fd6caab513f0f6e00c2aa125ec013395495c6e0eb53e9818182f37fa476d7e44

Analysis

max time kernel
223s
max time network
206s
platform
windows11-21h2_x64
resource
win11-20250313-en
resource tags

arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system
submitted
28/03/2025, 16:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Ember.zip
Size

27.9MB
MD5

2dbde3a13b7f9c8b84d2f186e53876cb
SHA1

b18020197e0e49346566e9e8afd8b22b9898177e
SHA256

fd6caab513f0f6e00c2aa125ec013395495c6e0eb53e9818182f37fa476d7e44
SHA512

1309904a4a8f2fd4346c566d04339b540f1462e5f4b33d7a0cf94a9678b7bc003764f78a2fa78cbef95b12d11a89ff6f48bd47dabff1b801a67d17e18890882d
SSDEEP

393216:KTM+AkKFTI2KF1M0FgVWFCkY1elhrhZGW026+BpQyocPNKNdI91DqRUAdP4KJaO3:xkK9IvC+gaC9ezrhZGWZlcQPNpWRA0ic

Score

7^/10

discovery vmprotect

Malware Config

Signatures

Executes dropped EXE 55 IoCs

pid	Process
3692	certification.tmp
3884	Certmgr.exe
4844	Certmgr.exe
676	Certmgr.exe
3988	Certmgr.exe
276	Certmgr.exe
2952	Certmgr.exe
4520	Certmgr.exe
4228	Certmgr.exe
3388	Certmgr.exe
1124	Certmgr.exe
2888	Certmgr.exe
2084	Certmgr.exe
1856	Certmgr.exe
1028	Certmgr.exe
3704	Certmgr.exe
4000	Certmgr.exe
2744	Certmgr.exe
1148	Certmgr.exe
3148	Certmgr.exe
4988	Certmgr.exe
4692	Certmgr.exe
3760	Certmgr.exe
1868	Certmgr.exe
3212	Certmgr.exe
3940	Certmgr.exe
1992	Certmgr.exe
5044	Certmgr.exe
1936	Certmgr.exe
4688	Certmgr.exe
2800	Certmgr.exe
1192	Certmgr.exe
664	Certmgr.exe
4388	Certmgr.exe
3328	Certmgr.exe
1096	Certmgr.exe
3084	Certmgr.exe
1940	Certmgr.exe
2020	Certmgr.exe
2320	Certmgr.exe
2776	Certmgr.exe
5048	Certmgr.exe
3140	Certmgr.exe
4724	Certmgr.exe
5008	Certmgr.exe
4720	Certmgr.exe
2148	Certmgr.exe
3884	Certmgr.exe
2388	Certmgr.exe
3988	Certmgr.exe
2936	Certmgr.exe
2784	Certmgr.exe
2952	Certmgr.exe
1216	Certmgr.exe
3460	Certmgr.exe

Loads dropped DLL 2 IoCs

pid	Process
3692	certification.tmp
3692	certification.tmp

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/1144-282-0x0000000000EA0000-0x00000000024EE000-memory.dmp	vmprotect

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 37 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\is-LDTVR.tmp	certification.tmp
File created	C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\is-ERIR9.tmp	certification.tmp
File created	C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\is-4M6CH.tmp	certification.tmp
File created	C:\Program Files (x86)\Pikacu Test CA Truster\is-L7LGE.tmp	certification.tmp
File created	C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\is-T1R69.tmp	certification.tmp
File created	C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\is-F26G7.tmp	certification.tmp
File created	C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\is-03UVK.tmp	certification.tmp
File created	C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\is-IA5VT.tmp	certification.tmp
File created	C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\is-AHNJ9.tmp	certification.tmp
File created	C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\is-8MU44.tmp	certification.tmp
File created	C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\is-2UML6.tmp	certification.tmp
File created	C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\is-V12HB.tmp	certification.tmp
File opened for modification	C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe	certification.tmp
File created	C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\is-BI8TB.tmp	certification.tmp
File created	C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\is-NQGLG.tmp	certification.tmp
File created	C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\is-E0L1M.tmp	certification.tmp
File created	C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\is-TL9US.tmp	certification.tmp
File created	C:\Program Files (x86)\Pikacu Test CA Truster\unins000.dat	certification.tmp
File created	C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\is-8AUJB.tmp	certification.tmp
File created	C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\is-EJEC8.tmp	certification.tmp
File created	C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\is-CAKQP.tmp	certification.tmp
File created	C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\is-LK121.tmp	certification.tmp
File created	C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\is-KJJAF.tmp	certification.tmp
File created	C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\is-6P5ES.tmp	certification.tmp
File created	C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\is-3090I.tmp	certification.tmp
File created	C:\Program Files (x86)\Pikacu Test CA Truster\is-9M9EQ.tmp	certification.tmp
File created	C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\is-T2HSR.tmp	certification.tmp
File created	C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\is-2USKD.tmp	certification.tmp
File created	C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\is-V62UA.tmp	certification.tmp
File created	C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\is-KI7NI.tmp	certification.tmp
File created	C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\is-U2J3V.tmp	certification.tmp
File created	C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\is-1J1D7.tmp	certification.tmp
File created	C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\is-70JJ2.tmp	certification.tmp
File created	C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\is-UG1O9.tmp	certification.tmp
File created	C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\is-DELOV.tmp	certification.tmp
File opened for modification	C:\Program Files (x86)\Pikacu Test CA Truster\unins000.dat	certification.tmp
File created	C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\is-GJ2AC.tmp	certification.tmp

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe

System Location Discovery: System Language Discovery 1 TTPs 60 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mode.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ember.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	certification.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	certification.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Certmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008d80a76efe9fdb01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d9e2a96efe9fdb01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005bc7aa6dfe9fdb01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000082e74c6efe9fdb01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000311f76dfe9fdb01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000327ec66efe9fdb01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000027fb406efe9fdb01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003a1cc46efe9fdb01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe

