Analysis
- max time kernel
150s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 06:03
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
21 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
21 signatures
150 seconds
General
- Target 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe
- Size 28.0MB
- Sample260820-gsf9wa1amd
- SHA256 41dc052ad230d3a00a9be6dacabdb0f8b9e613f567d55354edc9909faee921fa
- MD5 34f63ec83a24c5841b88672b37c28b77
- SHA1 6cffb92c422b8e02173c89ad599fa5a6d86393b0
- SHA512 223dfb7294b1a21dfa29f8ada78e43dbf2406ad5c8ff0d528ea5a888b4199c176be6a5a88af8c151a61d6509c3b35046bf68be2ce6256d0baad2ad174bcba387
- SSDEEP 786432:pC0zOVPn6LqLf5RuXnk5b6E7PumMX8KC+7KkLI+F8wCj:Rx+FRutEjumsCGFTC
- TLSH T1F457330223A8019DFEA7D0768617D5F6CEB5BC024266871F3954B6736E336706A2F363
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables packed with Babel 8 IoCs
resource yara_rule behavioral2/files/0x000b00000001c6e4-1058.dat INDICATOR_EXE_Packed_Babel behavioral2/files/0x000c00000001c516-1059.dat INDICATOR_EXE_Packed_Babel behavioral2/files/0x000c00000001c517-1060.dat INDICATOR_EXE_Packed_Babel behavioral2/memory/5868-1068-0x00000204FFF40000-0x00000204FFF52000-memory.dmp INDICATOR_EXE_Packed_Babel behavioral2/memory/5868-1069-0x00000204FFF30000-0x00000204FFF38000-memory.dmp INDICATOR_EXE_Packed_Babel behavioral2/memory/5868-1071-0x0000020500210000-0x0000020500418000-memory.dmp INDICATOR_EXE_Packed_Babel behavioral2/memory/5868-1073-0x0000020498850000-0x0000020498870000-memory.dmp INDICATOR_EXE_Packed_Babel behavioral2/memory/5868-1075-0x00000204988A0000-0x00000204988E4000-memory.dmp INDICATOR_EXE_Packed_Babel - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LicenseManager.exe ~tmktgnp.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LicenseManager.exe\debugger = "systray.exe" ~tmktgnp.tmp - Manipulates Digital Signatures 1 TTPs 1 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\B46183154587CA995A00B1AF68C497B8395FCC3A\Blob = 030000000100000014000000b46183154587ca995a00b1af68c497b8395fcc3a2000000001000000b5070000308207b130820599a003020102020c01a9c1bad3f800e4f7393d5b300d06092a864886f70d01010b0500305c310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613132303006035504031329476c6f62616c5369676e204743432052343520455620436f64655369676e696e672043412032303230301e170d3236303632343038303835315a170d3237303833313134343232305a30820115311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e3111300f06035504051308485242203439323031133011060b2b0601040182373c020103130244453120301e060b2b0601040182373c020102130f526865696e6c616e642d5066616c7a31193017060b2b0601040182373c0201011308576974746c696368310b3009060355040613024445311830160603550408130f526865696e6c616e642d5066616c7a310e300c0603550407130554726965723120301e06035504091317416d2057697373656e736368616674737061726b203236311a3018060355040a13114a414d20536f66747761726520476d6248311a3018060355040313114a414d20536f66747761726520476d624830820222300d06092a864886f70d01010105000382020f003082020a0282020100b14c0e80010c2a514c169805b3ff501f059f592922c9e5cf9e7b88ad488a98943027526cc830461bd9c85643844ca652156fe3c9cf78f4a1075d6ad575fd6d6df155b91cc11f4ef5aeedb5dec5aeb8820421c3c0cb0c0d72c00f7c15e7c88155dcaf0f44edf9fe1894caa55b05921d0ab47bad9db2ad5360fb16fd3919f8727ad8934d66cbbd2bc3a7b2888cff8c0134fe7e7288926df2a2817ed2a2ebd9831c93323c33db8c7bbceb39ee64fcf61bc03c441e6de9357cb790b320ca41cfa41e36a77584610e9c8dbe7c5c8c9e426b5d497098598a3a4407eacba2544f8b872230a916e1045e0fde3c24264eef65fac97122050e8f1bd07e91d01a769c23620c7680f0e838b5cbde5e9d5cbb88faef583a0f34fd1385b2847f55ff329358ecfcc910ef5f2b583d9f3e472d5c1651dc772dbb2d1bf21f68c84c744a9ce86ceb2a9e2db348d9635a1902e5c82be1621579f9fb606d03bfb383cc907736aff9806e9a8a36c1cbce1eca2bfa3cc7e3d10335c7f1c3ce3c938e88322bca45dc3ec412bf2a55638030fddaf64c180b49bc425fe923d506135306b8f4718e6ebc143d59eb36a4e24ff7