppData\Roaming\Sky Go\Service Worker\CacheStorage\d34286a3700f04a8036a4a41197caf9823f55284\index.txt.tmp

Filesize
136B

MD5
7af442340a56761d5f29ef6d9a5a3b5a

SHA1
20ab9cd130d15a45eafeef39949a4da7ea9b8a6f

SHA256
abc65f9e7fd320138d3ec42d10b2f13b61748bcefb3550f812b4daf86698d223

SHA512
749def5e9d95b4d2326b649545d5e9235416069342e19a78719e252d2738e4c4ef23e483180f1f63fd1093855a62bea302717c30d4f7abc763bb5ef640d3a0e4

Download Submit
C:\Users\Admin\AppData\Roaming\Sky Go\Service Worker\CacheStorage\d34286a3700f04a8036a4a41197caf9823f55284\index.txt.tmp

Filesize
138B

MD5
145888cf9dccafb5e3c5e8817afc7094

SHA1
1f111e6da0a47ccf966615ed5a4f0eec312ceb51

SHA256
a7924f1c6b4db1967faf35328325e2c0a35e6fa3384542fcb0476478cadc0562

SHA512
3e461c7a05a9a1368068bbcd226f670b278c489ea20d09f373a182bc3b2bb6cba2b8a282adaab4edbb2e6b66ce077cfe4e2917ffcd6951184e6738d054d7bdbf

Download Submit
C:\Users\Admin\AppData\Roaming\Sky Go\qgd-location.json

Filesize
148B

MD5
4c8c3fc5b290b10e884101eaaf24a347

SHA1
bdbd162cc610414b73ff1ed8b9b3c93376391903

SHA256
189f8b32da2d5a68bdf8239473bae359a13913de24c8b95b7169cecff818110b

SHA512
aedf8300af8efb3f44572608a3b6914a13bc88395754d71113699f75693bf4b734e5af8524ade71a1e356af6f16d42369beeb5c91f84f4bcce4f0690edd29e25

Download Submit
C:\Users\Admin\AppData\Roaming\Sky Go\qgd-location.json

Filesize
142B

MD5
5fd7ab1bb5ac8bd030d79306e6a3780e

SHA1
8bee6c5405b8e811ef77375db29ba8fe94b153a7

SHA256
67f4a98f48733be8dfacdbfb5a0435899c7974a0c3d6a060b5ba76676d557951

SHA512
7ddc56b0a989ad1cb30e3a34e2d6a7a4af11dbf9b6f7b1b795af8230f415f3baa59aee93ac698e4f99ff214a6003388f785e93dd809af7d8e628beab51b1a1e7

Download Submit
C:\Users\Admin\AppData\Roaming\Sky Go\qgd-redux-autoPlay.json

Filesize
372B

MD5
d1208b6b6c9e9050dd40ff128b2167b4

SHA1
2b0031c47155d441d7e1b0d6fdf437ee0802e82a

SHA256
b0fd351cb22663d3ac860642d298c64dd69914cf9cf42563b5b68e231e5c2340

SHA512
f5b21cc338b8ae729ec75cc03a104b37a7f7b2662d985f049d8a9b521ff826f2a195e5a88c11a786865d1e64d4fdb59b61e436fd833772c8699eac93b7909183

Download Submit
C:\Users\Admin\AppData\Roaming\Sky Go\qgd-redux-config.json

Filesize
881B

MD5
d6d994fa522849a557d8de3e43613c29

SHA1
82c55a56f369b8ddf25fb42de9b86100cdb05553

SHA256
bd97d5463a6cd843e81e9f8bdfe396325f595a7a1f4b3b39aa254a6e9e6d2a39

SHA512
41dad084d8ed7d1adecace5d18b369ab0868210e5ef7020d716434cbe0925c053e5649246ba1a8c595146983003f09d68410c6c82583746714d383a03df0431b

Download Submit
C:\Users\Admin\AppData\Roaming\Sky Go\qgd-redux-download.json

Filesize
114B

MD5
4dd6361a6700904a640dcc130a16a68a

SHA1
aab9cbfd9b63da07ef15477b039fe6175f1b830c

SHA256
1027ff2bb4529373db26a4dfc50868e1b50d9e67532a10673ebb2072b2e94105

SHA512
ae26a0fa3c6450631a852b26f3f5ac00e8a7f48b2a05bf9279097cc20393dd41b382465d585865ad25f54ca79ead611e61585f163fd28b6624c5d6f78fd1f98e

Download Submit
C:\Users\Admin\AppData\Roaming\Sky Go\qgd-redux-inAppMessages.json

Filesize
240B

MD5
fb1f3309ff689e60bdcc80e2a2d011b3

SHA1
92b5af2204bbc067d0eaa6c1b4ec497a990fa251

SHA256
732fbd433f1021ff15c8f7f59ba2b855450fcca593e57761b59f03a43f05032d

SHA512
ee06a8d2eff4c9dd72e2a32e235921e67325c971292d3783d75461ec08e0061799f1547ea561b64644e9e5e4d35c7541fc74834fdf61a530b354006df1acce93