Modifies system certificate store 2 TTPs 64 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CRLs\3F0B29CB5298144A59285029DFF0970E27902279\Blob = 0300000001000000140000003f0b29cb5298144a59285029dff0970e279022792100000001000000140300003082031030820178020101300d06092a864886f70d01010b05003081f4310b300906035504061302434e3121301f060355040a131850696b61636875205472757374204e6574776f726b20434131283026060355040b131f50696b616368752043657274696669636174696f6e20417574686f72697479311c301a0603550403131350696b616368752055454649205375622043413121301f06092a864886f70d01090116127565666963614063657274732e75732e6b6731253023060355040d131c50696b616368752055454649204b65792045786368616e67652043413130302e060355040d0c27e79aaee58da1e4b89855454649e5af86e992a5e4baa4e68da2e8af81e4b9a6e4b8ade997b44341170d3030303130313030303030305a170d3234313233313233353935395aa04f304d301f0603551d230418301680149c13d47d6de9deedcc6b06caa2d598ca63b17f0e301e0603551d1204173015821350696b61636875205545464920537562204341300a0603551d140403020101300d06092a864886f70d01010b050003820181008eee90af22287d9510dc05fc764a7f97c0533b0c2d4e901e4d9ce7f2e191b1556e90535b65501e0e6d301afb1fe34272ee79098a2769dd896b4375634cfb7b4463f11184f95708d43876aed4751362b4bb791da09d4856e6c912a3b9ac23028cfc525a62ce75567d2a6545a73bb1b8ecd6d8663e6606454d8ecc172477532afee3f39e3e236fe3c200c20301cf15e33c547cc7fde29daefef8b20ba567f81021bc988936b6b2a81e56bb4ff0976b17834d167bd9ee3a2f23ddba6238b067055aa0d1db26c52f6af079bbbdf683a26ecc95f8b347722c53209b5c553f047ec980cdfe3afc1a86ca408f00fd3b10cd18dd6f5017294e690fa66b869dc81ef2a03018a2433b6a7d25bf50de7e9ff04087666168766220af46a46d7c969b1b24e5b40e97cffddd1cc50e1ed341106c565256e3c0cfd114c0ee35e63546c0ed1cb36e6d8c178484a65c81287928449aba6fcd8a7b6b393258a1bc081241759d4014a622e3fdced01ef9350799183eb7431cbe9cfba54d44f612348c70294aeb781946	Certmgr.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DB29F7A0DA6210199D4FCC6E02BB1CFB29691E2C\Blob = 030000000100000014000000db29f7a0da6210199d4fcc6e02bb1cfb29691e2c20000000010000006f0900003082096b30820753a003020102020827451029eb3e0322300d06092a864886f70d01010c05003081f5310b300906035504061302434e3121301f060355040a131850696b61636875205472757374204e6574776f726b20434131283026060355040b131f50696b616368752043657274696669636174696f6e20417574686f72697479311c301a0603550403131350696b616368752054657374204341205253413121301f06092a864886f70d01090116127465737463614063657274732e75732e6b6731253023060355040d131c50696b61636875205075626c6963205465737420526f6f74205253413131302f060355040d0c28e79aaee58da1e4b898e585ace585b1e69c8de58aa1e6b58be8af95e6a0b9e8af81e4b9a6205253413020170d3030303130313030303030305a180f32303939313233313233353935395a3081f6310b300906035504061302434e3121301f060355040a131850696b61636875205472757374204e6574776f726b20434131283026060355040b131f50696b616368752043657274696669636174696f6e20417574686f72697479311c301a0603550403131350696b616368752046696c65205375622043413121301f06092a864886f70d010901161266696c6563614063657274732e75732e6b6731253023060355040d131c50696b616368752046696c65205369676e6e696e672053756220434131323030060355040d0c29e79aaee58da1e4b898e585ace585b1e6b58be8af95e69687e4bbb6e58aa0e5af86e4b8ade997b44341308201a2300d06092a864886f70d01010105000382018f003082018a0282018100af2dd4f5a842b810521c14e3c227c60548c435f333bcad124138c89c66e1f4115361d1be6a17730d85d77bcf43bc420aa758e7aed080b3f4a425c49efe8f6d7aaab9878f7612cfca7d667c9dc7462152f65bbf9ff19c9c264b0bdedf090873bc289d1ad1e81adc5c9cc444976a7f3447a216791860336d3b6dc8c7571822679776cc47b5bc4591c17dfa82bf2747e24b84841d3872a49e343ed6eff1196130dcd5d9de9539717f18deb110362095e39ecd14e3f65797b3a511e26fc5bffcb2dc17f050d06cb13edf5dda192220dae504e5cd6f0b5017b3b542b48c54e21bfc8e803125c01518b6143c7e61b385e5c52f52f02be33b77ca8c72bce3967cb9cbb73a610fc27577e322e4371ebf1ecd418d5abb7a6494404d368e83baa9338bc23a4fce507db97b4d29ed268d06adf65c0ee557a0afa8bb059eada43292be9817474953154aa2174eed4af6818b2df3ed1d0aca0e6c4831723986241923d187b9adb1cfa1862d68f2692899595080b4a9a293da0a56dd92b919a0b6ae374f704f6b0203010001a38203783082037430120603551d130101ff040830060101ff020101301d0603551d0e04160414a37a31a2c4918caa1468ad0da3bc6bd471afe81b301f0603551d230418301680143f40532e376cba8e321f2f6a9e555870627d7693300f0603551d0f0101ff04050303073780304f0603551d250101ff044530430604551d2000060a2b0601040182370a0304060b2b0601040182370a030401060a2b0601040182370a030b060a2b060104018237430101060a2b060104018237430102301e0603551d1104173015821350696b616368752046696c652053756220434130818b0603551d200481833081803007060567810c0101300a06086086480186f842013069060d2b0601040182a464c628812d003058302506082b06010505070201161968747470733a2f2f746573742e63657274732e75732e6b672f302f06082b06010505070201162368747470733a2f2f70696b61636875696d2e6769746875622e696f2f7465737463612f3082012606082b060105050701010482011830820114302406082b060105050730018618687474703a2f2f746573742e6f637370732e75732e6b672f302606082b06010505073001861a687474703a2f2f746573742e6f637370732e6f706b672e636e2f303c06082b06010505073002863068747470733a2f2f746573742e63657274732e75732e6b672f63657274732f726f6f7463612f726f6f7463612e637274304606082b06010505073002863a68747470733a2f2f70696b61636875696d2e6769746875622e696f2f7465737463612f63657274732f726f6f7463612f726f6f7463612e637274303e06082b06010505073002863268747470733a2f2f746573742e63657274732e6f706b672e636e2f63657274732f726f6f7463612f726f6f7463612e6372743081bf0603551d1f0481b73081b43036a034a032863068747470733a2f2f746573742e63657274732e75732e6b672f63657274732f726f6f7463612f726f6f7463612e63726c3040a03ea03c863a68747470733a2f2f70696b61636875696d2e6769746875622e696f2f7465737463612f63657274732f726f6f7463612f726f6f7463612e63726c3038a036a034863268747470733a2f2f746573742e63657274732e6f706b672e636e2f63657274732f726f6f7463612f726f6f7463612e63726c302206096086480186f842010d0415161350696b616368752046696c6520537562204341300d06092a864886f70d01010c050003820201005b86d3b187eea7d0ca98cd3d3626057f5615116b92a346ff359743fdcd8059c22edb02856083279685a40400abf0f50fbf55dfc2d4941ce8d52bc18209dc65d5c9077546ba40f13940bfe0d3129d5e8f50f93ffbe98fb2db1d35d0666ab3f48e7c943d6d8f2feb7c9a76296bc0d8b511ee33a276d4224557fc59390dae97e8e24419f20301d9af08a7bf08747139ef5231852eecb5f99f0fde48174cc4210f716c5d0d1dee10f6417685231b9285424fd1d6eec45298fff2563b534650b692e04bbf1585770f277ca7ccd1222553ca1fb7d60ac61d551e1fad91babbf6bd6ae9ce74385f29d59bdcfd85fbb101f2f2e0ce63fa1559ce372849aa0c7ad206325fd2ea032b1a1b44749fb4ec05ebaba0f260af4d6ce6224b8c03bfd27b147c884100721c710599acfff62e8cc1ea207311587c865a86f25fd4c48c729e7404fcc3bf947a085c098ffac5e88c19af0a23ff7548f0847c20f3588bdc0d3f17689f6773a174452d26fa5fd2e4234b604164aed631164c9a640fea7acc8a6df96b1e7436a27fa82422267049ba1aeb8c3cea5614df0104b07aead10c5e6ddc66ffe39e6656df92603a1ee80dc966d78339e3dbe3c1cd1c1caf06bb3804fad541ae933749697448c491a0df2c9ef46d47c0445a2b4f59f7fd07e205461d611fd842393009bb4aa178e0ffa4036e5ffd77aa350e0d118acab3aa28ab33b676921fb1ffd8	Certmgr.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CRLs\55D5F5D1A1608C7D81101CA464FCEAF3EABE1FA9\Blob = 03000000010000001400000055d5f5d1a1608c7d81101ca464fceaf3eabe1fa9210000000100000016030000308203123082017a020101300d06092a864886f70d01010b05003081f6310b300906035504061302434e3121301f060355040a131850696b61636875205472757374204e6574776f726b20434131283026060355040b131f50696b616368752043657274696669636174696f6e20417574686f72697479311c301a0603550403131350696b6163687520436f6465205375622043413121301f06092a864886f70d0109011612636f646563614063657274732e75732e6b6731253023060355040d131c50696b6163687520436f6465205369676e6e696e672053756220434131323030060355040d0c29e79aaee58da1e4b898e585ace585b1e6b58be8af95e4bba3e7a081e8af81e4b9a6e4b8ade997b44341170d3030303130313030303030305a170d3234313233313233353935395aa04f304d301f0603551d23041830168014574722073f78800ef2b566ba6e2166f39908176e301e0603551d1204173015821350696b6163687520436f646520537562204341300a0603551d140403020101300d06092a864886f70d01010b050003820181007ba7b2b10ac2bb2de98a58a1b2a05af36713e158037e8e2d0b14770daf799792f2349c627961f2e070e9ccca735980e2a2dee18519478900776d4ab0de4c9df6a2c6468b293ca5048e8fa0e8015a5ee4f45457977f8de7ee4654c84b4c8a4bd5642ad576d5a4ca20262007bd00882c4c9f4b5052f14f70bbb2a609ba8cb65d12c07eb0fd16b7f4d08e845dbff1c2e017977d31fcdbc5a66ccf6eb2e14b1b4e2834b457fb3e5429d25b527f4d3b3da34a27def3f948688981008b358b06d56b50621e9288421491d6a9d1d121132dc00f0984077414e718fd957fbfbd7bd68aa84c6721f266b4a71f1c496e6ec0ef8ea6c3a0679111cfa112f9f925f4b72a88373d01651fb0813abc03fee936d9dc4f098a56f65106e2c71866ca997d4e4a8a213b418911bcfea4a4ab604107119c91ac0227477c5a7bef335cb84572deebdb113a85f2f40fd8645c4eb73df14a074bdda6719d81b639469d34c078610b627bbe6b14a6993068fb4b2913536b8e5732ecb5f91d3512e2218526eff76fd75f084d	Certmgr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E31FB52CA9A9B4149993EC1409A60075682C6059	Certmgr.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CRLs\CB11D2BAC13DE452846EDB375FA713EFF38B44CE\Blob = 030000000100000014000000cb11d2bac13de452846edb375fa713eff38b44ce210000000100000016030000308203123082017a020101300d06092a864886f70d01010b05003081f6310b300906035504061302434e3121301f060355040a131850696b61636875205472757374204e6574776f726b20434131283026060355040b131f50696b616368752043657274696669636174696f6e20417574686f72697479311c301a0603550403131350696b61636875205369676e205375622043413121301f06092a864886f70d01090116127369676e63614063657274732e75732e6b6731253023060355040d131c50696b6163687520446f6373205369676e6e696e672053756220434131323030060355040d0c29e79aaee58da1e4b898e585ace585b1e6b58be8af95e69687e6a1a3e7adbee5908de4b8ade997b44341170d3030303130313030303030305a170d3234313233313233353935395aa04f304d301f0603551d230418301680141cf45af22f134455722e7f472c8a2b1e7eb57d54301e0603551d1204173015821350696b61636875205369676e20537562204341300a0603551d140403020101300d06092a864886f70d01010b05000382018100bcebb2d5f59498ec7ce8eca6dc9a147568a8f51c4aad0692fe24a3c64e0c87823c71b67bdc9065394dceb9354aa979bb803beb316b74b5015126563c38b02fa041887e015cc1553cdf577b05468a52548e39cc9c6261f5177ad42aeace94282fdf62ca82ad697578fb096b841884661877d283ecc483eb669a7ac03a12b5dc19b2e9b2ee9416559bf9c8e16b3334d787bff1480383de42bb57b5db8d1f7731b6954037a110f4cc371e2f7f62438bdc69e5d5ac1775816a2b3508909daf4093621ac3e8082eec6239490012e7082c9862760c001dc751dd7845581202d5a3999c2ff81a52d46bd1642e846ca392a4c08b91bb47865931835162477e86dedaed04f35d1cf431f201cfee4e9a58c2980812611b31d4a3d0e132cb20f5c2ca7e7e88a30e9507a05fa608a37a81a62b9df692a0794a311dac5786eb5408e93e5895ceec46016e9b56eeb4ebbabbdc559ff9ef378ec39d8546c6c0ba2c6e0cfa06de1eeb46c69e0b74913175907d27185c1fd8ea612dfd4e1282ad87d8493508b4b575	Certmgr.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CRLs\55D5F5D1A1608C7D81101CA464FCEAF3EABE1FA9	Certmgr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CRLs\4DA3E72A06BAC305B1DB19621AA11E78F4C035EF	Certmgr.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CRLs\CB11D2BAC13DE452846EDB375FA713EFF38B44CE	Certmgr.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CRLs\B3EA425901374A8C622AA716586E1058A55556C3\Blob = 030000000100000014000000b3ea425901374a8c622aa716586e1058a55556c32100000001000000950300003082039130820179020101300d06092a864886f70d01010b05003081f5310b300906035504061302434e3121301f060355040a131850696b61636875205472757374204e6574776f726b20434131283026060355040b131f50696b616368752043657274696669636174696f6e20417574686f72697479311c301a0603550403131350696b616368752054657374204341205253413121301f06092a864886f70d01090116127465737463614063657274732e75732e6b6731253023060355040d131c50696b61636875205075626c6963205465737420526f6f74205253413131302f060355040d0c28e79aaee58da1e4b898e585ace585b1e69c8de58aa1e6b58be8af95e6a0b9e8af81e4b9a620525341170d3235303130313030303030305a170d3439313233313233353935395aa04f304d301f0603551d230418301680143f40532e376cba8e321f2f6a9e555870627d7693301e0603551d1204173015821350696b61636875205465737420434120525341300a0603551d140403020102300d06092a864886f70d01010b0500038202010080c1156a5464be8613aac4b4a5676766316f27c5802e78f016dad549c1315a1e123e04c1c34f6c5165221880189b4515ca7a37d984941ff444827d75e031b79fd338a69a94efd8e040abb177e61b0351f18ab20fcafc84470a1ef344ad5ffe82da31238546e6c289da1daedf4bb1eb44af6f98a53a4eeca64a0ccce6644f315e77316fe129d3ad63413bf7db3195693b37521058701ece1eda5239942ce78e14f9183417ebf5115e509d1553e8d55bcffbbb77a581f0d9551232c78a8353df1baeb18996b8fad3933cf45ae499211ccd74832983b404cccca5d7dd9bf75f1c67927afd401b4969e009857cd87133f855bfa51094d34f86f37b31d0e6c3e6e7e4bcbdcce0a535741a1328db086b2797cfcfcc1b5d3c5bab6456d17a11c6bf08806e50944384e08382bee4abd21df7c006babc49df8a713ccd4aa746ba358a853799a902ad3a9d5f720d04b33db3575e2a2e531e052878ce1abbff4e846b03fe7ee2d8129ec3b5e8cba8b56c92065dcc9ae9458d25e479e94c59c872873c962e1cdd529f9f1eedf7a91fa981f526266818666ca6caec6fa7f5b98732cc5c9cf7186a7184250ba3593a162246392369130f2ef5f002d5f1b6b46951923b083c751bc87234c706346aca71780cf944fc8e8e87ea30a8aba0b2dd969f73620ae525af0fad54daa820ccd2627703183624fbfa5750d4e13a6198820074c6f900e699d7	Certmgr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CRLs\6018A3BEA1D46E275A46B7D29D8BDE16C4AFF07F	Certmgr.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CRLs\3BFFE2A757368CE0F9897F67107AF009AA5E49B7\Blob = 0300000001000000140000003bffe2a757368ce0f9897f67107af009aa5e49b7210000000100000016030000308203123082017a020101300d06092a864886f70d01010b05003081f6310b300906035504061302434e3121301f060355040a131850696b61636875205472757374204e6574776f726b20434131283026060355040b131f50696b616368752043657274696669636174696f6e20417574686f72697479311c301a0603550403131350696b616368752041757468205375622043413121301f06092a864886f70d01090116126175746863614063657274732e75732e6b6731253023060355040d131c50696b616368752041757468205369676e6e696e672053756220434131323030060355040d0c29e79aaee58da1e4b898e585ace585b1e6b58be8af95e8baabe4bbbde8aea4e8af81e4b8ade997b44341170d3030303130313030303030305a170d3234313233313233353935395aa04f304d301f0603551d2304183016801415da2f56ce08df2d35391dfe16a4e7167d9b8846301e0603551d1204173015821350696b61636875204175746820537562204341300a0603551d140403020101300d06092a864886f70d01010b050003820181008b8e9987e26dcecdcfeebe6420467643b39590b9356a4723c2a43c3cb56c2474afa0fee23e392df3aee038cb005e29904f0c67f065ba44e32e59931a9622e1733f587505e38261d542ee644ba8a334a65ec6aa314289746fc11c71530fb2283eb9bf8e2d4cc8aadcd197fcd193fa8891fd11c3cd3ba8c945bee66455030c6f414a4ee182c0ec74f88d914143f2557cd4b0f2cac1d3522dce03f1105bc8fa5038c81f737e7c43d655a0216d72a1171db695cc3ddcbbdf2f005e0a827c25aeaf8c970e0705284451ec1264f0e66a7b2341be431d29aac8e4ba1644415209f18ade473fe04c22a85c4453a02555fe776ddd3e09c36d98d63dfedd3a25586fb37f75a39bc25710abb7be1c6c10d818d93015e67e7697017839f9ae6bd3fc8e53188ade14424e66064e24a188b21b5e56b09ec0d735223c6e460ece8e76bde01ccc00dec88b6a33292e2a06ce227ed4f993041df58d6297787bdbb66c3fe55ad34c7742a36150063ac5b237a5de6e61f3ce1611666f74bb8b63d9cc8c898a26c78e9d	Certmgr.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CRLs\7913E88105B1EFE9BF37A2AA74B55986AD4E0CC8\Blob = 0300000001000000140000007913e88105b1efe9bf37a2aa74b55986ad4e0cc8210000000100000016030000308203123082017a020101300d06092a864886f70d01010b05003081f6310b300906035504061302434e3121301f060355040a131850696b61636875205472757374204e6574776f726b20434131283026060355040b131f50696b616368752043657274696669636174696f6e20417574686f72697479311c301a0603550403131350696b616368752041757468205375622043413121301f06092a864886f70d01090116126175746863614063657274732e75732e6b6731253023060355040d131c50696b616368752041757468205369676e6e696e672053756220434131323030060355040d0c29e79aaee58da1e4b898e585ace585b1e6b58be8af95e8baabe4bbbde8aea4e8af81e4b8ade997b44341170d3235303130313030303030305a170d3439313233313233353935395aa04f304d301f0603551d2304183016801415da2f56ce08df2d35391dfe16a4e7167d9b8846301e0603551d1204173015821350696b61636875204175746820537562204341300a0603551d140403020102300d06092a864886f70d01010b0500038201810051a3687d6a5c482dca983f14928cf34790bcc4f67a82bd4a24a4c5c1644ff55fa660442da3f365bbc82d90f736f4263819f07eb5d6305ca24472cc3c18ec27801aaf42854e16b4f6d927126ee8bbfcbf0481b74e65a90648af3f1467ce99ce4df9d04060315fe8c2b2d113bdb25a1e6add1c00329fc474b85c1e463cdad3d2963b9f50f392326ab4079c10079bba3dfeb555277499f910857b569ac36e74213573a16dcad011af3a22291b617b74d632a22624ddf1059968d52b045da24ceb26b0090c97d5128f1ebf2b796516423358df99aa829c3f6eb9702b445b170e93e0cf45d6025a607d16d2f178ad7e55cf5b4a5cf88e8dcb4e053e6c85f36ba48adde4145eae834a2650ee088df35c71c0e6edbe4b591704922e2fa4abff39c45f06140fbeed8335cce9dc9a13523f4e9e9547d904f8ef060d3ca1e70a64f61f992d3afae27d4fd020db79307fce35242aa0ab2873840d58ded8ba59e65aae0fb4fa9036682a4fca18e5ca4dc9dfdfcb528753a51db93d2fde58a7a32fc0e588e102	Certmgr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CRLs\F088C7C2BB52A7ECD3E47309A3C87268FC307983	Certmgr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CRLs\CB11D2BAC13DE452846EDB375FA713EFF38B44CE	Certmgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1736937623-2710279395-1526620350-1000\Software\Microsoft\SystemCertificates\AuthRoot\Certificates\F57DF00CEB2476C8144B751F1D2D45EDBB3EDFE1\Blob = 