e786182242caff3e93b454ec03be1e05fb22e7b229ba1240399364b939cacdea4776da525b332aeee5279207b7fc936578b4769fc40513da8db0ca528a9cc23b0d366df2d1b15a773b31afedb51b338d471b3c8aa2b2c1347ba70203010001a38201b6308201b2300e0603551d0f0101ff04040302078030819f06082b0601050507010104819230818f304c06082b060105050730028640687474703a2f2f7365637572652e676c6f62616c7369676e2e636f6d2f6361636572742f67736763637234356576636f64657369676e6361323032302e637274303f06082b060105050730018633687474703a2f2f6f6373702e676c6f62616c7369676e2e636f6d2f67736763637234356576636f64657369676e63613230323030550603551d20044e304c304106092b06010401a03201023034303206082b06010505070201162668747470733a2f2f7777772e676c6f62616c7369676e2e636f6d2f7265706f7369746f72792f3007060567810c010330090603551d130402300030470603551d1f0440303e303ca03aa0388636687474703a2f2f63726c2e676c6f62616c7369676e2e636f6d2f67736763637234356576636f64657369676e6361323032302e63726c30130603551d25040c300a06082b06010505070303301f0603551d23041830168014259dd0fc59098663c5ecf3b1133b571c03923611301d0603551d0e04160414825617d6b9ecb5901b7a2f9c5a1fc0f31b5bab69300d06092a864886f70d01010b050003820201009aa63014699f6735700806a617185f27deab8178a5fc32e7b803bbbc4d787577efbb99dc278871cd10e5cdda18488af0d8ee9ecc6a851081a9cbbbbdcddcb43bea05e1a7ebcbc8579892f3286f5d6cf56ed2ac41036fb67d377fafc2a58024848110e6a7ebcefbd1914afc385bc25e80f5d583a44dbc966a644cf337f83fd941ddce8eec6e96aae693475bf83acdf2f8b4aef4127164fbb483613c9b93058c166a70f97e7862613f6aea1f373ab4f0e7f0ab4ec674cec1a15b6220632b41e141dd969bfe68cb24ec3656bb21aeb3f562751389757f240deecc6272e4cef14951aa3bc1434f19b83849bcf73ae867080bd950bc29ccb36bdd01f30fa2f1b111fcc368f408e1581969416487cba04d4a9975b3dad55e6f37e28d22cd030f642633375f0fd02748264dcead61fd69048181b0bf6f2865c77e37825fbfb660f5002889c70c7a04ae52248a58d67e2a91d51a8d5813680a34fb8f8c20d4a8b575a6bb0f151f91206421703308c6ad106f5c3411ca82bb11fab1f2a8cc2acd461d0e523cf11e8fecb0dc68fefc11f00be41a2e73753dead40cbf3b22dc4757023fa298abc54ab1a50665980b387aae5aae86c92d9549ea8967c8e42f9501aa7696126bad30ffe056ddb3577b56af73554d1703f780d6954610208a905953190e65cf76ed3d8f061b67a365e9c239bef9fb1f0c4526ce73cea01637d4b5d3d8f70768ae TreeSize.exe - Executes dropped EXE 5 IoCs
pid Process 4928 ~tmktgnp.tmp 3760 ~tmktgnp.tmp 5868 TreeSize.exe 3000 TreeSize.exe 1492 TreeSize.exe - Loads dropped DLL 4 IoCs
pid Process 3760 ~tmktgnp.tmp 3760 ~tmktgnp.tmp 3760 ~tmktgnp.tmp 3760 ~tmktgnp.tmp - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: TreeSize.exe File opened (read-only) \??\O: TreeSize.exe File opened (read-only) \??\U: TreeSize.exe File opened (read-only) \??\W: TreeSize.exe File opened (read-only) \??\A: TreeSize.exe File opened (read-only) \??\J: TreeSize.exe File opened (read-only) \??\L: TreeSize.exe File opened (read-only) \??\V: TreeSize.exe File opened (read-only) \??\Y: TreeSize.exe File opened (read-only) \??\Q: TreeSize.exe File opened (read-only) \??\S: TreeSize.exe File opened (read-only) \??\T: TreeSize.exe File opened (read-only) \??\X: TreeSize.exe File opened (read-only) \??\G: TreeSize.exe File opened (read-only) \??\H: TreeSize.exe File opened (read-only) \??\I: TreeSize.exe File opened (read-only) \??\K: TreeSize.exe File opened (read-only) \??\M: TreeSize.exe File opened (read-only) \??\P: TreeSize.exe File opened (read-only) \??\R: TreeSize.exe File opened (read-only) \??\Z: TreeSize.exe File opened (read-only) \??\B: TreeSize.exe File opened (read-only) \??\D: TreeSize.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\JAM Software\TreeSize\HELP_EN\is-R0NR3.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_RU\is-SNPQE.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_EN\is-GMVEB.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_EN\_images\is-88S9I.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_EN\_static\is-CA8S2.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_RU\is-BQDRQ.