Download Submit
C:\Users\Admin\AppData\Roaming\Sky Go\qgd-redux-inAppMessages.json

Filesize
269B

MD5
c257b6483679d3b584cc7e3483a7e97c

SHA1
c1e5e33453c321a5ec51a6ef9307cceb01c79490

SHA256
c6b8411348930583fc46de1f65cc4139fda5baceb3c3f215f379869caef3401d

SHA512
bcf54929950ba3d646e3b9607b47a2952c306e6396c550a9a2e9bab3ada783fda539fb621bd88e967c90915706ab72c3eedf785ae58e9c0f826b2f220e9480b4

Download Submit
C:\Users\Admin\AppData\Roaming\Sky Go\qgd-redux-linear.json

Filesize
1KB

MD5
a5ed6ff19e83f6e46c587b97cb7203c5

SHA1
91667beb6ce0d51ffcccf1d17fbc27ae3ef5ec8e

SHA256
1a584c3484d40327b061765635278792b8eb04fea2e03383398602851b578153

SHA512
85776a18897f44c3a274fe40c35e425be590745303a82aeff19f7d754f1aabf6fb9f551629952339b6298acaa400799fee7e8c362366673d0710af6acc6f5d60

Download Submit
C:\Users\Admin\AppData\Roaming\Sky Go\qgd-redux-linear.json

Filesize
1KB

MD5
93cf8ce9647087063cb411e5977ca627

SHA1
f3c08f48f0d18ccb3cc28e68ca32a1142ddab988

SHA256
8d581636971dadb5671ff22a75e3a49c6e85df15e21ab3d9a4011852bca986dc

SHA512
8436c69b3e2cc2c3b5a7b67a6f90752c74f460080a4f675c2503e7dfd3fcd94b7ab8e36f5fa6945cbdf9a4b990ced268da1fe6aa3d9a0afd06c760767111c014

Download Submit
C:\Users\Admin\AppData\Roaming\Sky Go\qgd-redux-notifications.json

Filesize
414B

MD5
9475fb74c0e58e0eb6e839b9104854cd

SHA1
e049f72189ed78e4e2318e78ccd250b42af29e95

SHA256
f23b1fb51d0ba0ebf9c244584e196eaa5c4dad55eb770638372390fcc1b071a8

SHA512
d750c3af16a600b5a401f5c69a59db1fa2cd919dde988c2cd1180fe7b0ac4de0a85ba67e0481ef310832c439d61ca293ed5248d5426d11088344cd9ac9036f23

Download Submit
C:\Users\Admin\AppData\Roaming\Sky Go\qgd-redux-settings.json

Filesize
1KB

MD5
4bb531f38ce1403b51206b09362a1a7c

SHA1
78e017b113b5840952300bb3769a34423a1aac32

SHA256
147fb61b2da523ebe0bbe506bb6374813c5fa0d57464fb78f2a9a61bed316a50

SHA512
64577769b62bd3f6037b6dc5bf0b883506d31527f80809cbb73273060facf03a8f8a574f3829def1b3c4a4dff4dc26409c79b538e4a5e6faa1f2c29209ad7b9d

Download Submit
C:\Users\Admin\AppData\Roaming\Sky\Sky Go\API-MS-Win-core-xstate-l2-1-0.dll

Filesize
2KB

MD5
9e683825eae3b6375cbd63623196be96

SHA1
1b30500a36883bf7e3eb63476e6b49151d51af78

SHA256
cbd3fef707abf622b150db1d10b5443264eb6da8f4d7aa2adc97c50a22d4d594

SHA512
c4316f38ecc0bbf3adcf1c2b67ce79453c0c292aa2d0637bf400bc10a1751e595885083c79023be58bd1953a5e30d8e6ebef4b4af849f680adbcb9e5ae820c11

Download Submit
C:\Users\Admin\AppData\Roaming\Sky\Sky Go\Sky Go.exe

Filesize
49.3MB

MD5
8f26372f9e534b59341b0852a51ad852

SHA1
33cf61ec219bdc8f3752029b6dedf6d6548e4d81

SHA256
f54ae070a8b10cf1de53bb3ca4a8fcdef9ba9e9e13e666bcdfa10732602f95b7

SHA512
c4029986b8b33e0a29ead4a7b2c14403a5875d86128d280df7efcb486f406276600c59b2cd3f6eaa251c3043e91d9bf75be6aa0605dd218524595c6e6c8acaeb

Download Submit
C:\Users\Admin\AppData\Roaming\Sky\Sky Go\api-ms-win-core-console-l1-1-0.dll