030000000100000014000000f57df00ceb2476c8144b751f1d2d45edbb3edfe12000000001000000c20a000030820abe308208a6a00302010202087f7c81149fe39151300d06092a864886f70d01010d05003081f5310b300906035504061302434e3121301f060355040a131850696b61636875205472757374204e6574776f726b20434131283026060355040b131f50696b616368752043657274696669636174696f6e20417574686f72697479311c301a0603550403131350696b616368752054657374204341205253413121301f06092a864886f70d01090116127465737463614063657274732e75732e6b6731253023060355040d131c50696b61636875205075626c6963205465737420526f6f74205253413131302f060355040d0c28e79aaee58da1e4b898e585ace585b1e69c8de58aa1e6b58be8af95e6a0b9e8af81e4b9a6205253413020170d3030303130313030303030305a180f32303939313233313233353935395a3081f5310b300906035504061302434e3121301f060355040a131850696b61636875205472757374204e6574776f726b20434131283026060355040b131f50696b616368752043657274696669636174696f6e20417574686f72697479311c301a0603550403131350696b616368752054657374204341205253413121301f06092a864886f70d01090116127465737463614063657274732e75732e6b6731253023060355040d131c50696b61636875205075626c6963205465737420526f6f74205253413131302f060355040d0c28e79aaee58da1e4b898e585ace585b1e69c8de58aa1e6b58be8af95e6a0b9e8af81e4b9a62052534130820222300d06092a864886f70d01010105000382020f003082020a0282020100cc8a666400ea743698024184c77df195fa3fea65a55d91d20ac3f28f41609fa51ab21a0fd9a379fa82a010aadd4540b88de2ee2a7a865bd690b891a4000814717120ce7b9e130cfeea1f34ffc02e75e741c46a29413d8024f4941f6563a0e446352c7f9ad8d29581c820a0ad151a58608cd33065b190678ed8f45c24da13e89913d7f4548a670a1859450b9ebed3c5253c1951dfbd039e5f5afe36e5cc0b454d8f6a692b8d313df445fa98466bd77311a3f1c6f65a4642a609d0c640e284af71f19add28db8ae9d6e5d37a8bfc4271484749c0ab2d48f793acea9f75983c10a82295a20384b0382c2a18dcd25d68f29821e3b9818ad6b89adc5a20d396e06df6231bfedc516436d0ee048c3c362c32f0e736bcfb88d3242ef96da5951e21322876b2b11e0098ea3f7011bf587b12151fa961da245315eede2e7278cb0870357500aefd4658ef903e900c24a275ce31b82ebd1f3eafe330e1d31a2623fe27b99c9b1019a81c07b73175f48a41172b4519b8c19e6d58243839d6471a2e1b8006c281f6d085f60cfcf8c8bfbe2e751160d6c7c7cdf581a78cc8425a14fdd1d7605b22b29d25c9dbe2912b664ff9140c6e33b20c27c5ba783cdf775e194fb75784cbe319203ca8baa8bc99d42c57cf948aa5706bdd52a385ee4b85f607cc1bebfa7e042d8c605ebe584ef858d1786a6bcba2f43245111bf445d205872f396f115b590203010001a382044c3082044830120603551d130101ff040830060101ff020102301d0603551d0e041604143f40532e376cba8e321f2f6a9e555870627d7693308201150603551d230482010c30820108a181fba481f83081f5310b300906035504061302434e3121301f060355040a131850696b61636875205472757374204e6574776f726b20434131283026060355040b131f50696b616368752043657274696669636174696f6e20417574686f72697479311c301a0603550403131350696b616368752054657374204341205253413121301f06092a864886f70d01090116127465737463614063657274732e75732e6b6731253023060355040d131c50696b61636875205075626c6963205465737420526f6f74205253413131302f060355040d0c28e79aaee58da1e4b898e585ace585b1e69c8de58aa1e6b58be8af95e6a0b9e8af81e4b9a62052534182087f7c81149fe39151300f0603551d0f0101ff0405030307ff8030180603551d250101ff040e300c0604551d20000604551d2500301e0603551d1104173015821350696b6163687520546573742043412052534130818b0603551d200481833081803007060567810c0101300a06086086480186f842013069060d2b0601040182a464c628812d003058302506082b06010505070201161968747470733a2f2f746573742e63657274732e75732e6b672f302f06082b06010505070201162368747470733a2f2f70696b61636875696d2e6769746875622e696f2f7465737463612f3082012606082b060105050701010482011830820114302406082b060105050730018618687474703a2f2f746573742e6f637370732e75732e6b672f302606082b06010505073001861a687474703a2f2f746573742e6f637370732e6f706b672e636e2f303c06082b06010505073002863068747470733a2f2f746573742e63657274732e75732e6b672f63657274732f726f6f7463612f726f6f7463612e637274304606082b06010505073002863a68747470733a2f2f70696b61636875696d2e6769746875622e696f2f7465737463612f63657274732f726f6f7463612f726f6f7463612e637274303e06082b06010505073002863268747470733a2f2f746573742e63657274732e6f706b672e636e2f63657274732f726f6f7463612f726f6f7463612e6372743081bf0603551d1f0481b73081b43036a034a032863068747470733a2f2f746573742e63657274732e75732e6b672f63657274732f726f6f7463612f726f6f7463612e63726c3040a03ea03c863a68747470733a2f2f70696b61636875696d2e6769746875622e696f2f7465737463612f63657274732f726f6f7463612f726f6f7463612e63726c3038a036a034863268747470733a2f2f746573742e63657274732e6f706b672e636e2f63657274732f726f6f7463612f726f6f7463612e63726c301106096086480186f8420101040403020007302206096086480186f842010d0415161350696b61636875205465737420434120525341300d06092a864886f70d01010d050003820201005774877fbea6f3ea17500a4442cd839a3dcef2e4dca65f3b88cb792f5c8983d7b2ed658e845cef3af3b37dda4b83b467b073dc31a9bbc133fd52334c14b03dda111f710d283b26652b2539269989d3903dfd261ce2af5e350751d36f593fe09533ea7917a8957bd90bba825c87c659618d467edaf8d2eb8f762a27a0576c2a11f849a01d60f7afc88e38bf6cfb3f7a6efcb63771678e680e3f1cd36c7e842c6a4d90949ecb29145b71ab108bea972683c7b3b863c10d2d9558b2f00ae9c15b8a00ddfe9ceb96594cc113a607cc042e5c50ad53b830d57b3bcc860179655476419751a48c66d4c25ac4386107c557c584d802039ecd185e5e3c039c8358976ed7acb44b0bb4e5900631c9525ff151ad65754d7d6ca3aca542f06598ec69d01b47e435ae5712c326ce02dff1620d8958f1452dc08b9a3286aaee870481d0711d02fb470d03fea5f25a1da47eaf71028f37af6561eeeae8194a23d70b813daf33412f0ddbb3b637d2070359f905c5ea12ee090213fb4c23e4697e1200dac7fcd265e31dc071273f2004c811c054bdb5fbbd63cb88597f328d72047beee9f9d265e7d4c6e38739663a9af5fabcfb9d004165450368c01bcec1ddf2077daed5eadeefbae3f3c52ad9e51c65dc5823879fc4eab69457647e0fcb9369feda8344cac44cf335b5ace8cdac8ee3a3573e9657f91241777419d377b4837c3a8522c2599a1c	Certmgr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CRLs\E722DAE3606960924663C3050F0E8D243D91B05B	Certmgr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\73099A0513827CA867F7C948A3E78FD578644A43	Certmgr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CRLs\3F0B29CB5298144A59285029DFF0970E27902279	Certmgr.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CRLs\1BDD8C9EDEF24B3BA126FDD688103DF55F8288AA\Blob = 0300000001000000140000001bdd8c9edef24b3ba126fdd688103df55f8288aa2100000001000000140300003082031030820178020101300d06092a864886f70d01010b05003081f4310b300906035504061302434e3121301f060355040a131850696b61636875205472757374204e6574776f726b20434131283026060355040b131f50696b616368752043657274696669636174696f6e20417574686f72697479311c301a0603550403131350696b61636875206d544c53205375622043413121301f06092a864886f70d01090116126d746c7363614063657274732e75732e6b6731253023060355040d131c50696b61636875206d544c53205369676e6e696e67205375622043413130302e060355040d0c27e79aaee58da1e4b898e585ace585b1e6b58be8af9553534c33e8af81e4b9a6e4b8ade997b44341170d3030303130313030303030305a170d3234313233313233353935395aa04f304d301f0603551d230418301680144d2cb91aad238d687d5c131f89dcf05bfe55828b301e0603551d1204173015821350696b61636875206d544c5320537562204341300a0603551d140403020101300d06092a864886f70d01010b050003820181007db299597ec34f3cb8b22721755011f713b032a6d9dc8917415e448c85d7b5fab30ce35e080779eeb613d102ac88fc46030828332536afb9878a5a55322f9dabdeda9967fab6835c626402c4e00fdbc9443c9ebc1df109c5233b0f8a6bd00f2b6820af9cd69d671f4b937d374e4ca6139f6b77da096bca15e6a65a0b420f059f81c23c1df63a6ecb7e8937409147913144e23b53a196048321f7cb5323f6419844921414e43381d4aae53b68da5b061e96fbd034341ee5e0c55b9e95a867951ad922d5af830c3c37b88e334d3b8c31bc3be913bba2661a4a47b9161eb4e36a961dd1ccf3255d1c8fb1294e8ac6f35706460b1c0f49c73cfdc0d8d06889e005355cc25c88e2636f8670ad2739642bca9a7150db5e6ca8419760146f9c4c4d706bd80b6cb3b558d7a0e5a070f85a244b811298d9b1073f733bdd2b574ee85d9cfbb3cd50264c9d264ddf77f0c911ff7b16ea7ae6acbc76e962d7ddcc5de8ddec53fdbf45efcd82504590ba3dfd16b1d57077ee3ae0fddcb3a972c3fc5e51d82d39	Certmgr.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CRLs\52FEDD61CFDDD48FD8F383F628F320723367B3A7	Certmgr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CRLs\B3EA425901374A8C622AA716586E1058A55556C3	Certmgr.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\671E553BC90A19B26F6F55231E5969F4771976BB\Blob = 030000000100000014000000671e553bc90a19b26f6f55231e5969f4771976bb200000000100000048090000308209443082072ca003020102020813eb7d765de6a4d2300d06092a864886f70d01010c05003081f5310b300906035504061302434e3121301f060355040a131850696b61636875205472757374204e6574776f726b20434131283026060355040b131f50696b616368752043657274696669636174696f6e20417574686f72697479311c301a0603550403131350696b616368752054657374204341205253413121301f06092a864886f70d01090116127465737463614063657274732e75732e6b6731253023060355040d131c50696b61636875205075626c6963205465737420526f6f74205253413131302f060355040d0c28e79aaee58da1e4b898e585ace585b1e69c8de58aa1e6b58be8af95e6a0b9e8af81e4b9a6205253413020170d3030303130313030303030305a180f32303939313233313233353935395a3081f6310b300906035504061302434e3121301f060355040a131850696b61636875205472757374204e6574776f726b20434131283026060355040b131f50696b616368752043657274696669636174696f6e20417574686f72697479311c301a0603550403131350696b616368752054696d65205375622043413121301f06092a864886f70d010901161274696d6563614063657274732e75732e6b6731253023060355040d131c50696b616368752054696d65205369676e6e696e672053756220434131323030060355040d0c29e79aaee58da1e4b898e697b6e997b4e688b3e7adbee7bdb2e4b8ade997b44341e5ad90e8af81e4b9a6308201a2300d06092a864886f70d01010105000382018f003082018a0282018100c301f46b0501e9b282a230f167a832ea5cd563773bec120824a775124f7ec0f3af51bc603025f5fba3c53fd637f3988d67b038b00c53653cdb072eb9e0919b312a6ff214f550fe1325181975eeac3025251f395b77cb78118bae074bb2bcf863201e0eb165f482889d7cac414ffa4088d5b151c78c5756fe7961f3b44ea7ef4b874b7e61364848f75349760f3478dc08af5ff824d3e3bc14885066da194dcccb99155f2658d13af9dcaf1f209a79839f42996c592c3c6f0b7133ed89c17054d1d75491a46591c2629f831dae5aacc35cbde6dd3af1f446e7c2386320b22456895fe83b416978561626f357b2149895fa15b38cef6832dfec7bc9f98e2b41e5f6a59a0b4e584db11f0e46ab65c9de331937f8380d5e9b47d9dd01dc434f4d7c63951dac86829c714e79f75b650bd12826682f69786d0f439ff8474e3100bf224cda7e135c9e91b3e5dc1a3e3bda9f880d6513d69081878b808aa82db724e457e9b2157becbc32e1b23dc49d0d4d0668728447907ca9cfd031b1d6ac92b10700ed0203010001a38203513082034d30120603551d130101ff040830060101ff020101301d0603551d0e041604146f18ddbf2922ef3d0fbe2a1c1018202e1a3b86a7301f0603551d230418301680143f40532e376cba8e321f2f6a9e555870627d7693300e0603551d0f0101ff04040302018630160603551d250101ff040c300a06082b06010505070308301e0603551d1104173015821350696b616368752054696d652053756220434130818b0603551d200481833081803007060567810c0101300a06086086480186f842013069060d2b0601040182a464c628812d003058302506082b06010505070201161968747470733a2f2f746573742e63657274732e75732e6b672f302f06082b06010505070201162368747470733a2f2f70696b61636875696d2e6769746875622e696f2f7465737463612f3082012606082b060105050701010482011830820114302406082b060105050730018618687474703a2f2f746573742e6f637370732e75732e6b672f302606082b06010505073001861a687474703a2f2f746573742e6f637370732e6f706b672e636e2f303c06082b06010505073002863068747470733a2f2f746573742e63657274732e75732e6b672f63657274732f726f6f7463612f726f6f7463612e637274304606082b06010505073002863a68747470733a2f2f70696b61636875696d2e6769746875622e696f2f7465737463612f63657274732f726f6f7463612f726f6f7463612e637274303e06082b06010505073002863268747470733a2f2f746573742e63657274732e6f706b672e636e2f63657274732f726f6f7463612f726f6f7463612e6372743081bf0603551d1f0481b73081b43036a034a032863068747470733a2f2f746573742e63657274732e75732e6b672f63657274732f726f6f7463612f726f6f7463612e63726c3040a03ea03c863a68747470733a2f2f70696b61636875696d2e6769746875622e696f2f7465737463612f63657274732f726f6f7463612f726f6f7463612e63726c3038a036a034863268747470733a2f2f746573742e63657274732e6f706b672e636e2f63657274732f726f6f7463612f726f6f7463612e63726c301106096086480186f8420101040403020011302206096086480186f842010d0415161350696b616368752054696d6520537562204341300d06092a864886f70d01010c0500038202010099c3e6b337e5b317c2be5a4510a22cdf8e190ff4411a9912244eb9b60266acc987ebb3703ee8d77663eb11bffa08ea3ac1def8faa65b884e77ce58a6bea88f9fd6ecb8be5d3c065afefc4e2fe5e92811d05f8668976735546688e07b035dd7d66d52d7276cbb627163eeabb64db0259351da04289664c7710f09f8955f02b9ca249c49017e41c546b3a6f63961c5871cc00508060cb045e4d87a30975b3b1cf671d022ec1466f2bb4e1fec1819195074cfae0f1549d758aecbfe1e066715d864255f4641515c9a349c59e8689facd30d5cb74f14311de61e6a7b24ee692d27f8aa7c92f48f5e6cd9c102e51ad6a1dca22b44706f1844c860d9e5914ca67dfe4f0f94be164d311ddb35fd43a899a6abdf27e111497846e02ae492a9f834b708b653091371eea5f5dc025ab97146ad46d7759294bfa0405c19392668f9a0594c28ed8adfe5f54aa1c06c11ee9ebf46d435913d90166cd5e9a1fc7646a7199cf0209653d03067299431266b68d54d22f74cbbf8d31ac7a574534a2fae26176cdb017dff3f1194284290c73d1812981ca56c0561d34ffea97ce9dd3f2ca24ff1003eebfbd500c81e9daf4b9defb7c43d97eabdb71a7772103289bfb587f44087669a3e53be1c1b306c8ffdb86de232a9830dcfe8347d23c70e7d9b854ed4ca2a380af6236ebfd667fcea83cfd3c99d7cbadfce2ed11fc1e48bbd4b6c2eb6125b79fe	Certmgr.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CRLs\D14BAD674DCE5E8B3E3BEABA654A5982C00EAB2C	Certmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-1736937623-2710279395-1526620350-1000\Software\Microsoft\SystemCertificates\AuthRoot\Certificates\F57DF00CEB2476C8144B751F1D2D45EDBB3EDFE1	Certmgr.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CRLs\3F0B29CB5298144A59285029DFF0970E27902279	Certmgr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5D2C92D132CC97F1DF8506582DE4B1910E1DE0FA	Certmgr.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CRLs\1BDD8C9EDEF24B3BA126FDD688103DF55F8288AA	Certmgr.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CRLs\4DA3E72A06BAC305B1DB19621AA11E78F4C035EF	Certmgr.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AE158C5E8F43FA2C4F32F8C17F42C8217E167BB0\Blob = 030000000100000014000000ae158c5e8f43fa2c4f32f8c17f42c8217e167bb02000000001000000ac0a000030820aa830820890a00302010202080adf9d12db227b9a300d06092a864886f70d01010c05003081f5310b300906035504061302434e3121301f060355040a131850696b61636875205472757374204e6574776f726b20434131283026060355040b131f50696b616368752043657274696669636174696f6e20417574686f72697479311c301a0603550403131350696b616368752054657374204341205253413121301f06092a864886f70d01090116127465737463614063657274732e75732e6b6731253023060355040d131c50696b61636875205075626c6963205465737420526f6f74205253413131302f060355040d0c28e79aaee58da1e4b898e585ace585b1e69c8de58aa1e6b58be8af95e6a0b9e8af81e4b9a6205253413020170d3030303130313030303030305a180f32303939313233313233353935395a3081f6310b300906035504061302434e3121301f060355040a131850696b61636875205472757374204e6574776f726b20434131283026060355040b131f50696b616368752043657274696669636174696f6e20417574686f72697479311c301a0603550403131350696b616368752041757468205375622043413121301f06092a864886f70d01090116126175746863614063657274732e75732e6b6731253023060355040d131c50696b616368752041757468205369676e6e696e672053756220434131323030060355040d0c29e79aaee58da1e4b898e585ace585b1e6b58be8af95e8baabe4bbbde8aea4e8af81e4b8ade997b44341308201a2300d06092a864886f70d01010105000382018f003082018a028201810094f3d1e95f9b6a241e2f173e8a1a6249b4f23b5d43b44bd6e091132d75b35c572cc5fa66edbf51141e4a364fdca8ab776196b32f881da4cfe2b66f510ca6fa3c8bc6524670cfc76f06c9a19f70d00341647cf99314ab6387064a19348ef45e11d5fa14185466474339ec6bfb6236ed0ba0dd599d93adf4e5ee68b2d51b471f9e077f886cd039e1172367332e1b06aef2f989989a4d747d802664dc0feb502f9dacecb0f8920f5353f24fa6b74f547678220d04c8e3bed338d920e5a50a75709c24e1f365c797477751bacd72c7eda76d24b12aa9495e940c784e7a0752ef28b5e896b723a1f097a5c7fb8db3188ed589408cabccf38eba2b239f959e15b95c3930ddf82360712ea03221c37e29dd77765d60401711add70eb19f20e7429351c04c9a24a4f47a6c55770fcd893f1990effd94d402ebfd483afe559da121f0660e1c079ddf96fd50c3d149c4e5394b14544f638dd88551069f54f60f97adc93e46ea5d582b83dc636648afc232ff0bdd6cfdf68370eacfaf481c9d07174503327d0203010001a38204b5308204b130120603551d130101ff040830060101ff020101301d0603551d0e0416041415da2f56ce08df2d35391dfe16a4e7167d9b8846301f0603551d230418301680143f40532e376cba8e321f2f6a9e555870627d7693300f0603551d0f0101ff0405030307ff803082018a0603551d250101ff0482017e3082017a0604551d20000604551d250006082b0601050507031506082b0601050507031606072b06010502030406072b06010401823706092b060104018237150106092b060104018237150506092b060104018237150306092b060104018237150406092b060104018237150606092b060104018237150206092b060104018237150a060a2b0601040182370a0303060a2b0601040182370a0301060a2b0601040182370a0309060a2b0601040182370a030a060a2b0601040182370a0501060a2b0601040182370a0601060a2b0601040182370a060206092b0601040182371402060a2b060104018237140201060a2b060104018237140202060a2b06010401823714020306082b0601050507031706082b0601050507031806082b0601050507031906082b0601050507031a06082b0601050507031b06082b0601050507031c06082b0601050507031d06082b0601050507031e06082b0601050507030506082b0601050507030606082b0601050508020206082b06010505070311301e0603551d1104173015821350696b6163687520417574682053756220434130818b0603551d200481833081803007060567810c0101300a06086086480186f842013069060d2b0601040182a464c628812d003058302506082b06010505070201161968747470733a2f2f746573742e63657274732e75732e6b672f302f06082b06010505070201162368747470733a2f2f70696b61636875696d2e6769746875622e696f2f7465737463612f3082012606082b060105050701010482011830820114302406082b060105050730018618687474703a2f2f746573742e6f637370732e75732e6b672f302606082b06010505073001861a687474703a2f2f746573742e6f637370732e6f706b672e636e2f303c06082b06010505073002863068747470733a2f2f746573742e63657274732e75732e6b672f63657274732f726f6f7463612f726f6f7463612e637274304606082b06010505073002863a68747470733a2f2f70696b61636875696d2e6769746875622e696f2f7465737463612f63657274732f726f6f7463612f726f6f7463612e637274303e06082b06010505073002863268747470733a2f2f746573742e63657274732e6f706b672e636e2f63657274732f726f6f7463612f726f6f7463612e6372743081bf0603551d1f0481b73081b43036a034a032863068747470733a2f2f746573742e63657274732e75732e6b672f63657274732f726f6f7463612f726f6f7463612e63726c3040a03ea03c863a68747470733a2f2f70696b61636875696d2e6769746875622e696f2f7465737463612f63657274732f726f6f7463612f726f6f7463612e63726c3038a036a034863268747470733a2f2f746573742e63657274732e6f706b672e636e2f63657274732f726f6f7463612f726f6f7463612e63726c302206096086480186f842010d0415161350696b61636875204175746820537562204341300d06092a864886f70d01010c05000382020100022fc22910905c183c8aeeda8f280a42ff825cb5ed2a859082175655b8132369d06ab27336689a2adf934c6756fc4d6d47b4f13474f4f8fe360ef8c3ebd1dfa48ccf414443ba8f22ed39037612a633d9d83204dd9d546ae56ef4b2331645ade32e62aee211b694f6175dbefc5a7d11d72eef83c41f3aa83a0f4d875d71f2448bc5ef25c48eda27919bbeff7fcba4dacdebef604db7913e3b6844c5a05c6d9a77a52a71a19da266782ae6f58f77c8841140aa6fab6804a59935e371a0d1a1acb23add3a886562a3f71f349301a7d4639eb37d2878919c6fd77f85a4c5de5531316f675028e2ea037316e775252a22c3b32ed2c1c3c55be701a42f36077d831d4074bcb431cebae74a55bacbe970a043c548f8939ef8c9b70a72bc62fc4574d6040248c7c1dda6503a624ff20a9ed77e3c8c25b123bd88dcee2376dd30ae72ec253af6e379e39a368ef3a0667f07f627bbf70ef53a5eb1bf2cb92684e8857f4d7a21ed3c06fb9a85c9c804bbe3f7a0c5dfb5e1414b7d4962d28ed865e78f8f238d182cc9c540a3ae74d65f2ca0514a75c9fb78f8019997ebe4d1b8dde6d912c102adf3bd7152e8bc9abca2c372c0311c655fe3d97294500e7c77c310980cf28f6c73f8f6c0aaf48651b04d48751cc5daf19d8f88a8d2e7dcdda46224634cdd7966951b72a084c3b62ccabad1517e30e48de69326bcf15eac68ee9dcf00786ff929	Certmgr.