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_RU\_images\is-9V6A5.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_RU\_images\is-SB43P.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_RU\_static\is-NI5A2.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_EN\_images\is-83N7P.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_EN\is-S22M0.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_EN\_images\is-4MDKH.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_RU\_images\is-MOPSM.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_RU\_images\is-I36CO.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_RU\_images\is-LRSJA.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_RU\_images\is-2N68F.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_RU\_images\is-0S9I4.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_EN\_images\is-2EMV5.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_EN\_images\is-PE67M.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_EN\_static\is-CHQ3N.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_RU\is-Q4FNN.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_RU\is-U14SK.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_RU\is-20KL0.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_RU\_images\is-ILKK2.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\is-B37A4.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_EN\_images\is-BTQS6.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_EN\_images\is-PM4T3.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_RU\is-JGGA2.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_RU\_images\is-HJELH.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_RU\_images\is-8JGK8.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_EN\is-PH586.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_RU\is-QVK8P.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_EN\_images\is-8SMIK.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_RU\is-H3VFL.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_RU\_images\is-KHAU7.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_RU\_images\is-LDC7H.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_RU\is-PV6A4.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_RU\is-HK1LT.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_RU\is-JVEEV.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_RU\_images\is-9OC0O.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_RU\_images\is-0P2BR.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_RU\_images\is-VFV76.tmp ~tmktgnp.tmp File opened for modification C:\Program Files\JAM Software\TreeSize\unins000.dat ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_EN\is-JUS3O.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_EN\_images\is-3MQ63.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_EN\_images\is-R6OII.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_EN\_static\is-IH1NV.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_EN\is-7M7VS.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_EN\is-8VN02.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_EN\_static\is-GJ1UH.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_EN\_static\is-L50EG.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_RU\is-09HVS.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_RU\is-LGT0E.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_EN\is-BJ3NP.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_EN\_images\is-36G3A.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_EN\_images\is-JR2TB.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_EN\_images\is-OQFE5.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_RU\is-N0551.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_RU\_images\is-EH6RV.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_RU\_static\is-DES8R.