Filesize
18KB

MD5
aabbb38c4110cc0bf7203a567734a7e7

SHA1
5df8d0cdd3e1977ffacca08faf8b1c92c13c6d48

SHA256
24b07028c1e38b9ca2f197750654a0dfb7d33c2e52c9dd67100609499e8028db

SHA512
c66c98d2669d7a180510c57bab707d1e224c12ab7e2b08994eb5fd5be2f3dee3dbdb934bcb9db168845e4d726114bce317045027215419d3f13dcfa0f143d713

Download Submit
C:\Users\Admin\AppData\Roaming\Sky\Sky Go\api-ms-win-core-datetime-l1-1-0.dll

Filesize
17KB

MD5
8894176af3ea65a09ae5cf4c0e6ff50f

SHA1
46858ea9029d7fc57318d27ca14e011327502910

SHA256
c64b7c6400e9bacc1a4f1baed6374bfbce9a3f8cf20c2d03f81ef18262f89c60

SHA512
64b31f9b180c2e4e692643d0ccd08c3499cae87211da6b2b737f67b5719f018ebcacc2476d487a0aeb91fea1666e6dbbf4ca7b08bb4ab5a031655bf9e02cea9a

Download Submit
C:\Users\Admin\AppData\Roaming\Sky\Sky Go\api-ms-win-core-debug-l1-1-0.dll

Filesize
17KB

MD5
879920c7fa905036856bcb10875121d9

SHA1
a82787ea553eefa0e7c3bb3aedb2f2c60e39459a

SHA256
7e4cba620b87189278b5631536cdad9bfda6e12abd8e4eb647cb85369a204fe8

SHA512
06650248ddbc68529ef51c8b3bc3185a22cf1685c5fa9904aee766a24e12d8a2a359b1efd7f49cc2f91471015e7c1516c71ba9d6961850553d424fa400b7ea91

Download Submit
C:\Users\Admin\AppData\Roaming\Sky\Sky Go\api-ms-win-core-errorhandling-l1-1-0.dll

Filesize
17KB

MD5
d91bf81cf5178d47d1a588b0df98eb24

SHA1
75f9f2da06aa2735906b1c572dd556a3c30e7717

SHA256
f8e3b45fd3e22866006f16a9e73e28b5e357f31f3c275b517692a5f16918b492

SHA512
93d1b0d226e94235f1b32d42f6c1b95fadfaf103b8c1782423d2c5a4836102084fb53f871e3c434b85f0288e47f44345138de54ea5f982ca3e8bbf2d2bea0706

Download Submit
C:\Users\Admin\AppData\Roaming\Sky\Sky Go\api-ms-win-core-file-l1-1-0.dll

Filesize
21KB

MD5
eefe86b5a3ab256beed8621a05210df2

SHA1
90c1623a85c519adbc5ef67b63354f881507b8a7

SHA256
1d1c11fc1ad1febf9308225c4ccf0431606a4ab08680ba04494d276cb310bf15

SHA512
c326a2ca190db24e8e96c43d1df58a4859a32eb64b0363f9778a8902f1ac0307dca585be04f831a66bc32df54499681ad952ce654d607f5fdb93e9b4504d653f

Download Submit
C:\Users\Admin\AppData\Roaming\Sky\Sky Go\api-ms-win-core-file-l1-2-0.dll

Filesize
17KB

MD5
79ee4a2fcbe24e9a65106de834ccda4a

SHA1
fd1ba674371af7116ea06ad42886185f98ba137b

SHA256
9f7bda59faafc8a455f98397a63a7f7d114efc4e8a41808c791256ebf33c7613

SHA512
6ef7857d856a1d23333669184a231ad402dc62c8f457a6305fe53ed5e792176ca6f9e561375a707da0d7dd27e6ea95f8c4355c5dc217e847e807000b310aa05c

Download Submit
C:\Users\Admin\AppData\Roaming\Sky\Sky Go\api-ms-win-core-file-l2-1-0.dll

Filesize
17KB

MD5
3f224766fe9b090333fdb43d5a22f9ea

SHA1
548d1bb707ae7a3dfccc0c2d99908561a305f57b

SHA256
ae5e73416eb64bc18249ace99f6847024eceea7ce9c343696c84196460f3a357

SHA512
c12ea6758071b332368d7ef0857479d2b43a4b27ceeab86cbb542bd6f1515f605ea526dfa3480717f8f452989c25d0ee92bf3335550b15ecec79e9b25e66a2ca

Download Submit
C:\Users\Admin\AppData\Roaming\Sky\Sky Go\api-ms-win-core-handle-l1-1-0.dll

Filesize
17KB

MD5
18fd51821d0a6f3e94e3fa71db6de3af

SHA1
7d9700e98ef2d93fdbf8f27592678194b740f4e0

SHA256
dba84e704ffe5fcd42548856258109dc77c6a46fd0b784119a3548ec47e5644b

SHA512
4009b4d50e3cb17197009ac7e41a2351de980b2c5b79c0b440c7fe4c1c3c4e18f1089c6f43216eaa262062c395423f3ad92ca494f664636ff7592c540c5ef89d