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1736937623-2710279395-1526620350-1000\Software\Microsoft\SystemCertificates\AuthRoot\Certificates\F57DF00CEB2476C8144B751F1D2D45EDBB3EDFE1	Certmgr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CRLs\52FEDD61CFDDD48FD8F383F628F320723367B3A7	Certmgr.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CRLs\E722DAE3606960924663C3050F0E8D243D91B05B\Blob = 030000000100000014000000e722dae3606960924663c3050f0e8d243d91b05b210000000100000016030000308203123082017a020101300d06092a864886f70d01010b05003081f6310b300906035504061302434e3121301f060355040a131850696b61636875205472757374204e6574776f726b20434131283026060355040b131f50696b616368752043657274696669636174696f6e20417574686f72697479311c301a0603550403131350696b616368752054696d65205375622043413121301f06092a864886f70d010901161274696d6563614063657274732e75732e6b6731253023060355040d131c50696b616368752054696d65205369676e6e696e672053756220434131323030060355040d0c29e79aaee58da1e4b898e697b6e997b4e688b3e7adbee7bdb2e4b8ade997b44341e5ad90e8af81e4b9a6170d3235303130313030303030305a170d3439313233313233353935395aa04f304d301f0603551d230418301680146f18ddbf2922ef3d0fbe2a1c1018202e1a3b86a7301e0603551d1204173015821350696b616368752054696d6520537562204341300a0603551d140403020102300d06092a864886f70d01010b05000382018100240ae4a06c8f48b2e76de903a13a50150c1f5c37543711fac8f881db3ff2b8427c728dc2bfd7d3cc17a8515a866cf4215bf26a232008c93fd13fa547cab398f645909f7f1ff0fed4820710d00a2c45ad2072dd66d077c380d4e81c92af2bc1370e61055ad5d9a4662e97c5682ba6ef43413423119c2a1950481d295372b9d4c153629e8d4114f0d91662b173de5544378083b1549186f9b1066c07a5151337bd8cb83590906d5add486874025adf60ca6dff887f715e4a06d22c5e8dc4f119f2312bd50eaecd654e635133c9a0396ab8c47f1b38c767fa42d280e1fb521fea1fb3b1473041b23e36a46c2e47779521db76e5ae0e3175452461e899ae908d9a9a9e3e7bf9f15ae776d0ceeb16b847c664fe855e86cf8d99cbf69b29acedd910f1e8a693147a01e546c3e4339ef6920265416445c56031a35422ac99251bede200e47f09ce43ae6c50cc60c25a1c70fd56024c7670a14265110a649f368f9572312e4cf81b591d113d57d1373533dbaa2f4aada1ad01ab7a55a9ccd2cf4cdbe7bb	Certmgr.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CRLs\F1AD12BEA16B8861596FF3713CBF8CD563B7D7AF\Blob = 030000000100000014000000f1ad12bea16b8861596ff3713cbf8cd563b7d7af210000000100000016030000308203123082017a020101300d06092a864886f70d01010b05003081f6310b300906035504061302434e3121301f060355040a131850696b61636875205472757374204e6574776f726b20434131283026060355040b131f50696b616368752043657274696669636174696f6e20417574686f72697479311c301a0603550403131350696b61636875204d61696c205375622043413121301f06092a864886f70d01090116126d61696c63614063657274732e75732e6b6731253023060355040d131c50696b61636875204d61696c205369676e6e696e672053756220434131323030060355040d0c29e79aaee58da1e4b898e585ace585b1e6b58be8af95e982aee4bbb6e58aa0e5af86e4b8ade997b44341170d3235303130313030303030305a170d3439313233313233353935395aa04f304d301f0603551d23041830168014393bd44e6f32debce6d6dd4c7446712917b70aec301e0603551d1204173015821350696b61636875204d61696c20537562204341300a0603551d140403020102300d06092a864886f70d01010b050003820181009646a2a288bb7ce1b92dc2340dd548121557fe9b2943888de31c86009deaaeeba0c287d5ef8d9651a21ec4637c06b50dbe42b35f235f903ec949d92903bf75de0c5ee548c070f5d056ce713aded613d179d087dbeb17f2f3a268f12021001074ae5d20c2894a9845954dc760bdf4f5cf974ade897113af1600115e6111ddfa6f1390a894ba1d5c97a33403a3e96e97baff595441d17bed4737d010f92ce2fe59ce2bac18c780ffe96059e54fe316f9cf811d0d9081e79357822288f42b225a31e89854475b387d9258379b8491e6de4de28243dab5f849ac6553e048762c0eb5854314e295d378442ac1ebafaafa9e94ef50afec048a98e5b3261791ed0948108380b717a447e3631794260eb0f34eff3e2d63df58cb8a007fbe618d7edab80304794bf83cd4f9539b3977a88193b92e11b42986a16a46888d57074e69d805d04e7101cf174dea3ccf89347f54efa7971cc91a0c02a77ad39b209f92e31bcf147e2fd31f80e30013dd8464d8915d34b80b4bc1b71561f1901babfb06ebe73928	Certmgr.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E31FB52CA9A9B4149993EC1409A60075682C6059\Blob = 030000000100000014000000e31fb52ca9a9b4149993ec1409a60075682c6059200000000100000056090000308209523082073aa003020102020809f74369ad6f880f300d06092a864886f70d01010c05003081f5310b300906035504061302434e3121301f060355040a131850696b61636875205472757374204e6574776f726b20434131283026060355040b131f50696b616368752043657274696669636174696f6e20417574686f72697479311c301a0603550403131350696b616368752054657374204341205253413121301f06092a864886f70d01090116127465737463614063657274732e75732e6b6731253023060355040d131c50696b61636875205075626c6963205465737420526f6f74205253413131302f060355040d0c28e79aaee58da1e4b898e585ace585b1e69c8de58aa1e6b58be8af95e6a0b9e8af81e4b9a6205253413020170d3030303130313030303030305a180f32303939313233313233353935395a3081f4310b300906035504061302434e3121301f060355040a131850696b61636875205472757374204e6574776f726b20434131283026060355040b131f50696b616368752043657274696669636174696f6e20417574686f72697479311c301a0603550403131350696b61636875206d544c53205375622043413121301f06092a864886f70d01090116126d746c7363614063657274732e75732e6b6731253023060355040d131c50696b61636875206d544c53205369676e6e696e67205375622043413130302e060355040d0c27e79aaee58da1e4b898e585ace585b1e6b58be8af9553534c33e8af81e4b9a6e4b8ade997b44341308201a2300d06092a864886f70d01010105000382018f003082018a0282018100b9c4d23d05ced74383e0e811047ebc0b303852f8a1a07d8a470bdf7eb516a41d05adc06a0f671ec1ef1ea3b5f9337ec0ebaa4a43fbabff914483f4ee74149b7e813234c44b4072c29e143449b5c2f56bdc17e3777bf039e1bd2bfc0aeb2e84954a1b1cc22ef78876be933151555ba7c28adb18654804c4522b76265fbf3b759d504c0d9cc0910d391d54986b251f54803ba57488beacb29cf93074dbcd81526e58d9b0deae3542bec045827df964e3c49d0cc9b9de989eb4bf52a588ebd7c115668df16574726b201ea7f5c7aa72320b9bb7ea3412ee9fd8eb8ba11ef21f499bd1fa45dce01991c5d90c126750661c9c8151e21ddd154654141bed3badc1d4e077c254809b6af826ecf853d97e83b1c30bdb517d80fe54072b9e491e8a6870c2ffc7eece3458a038d86db220f23b55cf1756e73f594de8c73c0465c96dd50241ecc11fb4980a53bbcbb9988e7bb043f8c8ad7979762457451a1b6fc858419a91cb58111287ab172baf9780bf6d8d7c0c112abcf9546574daa34c18b80786c80d0203010001a38203613082035d30120603551d130101ff040830060101ff020101301d0603551d0e041604144d2cb91aad238d687d5c131f89dcf05bfe55828b301f0603551d230418301680143f40532e376cba8e321f2f6a9e555870627d7693300e0603551d0f0101ff04040302018e30260603551d250101ff041c301a0604551d200006082b0601050507030106082b06010505070302301e0603551d1104173015821350696b61636875206d544c532053756220434130818b0603551d200481833081803007060567810c0101300a06086086480186f842013069060d2b0601040182a464c628812d003058302506082b06010505070201161968747470733a2f2f746573742e63657274732e75732e6b672f302f06082b06010505070201162368747470733a2f2f70696b61636875696d2e6769746875622e696f2f7465737463612f3082012606082b060105050701010482011830820114302406082b060105050730018618687474703a2f2f746573742e6f637370732e75732e6b672f302606082b06010505073001861a687474703a2f2f746573742e6f637370732e6f706b672e636e2f303c06082b06010505073002863068747470733a2f2f746573742e63657274732e75732e6b672f63657274732f726f6f7463612f726f6f7463612e637274304606082b06010505073002863a68747470733a2f2f70696b61636875696d2e6769746875622e696f2f7465737463612f63657274732f726f6f7463612f726f6f7463612e637274303e06082b06010505073002863268747470733a2f2f746573742e63657274732e6f706b672e636e2f63657274732f726f6f7463612f726f6f7463612e6372743081bf0603551d1f0481b73081b43036a034a032863068747470733a2f2f746573742e63657274732e75732e6b672f63657274732f726f6f7463612f726f6f7463612e63726c3040a03ea03c863a68747470733a2f2f70696b61636875696d2e6769746875622e696f2f7465737463612f63657274732f726f6f7463612f726f6f7463612e63726c3038a036a034863268747470733a2f2f746573742e63657274732e6f706b672e636e2f63657274732f726f6f7463612f726f6f7463612e63726c301106096086480186f84201010404030202c4302206096086480186f842010d0415161350696b61636875206d544c5320537562204341300d06092a864886f70d01010c0500038202010082f50fdbae2484bfa1ba0993db9c61012b8c1ffd372654b71839df4065233bf56fed161caa7ebf3b2d7401bf6d3b569b5e5570a51776f16e1910ea11d726add85939d1bf2afb189b314a9dfe208d4cc986096444757b5dd7bf558e607726b17df76b16397af0a27263d7f003eb9f71251e384e633887c6c5a904f115cf4349c4c0c9ae08bb43cdb0be9fdc52c65789a821040631498cb572223dff0bb3596990c0d5349a63926ed4f1febe95d902e20a1b9bdc07a03719a75d110ea453f4b1d7bbfebe79de8aae09bd18abda0a44cf5af2139d9938a19b4c621d07a9b386ece53b51f611a7871949240747e41f47a11b2e1fdb58da3d8dd2b49c10ed13ad967431277e3e79dd7cd985debf89b06ff0ae9343faf2bc979cba7b39e6c4a0c91053c028040831e5bbe9a79b0e2ccd82f3fe0e29f8746eb1e4f9c374bd9d8879a7cfd2d47c25f4dabc3e061d3c1c54810025267e81e458244f0a94042bfa2500833cad9bd13daaca34d243785bf28ab686e72387fd565654284a7424313586999de99dd0f2b7a2db2448ee68f6305b9778500c51773262756d8b430789282ab23591f1a11b7f24413d979407d762d1358f461d6cf975552bce50c6f37b9c55bbbf412ffb8e6a4160a43008d77555efb536a3c7dd8509f3ae48787e436b950cb6966e42ba20d0ea7aaff1562fe6039b2fa96e23ce33c780565f94f7d913f5f45f6f69	Certmgr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CRLs\D14BAD674DCE5E8B3E3BEABA654A5982C00EAB2C	Certmgr.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CRLs\F088C7C2BB52A7ECD3E47309A3C87268FC307983\Blob = 030000000100000014000000f088c7c2bb52a7ecd3e47309a3c87268fc307983210000000100000016030000308203123082017a020101300d06092a864886f70d01010b05003081f6310b300906035504061302434e3121301f060355040a131850696b61636875205472757374204e6574776f726b20434131283026060355040b131f50696b616368752043657274696669636174696f6e20417574686f72697479311c301a0603550403131350696b616368752046696c65205375622043413121301f06092a864886f70d010901161266696c6563614063657274732e75732e6b6731253023060355040d131c50696b616368752046696c65205369676e6e696e672053756220434131323030060355040d0c29e79aaee58da1e4b898e585ace585b1e6b58be8af95e69687e4bbb6e58aa0e5af86e4b8ade997b44341170d3235303130313030303030305a170d3439313233313233353935395aa04f304d301f0603551d23041830168014a37a31a2c4918caa1468ad0da3bc6bd471afe81b301e0603551d1204173015821350696b616368752046696c6520537562204341300a0603551d140403020102300d06092a864886f70d01010b05000382018100374015191b92dc2da90760a0a6ba2708678267f24058a10c33aa40b14abe83e497ab2efe29aaf7f71c6a33225bca6cf0673480857deb645aa285c521493d871ec05618f71cf771e47e553c38e7af21b02bfbc7bb2abf97c618959bcc44a035a4d813291d24317c1c3d6af0fad5b888e640d324783a2efa9424f4114208188a2af92b4dd608c697cbcdafb7529ccd56e6bfd03ae664f4c73c42cce9fef6fa8b9e8d718a99d65314f475b0a70d9711054f39d8a068b92a9a73f2119f124bd9c6f75f5d6ebd11d3bba315fe3aab9954bb96aa80c4de69faa2977dc7c5b7a20f9c79980ebfcce76e839f3e6c98288ef75840d8ca32989dbb8f3bf366758152b8dba97359bf344e62830c57a2fdde3b58c38f58aa9d93e95226a4b3d44bc70a8d49f8e8c5aa9b9ce19063d372c8484d68d3620f0a758dcf37a53b3819eb8275aa5d4d8330037291a354a82539f844db6980fbe892266f8a3480a959792bb29c57d9112593d1159d5704a4145330b21bb8230d7f691da8e9c85fdba62b858a9c1d58e1	Certmgr.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CRLs\3BFFE2A757368CE0F9897F67107AF009AA5E49B7	Certmgr.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CRLs\BCEA42B5DFA007F9903A8EF36C0935E684DD5E9C	Certmgr.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CRLs\6018A3BEA1D46E275A46B7D29D8BDE16C4AFF07F\Blob = 0300000001000000140000006018a3bea1d46e275a46b7d29d8bde16c4aff07f2100000001000000140300003082031030820178020101300d06092a864886f70d01010b05003081f4310b300906035504061302434e3121301f060355040a131850696b61636875205472757374204e6574776f726b20434131283026060355040b131f50696b616368752043657274696669636174696f6e20417574686f72697479311c301a0603550403131350696b616368752055454649205375622043413121301f06092a864886f70d01090116127565666963614063657274732e75732e6b6731253023060355040d131c50696b616368752055454649204b65792045786368616e67652043413130302e060355040d0c27e79aaee58da1e4b89855454649e5af86e992a5e4baa4e68da2e8af81e4b9a6e4b8ade997b44341170d3235303130313030303030305a170d3439313233313233353935395aa04f304d301f0603551d230418301680149c13d47d6de9deedcc6b06caa2d598ca63b17f0e301e0603551d1204173015821350696b61636875205545464920537562204341300a0603551d140403020102300d06092a864886f70d01010b050003820181001434aafe647c08a32e678e459a341d44c29d5907124e71f3841d7e524cb3ea2484da9b4559100bad6bcd260c33b7b754530a0e8e7aac915315491f816130b3d282676aab48e900489f2a2ad10ba3507bb9596fb10909e6bb6bd4f722586d76b538bfb2cd24bfa9cf89e04af5c15846607620139be9284f8eef4c484258ec1373cb4c25d8e3f0265e779c66dd0fa4d6a043e7832ad8cefb3a58427ff1fe410849f95b9ee1ec5cbdf79b79679b1f93dc927169dd237122ca6ee9a732fd1dd446b8338e47e8608c55963ea28813eb8068d71d633212deffb25f3dbbb25af253e444dde3ce4961c0edbd8f7d91d58fe4d56a46396f3db634df2beb63666fdb6da6778718c7440d817858489ce7605991abfcda547ec9333da199b22b84523a2f5f6a49f7e1692c5c289df9af1e6421f8e9a575f41d1c88131b1e94f5fb0796aa5d678ae6fa6c1922ecb2ab02466d805a5f2e5ce4db9db1158fe0136e82ea49d8c43a00913e1826c9729981d53215b4a30f5a30b0927add220635c28a50e62a431f4f	Certmgr.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CRLs\4DA3E72A06BAC305B1DB19621AA11E78F4C035EF\Blob = 0300000001000000140000004da3e72a06bac305b1db19621aa11e78f4c035ef210000000100000016030000308203123082017a020101300d06092a864886f70d01010b05003081f6310b300906035504061302434e3121301f060355040a131850696b61636875205472757374204e6574776f726b20434131283026060355040b131f50696b616368752043657274696669636174696f6e20417574686f72697479311c301a0603550403131350696b61636875204d61696c205375622043413121301f06092a864886f70d01090116126d61696c63614063657274732e75732e6b6731253023060355040d131c50696b61636875204d61696c205369676e6e696e672053756220434131323030060355040d0c29e79aaee58da1e4b898e585ace585b1e6b58be8af95e982aee4bbb6e58aa0e5af86e4b8ade997b44341170d3030303130313030303030305a170d3234313233313233353935395aa04f304d301f0603551d23041830168014393bd44e6f32debce6d6dd4c7446712917b70aec301e0603551d1204173015821350696b61636875204d61696c20537562204341300a0603551d140403020101300d06092a864886f70d01010b050003820181000076dbfca92b3943fcf568bcdb1b56e78d089e65e389e125e57317d74f88538d24227d11025437e31fc124c54e0f86c4c64c81a25c11865b4a449c3cdd171b0969f410558100e24486ccbb914a078cdf946d872eb627267dd3621dd444e07d57e9901735cceeeaf7e55cc3d2c7a25c4a9c204e5193e722de15ca48dfc23281d86f0e4eaa4a9b7c18f60db8a5beef715b244e96d037c68ab3ee9cbbe2840ce5c0bf96577074dc2827e398a229b86bca4cfca1ab54c5f4022c97af13dba3cf041c7b765cff875c60b487985b435a17a38fca0228c7755a8a49c049a694d85975f0aa0341aacd7fa64753146cf34e2dbc43f45b26a1e851677646a4d0fcf74151b604f4b5f8187e31fc2040d17574af11c86527f8ca00aa2e4c93f7b573045fe3df6490186f381c89654aeabe650a36b53929e171d5c4cadb36cd6117ec2ce89c87fced84ce4310cd27ee23e669b060c7f9aeb5cc83bda0ffe8328e1422030b0c6793f1b980f4494b87caf17a7452cd719153718e1ccad9166d804ec00642e64212	Certmgr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AE158C5E8F43FA2C4F32F8C17F42C8217E167BB0	Certmgr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CRLs\BCEA42B5DFA007F9903A8EF36C0935E684DD5E9C	Certmgr.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\73099A0513827CA867F7C948A3E78FD578644A43\Blob = 03000000010000001400000073099a0513827ca867f7c948a3e78fd578644a432000000001000000df090000308209db308207c3a003020102020876d08975db7a7ead300d06092a864886f70d01010b05003081f5310b300906035504061302434e3121301f060355040a131850696b61636875205472757374204e6574776f726b20434131283026060355040b131f50696b616368752043657274696669636174696f6e20417574686f72697479311c301a0603550403131350696b616368752054657374204341205253413121301f06092a864886f70d01090116127465737463614063657274732e75732e6b6731253023060355040d131c50696b61636875205075626c6963205465737420526f6f74205253413131302f060355040d0c28e79aaee58da1e4b898e585ace585b1e69c8de58aa1e6b58be8af95e6a0b9e8af81e4b9a6205253413020170d3030303130313030303030305a180f32303939313233313233353935395a3081f4310b300906035504061302434e3121301f060355040a131850696b61636875205472757374204e6574776f726b20434131283026060355040b131f50696b616368752043657274696669636174696f6e20417574686f72697479311c301a0603550403131350696b616368752055454649205375622043413121301f06092a864886f70d01090116127565666963614063657274732e75732e6b6731253023060355040d131c50696b616368752055454649204b65792045786368616e67652043413130302e060355040d0c27e79aaee58da1e4b89855454649e5af86e992a5e4baa4e68da2e8af81e4b9a6e4b8ade997b44341308201a2300d06092a864886f70d01010105000382018f003082018a0282018100d1fabf23608723fde3c504a3a4c992b4515b7331b1e7b938abe06629f5cd04127165a09c92fd696e46e034caa20a679e2df978c902e121c5410af8058a321e8fa287d91fd4b1fd9612b0facf0897b8aa2450a23e1aeed04e1f3ff62cdc6c609f2532936efe1ac7d97ff7350f1ad3a9633c939ac2507da2d39b4270369a8a1f39d654b5487c15c8d4ca4e2f94d07f3c756ab38bf9a9762d3f5114a7649892068ac990ec0bdc79296bd2717fc18d38ed91ed5a959c0bff90733027369d290d7ec5ec2d74ec6af97ad5f98993205a1cc03cda15f0ee56b0a1544d3820876d3b8d9fb3da2811b7704d1edbede889a4af0368d9c57f709982e0968a08edd7ee180d5b1e7fe4df21c1a2f4085aebbe1839bca5104a009c7b8d36761a9076e1a982e413613f3d4cd04f1a004c291ea8024e86b33f95e9789ac638b266805a40e534abfe52f7d4f65b33dd5551d0659eef07c0c6618f83cafe78865fec57fc51c5b266a62ed04a416804ba2a8c8dc136aa0c368d34d4cdb955b7b182286d32280b89f42f0203010001a38203ea308203e630120603551d130101ff040830060101ff020101301d0603551d0e041604149c13d47d6de9deedcc6b06caa2d598ca63b17f0e301f0603551d230418301680143f40532e376cba8e321f2f6a9e555870627d7693300e0603551d0f0101ff0404030201863081ae0603551d250101ff0481a33081a00604551d200006082b06010505070303060a2b0601040182373d0101060a2b0601040182370a0327060a2b0601040182370a0305060a2b0601040182370a0307060a2b0601040182370a0306060a2b0601040182370a0308060a2b060104019208100101060a2b060104019208100102060a2b060104019208100103060a2b060104019208100101060a2b060104019208100102060a2b060104019208100103301e0603551d1104173015821350696b6163687520554546492053756220434130818b0603551d200481833081803007060567810c0101300a06086086480186f842013069060d2b0601040182a464c628812d003058302506082b06010505070201161968747470733a2f2f746573742e63657274732e75732e6b672f302f06082b06010505070201162368747470733a2f2f70696b61636875696d2e6769746875622e696f2f7465737463612f3082012606082b060105050701010482011830820114302406082b060105050730018618687474703a2f2f746573742e6f637370732e75732e6b672f302606082b06010505073001861a687474703a2f2f746573742e6f637370732e6f706b672e636e2f303c06082b06010505073002863068747470733a2f2f746573742e63657274732e75732e6b672f63657274732f726f6f7463612f726f6f7463612e637274304606082b06010505073002863a68747470733a2f2f70696b61636875696d2e6769746875622e696f2f7465737463612f63657274732f726f6f7463612f726f6f7463612e637274303e06082b06010505073002863268747470733a2f2f746573742e63657274732e6f706b672e636e2f63657274732f726f6f7463612f726f6f7463612e6372743081bf0603551d1f0481b73081b43036a034a032863068747470733a2f2f746573742e63657274732e75732e6b672f63657274732f726f6f7463612f726f6f7463612e63726c3040a03ea03c863a68747470733a2f2f70696b61636875696d2e6769746875622e696f2f7465737463612f63657274732f726f6f7463612f726f6f7463612e63726c3038a036a034863268747470733a2f2f746573742e63657274732e6f706b672e636e2f63657274732f726f6f7463612f726f6f7463612e63726c301106096086480186f8420101040403020011302206096086480186f842010d0415161350696b61636875205545464920537562204341300d06092a864886f70d01010b0500038202010088ff18b528453ff8a68db7c284cb40d642d8f0c05549b6d64e62dd4c30e0f58dc8e3729d2974e93ab764a491f71df5754e6d30efaafaf9fce3371cee9ca09d1d2daa8bf4f5c5142cfaab2179985ee25a496ad00c0a839d63b75e26620ddb5d7cfd6fe7b73a4a9ae8c887a2da52c38fc68006565351d91d3275e2c434626325ca2e68a3e91397dd41702d3f8dae3b45cc23ba19f5f8c9c997ee7df1a8447c9ddda8f3dfe6d193f6b7de1957354e05608d50ee86444093701d5b98697971a0d491ec878b960612fdfcecc9eb2947b9b4840bdc5404eacdaff7265efa64e91c48c7ea26ee8601a878b939692f983c80f8ff1ad5bee9d9d7da8aa6e4036431db00ec3e109812a3d356bfc511e9c447055e5c086f58630452aead2186a6891b92d0079cad7c17b7b692b8dccc38670846b0af58c821bd2cacd48ecdb1496d4c0f025a1f6e767451705942de7aa3228966c7fa4a42d9fb40264f440a28f668db16ce463eb3298211945258be22f8cbe05e45db203833a0df6e75c1c6eb7c14f4e2f40daa7f0ee5591ff9038258bf6ceaf70e778e0460c3a0dc5592d1d4a32d4ec0d0d0d5f6b798510a7289bd8cdba0efbd7f8d0f608e33e97b5814e2fbe95e9181e682077930fb12a5aadb7b1708645b63c081315170fd76d84256fb28ca1ad410f451124ecf6c4a5eb5054387c3949ff82b657dd1ee8172bde0016d90ff96ee6d2696	