Download Submit
C:\Users\Admin\AppData\Roaming\Sky\Sky Go\api-ms-win-core-heap-l1-1-0.dll

Filesize
17KB

MD5
ff8026dab5d3dabca8f72b6fa7d258fa

SHA1
075c8719e226a34d7b883fd62b2d7f8823d70f1a

SHA256
535e9d20f00a2f1a62f843a4a26cfb763138d5dfe358b0126d33996fba9ca4d1

SHA512
9c56ff11d5843ba09cd29e3bc6c6b9396926c6a588194193ba220cfa784b770ab6756076f16f18cfea75b51a8184a1063ef47f63804839530382f8d39d5cf006

Download Submit
C:\Users\Admin\AppData\Roaming\Sky\Sky Go\api-ms-win-core-interlocked-l1-1-0.dll

Filesize
18KB

MD5
cfe87d58f973daeda4ee7d2cf4ae521d

SHA1
fd0aa97b7cb6e50c6d5d2bf2d21d757040b5204a

SHA256
4997fda5d0e90b8a0ab7da314cb56f25d1450b366701c45c294d8dd3254de483

SHA512
40eb68deb940bbe1b835954183eea711994c434de0abbdea0b1a51db6233a12e07827ad4a8639ae0baf46dd26c168a775ffe606c82cbe47bae655c7f28ab730b

Download Submit
C:\Users\Admin\AppData\Roaming\Sky\Sky Go\api-ms-win-core-libraryloader-l1-1-0.dll

Filesize
18KB

MD5
0c48220a4485f36feed84ef5dd0a5e9c

SHA1
1e7d4038c2765cffa6d4255737a2a8aa86b5551c

SHA256
2dd4ebaa12cbba142b5d61a0ebf84a14d0d1bb8826ba42b63e303fe6721408df

SHA512
e09951785b09f535340e1e6c256df1919485b4dad302b30d90126411cc49a13807b580fa2fcd0d6f7b64aac4f5b5ea3e250b66035a0e2f664d865408c9b43d48

Download Submit
C:\Users\Admin\AppData\Roaming\Sky\Sky Go\api-ms-win-core-localization-l1-2-0.dll

Filesize
20KB

MD5
23bd405a6cfd1e38c74c5150eec28d0a

SHA1
1d3be98e7dfe565e297e837a7085731ecd368c7b

SHA256
a7fa48de6c06666b80184afee7e544c258e0fb11399ab3fe47d4e74667779f41

SHA512
c52d487727a34fbb601b01031300a80eca7c4a08af87567da32cb5b60f7a41eb2cae06697cd11095322f2fc8307219111ee02b60045904b5c9b1f37e48a06a21

Download Submit
C:\Users\Admin\AppData\Roaming\Sky\Sky Go\api-ms-win-core-memory-l1-1-0.dll

Filesize
18KB

MD5
3940167ffb4383992e73f9a10e4b8b1e

SHA1
53541c824003b0f90b236eda83b06bec5e1acbf5

SHA256
ec573431338371504b7b9e57b2d91382b856aabf25d2b4ad96486efb794c198e

SHA512
9732acaa4db773f4f99f423d9feaebb35c197bbd468922348e0ad086f7131d83f6d9714dc7d375183e7cb8920cfe37f3da19b0041a9063cc60abe183375b1929

Download Submit
C:\Users\Admin\AppData\Roaming\Sky\Sky Go\api-ms-win-core-namedpipe-l1-1-0.dll

Filesize
17KB

MD5
990ac84ae2d83eeb532a28fe29602827

SHA1
0916f85cc6cc1f01dc08bdf71517a1dc1b8eaf78

SHA256
dbd788b1c5694d65fa6f6e2202bfabb30adf77eb1973ceb9a737efb16e9edae2

SHA512
f0e4705a6890b4f81b7d46f66ca6b8ee82f647e163bce9ecad11d0bbd69caf4ff3c4f15e0d3f829c048b6849b99a7641861e6caf319904d4d61a6084f10da353

Download Submit
C:\Users\Admin\AppData\Roaming\Sky\Sky Go\api-ms-win-core-rtlsupport-l1-1-0.dll

Filesize
17KB

MD5
65fc0b6c2ceff31336983e33b84a9313

SHA1
980de034cc3a36021fd8bafff3846b0731b7068e

SHA256
966a38ed7034f8d355e1e8772dfc92f23fb3c8a669780ed4ac3b075625d09744

SHA512
f4ebc7a6d12ae6afa5b96c06413a3438e1678b276b1517da07d33912818fc863b4d35cb46280f12cf90e37bc93e3ab5e44ea6f75767a314c59222b7d397e5b6a