Certmgr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F56AAF0F4CF914BD412EC8F08B5284BA398A2C67	Certmgr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CRLs\7913E88105B1EFE9BF37A2AA74B55986AD4E0CC8	Certmgr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CRLs\27816FE11476AEFF161A11BB0840FA75419F00ED	Certmgr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CRLs\1BDD8C9EDEF24B3BA126FDD688103DF55F8288AA	Certmgr.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CRLs\1A188288EE3B787E17103654727657EB8465F9AC\Blob = 0300000001000000140000001a188288ee3b787e17103654727657eb8465f9ac2100000001000000140300003082031030820178020101300d06092a864886f70d01010b05003081f4310b300906035504061302434e3121301f060355040a131850696b61636875205472757374204e6574776f726b20434131283026060355040b131f50696b616368752043657274696669636174696f6e20417574686f72697479311c301a0603550403131350696b61636875206d544c53205375622043413121301f06092a864886f70d01090116126d746c7363614063657274732e75732e6b6731253023060355040d131c50696b61636875206d544c53205369676e6e696e67205375622043413130302e060355040d0c27e79aaee58da1e4b898e585ace585b1e6b58be8af9553534c33e8af81e4b9a6e4b8ade997b44341170d3235303130313030303030305a170d3439313233313233353935395aa04f304d301f0603551d230418301680144d2cb91aad238d687d5c131f89dcf05bfe55828b301e0603551d1204173015821350696b61636875206d544c5320537562204341300a0603551d140403020102300d06092a864886f70d01010b05000382018100192d4c15623d8370b96599d4addb768332f3f9ca7c1fe3465eb7c63a3d4cafb169633e93e5c5a3f27444b9e7d7be37a56eca0ac1cff96720a3c5eb2239523a40b0d8de272ec76bbc161afed3df19b3707ea5cebea990590f85143cd3fa08bb8d0025a5eca476064363f10f779afe379c7f6149fab143231eda057fd26925d785f4116cc35ac688c42c961b5070eed6f73fd458125bc42c9234f961033c8d4ce1001fb74bd0504147495cbeee9b46004594af27f2cfa3bde6c5f7adcc44bda5debd9a48de85446c595ce40121e5d751543bbbe8196b58bdab27540fc5a51f8dd037aedc42877ce51d13ba0442a762cab75c6b05eb59de3b1d882de83983583801a25e292d004b33cfe8ee52293b1ec8c9c6b148e3e0fca67086ebdf3c58c5d1f146cf1b7c7bd8b28ed0960524486a899993fa4197ab460092428924393baa4367912f76704e8773e66cdeb2a3723e8eb87f97c51139d75381c76d3c387c5317cd3ff012b79a6b2c69ce1ef66c1a13b7cb5270c008e53b55a21070d52596f4bd9a	Certmgr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CRLs\5657CB5F121EB14E17F897B117C91DCA4792E225	Certmgr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F57DF00CEB2476C8144B751F1D2D45EDBB3EDFE1	Certmgr.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5D2C92D132CC97F1DF8506582DE4B1910E1DE0FA\Blob = 0300000001000000140000005d2c92d132cc97f1df8506582de4b1910e1de0fa2000000001000000010a0000308209fd308207e5a003020102020823e54884d6c901c7300d06092a864886f70d01010c05003081f5310b300906035504061302434e3121301f060355040a131850696b61636875205472757374204e6574776f726b20434131283026060355040b131f50696b616368752043657274696669636174696f6e20417574686f72697479311c301a0603550403131350696b616368752054657374204341205253413121301f06092a864886f70d01090116127465737463614063657274732e75732e6b6731253023060355040d131c50696b61636875205075626c6963205465737420526f6f74205253413131302f060355040d0c28e79aaee58da1e4b898e585ace585b1e69c8de58aa1e6b58be8af95e6a0b9e8af81e4b9a6205253413020170d3030303130313030303030305a180f32303939313233313233353935395a3081f6310b300906035504061302434e3121301f060355040a131850696b61636875205472757374204e6574776f726b20434131283026060355040b131f50696b616368752043657274696669636174696f6e20417574686f72697479311c301a0603550403131350696b6163687520436f6465205375622043413121301f06092a864886f70d0109011612636f646563614063657274732e75732e6b6731253023060355040d131c50696b6163687520436f6465205369676e6e696e672053756220434131323030060355040d0c29e79aaee58da1e4b898e585ace585b1e6b58be8af95e4bba3e7a081e8af81e4b9a6e4b8ade997b44341308201a2300d06092a864886f70d01010105000382018f003082018a0282018100b8d0996f051396590ceebcef8586fd82e0c4ad1c0be5273c861a30232cd30c84ef916aee08fa7a65704b4f3afbbd6f4e3a4fa2da2b5b8f54cf7e1aa15e018ef4b2e1487a753f42b5194c5bb3c0b0339fa926f78e18c19103d6ee79b1f6ffedc67898eaced028de0d591e79889ef030a837da6807a7fabd3a9c823e9bf866bdf41e85756d5f04a983fd6f1123b0db5d33750cb6902fe3946520700152e7b47be1a57cb21c4f279695407c284673c8cfc5fb2d10786b69805f0e1b3d5347ca8c99f7f8552efb56f6ee8b9bfb9c826897d3b3eba7acca443056cc3922295b5e981690f6d05d7e4ef33417cc02d12791acc8a8fde349bd988910d6be887c954b05e7649a8b23dbc8f1e4325c099a90a609e35cadb780067365b8957f7bd2ab37615c727155dc289bed89353ca4e8eeaf45ed255962459391f2d7a39f1efa7f7f62df5b3ae6e02be4ebf30de69814d8b3882b3d24f75f9df3f73a11f40390a9f2102c7a373f7d2a01c10cdb07e1b2c69b01c7e136c69f4d8cc87341a25f17431c9bfd0203010001a382040a3082040630120603551d130101ff040830060101ff020101301d0603551d0e04160414574722073f78800ef2b566ba6e2166f39908176e301f0603551d230418301680143f40532e376cba8e321f2f6a9e555870627d7693300e0603551d0f0101ff0404030201863081ce0603551d250101ff0481c33081c00604551d200006082b06010505070303060667810c010401060a2b0601040182373d0101060a2b0601040182370a0327060a2b0601040182370a0305060a2b0601040182370a0307060a2b0601040182370a0306060a2b0601040182370a0308060a2b060104019208100101060a2b060104019208100102060a2b060104019208100103060a2b060104018237020115060a2b060104018237020116060a2b060104019208100101060a2b060104019208100102060a2b060104019208100103301e0603551d1104173015821350696b6163687520436f64652053756220434130818b0603551d200481833081803007060567810c0101300a06086086480186f842013069060d2b0601040182a464c628812d003058302506082b06010505070201161968747470733a2f2f746573742e63657274732e75732e6b672f302f06082b06010505070201162368747470733a2f2f70696b61636875696d2e6769746875622e696f2f7465737463612f3082012606082b060105050701010482011830820114302406082b060105050730018618687474703a2f2f746573742e6f637370732e75732e6b672f302606082b06010505073001861a687474703a2f2f746573742e6f637370732e6f706b672e636e2f303c06082b06010505073002863068747470733a2f2f746573742e63657274732e75732e6b672f63657274732f726f6f7463612f726f6f7463612e637274304606082b06010505073002863a68747470733a2f2f70696b61636875696d2e6769746875622e696f2f7465737463612f63657274732f726f6f7463612f726f6f7463612e637274303e06082b06010505073002863268747470733a2f2f746573742e63657274732e6f706b672e636e2f63657274732f726f6f7463612f726f6f7463612e6372743081bf0603551d1f0481b73081b43036a034a032863068747470733a2f2f746573742e63657274732e75732e6b672f63657274732f726f6f7463612f726f6f7463612e63726c3040a03ea03c863a68747470733a2f2f70696b61636875696d2e6769746875622e696f2f7465737463612f63657274732f726f6f7463612f726f6f7463612e63726c3038a036a034863268747470733a2f2f746573742e63657274732e6f706b672e636e2f63657274732f726f6f7463612f726f6f7463612e63726c301106096086480186f8420101040403020011302206096086480186f842010d0415161350696b6163687520436f646520537562204341300d06092a864886f70d01010c050003820201006974c9724af2a5aa147cea5b829c47bbb78d883475ba6079b25f0270d84ecfbc66948c0f7d6051cf8a8a459ebb5513267a415b9c1c1bae808dd566ae9f5308d5a321029ac94d3a060678cfbbb4131b055a53ee89561f8e6eddc33b5c31cc24ba900338bae7b988e553780a61d35b49f64744b87078b79d21153a1bafb6ebb35705da6cc78e7faf03102f8b391b8bfdbea964a65cacba3aaa5dcf14df36bc93b14a2c6e2851c5ef1fb0ec413094a210d0a57cfa4ca8e6bdcd8f4d470f76d443ff88631c752da85b258d0b23b5fe88912708793b5ddd680561f12750d0f7da1a17088c6820b111d16b0b57ebc70e6479a7df0bccdf5d02f98bb4bb89804a7be5804bd85a5929a9161be91aebccf76764b8a773d366b82688e1671b0ef6136c3c4f86e89c4f0204432e2c8d899cbbb1c7cb9a1bed038b78aa7a2c45c4671ec894bb6fca5bd17b057b92b2162625a5f741d99b9d1c87cd0cd6134c1e5319cfe76417c190eff8cd964f08238d24a3c97f8df2257d7c906f0d4d56eecd66185b300154a5f4b68ac665052396768934ceced1002bbf00f299e1fe41f0ce959825f4e3d1d82bd818e89f0d9c73d3faa176e69fa363ff660d308dce2413ee656d5828346ffee015ed14d86d334faf11e79d220a2605bd8b2731173f27a8bc780f9134a5c0460737313185151f9df6079856590a65256cc5c15b68d40df8f01b3d639ca4c6	Certmgr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CRLs\1A188288EE3B787E17103654727657EB8465F9AC	Certmgr.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CRLs\5657CB5F121EB14E17F897B117C91DCA4792E225\Blob = 0300000001000000140000005657cb5f121eb14e17f897b117c91dca4792e225210000000100000016030000308203123082017a020101300d06092a864886f70d01010b05003081f6310b300906035504061302434e3121301f060355040a131850696b61636875205472757374204e6574776f726b20434131283026060355040b131f50696b616368752043657274696669636174696f6e20417574686f72697479311c301a0603550403131350696b61636875205369676e205375622043413121301f06092a864886f70d01090116127369676e63614063657274732e75732e6b6731253023060355040d131c50696b6163687520446f6373205369676e6e696e672053756220434131323030060355040d0c29e79aaee58da1e4b898e585ace585b1e6b58be8af95e69687e6a1a3e7adbee5908de4b8ade997b44341170d3235303130313030303030305a170d3439313233313233353935395aa04f304d301f0603551d230418301680141cf45af22f134455722e7f472c8a2b1e7eb57d54301e0603551d1204173015821350696b61636875205369676e20537562204341300a0603551d140403020102300d06092a864886f70d01010b05000382018100713ce3ab4ec1a2090ec2581db7c99c6edc100e321cb51e1dbe0d2d0b0bd2e81430b86c350ee6298d8414f59d970bbeff2c90a2fc243a80c2d8868639e12bf88e7d1189914a84a09a4dcc8f6557fee22872ee20aca18179caa0edddcb3d2f518b712c26d9501df205bae12cd293d477b704fef51f860a2b446b3509da7a03fb6da8d5b11ee12c8ca4601b429f6107f8e19917f405a07fe86a8d189c807450f363be34dfd40341c509c79389cbda3947c3fb275e77ec3129fb7a75e940b079373a2ef63520508b710d209e66edf0ae6aae1fe8028469eec1b0b1a4aedb7a79f878b4490493b3d44858e6cde04443277e674a028081039d0ee17318e594a3cb17a6d29a8e168b076cd631b859ebb58afd1be16f86b58832c4b92e431efcc289308870b2ec1f8ebed0019587125c7da80a139f17c2950bb9d7075b41fd3a21ebaa61627390059cec513e4db7a0c007ee71365936e5c68ffe06eaa587fb07197810202ee88bb32391aa3426dbb5628f5c3dbfb8cab98b2e8084a3f9e6e5ea62836ebe	Certmgr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\671E553BC90A19B26F6F55231E5969F4771976BB	Certmgr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CRLs\55D5F5D1A1608C7D81101CA464FCEAF3EABE1FA9	Certmgr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DB29F7A0DA6210199D4FCC6E02BB1CFB29691E2C	Certmgr.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3EAB922A4AC7C9D4C8FCE5C904E7BF227DFA64F3\Blob = 0300000001000000140000003eab922a4ac7c9d4c8fce5c904e7bf227dfa64f32000000001000000850900003082098130820769a00302010202082f141257b52cd31c300d06092a864886f70d01010c05003081f5310b300906035504061302434e3121301f060355040a131850696b61636875205472757374204e6574776f726b20434131283026060355040b131f50696b616368752043657274696669636174696f6e20417574686f72697479311c301a0603550403131350696b616368752054657374204341205253413121301f06092a864886f70d01090116127465737463614063657274732e75732e6b6731253023060355040d131c50696b61636875205075626c6963205465737420526f6f74205253413131302f060355040d0c28e79aaee58da1e4b898e585ace585b1e69c8de58aa1e6b58be8af95e6a0b9e8af81e4b9a6205253413020170d3030303130313030303030305a180f32303939313233313233353935395a3081f6310b300906035504061302434e3121301f060355040a131850696b61636875205472757374204e6574776f726b20434131283026060355040b131f50696b616368752043657274696669636174696f6e20417574686f72697479311c301a0603550403131350696b61636875205369676e205375622043413121301f06092a864886f70d01090116127369676e63614063657274732e75732e6b6731253023060355040d131c50696b6163687520446f6373205369676e6e696e672053756220434131323030060355040d0c29e79aaee58da1e4b898e585ace585b1e6b58be8af95e69687e6a1a3e7adbee5908de4b8ade997b44341308201a2300d06092a864886f70d01010105000382018f003082018a0282018100e20a9380ea963da773dab6691e1dbec88c63d36d975bd851592348af45b2a8f84d5fe1213333025a19c7e6356edbcb238f46caed2b9519788c0af75ff591875561c5e3958b3e44ca77f726db6f61f4a904b6233daf23e8745a185100a7c3b9044cf7985a18e2144c4c59c7609ad76291c2536482bd9b5e4043300987948061fb6a44775c71e1152457d379f5b1faf031972c0c339b95f9b37ba7d37e2aa814eb1df98e569c7e45b1bfea47f93bddc9da4efd8cd91b41386df59e21f27df5f23ece5934285edc7a57a6f5e09cfe630f24cc0ae669c299bfa0255648220231851c183d174dee6925726141e7fc18812ad58d2266bb0b1e29d403b07dc2f32369be0948c5defafb671e95e0b9c2b19ef8567479270580e4e3828587716b1012626c514729fb109143a253bd7891cf6444c923d705ac8b04bdbfe2b31d6299136b04df2220083e37727c1d03ec57fc3ba3936bcb19d4f043179aa9cec9be401ab02cfb6fb5f35dc019a6c7296a6b8feb31556e7683e157b69ad0d950cb5577ffec150203010001a382038e3082038a30120603551d130101ff040830060101ff020101301d0603551d0e041604141cf45af22f134455722e7f472c8a2b1e7eb57d54301f0603551d230418301680143f40532e376cba8e321f2f6a9e555870627d7693300e0603551d0f0101ff0404030201c630530603551d250101ff044930470604551d20000604551d250006092a864886f72f010105060a2b0601040182370a030c060a2b0601040182370a0301060a2b0601040182370a0302060a2b0601040182370a030d301e0603551d1104173015821350696b61636875205369676e2053756220434130818b0603551d200481833081803007060567810c0101300a06086086480186f842013069060d2b0601040182a464c628812d003058302506082b06010505070201161968747470733a2f2f746573742e63657274732e75732e6b672f302f06082b06010505070201162368747470733a2f2f70696b61636875696d2e6769746875622e696f2f7465737463612f3082012606082b060105050701010482011830820114302406082b060105050730018618687474703a2f2f746573742e6f637370732e75732e6b672f302606082b06010505073001861a687474703a2f2f746573742e6f637370732e6f706b672e636e2f303c06082b06010505073002863068747470733a2f2f746573742e63657274732e75732e6b672f63657274732f726f6f7463612f726f6f7463612e637274304606082b06010505073002863a68747470733a2f2f70696b61636875696d2e6769746875622e696f2f7465737463612f63657274732f726f6f7463612f726f6f7463612e637274303e06082b06010505073002863268747470733a2f2f746573742e63657274732e6f706b672e636e2f63657274732f726f6f7463612f726f6f7463612e6372743081bf0603551d1f0481b73081b43036a034a032863068747470733a2f2f746573742e63657274732e75732e6b672f63657274732f726f6f7463612f726f6f7463612e63726c3040a03ea03c863a68747470733a2f2f70696b61636875696d2e6769746875622e696f2f7465737463612f63657274732f726f6f7463612f726f6f7463612e63726c3038a036a034863268747470733a2f2f746573742e63657274732e6f706b672e636e2f63657274732f726f6f7463612f726f6f7463612e63726c301106096086480186f8420101040403020011302206096086480186f842010d0415161350696b61636875205369676e20537562204341300d06092a864886f70d01010c05000382020100733f2df6647a5055b81a481b3ab50ca378d181f2f9218673d14c08438cc6d14671b8f172a28b5ac4437d002efa9749ef17e5e7bc5a0dd6ea0cbaabb35448b268043219adbd25a6f9fff9c6e68ce7b653daf243f763be66914e642db4c6f307c75ac339d8f3260da00c1b9b4450c56dd181b1102a5fb9a4ea6e37c9ea52c4039f2b803030904d0d00678e6155ec4d16c0fc68e3420c0ad13fa5ac412f3723a69d8acc0706115779ce489aaa7f256b8f7abef3fc3e9ef8843241c12bbc4b4f7df3ebe7821b6f4cce29d50490ea51085df8b88ce5acaef95167cd6459e3b64e17d72bab1f7e808cee9081eff3525104f5cc23e16480abcafa2b689873326564b5e3ddd189434d9e82eba675a616b3c6bb7b6f8b124cfdad5cbe1c8cb5a915b6da6edd5d3b21392ce30f6957dc7257cbcadae8af3761659dae0ffd12ff197ad180d4d38c01833357633c3de03693326352fe3cf5b18e1950a54fe4f73faec54b3555c58ad84420277eefb3fab4f027be5a897ee8a2f8e81534dc230b06bd6efbc0271403eacea54ddfd170f1f9ad59224d7f7f98b9de23713c8eef7a53f561a68e1b230278390414d930865ff0d593f7bd1a159017cf08289f936e624cae25ddc0a30b1774a05f838283d405cef554dde79719e5b7afae5ec81214b8fb1b9ac8c612427f0e4becb85139965774ccf7deb20a9280f7658c971cb949d3f14a6ed27a94	Certmgr.