Download Submit
C:\Users\Admin\AppData\Roaming\Sky\Sky Go\api-ms-win-core-synch-l1-1-0.dll

Filesize
19KB

MD5
c1dcdb0fabc8ae671a7c7a94f42fb79a

SHA1
99355912d7a7d622753b2a855cae4f5a4e50146f

SHA256
cc76a4e82e0e0cd08df3bb8f5ad57142305e0f666cc32599d76e363d0b43efcb

SHA512
6d92e7520aeebfe60aab43d6616b76a2dd385edcaa217db60003a0c0cbcb0e367063d240e38a19d0b8bee2f2e7d4b982c4f08c8e9ccf34c7f670cb49f6561fff

Download Submit
C:\Users\Admin\AppData\Roaming\Sky\Sky Go\api-ms-win-crt-math-l1-1-0.dll

Filesize
28KB

MD5
8da414c3524a869e5679c0678d1640c1

SHA1
60cf28792c68e9894878c31b323e68feb4676865

SHA256
39723e61c98703034b264b97ee0fe12e696c6560483d799020f9847d8a952672

SHA512
6ef3f81206e7d4dca5b3c1fafc9aa2328b717e61ee0acce30dfb15ad0fe3cb59b2bd61f92bf6046c0aae01445896dcb1485ad8be86629d22c3301a1b5f4f2cfa

Download Submit
C:\Users\Admin\AppData\Roaming\Sky\Sky Go\ffmpeg.dll

Filesize
1.6MB

MD5
aea16baa073513d1fe8072c25b496820

SHA1
c25b477b50a9aacff7eae1944f8e52d9ae2b42fd

SHA256
1ad1849ef77828ecdbf7440b84de4bac8517e7f9e10295a2b6b9e3bbd9738bf8

SHA512
5aecf9b2b75a806529a0a5e6ddeb15d4bcc76322a2a631528d32e051fe79b3e41d96c457a7b591c2a6b95a88ec7ac4de8c76fc1ea0e769c45fa4dd7997b33845

Download Submit
C:\Users\Admin\AppData\Roaming\Sky\Sky Go\icudtl.dat

Filesize
9.7MB

MD5
bc7f54e4df91c9137dced27976228b66

SHA1
fe532df1de6dd6f9971227b48f8856e07ae0883d

SHA256
51b93e0bc7e6d697ccc29703e2ebc9210c231c931fe764c372e5ba0d26098d3b

SHA512
8fe03a5b65236c90af171f68e911ff307d40f249120ea1c2324e8a7ccf4061ce6ce6dfe66bc957e76bfa7e5161aaa005f40b9be95dc6481df46f25fbae41e14b

Download Submit
C:\Users\Admin\AppData\Roaming\Sky\Sky Go\libGLESv2.dll

Filesize
2.4MB

MD5
211626e88b9ce14f866f924d60e1f151

SHA1
efd8391aaef4cdd6ee673d2b7ea4d52061918696

SHA256
6933fc22d389e8a95e42e3ece6a6be29172aa00f9c404e87e0f896fd72db4379

SHA512
8455209b36ccb4b7e3d97a40dc3960509a04a30a9ad17cb91ab16b4d0b78fe434498125e2be810c79d94141048be9fd5a36ada06bba163520fd45f32529a8b06

Download Submit
C:\Users\Admin\AppData\Roaming\Sky\Sky Go\locales\pl.pak

Filesize
4KB

MD5
7b6787fc74da7cbfcc6284b5a0fec719

SHA1
f4dbd3acf50ece9406f5045d90c916736f87a7e8

SHA256
7b2ea68c0dd40cd25efe9b07aba8948abf2a0b54a7d86383c6679a476ae4df52

SHA512
06f1cfbc510ce19149b23e51df3cb10f6161683f88a6bef3faf762341044e0c1bebb8ab65b28e48b21b668646b2fff6426a43cba236047d074327735e852464d

Download Submit
C:\Users\Admin\AppData\Roaming\Sky\Sky Go\locales\sr.pak

Filesize
6KB

MD5
80ccce6ddcc7e6737f686eec1f192316

SHA1
68520b2b3e7217848baf110eb575f63147ba4d09

SHA256
08b8bf6d7d8155c183b91fdabc77687b580bb74cfcbb53f8656e101acd79f37e

SHA512
d725a7a6decf93889571550b8253bd8ef068c164e609af28491d3244790f1b6a6be7132d97250aa026c95047da66672b7ba21075a9ed33389ae200476b17820a

Download Submit
C:\Users\Admin\AppData\Roaming\Sky\Sky Go\locales\zh-TW.pak

Filesize
3KB

MD5
3abcad2e39a1eb9b3488595d63750be2

SHA1
14fc021b22b4158886f3e0781412a9bfd0e13130

SHA256
caaa302ca242d868f9f055429799e48fa6e4c6466639b0ff7503536ce32cad13

SHA512
a982f0447a202baa4cc50f5409d85996df118fa0c2a7364dc14cfa1604bd17085510437739b33d0db5b265cd51b42ec484d5ef3b3555d62fe9106acb43c664d5

Download Submit
C:\Users\Admin\AppData\Roaming\Sky\Sky Go\msvcp140.dll

Filesize
429KB

MD5
851e7732d09151d218a2e7c3bf2dafbb

SHA1
f5aca8cd8da53976b13a4adc9c6111356803c4c9

SHA256
2545c8b2eab83c9de0e48a36923949d30837dbc61d638a5fb879b0c9d647976d

SHA512
9fbd2e66cd6a107e14b083372ac3303058e3978c8616b9e3b79a05b26066c3681d16ca8c2f29423e53af0e3d3ec61745414f9845f416fa7272a3a7ffaca65465

Download Submit
C:\Users\Admin\AppData\Roaming\Sky\Sky Go\natives_blob.bin

Filesize
233KB

MD5
cf12cd78ea6ba08a203a8c8067e8b434

SHA1
cf6fcf5f84dfe4f79a59fe2859f224bda27558b4

SHA256
842a94a6b9db685e61b6224a44012a2862698e35861044612d91112a6adeedb8

SHA512
b271cc554fef7e51add17459ac289472887a30709e24023c8c28fbc5e48c4ea67e8988b8a57a4bc4bd3936186452e6728cb6e85cf20854d06d6323dc2f5c500f

Download Submit
C:\Users\Admin\AppData\Roaming\Sky\Sky Go\node.dll

Filesize
13.5MB

MD5
74ca1c7d718ec7c98bc2e3d6018afc97

SHA1
abd12441c6c72d282103bed101eb6b26e6bd401b

SHA256
85eae588bc1348e0e1b800f1b77cbe21930965c7530829d60f0eb838b33b5647

SHA512
e90b8cbdae765cd89430122a8f33e59c6bf095a0d5bd861838717273d652b1512eba208121fc377cfd0cbde0b6b76f3c90dd61c4248e0cabf6daf172b6f2d516

Download Submit
C:\Users\Admin\AppData\Roaming\Sky\Sky Go\resources\app.asar.sig

Filesize
344B

MD5
0eee383326c3fdfabdaa3be9a81eff20

SHA1
8eb8c663622e3c2f50cc95b8d71ab9f495275c2e

SHA256
b902ebb69b095a8c4b895cde5d61303ab4a48057c452a6afb4e4abb857bca8e6

SHA512
19fd0647701be5c94eda57d7b7b786e7fef9db8e5591fcf870ddec3c4c261c44e1d9782fca6e358f38b57cef3b756430e6d2d68c522e4be49ed8f09cf0aa015c

Download Submit
C:\Users\Admin\AppData\Roaming\Sky\Sky Go\resources\app.asar.unpacked\node_modules\@qgo\sky-go-electron-videoguard\bin\win32\libgstaudio-0.10.dll

Filesize
106KB

MD5
76801ecb911b4abbc33cfe70d892128c

SHA1
52d4c4beddba1aad038aa4f71a13ae0369c705f5

SHA256
99c5f739d6c2a444a069b36989cfaca7dd9aadc708b4a1909242c23355cd3351

SHA512
6e2be160c1624148588a98a44e6b562ccfa4eea72aa9b4d908bf0360ccb9760a22f2ffda141d78e5e0c8826e59d65cc8bc5bd1aa42aa8fd3f6adb3e51d08b555

Download Submit
C:\Users\Admin\AppData\Roaming\Sky\Sky Go\resources\app.asar.unpacked\node_modules\@qgo\sky-go-electron-videoguard\bin\win32\libgstaudioresample.dll

Filesize
49KB

MD5
994804f41a7867551bde1670b2f4c5da

SHA1
f101271fbb0393fb8f96a768a5d82c2f914a29d9

SHA256
eae2e0d977760ad5f283c343f6051a317bfd30a5ab0659f8a6b132d2d68463b6

SHA512
554156e51dae8662a60c7ca2b07b9932f3132487f49e129275b09e038e2e49a97094c955c6165fbec4e4bf74dc274e4936cd962ad918a47980408d2d035d34b6

Download Submit
C:\Users\Admin\AppData\Roaming\Sky\Sky Go\resources\app.asar.unpacked\node_modules\@qgo\sky-go-electron-videoguard\bin\win32\libgstbase-0.10.dll

Filesize
194KB

MD5
d401adef49c4f22a4f507d6979284571

SHA1
e83caf424b6014cb71b1f16b529df9187ae3555f

SHA256
86dfc79c39019ef9fbb7fb5ef22eaa187f92d6e43dfc4d0f1c310b281ed8398f

SHA512
f8991c41d0ffc8f78c11cd77e28dc5ef30e1bb70c1097e12d7cca0b81e4a855a071dad1c3b85dacee5773bfa258f1ad2a29e9d306c60a67372c99eca8a02efa0