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CRLs\27816FE11476AEFF161A11BB0840FA75419F00ED\Blob = 03000000010000001400000027816fe11476aeff161a11bb0840fa75419f00ed210000000100000016030000308203123082017a020101300d06092a864886f70d01010b05003081f6310b300906035504061302434e3121301f060355040a131850696b61636875205472757374204e6574776f726b20434131283026060355040b131f50696b616368752043657274696669636174696f6e20417574686f72697479311c301a0603550403131350696b6163687520436f6465205375622043413121301f06092a864886f70d0109011612636f646563614063657274732e75732e6b6731253023060355040d131c50696b6163687520436f6465205369676e6e696e672053756220434131323030060355040d0c29e79aaee58da1e4b898e585ace585b1e6b58be8af95e4bba3e7a081e8af81e4b9a6e4b8ade997b44341170d3235303130313030303030305a170d3439313233313233353935395aa04f304d301f0603551d23041830168014574722073f78800ef2b566ba6e2166f39908176e301e0603551d1204173015821350696b6163687520436f646520537562204341300a0603551d140403020102300d06092a864886f70d01010b050003820181002e006a4b879ba80f600155479cf1e896b9440e54b203847f9a1d0fc528e958ab4b9ae88c2ae440c6fecf7c346d89ff83e0f255923a57d7bfc9c1e3cd5ef4e64df86f9e62be71d32766a9114f5d27dc46b0f352b0fee2c12f35442a316c3baa482d9aebb72ff4972867481d47f4efe23d148505abc19674d77562e9df09498f4a19cdbd64de7adb7a1ca77bdc405cc0e3783ccf635435f160d758b893b0267ba0366997b513c243840c33dea127687288226ffd109c755889816b84ae1e241f80a9f7323cec2472fcc47573b87e32276d14f4b8096467a2b2d1a265bc980f9578e69948cea2ebc6915e77c717e28bb254a0874ad824dc6ff88c8335ea5313d610c669f64aa278c3abe02220da347fb9584bc0a410b311f6aa005c627670023b93caa272c0a0dae107726c68396857f7da72624c1ad2571a44b973204c74c6f9b712b65c774923068413f108b4f05e6174d5ec6d8ca69cad601c601aab3bec4b9863312a0a0d99732f8d62a5534c7954aa121c1f98fed655e2f036d77d5fba5585	Certmgr.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CRLs\D14BAD674DCE5E8B3E3BEABA654A5982C00EAB2C\Blob = 030000000100000014000000d14bad674dce5e8b3e3beaba654a5982c00eab2c210000000100000016030000308203123082017a020101300d06092a864886f70d01010b05003081f6310b300906035504061302434e3121301f060355040a131850696b61636875205472757374204e6574776f726b20434131283026060355040b131f50696b616368752043657274696669636174696f6e20417574686f72697479311c301a0603550403131350696b616368752046696c65205375622043413121301f06092a864886f70d010901161266696c6563614063657274732e75732e6b6731253023060355040d131c50696b616368752046696c65205369676e6e696e672053756220434131323030060355040d0c29e79aaee58da1e4b898e585ace585b1e6b58be8af95e69687e4bbb6e58aa0e5af86e4b8ade997b44341170d3030303130313030303030305a170d3234313233313233353935395aa04f304d301f0603551d23041830168014a37a31a2c4918caa1468ad0da3bc6bd471afe81b301e0603551d1204173015821350696b616368752046696c6520537562204341300a0603551d140403020101300d06092a864886f70d01010b05000382018100208b439da85c85761b9e2c32afd901228eaeba0939f190606b7ef6afc811687bf89782b276d527ebbad2b0baf24b4018fdb8c0a9aeb3cced748322e1e218e96657091e4132560baa13c918bf36a71e5ee93c40de394d1d25c6e18bf1ba8e694a22e060c179ef5bc622f64611fc7fe5901bf394282b4abb67a5aa5f8046462730c8c49e59a68310787b0ba7251ff9593d8fc8738f0daa4d832c5aa0c5a125c08b949e5ee1af3a352dae2201e2d1173890fb08d148b3783ed35e368313f7f2da5b9e4ee39093f661c50d1f0a529d25557d8dd1a385ca966ff45a93f3ef8314658c226fb1f58ae52b222fb1f9b11b858b78a177259203634ac45f4cd9d2f00246fb2c16212f78d0af06e0c361ef0748cd28f1d80c8473bebcc3348501117bd0f9dcf8c91d81aa14bbd6e7391929d24bd6d9db5d3c6942b40a99d30bbf4efac813f3b638da72b08df68ffc9b25f1899d869a921175367f7c71f664cfee485623ac356405cfc2b40c510a8372583de3476f253b31b2527a9787c0e55c288196252a7e	Certmgr.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F56AAF0F4CF914BD412EC8F08B5284BA398A2C67\Blob = 030000000100000014000000f56aaf0f4cf914bd412ec8f08b5284ba398a2c6720000000010000005a090000308209563082073ea00302010202083490f7bad7603b24300d06092a864886f70d01010c05003081f5310b300906035504061302434e3121301f060355040a131850696b61636875205472757374204e6574776f726b20434131283026060355040b131f50696b616368752043657274696669636174696f6e20417574686f72697479311c301a0603550403131350696b616368752054657374204341205253413121301f06092a864886f70d01090116127465737463614063657274732e75732e6b6731253023060355040d131c50696b61636875205075626c6963205465737420526f6f74205253413131302f060355040d0c28e79aaee58da1e4b898e585ace585b1e69c8de58aa1e6b58be8af95e6a0b9e8af81e4b9a6205253413020170d3030303130313030303030305a180f32303939313233313233353935395a3081f6310b300906035504061302434e3121301f060355040a131850696b61636875205472757374204e6574776f726b20434131283026060355040b131f50696b616368752043657274696669636174696f6e20417574686f72697479311c301a0603550403131350696b61636875204d61696c205375622043413121301f06092a864886f70d01090116126d61696c63614063657274732e75732e6b6731253023060355040d131c50696b61636875204d61696c205369676e6e696e672053756220434131323030060355040d0c29e79aaee58da1e4b898e585ace585b1e6b58be8af95e982aee4bbb6e58aa0e5af86e4b8ade997b44341308201a2300d06092a864886f70d01010105000382018f003082018a0282018100978f8444209a24fb3f6cd0c6725e6704e72f4a72a06e3c5c9da803466678287b4dad25ff5d9a06d8496286cd517c7f6c8c206f4312b42b4c2e71bd370a7b08deeae135c7e84517860832b615dc5e32a202b23434cb0d4f3415c14d6f4573ba04180438f710105f5b07f1d0a366e925498847c66efc15820f995f364c3c58479d4e146f237ed659ecac34685779db1f006bf0c2475bd3d107f0ab2cea21588e88e86f3113b4b48f29296cbddc99c9e4b4c7b8ff0a7003ccd56f8e1569b9128b4140c1231c633f6c75ea30fbfa0c92665a39718c9697536814a43c5de7d8067dc3747d610ab325344109f219866ea81671dda317a74ecfcb10f19aaa5ea2b104f4ea220b2043f3d21e9456fbeb8100c3d7581951679017cfc67459070cb8093600ffdf8fe709a9a45b3cfe29f01be1a0e7c6b8549ee8b1bd711e1d8fe2d5195a0354608080d14956cf7f7cc9c1dcec8bff25e6d29356ca12ce8ad3f1c68fb5cc7be3f856c6db3b274f8eec677df88390f4017188929725f58c0bb337c0a8cd0d750203010001a38203633082035f30120603551d130101ff040830060101ff020101301d0603551d0e04160414393bd44e6f32debce6d6dd4c7446712917b70aec301f0603551d230418301680143f40532e376cba8e321f2f6a9e555870627d7693300f0603551d0f0101ff0405030307878030270603551d250101ff041d301b0604551d200006082b0601050507030406092b0601040182371513301e0603551d1104173015821350696b61636875204d61696c2053756220434130818b0603551d200481833081803007060567810c0101300a06086086480186f842013069060d2b0601040182a464c628812d003058302506082b06010505070201161968747470733a2f2f746573742e63657274732e75732e6b672f302f06082b06010505070201162368747470733a2f2f70696b61636875696d2e6769746875622e696f2f7465737463612f3082012606082b060105050701010482011830820114302406082b060105050730018618687474703a2f2f746573742e6f637370732e75732e6b672f302606082b06010505073001861a687474703a2f2f746573742e6f637370732e6f706b672e636e2f303c06082b06010505073002863068747470733a2f2f746573742e63657274732e75732e6b672f63657274732f726f6f7463612f726f6f7463612e637274304606082b06010505073002863a68747470733a2f2f70696b61636875696d2e6769746875622e696f2f7465737463612f63657274732f726f6f7463612f726f6f7463612e637274303e06082b06010505073002863268747470733a2f2f746573742e63657274732e6f706b672e636e2f63657274732f726f6f7463612f726f6f7463612e6372743081bf0603551d1f0481b73081b43036a034a032863068747470733a2f2f746573742e63657274732e75732e6b672f63657274732f726f6f7463612f726f6f7463612e63726c3040a03ea03c863a68747470733a2f2f70696b61636875696d2e6769746875622e696f2f7465737463612f63657274732f726f6f7463612f726f6f7463612e63726c3038a036a034863268747470733a2f2f746573742e63657274732e6f706b672e636e2f63657274732f726f6f7463612f726f6f7463612e63726c301106096086480186f8420101040403020122302206096086480186f842010d0415161350696b61636875204d61696c20537562204341300d06092a864886f70d01010c050003820201000f5bd031945c74f0589b868638aae57784d1e157138182a3899f480ba27b0768ef6ed853dc63c249a6e31edca17539e09fd5f4e49b0154e2ac9328e5f4dd190b1d3ec5ea3e488f665bd9000c2576ee6d0ec937b3d08b9bdc963a9c7ce697a4bf37ab926f34512149910f9e986c89bb5c0a35400fa6edaec4ad19a0acad86a69d3d63b73142d3d4c9cc1740d0b5123e5eb54068a3540adb0db98881d14f4b7d2052ef0035d7b4c677aa6256952bca5a2a3b6f0b05bb4a2386efecaae2fe66b0c888775234b5debdc829e29f532dbbf165fb89197ffda3e1935b579d9e615dbee8562459127217be595d1acbdd44cdf95017343308b12a423692944b82732cad8230f03a1e1172751693a7f8bd301525d5d912fdf8febab9f5be2dd18aa8fa095aff063da4e81e50b0d0f544f38ca634417e5918bd97487bba07cb9ffc4073e015c11b02eccc56825d545499c8fc86f95b72543e3ca3c7f7db2008ef49afb0c67ad7ef2a3390d9ce9b11cb616df1fb722fcb64c2c13ef13d12a9f36df139b2129da73d07f8b3da7757d265ebe9116c0ccdb3fb69ef3a00def966726e03fe4669be6950329ab159481994cfd48513518fb584b6e293926b8860b5ff3490a8e1e2d0cc92d9fa0585ff26c883435a29343d5a5cceb1fb0c75bc189e26fde33a85c62d760e7f7d63244f3d6336285ebae4a597d7e0f6cdaba3efe623da2964147328c1	Certmgr.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F57DF00CEB2476C8144B751F1D2D45EDBB3EDFE1\Blob = 030000000100000014000000f57df00ceb2476c8144b751f1d2d45edbb3edfe12000000001000000c20a000030820abe308208a6a00302010202087f7c81149fe39151300d06092a864886f70d01010d05003081f5310b300906035504061302434e3121301f060355040a131850696b61636875205472757374204e6574776f726b20434131283026060355040b131f50696b616368752043657274696669636174696f6e20417574686f72697479311c301a0603550403131350696b616368752054657374204341205253413121301f06092a864886f70d01090116127465737463614063657274732e75732e6b6731253023060355040d131c50696b61636875205075626c6963205465737420526f6f74205253413131302f060355040d0c28e79aaee58da1e4b898e585ace585b1e69c8de58aa1e6b58be8af95e6a0b9e8af81e4b9a6205253413020170d3030303130313030303030305a180f32303939313233313233353935395a3081f5310b300906035504061302434e3121301f060355040a131850696b61636875205472757374204e6574776f726b20434131283026060355040b131f50696b616368752043657274696669636174696f6e20417574686f72697479311c301a0603550403131350696b616368752054657374204341205253413121301f06092a864886f70d01090116127465737463614063657274732e75732e6b6731253023060355040d131c50696b61636875205075626c6963205465737420526f6f74205253413131302f060355040d0c28e79aaee58da1e4b898e585ace585b1e69c8de58aa1e6b58be8af95e6a0b9e8af81e4b9a62052534130820222300d06092a864886f70d01010105000382020f003082020a0282020100cc8a666400ea743698024184c77df195fa3fea65a55d91d20ac3f28f41609fa51ab21a0fd9a379fa82a010aadd4540b88de2ee2a7a865bd690b891a4000814717120ce7b9e130cfeea1f34ffc02e75e741c46a29413d8024f4941f6563a0e446352c7f9ad8d29581c820a0ad151a58608cd33065b190678ed8f45c24da13e89913d7f4548a670a1859450b9ebed3c5253c1951dfbd039e5f5afe36e5cc0b454d8f6a692b8d313df445fa98466bd77311a3f1c6f65a4642a609d0c640e284af71f19add28db8ae9d6e5d37a8bfc4271484749c0ab2d48f793acea9f75983c10a82295a20384b0382c2a18dcd25d68f29821e3b9818ad6b89adc5a20d396e06df6231bfedc516436d0ee048c3c362c32f0e736bcfb88d3242ef96da5951e21322876b2b11e0098ea3f7011bf587b12151fa961da245315eede2e7278cb0870357500aefd4658ef903e900c24a275ce31b82ebd1f3eafe330e1d31a2623fe27b99c9b1019a81c07b73175f48a41172b4519b8c19e6d58243839d6471a2e1b8006c281f6d085f60cfcf8c8bfbe2e751160d6c7c7cdf581a78cc8425a14fdd1d7605b22b29d25c9dbe2912b664ff9140c6e33b20c27c5ba783cdf775e194fb75784cbe319203ca8baa8bc99d42c57cf948aa5706bdd52a385ee4b85f607cc1bebfa7e042d8c605ebe584ef858d1786a6bcba2f43245111bf445d205872f396f115b590203010001a382044c3082044830120603551d130101ff040830060101ff020102301d0603551d0e041604143f40532e376cba8e321f2f6a9e555870627d7693308201150603551d230482010c30820108a181fba481f83081f5310b300906035504061302434e3121301f060355040a131850696b61636875205472757374204e6574776f726b20434131283026060355040b131f50696b616368752043657274696669636174696f6e20417574686f72697479311c301a0603550403131350696b616368752054657374204341205253413121301f06092a864886f70d01090116127465737463614063657274732e75732e6b6731253023060355040d131c50696b61636875205075626c6963205465737420526f6f74205253413131302f060355040d0c28e79aaee58da1e4b898e585ace585b1e69c8de58aa1e6b58be8af95e6a0b9e8af81e4b9a62052534182087f7c81149fe39151300f0603551d0f0101ff0405030307ff8030180603551d250101ff040e300c0604551d20000604551d2500301e0603551d1104173015821350696b6163687520546573742043412052534130818b0603551d200481833081803007060567810c0101300a06086086480186f842013069060d2b0601040182a464c628812d003058302506082b06010505070201161968747470733a2f2f746573742e63657274732e75732e6b672f302f06082b06010505070201162368747470733a2f2f70696b61636875696d2e6769746875622e696f2f7465737463612f3082012606082b060105050701010482011830820114302406082b060105050730018618687474703a2f2f746573742e6f637370732e75732e6b672f302606082b06010505073001861a687474703a2f2f746573742e6f637370732e6f706b672e636e2f303c06082b06010505073002863068747470733a2f2f746573742e63657274732e75732e6b672f63657274732f726f6f7463612f726f6f7463612e637274304606082b06010505073002863a68747470733a2f2f70696b61636875696d2e6769746875622e696f2f7465737463612f63657274732f726f6f7463612f726f6f7463612e637274303e06082b06010505073002863268747470733a2f2f746573742e63657274732e6f706b672e636e2f63657274732f726f6f7463612f726f6f7463612e6372743081bf0603551d1f0481b73081b43036a034a032863068747470733a2f2f746573742e63657274732e75732e6b672f63657274732f726f6f7463612f726f6f7463612e63726c3040a03ea03c863a68747470733a2f2f70696b61636875696d2e6769746875622e696f2f7465737463612f63657274732f726f6f7463612f726f6f7463612e63726c3038a036a034863268747470733a2f2f746573742e63657274732e6f706b672e636e2f63657274732f726f6f7463612f726f6f7463612e63726c301106096086480186f8420101040403020007302206096086480186f842010d0415161350696b61636875205465737420434120525341300d06092a864886f70d01010d050003820201005774877fbea6f3ea17500a4442cd839a3dcef2e4dca65f3b88cb792f5c8983d7b2ed658e845cef3af3b37dda4b83b467b073dc31a9bbc133fd52334c14b03dda111f710d283b26652b2539269989d3903dfd261ce2af5e350751d36f593fe09533ea7917a8957bd90bba825c87c659618d467edaf8d2eb8f762a27a0576c2a11f849a01d60f7afc88e38bf6cfb3f7a6efcb63771678e680e3f1cd36c7e842c6a4d90949ecb29145b71ab108bea972683c7b3b863c10d2d9558b2f00ae9c15b8a00ddfe9ceb96594cc113a607cc042e5c50ad53b830d57b3bcc860179655476419751a48c66d4c25ac4386107c557c584d802039ecd185e5e3c039c8358976ed7acb44b0bb4e5900631c9525ff151ad65754d7d6ca3aca542f06598ec69d01b47e435ae5712c326ce02dff1620d8958f1452dc08b9a3286aaee870481d0711d02fb470d03fea5f25a1da47eaf71028f37af6561eeeae8194a23d70b813daf33412f0ddbb3b637d2070359f905c5ea12ee090213fb4c23e4697e1200dac7fcd265e31dc071273f2004c811c054bdb5fbbd63cb88597f328d72047beee9f9d265e7d4c6e38739663a9af5fabcfb9d004165450368c01bcec1ddf2077daed5eadeefbae3f3c52ad9e51c65dc5823879fc4eab69457647e0fcb9369feda8344cac44cf335b5ace8cdac8ee3a3573e9657f91241777419d377b4837c3a8522c2599a1c	Certmgr.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CRLs\52FEDD61CFDDD48FD8F383F628F320723367B3A7\Blob = 03000000010000001400000052fedd61cfddd48fd8f383f628f320723367b3a72100000001000000950300003082039130820179020101300d06092a864886f70d01010b05003081f5310b300906035504061302434e3121301f060355040a131850696b61636875205472757374204e6574776f726b20434131283026060355040b131f50696b616368752043657274696669636174696f6e20417574686f72697479311c301a0603550403131350696b616368752054657374204341205253413121301f06092a864886f70d01090116127465737463614063657274732e75732e6b6731253023060355040d131c50696b61636875205075626c6963205465737420526f6f74205253413131302f060355040d0c28e79aaee58da1e4b898e585ace585b1e69c8de58aa1e6b58be8af95e6a0b9e8af81e4b9a620525341170d3030303130313030303030305a170d3234313233313233353935395aa04f304d301f0603551d230418301680143f40532e376cba8e321f2f6a9e555870627d7693301e0603551d1204173015821350696b61636875205465737420434120525341300a0603551d140403020101300d06092a864886f70d01010b050003820201008d5249884792c3c6d0a304dd11174cac640e91fb5d0257df08f5416b343fc7731129217ff58a9fbff4332e32cf1873cecc3c8e1518f9685489b6a5d8d43a5537914589d503cef21e25e4393128b2b27665310c5ab53473537e9d6826baf57d0ac795b3fab7dd9793df839041cce58a3256230599efc2947ef0992a3d5d4afff2579171be8be095250957f8eb159a8e2889bf45a90651b5253305114addbc5fa43ac7541159731edb342df3e337ccb4d9c732a3f98c3eb112bbc4e379c332d1cbbc9542405fbef24a0ba0293d360ff3f667e1b119275742b1ca6db83080c40410e47391963febf6dc0e366f307b3ad15c55d8f3ba93722dd7d5b3163f92b6ae0d3fc419ac4029c61c740901ddd64dee7fbcd7bf860fff3ea5321e92046d1e91d2edd16771ea14f05918bef6cdd1fb6b2e32f65927b6d096c51887f85ab0c7d2a017d8c9388742079886f5f9f35da2fb39ebef0aff52b96ed545fceb233c280c725e50348e7e427d9b39d4889a44bccbd4f0b7471e898f5c2641fec930bfc46b61562c1624046741a1757b333be98dff080017b837906db4eaeec6c31b113671ed85feed362aa5faf3f2651ce6567f0900afaf9fa874c3cbb737f3f3a901b379d483494c52cc280ab4a604aac02d5b3eb488326467e3de4590f0e5a9a0a053776e58299da13a3e606ede3083e31c6197c60b7f39fe4a4d5a53347cb789a33bc594	Certmgr.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CRLs\BCEA42B5DFA007F9903A8EF36C0935E684DD5E9C\Blob = 030000000100000014000000bcea42b5dfa007f9903a8ef36c0935e684dd5e9c210000000100000016030000308203123082017a020101300d06092a864886f70d01010b05003081f6310b300906035504061302434e3121301f060355040a131850696b61636875205472757374204e6574776f726b20434131283026060355040b131f50696b616368752043657274696669636174696f6e20417574686f72697479311c301a0603550403131350696b616368752054696d65205375622043413121301f06092a864886f70d010901161274696d6563614063657274732e75732e6b6731253023060355040d131c50696b616368752054696d65205369676e6e696e672053756220434131323030060355040d0c29e79aaee58da1e4b898e697b6e997b4e688b3e7adbee7bdb2e4b8ade997b44341e5ad90e8af81e4b9a6170d3030303130313030303030305a170d3234313233313233353935395aa04f304d301f0603551d230418301680146f18ddbf2922ef3d0fbe2a1c1018202e1a3b86a7301e0603551d1204173015821350696b616368752054696d6520537562204341300a0603551d140403020101300d06092a864886f70d01010b05000382018100a5fcfe663974c430842dec907774d11a4af2625f039bf86f76513c8a8d8a622242d552a5c86202e282b1e1128b19b210310991381be79662fe1bda3af078cdd2013b90647bf1d65f2fcc64a1167f4d254cabf46033ef5fd6ec51acd6019d952078cfe1d4232e1c4feec3db4e290644f1aba96f33a2ec0debc650e2b80e638ded4670d71768c30815ce2ef715ec0f88bf3709a6478ad0355de99ba1797c7da986c382ed053d37c5fdcb0a1407d249df1f7befbf3a8d27b686aca337eff3acfcdce12c6803f328f9af855a358a851c9d8bc53c10ebc4886d1d25fadfdc6e439a1c5adfc32e38cedaabfad7527dd5a04ce2bac7913fc3351b73a362a76e8064bbf7ecb2e52fd04eb134be1c01e9fd6dd2e4079b70aa6931b4be5d8be04b28164e1e35e1e44f4fe4d943dfc4ba11b1c1c9dc0d6c1976feeb1378902ab25ff1c089313e241adcb8fb0900bc19c25d0faf721d5c14382032ab6e29874b34bb5afeca7ed87c6f2128c70fd9f7b88f1954938e56c337a67d2c6edb81015390b6767f17a1	Certmgr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CRLs\F1AD12BEA16B8861596FF3713CBF8CD563B7D7AF	Certmgr.exe