Download Submit
C:\Users\Admin\AppData\Roaming\Sky\Sky Go\resources\electron.asar

Filesize
234KB

MD5
08bf496aacbee638ae971878f54908d7

SHA1
4f41679a6103eb5a7af0af0a1086ce2304a2ee37

SHA256
f97abf2f058c912cb4b7e51dd25aad6fba5d2a25c61aadf1016fb1cb0ca13823

SHA512
68ebe0eca57418633eca9a4e5fb5a993b616ba53f6ecfe1ae4bbe2627c85a286d9031e00794cea071307f47316380f3e2b371462fdc4c62737887c3ad20deed9

Download Submit
C:\Users\Admin\AppData\Roaming\Sky\Sky Go\resources\electron.asar.sig

Filesize
344B

MD5
4bcc9379de290c6bb81eac31cf032b43

SHA1
f483d2d976b2f089636278948135f1ade1890d14

SHA256
194a46776f6f748d2866fc21cdcddca475a1a7ce13df10a04aca63e4c7fdbdbb

SHA512
a128fe4e3a52c84cc07769a21788d960326665b59bd34d9d2d82bcc3381c496e29a0d5d063d9255e41b5b9732847274d012bace3f4814290706747e32905a961

Download Submit
C:\Users\Admin\AppData\Roaming\Sky\Sky Go\snapshot_blob.bin

Filesize
1.1MB

MD5
6c70fcd9313aaaec2079d44d0bac7ed9

SHA1
211b176565d258e2e6dc2f829e9ae9a67ebb4c15

SHA256
6c2ed646dc91686d9d6c82328c34ac301a355063009901f7e4545957016af24e

SHA512
4bcc13bd48ea42b05a81111950113dfa326b56b3e04e66c2602bcbe24ff631dbc1b99182ec6a0d3a3da0ecb5f77188ede6bb0a5100cef0dc69ebd595a5c27bf2

Download Submit
C:\Users\Admin\AppData\Roaming\Sky\Sky Go\unins000.msg

Filesize
25KB

MD5
cb397328f8dfbb1b7d2a68703ea50f8b

SHA1
f4aec2a703f5f13a17c7c4e717ca25773c0115f7

SHA256
9b5a020759d326e2eb9c16904aad022673b1e0b0a2053ca30b4b6d67791e1c4b

SHA512
eb157fbb35e1f1d286967d1c11db2b365d67794e22b900f93ed07ae3f79d7212395a48faf709faf571c706f9b55cb5688cde658c2888ddbc0f071b190d1eee20

Download Submit
C:\Users\Admin\AppData\Roaming\Sky\Sky Go\vcruntime140.dll

Filesize
81KB

MD5
aeab74db6bc6c914997f1a8a9ff013ec

SHA1
6b717f23227d158d6aa566498c438b8f305a29b5

SHA256
18ccb2dd8af853f4e6221bb5513e3154ef67ae61cee6ec319a8a97615987dc4b

SHA512
a2832b7720599361e2537f79a2597acb1a2d5633fdfe20a0d1075e9457683fdb1d5676d121c0bf1a825ff99512dcd924254f1151b50aae922acc0cc10f461036