Runs .reg file with regedit 1 IoCs

pid	Process
896	regedit.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3692	certification.tmp
3692	certification.tmp
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe
1144	Ember.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
564	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1872	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1872	SearchIndexer.exe
Token: SeDebugPrivilege	1144	Ember.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3692	certification.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 4396	1872	SearchIndexer.exe	89
PID 1872 wrote to memory of 4396	1872	SearchIndexer.exe	89
PID 1872 wrote to memory of 1460	1872	SearchIndexer.exe	91
PID 1872 wrote to memory of 1460	1872	SearchIndexer.exe	91
PID 1872 wrote to memory of 4672	1872	SearchIndexer.exe	92
PID 1872 wrote to memory of 4672	1872	SearchIndexer.exe	92
PID 624 wrote to memory of 3692	624	certification.exe	99
PID 624 wrote to memory of 3692	624	certification.exe	99
PID 624 wrote to memory of 3692	624	certification.exe	99
PID 3692 wrote to memory of 2740	3692	certification.tmp	100
PID 3692 wrote to memory of 2740	3692	certification.tmp	100
PID 3692 wrote to memory of 2740	3692	certification.tmp	100
PID 2740 wrote to memory of 4724	2740	cmd.exe	102
PID 2740 wrote to memory of 4724	2740	cmd.exe	102
PID 2740 wrote to memory of 4724	2740	cmd.exe	102
PID 2740 wrote to memory of 896	2740	cmd.exe	103
PID 2740 wrote to memory of 896	2740	cmd.exe	103
PID 2740 wrote to memory of 896	2740	cmd.exe	103
PID 2740 wrote to memory of 3884	2740	cmd.exe	104
PID 2740 wrote to memory of 3884	2740	cmd.exe	104
PID 2740 wrote to memory of 3884	2740	cmd.exe	104
PID 2740 wrote to memory of 4844	2740	cmd.exe	105
PID 2740 wrote to memory of 4844	2740	cmd.exe	105
PID 2740 wrote to memory of 4844	2740	cmd.exe	105
PID 2740 wrote to memory of 676	2740	cmd.exe	106
PID 2740 wrote to memory of 676	2740	cmd.exe	106
PID 2740 wrote to memory of 676	2740	cmd.exe	106
PID 2740 wrote to memory of 3988	2740	cmd.exe	107
PID 2740 wrote to memory of 3988	2740	cmd.exe	107
PID 2740 wrote to memory of 3988	2740	cmd.exe	107
PID 2740 wrote to memory of 276	2740	cmd.exe	108
PID 2740 wrote to memory of 276	2740	cmd.exe	108
PID 2740 wrote to memory of 276	2740	cmd.exe	108
PID 2740 wrote to memory of 2952	2740	cmd.exe	109
PID 2740 wrote to memory of 2952	2740	cmd.exe	109
PID 2740 wrote to memory of 2952	2740	cmd.exe	109
PID 2740 wrote to memory of 4520	2740	cmd.exe	110
PID 2740 wrote to memory of 4520	2740	cmd.exe	110
PID 2740 wrote to memory of 4520	2740	cmd.exe	110
PID 2740 wrote to memory of 4228	2740	cmd.exe	111
PID 2740 wrote to memory of 4228	2740	cmd.exe	111
PID 2740 wrote to memory of 4228	2740	cmd.exe	111
PID 2740 wrote to memory of 3388	2740	cmd.exe	112
PID 2740 wrote to memory of 3388	2740	cmd.exe	112
PID 2740 wrote to memory of 3388	2740	cmd.exe	112
PID 2740 wrote to memory of 1124	2740	cmd.exe	113
PID 2740 wrote to memory of 1124	2740	cmd.exe	113
PID 2740 wrote to memory of 1124	2740	cmd.exe	113
PID 2740 wrote to memory of 2888	2740	cmd.exe	114
PID 2740 wrote to memory of 2888	2740	cmd.exe	114
PID 2740 wrote to memory of 2888	2740	cmd.exe	114
PID 2740 wrote to memory of 2084	2740	cmd.exe	115
PID 2740 wrote to memory of 2084	2740	cmd.exe	115
PID 2740 wrote to memory of 2084	2740	cmd.exe	115
PID 2740 wrote to memory of 1856	2740	cmd.exe	116
PID 2740 wrote to memory of 1856	2740	cmd.exe	116
PID 2740 wrote to memory of 1856	2740	cmd.exe	116
PID 2740 wrote to memory of 1028	2740	cmd.exe	117
PID 2740 wrote to memory of 1028	2740	cmd.exe	117
PID 2740 wrote to memory of 1028	2740	cmd.exe	117
PID 2740 wrote to memory of 3704	2740	cmd.exe	118
PID 2740 wrote to memory of 3704	2740	cmd.exe	118
PID 2740 wrote to memory of 3704	2740	cmd.exe	118
PID 2740 wrote to memory of 4000	2740	cmd.exe	119

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Ember.zip
1⤵
PID:4868

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1216

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4396
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 828 2316 2656 812 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1460
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 828 2700 2696 812 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4672

C:\Users\Admin\Downloads\Ember\certification.exe
"C:\Users\Admin\Downloads\Ember\certification.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:624
- C:\Users\Admin\AppData\Local\Temp\is-LMFH4.tmp\certification.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-LMFH4.tmp\certification.tmp" /SL5="$4021E,908493,832512,C:\Users\Admin\Downloads\Ember\certification.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3692
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\CA-INSTALL.bat""
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2740
  - - C:\Windows\SysWOW64\mode.com
      mode con lines=42 cols=60
      4⤵
      System Location Discovery: System Language Discovery
      PID:4724
  - - C:\Windows\SysWOW64\regedit.exe
      regedit.exe /s .\CA-INSTALL.reg
      4⤵
      System Location Discovery: System Language Discovery
      Runs .reg file with regedit
      PID:896
  - - C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe
      certmgr.exe -add /all .\0-Pikachu_Test_CA_RSA.crt -s -r localMachine AuthRoot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      PID:3884
  - - C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe
      certmgr.exe -add /all .\0-Pikachu_Test_CA_RSA.crt -s -r currentUser AuthRoot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      PID:4844
  - - C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe
      certmgr.exe -crl -add /all .\0-Pikachu_Test_CA_RSA-G1.crl -s -r localMachine AuthRoot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      PID:676
  - - C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe
      certmgr.exe -crl -add /all .\0-Pikachu_Test_CA_RSA-G1.crl -s -r currentUser AuthRoot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3988
  - - C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe
      certmgr.exe -crl -add /all .\0-Pikachu_Test_CA_RSA-G2.crl -s -r localMachine AuthRoot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      PID:276
  - - C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe
      certmgr.exe -crl -add /all .\0-Pikachu_Test_CA_RSA-G2.crl -s -r currentUser AuthRoot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2952
  - - C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe
      certmgr.exe -add /all .\2-Pikachu_Time_Sub_CA.crt -s -r localMachine AuthRoot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      PID:4520
  - - C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe
      certmgr.exe -add /all .\2-Pikachu_Time_Sub_CA.crt -s -r currentUser AuthRoot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4228
  - - C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe
      certmgr.exe -crl -add /all .\2-Pikachu_Time_Sub_CA-G1.crl -s -r localMachine AuthRoot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      PID:3388
  - - C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe
      certmgr.exe -crl -add /all .\2-Pikachu_Time_Sub_CA-G1.crl -s -r currentUser AuthRoot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1124
  - - C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe
      certmgr.exe -crl -add /all .\2-Pikachu_Time_Sub_CA-G2.crl -s -r localMachine AuthRoot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      PID:2888
  - - C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe
      certmgr.exe -crl -add /all .\2-Pikachu_Time_Sub_CA-G2.crl -s -r currentUser AuthRoot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2084
  - - C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe
      certmgr.exe -add /all .\3-Pikachu_UEFI_Sub_CA.crt -s -r localMachine AuthRoot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      PID:1856
  - - C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe
      certmgr.exe -add /all .\3-Pikachu_UEFI_Sub_CA.crt -s -r currentUser AuthRoot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1028
  - - C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe
      certmgr.exe -crl -add /all .\3-Pikachu_UEFI_Sub_CA-G1.crl -s -r localMachine AuthRoot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      PID:3704
  - - C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe
      certmgr.exe -crl -add /all .\3-Pikachu_UEFI_Sub_CA-G1.crl -s -r currentUser AuthRoot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4000
  - - C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe
      certmgr.exe -crl -add /all .\3-Pikachu_UEFI_Sub_CA-G2.crl -s -r localMachine AuthRoot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      PID:2744
  - - C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe
      certmgr.exe -crl -add /all .\3-Pikachu_UEFI_Sub_CA-G2.crl -s -r currentUser AuthRoot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1148
  - - C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe
      certmgr.exe -add /all .\4-Pikachu_Code_Sub_CA.crt -s -r localMachine AuthRoot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      PID:3148
  - - C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe
      certmgr.exe -add /all .\4-Pikachu_Code_Sub_CA.crt -s -r currentUser AuthRoot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4988
  - - C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe
      certmgr.exe -crl -add /all .\4-Pikachu_Code_Sub_CA-G1.crl -s -r localMachine AuthRoot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      PID:4692
  - - C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe
      certmgr.exe -crl -add /all .\4-Pikachu_Code_Sub_CA-G1.crl -s -r currentUser AuthRoot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3760
  - - C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe
      certmgr.exe -crl -add /all .\4-Pikachu_Code_Sub_CA-G2.crl -s -r localMachine AuthRoot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      PID:1868
  - - C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe
      certmgr.exe -crl -add /all .\4-Pikachu_Code_Sub_CA-G2.crl -s -r currentUser AuthRoot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3212
  - - C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe
      certmgr.exe -add /all .\5-Pikachu_mTLS_Sub_CA.crt -s -r localMachine AuthRoot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      PID:3940
  - - C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe
      certmgr.exe -add /all .\5-Pikachu_mTLS_Sub_CA.crt -s -r currentUser AuthRoot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1992
  - - C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe
      certmgr.exe -crl -add /all .\5-Pikachu_mTLS_Sub_CA-G1.crl -s -r localMachine AuthRoot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      PID:5044
  - - C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe
      certmgr.exe -crl -add /all .\5-Pikachu_mTLS_Sub_CA-G1.crl -s -r currentUser AuthRoot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1936
  - - C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe
      certmgr.exe -crl -add /all .\5-Pikachu_mTLS_Sub_CA-G2.crl -s -r localMachine AuthRoot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      PID:4688
  - - C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe
      certmgr.exe -crl -add /all .\5-Pikachu_mTLS_Sub_CA-G2.crl -s -r currentUser AuthRoot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2800
  - - C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe
      certmgr.exe -add /all .\6-Pikachu_File_Sub_CA.crt -s -r localMachine AuthRoot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      PID:1192
  - - C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe
      certmgr.exe -add /all .\6-Pikachu_File_Sub_CA.crt -s -r currentUser AuthRoot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:664
  - - C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe
      certmgr.exe -crl -add /all .\6-Pikachu_File_Sub_CA-G1.crl -s -r localMachine AuthRoot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      PID:4388
  - - C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe
      certmgr.exe -crl -add /all .\6-Pikachu_File_Sub_CA-G1.crl -s -r currentUser AuthRoot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3328
  - - C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe
      certmgr.exe -crl -add /all .\6-Pikachu_File_Sub_CA-G2.crl -s -r localMachine AuthRoot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      PID:1096
  - - C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe
      certmgr.exe -crl -add /all .\6-Pikachu_File_Sub_CA-G2.crl -s -r currentUser AuthRoot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3084
  - - C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe
      certmgr.exe -add /all .\7-Pikachu_Mail_Sub_CA.crt -s -r localMachine AuthRoot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      PID:1940
  - - C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe
      certmgr.exe -add /all .\7-Pikachu_Mail_Sub_CA.crt -s -r currentUser AuthRoot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2020
  - - C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe
      certmgr.exe -crl -add /all .\7-Pikachu_Mail_Sub_CA-G1.crl -s -r localMachine AuthRoot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      PID:2320
  - - C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe
      certmgr.exe -crl -add /all .\7-Pikachu_Mail_Sub_CA-G1.crl -s -r currentUser AuthRoot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2776
  - - C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe
      certmgr.exe -crl -add /all .\7-Pikachu_Mail_Sub_CA-G2.crl -s -r localMachine AuthRoot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      PID:5048
  - - C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe
      certmgr.exe -crl -add /all .\7-Pikachu_Mail_Sub_CA-G2.crl -s -r currentUser AuthRoot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3140
  - - C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe
      certmgr.exe -add /all .\8-Pikachu_Sign_Sub_CA.crt -s -r localMachine AuthRoot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      PID:4724
  - - C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe
      certmgr.exe -add /all .\8-Pikachu_Sign_Sub_CA.crt -s -r currentUser AuthRoot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5008
  - - C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe
      certmgr.exe -crl -add /all .\8-Pikachu_Sign_Sub_CA-G1.crl -s -r localMachine AuthRoot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      PID:4720
  - - C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe
      certmgr.exe -crl -add /all .\8-Pikachu_Sign_Sub_CA-G1.crl -s -r currentUser AuthRoot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2148
  - - C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe
      certmgr.exe -crl -add /all .\8-Pikachu_Sign_Sub_CA-G2.crl -s -r localMachine AuthRoot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      PID:3884
  - - C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe
      certmgr.exe -crl -add /all .\8-Pikachu_Sign_Sub_CA-G2.crl -s -r currentUser AuthRoot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2388
  - - C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe
      certmgr.exe -add /all .\9-Pikachu_Auth_Sub_CA.crt -s -r localMachine AuthRoot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      PID:3988
  - - C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe
      certmgr.exe -add /all .\9-Pikachu_Auth_Sub_CA.crt -s -r currentUser AuthRoot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2936
  - - C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe
      certmgr.exe -crl -add /all .\9-Pikachu_Auth_Sub_CA-G1.crl -s -r localMachine AuthRoot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      PID:2784
  - - C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe
      certmgr.exe -crl -add /all .\9-Pikachu_Auth_Sub_CA-G1.crl -s -r currentUser AuthRoot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2952
  - - C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe
      certmgr.exe -crl -add /all .\9-Pikachu_Auth_Sub_CA-G2.crl -s -r localMachine AuthRoot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      PID:1216
  - - C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe
      certmgr.exe -crl -add /all .\9-Pikachu_Auth_Sub_CA-G2.crl -s -r currentUser AuthRoot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3460

C:\Users\Admin\Downloads\Ember\Ember.exe
"C:\Users\Admin\Downloads\Ember\Ember.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1144
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Ember.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\Downloads\Ember\Ember.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --mojo-named-platform-channel-pipe=1144.2220.8036945844932584924
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:564
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\Downloads\Ember\Ember.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\Downloads\Ember\Ember.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x17c,0x180,0x184,0x158,0x18c,0x7fffdbc5b078,0x7fffdbc5b084,0x7fffdbc5b090
    3⤵
    PID:2576
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Ember\Ember.exe.WebView2\EBWebView" --webview-exe-name=Ember.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1744,i,7564335366479875852,10946630005906460062,262144 --variations-seed-version --mojo-platform-channel-handle=1740 /prefetch:2
    3⤵
    PID:2596
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Ember\Ember.exe.WebView2\EBWebView" --webview-exe-name=Ember.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2028,i,7564335366479875852,10946630005906460062,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:11
    3⤵
    PID:4864
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Ember\Ember.exe.WebView2\EBWebView" --webview-exe-name=Ember.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2300,i,7564335366479875852,10946630005906460062,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:13
    3⤵
    PID:2024
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Ember\Ember.exe.WebView2\EBWebView" --webview-exe-name=Ember.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3584,i,7564335366479875852,10946630005906460062,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
    3⤵
    PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\0-Pikachu_Test_CA_RSA-G1.crl

Filesize
1KB

MD5
51f968c58dcd358393ea98de5b0d340e

SHA1
2d5e59106848aaeddebff983bc2d87d7342e3569

SHA256
1c83c4b49a985ba87ba0cd1bd0d65db972f1f3ff5c4772744c16a093f7824ec5

SHA512
e898052a329c139e9b9218b895e6d99a4bc6f65565491cae53cc04d586ae3eb485e0998901eccb68235d7a66b247ea8799a26e732b7490ce9b10e199dc534d8a

Download Submit
C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\0-Pikachu_Test_CA_RSA-G2.crl

Filesize
1KB

MD5
d4a7eae5025ab073e5e535b4a8bcaa2e

SHA1
dbb7c8dd2be56c88a1169a5e407600820e513806

SHA256
36b8078c525b816a47a9f711af22505c958dcd81786d93e67b5db2cfd2f7c4a2

SHA512
e760e0fd93fdececaa38c66909a4c601589abb556f9a3da9a089be2ac222b24368457c55ce16740ad21cf3be49e4526dd50a1173b1779b9bb833a37c8844af91

Download Submit
C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\0-Pikachu_Test_CA_RSA.crt

Filesize
3KB

MD5
c6b82192e9f8fcf65608a1a5640f706b

SHA1
fe02e1682871948186ed5da1b88983781f23a1ad

SHA256
d49701e4f6b57229fe7623a7355ea1b2ac14ad3d5a387d30387a3a82e403553e

SHA512
ba70cb1a241975d2e552b6123fa7c6cb7b3fb781c0d34ad9bbc1e4aa3016e418cb9c783fcdb08a403a0b4f2a41cb5411120f3751c89b72bc651dd826c68c0108

Download Submit
C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\2-Pikachu_Time_Sub_CA-G1.crl

Filesize
1KB

MD5
11193587d6c853afd46dee6835a55a6d

SHA1
0ac35d1218e05b9e81334c26208c25641ae696c2

SHA256
7a5fee4fa2cd2164250808dfb7b50cd8d8dad491051c944cd4b6d0902f59bb02

SHA512
1350f6ffdf412e081a2d2aabfb7a40f2c85194c3b0410d4d09f3ba87a10dafab161d5fc06e10e31349dde1c607cee2946e21ffa46e1414934bfae0b413a43de2

Download Submit
C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\2-Pikachu_Time_Sub_CA-G2.crl

Filesize
1KB

MD5
aee260b1675e4e2c28eaa9d5ba8daa53

SHA1
bf280aa4dd63fc190986695ebb829024bd3b757b

SHA256
7373e065047c75f671fa75bac5a65e78fad71ecb59ff2cc7e1de89d4c7207884

SHA512
95242b95d2d17f3d53b3fb18db137700c65f9f500b67045c1a82ab678f77af5ceefc47946d51c673056191121d1619eb680b4d2d58f3e2e23e98558140c1a155

Download Submit
C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\2-Pikachu_Time_Sub_CA.crt

Filesize
3KB

MD5
b72a4912ef7da71988c96ac30632341b

SHA1
784bd9418e3dfebba8b046f2a4c9bce7bcf88f8c

SHA256
61f2dfbbf9fa960a11eebf27fe58f52aca0e8a1d9128149085b90563085ccc8b

SHA512
54ff0795afb7d14685693c8b380fa60be42e6ca6a7cb191947e514db9e8d68f65618e85bdc2313b2c5f3fa32631ecba640c8d51ed4354c267c747fc9212b3ff5

Download Submit
C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\3-Pikachu_UEFI_Sub_CA-G1.crl

Filesize
1KB

MD5
dc344ace0a557cfce49549e25261badf

SHA1
4801d4f33f6d095b093fd1f884153afd40c6abb6

SHA256
c149784e78ad8ae0a07ebd30534e9ffe9d49a8ee46c95d93fd4e3b77b306bda9

SHA512
eec0fa6b15699d4574d870911825dd449bc5736486212e8986101c7413cc926de73ed501e5018b8ac26d4615733f1c12b0a4df17327961c75cbceab36d911754

Download Submit
C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\3-Pikachu_UEFI_Sub_CA-G2.crl

Filesize
1KB

MD5
59d35523644e2a14a738bed66a39e97f

SHA1
6e6056d2fcf57e774f56e7a7d692c27368ce4749

SHA256
2cfe6dd78cf861f1dc72b117387d438f4f004ff6651a82395d1d09c2ed897f70

SHA512
66fff7d7e3914d65999ae5595278609f5393473f9c3706af7b1a4aa30bd6a6e7c48056ce77b8792f46b9a591e5185bb0471c13fd7222117d88afeb42d8de867b

Download Submit
C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\3-Pikachu_UEFI_Sub_CA.crt

Filesize
3KB

MD5
d3dc3379ff1079d6a11e2260006c5f17

SHA1
426d334270e0df9c2656682c780256bf47c67faf

SHA256
a8d93e544fd9f731efed42e9954d90035171b69e7471fd04548eeb305c448125

SHA512
ab21f0e3e5c263b773f81ee637619d00a56d097d36dcad738d9a69491dfdd7ffd71eac95ee21e68d4560084230d3d439d08ae280b8ce854fdea5e95364b0d1a6

Download Submit
C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\4-Pikachu_Code_Sub_CA-G1.crl

Filesize
1KB

MD5
ed3cf6602db780e35db0810dcfa885c6

SHA1
b4315d22f02709a4c406f2b3113f7aa768a387bb

SHA256
673a1bd51ef1fd2e16c05c62ae41c9bc0bf8db1c84c0eb7ecea92854c86a8ab0

SHA512
3d89d358c1011a59df113d16bfb405a9a859771c3b7223d3ffffe26a7953866c4307077470acce36e1bb14bc9af4581367adf27a2771e32ff78154225a85477e