Download Submit
memory/472-983-0x0000000069720000-0x000000006976C000-memory.dmp

Filesize
304KB

Download
memory/472-984-0x0000000069E60000-0x000000006A1B4000-memory.dmp

Filesize
3.3MB

Download
memory/552-114-0x0000000000400000-0x000000000057A000-memory.dmp

Filesize
1.5MB

Download
memory/552-482-0x0000000000400000-0x000000000057A000-memory.dmp

Filesize
1.5MB

Download
memory/552-616-0x0000000000400000-0x000000000057A000-memory.dmp

Filesize
1.5MB

Download
memory/552-621-0x0000000000400000-0x000000000057A000-memory.dmp

Filesize
1.5MB

Download
memory/552-622-0x0000000000400000-0x000000000057A000-memory.dmp

Filesize
1.5MB

Download
memory/552-648-0x0000000000400000-0x000000000057A000-memory.dmp

Filesize
1.5MB

Download
memory/552-655-0x0000000000400000-0x000000000057A000-memory.dmp

Filesize
1.5MB

Download
memory/552-775-0x0000000000400000-0x000000000057A000-memory.dmp

Filesize
1.5MB

Download
memory/552-781-0x0000000000400000-0x000000000057A000-memory.dmp

Filesize
1.5MB

Download
memory/552-859-0x0000000000400000-0x000000000057A000-memory.dmp

Filesize
1.5MB

Download
memory/1220-1049-0x0000000017780000-0x0000000018FC9000-memory.dmp

Filesize
24.3MB

Download
memory/1220-917-0x0000000063A40000-0x0000000063A8A000-memory.dmp

Filesize
296KB

Download
memory/1220-856-0x0000000034D80000-0x0000000034D81000-memory.dmp

Filesize
4KB

Download
memory/1220-1020-0x0000000007260000-0x000000000728F000-memory.dmp

Filesize
188KB

Download
memory/1220-1315-0x0000000007B70000-0x0000000007CCD000-memory.dmp

Filesize
1.4MB

Download
memory/1220-1316-0x0000000007260000-0x000000000728F000-memory.dmp

Filesize
188KB

Download
memory/1220-1314-0x0000000063A40000-0x0000000063A8A000-memory.dmp

Filesize
296KB

Download
memory/1220-1021-0x0000000011690000-0x00000000116C4000-memory.dmp

Filesize
208KB

Download
memory/1220-1260-0x0000000017780000-0x0000000018FC9000-memory.dmp

Filesize
24.3MB

Download
memory/1220-1192-0x0000000017780000-0x0000000018FC9000-memory.dmp

Filesize
24.3MB

Download
memory/1220-875-0x0000000007B70000-0x0000000007CCD000-memory.dmp

Filesize
1.4MB

Download
memory/1220-919-0x0000000007260000-0x000000000728F000-memory.dmp

Filesize
188KB

Download
memory/1220-918-0x0000000007B70000-0x0000000007CCD000-memory.dmp

Filesize
1.4MB

Download
memory/1460-476-0x0000000039D00000-0x0000000039D01000-memory.dmp

Filesize
4KB

Download
memory/1764-481-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/1764-105-0x0000000000401000-0x0000000000412000-memory.dmp

Filesize
68KB

Download
memory/1764-103-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/1764-860-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2372-461-0x0000000000400000-0x000000000057A000-memory.dmp

Filesize
1.5MB

Download
memory/2760-916-0x00000000067D0000-0x00000000067EE000-memory.dmp

Filesize
120KB

Download
memory/2760-920-0x0000000006B90000-0x0000000006BDC000-memory.dmp

Filesize
304KB

Download
memory/2760-892-0x0000000005340000-0x0000000005376000-memory.dmp

Filesize
216KB

Download
memory/2760-942-0x0000000008DE0000-0x0000000009384000-memory.dmp

Filesize
5.6MB

Download
memory/2760-945-0x0000000008000000-0x0000000008032000-memory.dmp

Filesize
200KB

Download
memory/2760-946-0x0000000069720000-0x000000006976C000-memory.dmp

Filesize
304KB

Download
memory/2760-957-0x0000000008060000-0x000000000807E000-memory.dmp

Filesize
120KB

Download
memory/2760-922-0x0000000007AB0000-0x0000000007B26000-memory.dmp

Filesize
472KB

Download
memory/2760-921-0x00000000079A0000-0x00000000079E4000-memory.dmp

Filesize
272KB

Download
memory/2760-947-0x0000000069E60000-0x000000006A1B4000-memory.dmp

Filesize
3.3MB

Download
memory/2760-940-0x0000000007D00000-0x0000000007D96000-memory.dmp

Filesize
600KB

Download
memory/2760-894-0x0000000005830000-0x0000000005852000-memory.dmp

Filesize
136KB

Download
memory/2760-895-0x0000000006050000-0x00000000060B6000-memory.dmp

Filesize
408KB

Download
memory/2760-896-0x00000000060C0000-0x0000000006126000-memory.dmp

Filesize
408KB

Download
memory/2760-961-0x0000000008860000-0x0000000008884000-memory.dmp

Filesize
144KB

Download
memory/2760-941-0x0000000007CA0000-0x0000000007CC2000-memory.dmp

Filesize
136KB

Download
memory/2760-960-0x0000000008830000-0x000000000885A000-memory.dmp

Filesize
168KB

Download
memory/2760-958-0x0000000008080000-0x0000000008123000-memory.dmp

Filesize
652KB

Download
memory/2760-959-0x0000000008170000-0x000000000817A000-memory.dmp

Filesize
40KB

Download
memory/3980-463-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/3980-110-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/3980-108-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/4208-877-0x000000000C180000-0x000000000C181000-memory.dmp

Filesize
4KB

Download
memory/4988-893-0x00000000058D0000-0x0000000005EF8000-memory.dmp

Filesize
6.2MB

Download
memory/4988-925-0x0000000007FA0000-0x000000000861A000-memory.dmp

Filesize
6.5MB

Download
memory/4988-926-0x0000000007950000-0x000000000796A000-memory.dmp

Filesize
104KB

Download
memory/4988-902-0x0000000006000000-0x0000000006354000-memory.dmp

Filesize
3.3MB

Download
memory/5540-1037-0x0000000037B00000-0x0000000037B01000-memory.dmp

Filesize
4KB

Download