Download Submit
C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\4-Pikachu_Code_Sub_CA-G2.crl

Filesize
1KB

MD5
3927baaa52959c42d853d3f4ee204e15

SHA1
704762fb21487fa39e1b0b48a3bf3da037647362

SHA256
8f05f78dda961567b1753731282257c538acab67d21c1aaa4bd33e175f52447c

SHA512
5b7ad2124c45e779dfce617827354a4cd7667349abd10212f3a38e703874394ea8a54d576e450b4021a28bc6b81fa396ab5e086e40ac0e9d6249d635aa8c8a6a

Download Submit
C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\4-Pikachu_Code_Sub_CA.crt

Filesize
3KB

MD5
707327f4a78be73a965183cf4615d645

SHA1
3045aab3e4f999bb3fe8680600f1222dc11732f8

SHA256
88301a4ff80d1b2e373eafffd02ba55112a633bcfac57e94cb635ad395a9dfdc

SHA512
4bdfddd50092ecc9535a4e0e1391c6af6cf23746b298b97d2219cb1608f9bb753616f67a62deae5bc63cc769f9f9fd10118e125c5a5f3c7ff1faa6391fe2095a

Download Submit
C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\5-Pikachu_mTLS_Sub_CA-G1.crl

Filesize
1KB

MD5
48c74750e4b3f6e49888e537bb2c5538

SHA1
745f3f9a9640b3b3b2269b1753fe3ffaf00e4b71

SHA256
0392c9f8b264910d5fd99cb6ec2967aaa4586b04eff384e1e56a7db957193e14

SHA512
155af274284f313698adc048a0f4a70285760b9c674dd8e60031d5d7cf09d4b7fe3f12dcc6544763b6247e0785e6b9f8fe799834b1f2284d0f2e17fc3e04e35d

Download Submit
C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\5-Pikachu_mTLS_Sub_CA-G2.crl

Filesize
1KB

MD5
c00785882c78f674df2a85f44352d015

SHA1
2b8f2711a8d4b2e507e0b80040da07e57ca7d7f7

SHA256
0b14275581a536205be342ca7bc90de86a3315978fcc0551e4776ab339d9a338

SHA512
8f548c63142181e52bc57cdf9d4d88c5e156761dd6d0a37d0506ea7c1d7761861718a2b4c7d82a788c8f464450bbdce46dd402ebdf96e7d278a687db9fd1a2d3

Download Submit
C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\5-Pikachu_mTLS_Sub_CA.crt

Filesize
3KB

MD5
10826a6d60e8a9787fdfaa0e669cbfbc

SHA1
6adb35296936ef99d5474a5aed26a4bc6ea4019b

SHA256
e3f0039003fded5d3f995db5b8fa1b6910b25f9dbc3b708485edc1223fcf85f3

SHA512
6208f606be44a2dcf26214c6a6af1f4281cf84df91fb90efbf8debec69ea571f48637c577f273f885559436117a036d9db4a8cadc227da9beaa0eca0a32d0209

Download Submit
C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\6-Pikachu_File_Sub_CA-G1.crl

Filesize
1KB

MD5
d1353c89a816dc09376ad9a392827b8c

SHA1
435812dba88f088466c1e70aa870243de36040c5

SHA256
c2fde84fcbe78db47797da5ab3e0b0def7d6d1b1d43c326ccd7b90d8e98e2ad0

SHA512
f7a13d2ea45817cecaa1d711cd25dc3d4b1fedbd2cad38a6e89328836db208f86e28f6386e1c89f1672f371c5da793f68bc44d069f2bccfac50a2ce9c79f8838

Download Submit
C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\6-Pikachu_File_Sub_CA-G2.crl

Filesize
1KB

MD5
9f920be53c25abcf3261185a0510057a

SHA1
b8526e4ba4afec4f5ee33d43d5f73dd9b46f8302

SHA256
fb3f0b78c9a22f27fe3937f13e7b493a260c7278c8edff671b0247ab3d8e0f61

SHA512
22332e25a5fd6699a1ea9b5dd4efc0ad34bc6860b292c77117ff0b071a8f3320e9dea8b3605016366116c03b9cda1b7830862b6b465097d1ecf744eaa091d871

Download Submit
C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\6-Pikachu_File_Sub_CA.crt

Filesize
3KB

MD5
06db713dd094255e5df7ef6706580872

SHA1
601919fa67d81de1eb1ab6a7737783c25217e458

SHA256
c1e13bee520d6b8d4148d1a32a081ae1e7f150c3461d592b74a207012a00ce34

SHA512
b03b5119e57e0510687e9e13f55cd286aef45ce5f08af9e17c4182cf95d404cb52aac9cd3ac12626e6946f6506b9a12334d615010178c445232e3b7fe8a2359e

Download Submit
C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\7-Pikachu_Mail_Sub_CA.crt

Filesize
3KB

MD5
415d965a006b635d6ed84bfabc2fcc9e

SHA1
c48d9fc9b6f40d66bc8797ed64a3b396ebb7b5bc

SHA256
3e7ee6d2943525c718d85ac06e9e06d192d53ca90db6cb397e8f7ed289def5d7

SHA512
4bcae8b569e955514e39469fba375658ce82e8e66e7b463d135954ef6522db230b38461a5961ab3eced353f9f08bcbfd1bee28c6a696fe1ea104c5a14483cf07

Download Submit
C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\CA-INSTALL.bat

Filesize
5KB

MD5
e851ac7cc3b812183bf9e00d3a9424c1

SHA1
88a950dfbb1bb6f62b086f9b3ef9ab69846975f3

SHA256
6044f5a93fd6ae24402738caaab8d433f52d9063a63547f94b1c5ae5aef934b4

SHA512
53f43c5bd6b890e2b16402e6d72c0948842e41de565c138ae9d20313bd8ca7bef8f17c86f2a8f356a87f20b321bd66525b9a82fa93b2b233c2e8d0e10c767b91

Download Submit
C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\CA-INSTALL.reg

Filesize
39KB

MD5
2a166611d275607082a6d75039c4977e

SHA1
8d68e5708414db92b0395ad829016bf7ccb42123

SHA256
d9e860a805060b43214c594bcbad4fdcff7daeb810d003f77d4619b60c4372f1

SHA512
a19cd5ee6e7e261955fa5df29869a4737deb54b22146cf598407dca14026a5125481b227e3b260c14b763388393aac5b6e828f8dbca35f7f94a2335937c02ba6

Download Submit
C:\Program Files (x86)\Pikacu Test CA Truster\Scripts\Certmgr.exe

Filesize
79KB

MD5
322bf8029866cf3eb7f1de33f18fb07a

SHA1
65948959452d2fde1f3a3dcbb8e07c4224a3dd0b

SHA256
312da44e936c59872eecf0c057f2d21f92edfb2e712f646569513ee33be269b0

SHA512
c13f3373b142644c19971a2bbb9f019bdce21338e40e8edcb0cff643ea9883721bdfb48c3338b44fa87bc27b0756a0f3fca5381e255836f6a49260e638386498

Download Submit
C:\Users\Admin\AppData\Local\PeppermintInterface\Ember.exe_Url_qydckjnz1xvvzjmc0xrkf1ljl4t1ildf\1.0.0.0\cndxh33t.newcfg

Filesize
459B

MD5
c9ab0387514bc7daa2b6391d7b4bda1d

SHA1
1ef5e0ae332f9adda479bd84dfeeff7c86f98de3

SHA256
86c1921051f67b8d5414c9dda3cd4b6ff67b26f993c3503f546a66269cb70c68

SHA512
870c955e62d667cb73be37e20d6c106daa2ed2fd26f5a8f0c950fc1da2ca150e4d67b79bb102bc4fc8241c36bdac6ed09f2bf4fbe607b3b4c6ab3632ead914e8

Download Submit
C:\Users\Admin\AppData\Local\PeppermintInterface\Ember.exe_Url_qydckjnz1xvvzjmc0xrkf1ljl4t1ildf\1.0.0.0\user.config

Filesize
337B

MD5
668b0d95a2870e03873da0bc9a73747f

SHA1
c55862d7684dcf27a1e96e0869b9cf9d808c4b35

SHA256
e3f1efd055ec3014a5fdeb277b5ca8a3322b215cde27134204f0252812468a38

SHA512
a9319339cc6149a9870f47fd4bdfab77852b06af2ad32f96f5d442a1ee0a08649a4b20d3e2ede20121f60c1115acda5a4698a487f458cd928fcfb2e1025981d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-2Q916.tmp\_isetup\_isdecmp.dll

Filesize
28KB

MD5
077cb4461a2767383b317eb0c50f5f13

SHA1
584e64f1d162398b7f377ce55a6b5740379c4282

SHA256
8287d0e287a66ee78537c8d1d98e426562b95c50f569b92cea9ce36a9fa57e64

SHA512
b1fcb0265697561ef497e6a60fcee99dc5ea0cf02b4010da9f5ed93bce88bdfea6bfe823a017487b8059158464ea29636aad8e5f9dd1e8b8a1b6eaaab670e547

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-LMFH4.tmp\certification.tmp

Filesize
3.1MB

MD5
2f129949f1a82013642be1e44ec00cfc

SHA1
87f929752e4873b298f3e9c84521ce95cc8048b0

SHA256
9cbf6c1ddc60cf30d4a3e096373b605989a0f7d66a77ce5ea9fd5cdecf847878

SHA512
a12c5f5d251cb1fe75a23e85e94634d0c1feaf3e4534cddff9c608f875fcead14754d344d119fddb1bfaf8bc991e5e5f51487acc8e89587a919257544e8b7b37

Download Submit
C:\Users\Admin\Downloads\Ember\Ember.exe.WebView2\EBWebView\Crashpad\settings.dat

Filesize
280B

MD5
519401913b3514b1c05d2b07831fb5de

SHA1
bda15e625924c54b3d21f9147f46e655479c1a31

SHA256
c5bd86d4343a87afc4d3b2a24e7cabe1eb7b2a207f251dad00ee230030db813d

SHA512
2543799fb9e20f6d408e2d638fdfd350360ba71239771e6a7f3fbd8241fa0b7892572a8f6ec6413c3d840f3feb8f2d0dca806482c250a7e495aa2d82e7beb28b

Download Submit
C:\Users\Admin\Downloads\Ember\Ember.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\Downloads\Ember\Ember.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\Downloads\Ember\Ember.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\Downloads\Ember\Ember.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\Downloads\Ember\Ember.exe.WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\Downloads\Ember\Ember.exe.WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\Downloads\Ember\Ember.exe.WebView2\EBWebView\Default\Preferences

Filesize
6KB

MD5
cddc8907abc58c09d3092e0ed5e4208f

SHA1
dc7a695fd0c1b3cfbb7ca669e6733a9fa692b083

SHA256
5fdf8e16ca3ae5c08b43032fe91192eb8279eed0f96eda036fb74eda26b02f3e

SHA512
a5346f7e0a8999e96442a5ab40aade0d151f89f6b7fbe95066cef224f7d7627c247b54ba38dbd0618f2e160b062b8f06dee24c83a391de6a87bf39348290b03b

Download Submit
C:\Users\Admin\Downloads\Ember\Ember.exe.WebView2\EBWebView\Default\Sync Data\LevelDB\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\Downloads\Ember\Ember.exe.WebView2\EBWebView\Local State

Filesize
16KB

MD5
8c3c70aac594c1de9bccd8047a071af6

SHA1
223a5055f98a71c27fd862f9afd009b6ac592194

SHA256
dbdfdee3730c01360190d9562436bc71dd7b0d8fe929fe5d3e44c6ee27134297

SHA512
da081e9e7a10e2030cf716580141d9314a46395929edcf039deb03559de417ab672edf033a7e49bd89cfd6191800b230589fe183a4fb9723b5503f8a942b170c

Download Submit
C:\Users\Admin\Downloads\Ember\Ember.exe.WebView2\EBWebView\Local State

Filesize
16KB

MD5
c463f3fe31305928ce0bf8e220ac8f47

SHA1
e49fb0ea1e1ad13fce0674d9fcefa905c4d383af

SHA256
aad626f3f4fd099752116f25311f73b3e41e44e05f61caf64107d903aa209929

SHA512
a5c6c8d5c4618235495d92496758f877dc0b0ac9c91c5c029c7ff6db27d3b3504b47fa262b5a1c8952affbd581b5fdb2d543afb495ce08643078b6875e1d9d0a

Download Submit
C:\Users\Admin\Downloads\Ember\Ember.exe.WebView2\EBWebView\Local State

Filesize
1KB

MD5
be61f7781b75c4a77103105f5acf3c7c

SHA1
de930ed4c374c5d6fbfa221bf73c53ad5b936dee

SHA256
897dad7ab436ab057a288f5a48322765a43b4713d3cad64bf79ebbb6df3410a5

SHA512
d20f2838e2af67e4a0245ee8ff968965b655dd7a6728b52af8ebe3311e7519c52303c6bbf65e9edda4769be147ee312b13ff60741c3a7334716c89178502aa60

Download Submit
C:\Users\Admin\Downloads\Ember\Ember.exe.WebView2\EBWebView\Local State

Filesize
2KB

MD5
f9a847edb181cd55b180a3736a899439

SHA1
3764cff01e34a4efa0fe7edaf869f4a37d6377e8

SHA256
34c0bad24dbc93547195016a0b5184022ce2642811a0b931a65e7ac20b22552d

SHA512
36eeada9700b8d8b1530eb107b4c5742ac89086713750a2b0e2276477290713f86e391a23a67175448cf596dde961aa6f53615a2d3810fbc5da0b669d801ee9d

Download Submit
C:\Users\Admin\Downloads\Ember\Ember.exe.WebView2\EBWebView\Local State

Filesize
3KB

MD5
a3fc7cba852029c4985c3f7f44d8244e

SHA1
c7d80835e209dbcc102756e4638f173a415de3a1

SHA256
0bca71acd8bd2ce95ae51280f278dd9ead826ff5d91d277ff23d25bef8519f05

SHA512
c9c43ecf94e25ef137b45940526e9bdafd50c06ad316f9eeb0756f068f64f21ce2fe11cdd384a9869774c197459cc7740a9b2572e167436e3b92adb58ac32dd3

Download Submit
C:\Users\Admin\Downloads\Ember\Ember.exe.WebView2\EBWebView\Local State~RFe5a74a5.TMP

Filesize
1KB

MD5
2518955fa1e3ed913679651199eba7aa

SHA1
eccfcccd5919bef87de6e752a63b3ac5f068d5f0

SHA256
b934bd40c2ac48bc3b4162ca72ada8a19d79a868b172d40aaa4635dcd1d0bfd2

SHA512
fa18273af8016dc8159d3b7f44be79dd24c62bd381bd8d8833df84718019500d7e34c085b288e506aee664a4ceca36ec78921461999fbcfe10a7c52bad92e06c

Download Submit
memory/1144-293-0x0000000009EA0000-0x0000000009F52000-memory.dmp

Filesize
712KB

Download
memory/1144-282-0x0000000000EA0000-0x00000000024EE000-memory.dmp

Filesize
22.3MB

Download
memory/1144-457-0x00000000081A0000-0x00000000081AC000-memory.dmp

Filesize
48KB

Download
memory/1144-319-0x000000000F0F0000-0x000000000F278000-memory.dmp

Filesize
1.5MB

Download
memory/1144-298-0x000000000E960000-0x000000000ECB7000-memory.dmp

Filesize
3.3MB

Download
memory/1144-297-0x000000000E920000-0x000000000E942000-memory.dmp

Filesize
136KB

Download
memory/1144-289-0x0000000008E40000-0x0000000008E4E000-memory.dmp

Filesize
56KB

Download
memory/1144-288-0x0000000008E80000-0x0000000008EB8000-memory.dmp

Filesize
224KB

Download
memory/1144-287-0x0000000008CE0000-0x0000000008CE8000-memory.dmp

Filesize
32KB

Download
memory/1144-286-0x0000000008DA0000-0x0000000008E3E000-memory.dmp

Filesize
632KB

Download
memory/1144-285-0x0000000008D00000-0x0000000008D92000-memory.dmp

Filesize
584KB

Download
memory/1144-284-0x0000000008C40000-0x0000000008C58000-memory.dmp

Filesize
96KB

Download
memory/1144-283-0x0000000007160000-0x0000000007886000-memory.dmp

Filesize
7.1MB

Download
memory/1460-57-0x0000013C50780000-0x0000013C50790000-memory.dmp

Filesize
64KB

Download
memory/1460-48-0x0000013C50780000-0x0000013C50790000-memory.dmp

Filesize
64KB

Download
memory/1460-60-0x0000013C50780000-0x0000013C50790000-memory.dmp

Filesize
64KB

Download
memory/1460-61-0x0000013C50780000-0x0000013C50790000-memory.dmp

Filesize
64KB

Download
memory/1460-58-0x0000013C50780000-0x0000013C50790000-memory.dmp

Filesize
64KB

Download
memory/1460-46-0x0000013C50780000-0x0000013C50790000-memory.dmp

Filesize
64KB

Download
memory/1460-56-0x0000013C50780000-0x0000013C50790000-memory.dmp

Filesize
64KB

Download
memory/1460-55-0x0000013C50780000-0x0000013C50790000-memory.dmp

Filesize
64KB

Download
memory/1460-54-0x0000013C50780000-0x0000013C50790000-memory.dmp

Filesize
64KB

Download
memory/1460-53-0x0000013C50780000-0x0000013C50790000-memory.dmp

Filesize
64KB

Download
memory/1460-52-0x0000013C50780000-0x0000013C50790000-memory.dmp

Filesize
64KB

Download
memory/1460-51-0x0000013C50780000-0x0000013C50790000-memory.dmp

Filesize
64KB

Download
memory/1460-38-0x0000013C50780000-0x0000013C50790000-memory.dmp

Filesize
64KB

Download
memory/1460-50-0x0000013C50780000-0x0000013C50790000-memory.dmp

Filesize
64KB

Download
memory/1460-49-0x0000013C50780000-0x0000013C50790000-memory.dmp

Filesize
64KB

Download
memory/1460-65-0x0000013C50780000-0x0000013C50790000-memory.dmp

Filesize
64KB

Download
memory/1460-66-0x0000013C50780000-0x0000013C50790000-memory.dmp

Filesize
64KB

Download
memory/1460-59-0x0000013C50780000-0x0000013C50790000-memory.dmp

Filesize
64KB

Download
memory/1460-67-0x0000013C50780000-0x0000013C50790000-memory.dmp

Filesize
64KB

Download
memory/1460-62-0x0000013C50780000-0x0000013C50790000-memory.dmp

Filesize
64KB

Download
memory/1460-64-0x0000013C50780000-0x0000013C50790000-memory.dmp

Filesize
64KB

Download
memory/1460-63-0x0000013C50780000-0x0000013C50790000-memory.dmp

Filesize
64KB

Download
memory/1460-45-0x0000013C50780000-0x0000013C50790000-memory.dmp

Filesize
64KB

Download
memory/1460-44-0x0000013C50780000-0x0000013C50790000-memory.dmp

Filesize
64KB

Download
memory/1460-43-0x0000013C50780000-0x0000013C50790000-memory.dmp

Filesize
64KB

Download
memory/1460-42-0x0000013C50780000-0x0000013C50790000-memory.dmp

Filesize
64KB

Download
memory/1460-41-0x0000013C50780000-0x0000013C50790000-memory.dmp

Filesize
64KB

Download
memory/1460-40-0x0000013C50780000-0x0000013C50790000-memory.dmp

Filesize
64KB

Download
memory/1460-47-0x0000013C50780000-0x0000013C50790000-memory.dmp

Filesize
64KB

Download
memory/1460-39-0x0000013C50780000-0x0000013C50790000-memory.dmp

Filesize
64KB

Download
memory/1872-0-0x000001AFF7FC0000-0x000001AFF7FD0000-memory.dmp

Filesize
64KB

Download
memory/1872-36-0x000001AFF9880000-0x000001AFF9888000-memory.dmp

Filesize
32KB

Download
memory/1872-32-0x000001AFF85B0000-0x000001AFF85B8000-memory.dmp

Filesize
32KB

Download
memory/1872-16-0x000001AFF80D0000-0x000001AFF80E0000-memory.dmp

Filesize
64KB

Download