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_EN\is-IITC7.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_EN\is-4EELB.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_RU\_images\is-T99MK.tmp ~tmktgnp.tmp File created C:\Program Files\JAM Software\TreeSize\HELP_EN\is-OR84B.tmp ~tmktgnp.tmp - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies trusted root certificate store through registry 1 TTPs 16 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\C10BB76AD4EE815242406A1E3E1117FFEC743D4F\Blob = 5c0000000100000004000000001000006b0000000100000020000000cd0e144dd10bac221fe2fb901058d16450a0578b3c47c770908f2e9ada28ef12140000000100000014000000259dd0fc59098663c5ecf3b1133b571c03923611030000000100000014000000c10bb76ad4ee815242406a1e3e1117ffec743d4f1900000001000000100000008050a1c09667687456bd1c63be8f6fcb0f0000000100000020000000d9c7db0b704f07089440c56e69a0f31d730edf77cfbf7514630e8b5390a270fe2000000001000000ec060000308206e8308204d0a003020102021077bd0e05b7590bb61d4761531e3f75ed300d06092a864886f70d01010b05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303732383030303030305a170d3330303732383030303030305a305c310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613132303006035504031329476c6f62616c5369676e204743432052343520455620436f64655369676e696e67204341203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100cb20ef971eb9013243a05ba98a23fd205eae38128bca2cd4ff41d81a55d41953b7fda317e77a395cc0f7ce11a3f9a5ed01fab5ba93efaf93dcf8e2b3194c83b04a4450047884106aa4d696908e81f87cab2fb5a35733d2587b940e6d0fa591262ab3834f72b18a7b6492d0f0b4555f960b11e59ab52cb211cf251b7d512b981f49a35ff8139e35b80302daa4132f854aefc42f700ec1d4cc3312ecbd4095d311cae6cdb3059cc853eb52d7784c51019282de13f3078e74ba84809fd2a4150ee8afebf789f6df71f0d1bea7b241332075ccb1d5ed1d0719c4eb2677f2ab6d179349a9b7e6c3909cc6b8ecccc97b9a5ec5c52493636f7e108b61cf9855a324a28836f2f99fbe932eb2069f26c00c015612e1b28a9f0e1edc988b2ecfdae28934a61f26a0a8ae786deca188153cc2eaeeb7d8ad61a5af7036a2798edc0d73c0f1e42cab94ec5806393648d63b5ae822ce740eaf2cf115dad1b495e8acd5496de5afdd9b6b63205d8e7e3bb243d8623a94e5cdb498b3371924127273ab04b009dc85e6d42204ef402a1d2e6dc769d36eb7016c0de097a716e6268b88f70344865f62674cb5a737a855dc03368c6ecf6d3626f10e8fb03d71c0e132a782e4b6320232307cb593c821fd3c88e66963f8ee75c98bc2abefba3afde95ebfb611f1bef03dca323e6e7dde0f7e9b95c41287e71ab84eee2cc1dfa165e82483c92ac2fdb9530203010001a38201ad308201a9300e0603551d0f0101ff04040302018630130603551d25040c300a06082b0601050507030330120603551d130101ff040830060101ff020100301d0603551d0e04160414259dd0fc59098663c5ecf3b1133b571c03923611301f0603551d230418301680141f00bf46800afc7839b7a5b443d95650bbce963b30819306082b06010505070101048186308183303906082b06010505073001862d687474703a2f2f6f6373702e676c6f62616c7369676e2e636f6d2f636f64657369676e696e67726f6f74723435304606082b06010505073002863a687474703a2f2f7365637572652e676c6f62616c7369676e2e636f6d2f6361636572742f636f64657369676e696e67726f6f747234352e63727430410603551d1f043a30383036a034a0328630687474703a2f2f63726c2e676c6f62616c7369676e2e636f6d2f636f64657369676e696e67726f6f747234352e63726c30550603551d20044e304c304106092b06010401a03201023034303206082b06010505070201162668747470733a2f2f7777772e676c6f62616c7369676e2e636f6d2f7265706f7369746f72792f3007060567810c0103300d06092a864886f70d01010b050003820201002575a009c939bab7a139892f189fabd6eb1d4be8947c0d07689b1c9def71b6176a6b024fb33f864587cc659b4ce35806022266d56102c5638fd4a2f1b65e250b7796e9cd7140338829eceef3a26dbc4db53e064bc97333ca08142d3d4ce8b0ba75a6742da4583a6c1349f8a5150a149685b16a68342542af9656f410fa247df12b72c116e16bebe6a998c73e5af4d0189dfd74978677462a3d237d28738aaeef2b1b9abf6c53a7149e3c8771c05e8ec8fbd32a9233ea574d5e075ecac118ac812d1a21fa6ecf97617bdf717a3aca63f7d530443732febb4385dcbafca6ca33192b776ddbcb05f07e5f752ea2b6bf35aa3663c9ce64d9bdfcbc2cf3495600c8122bc627bb37af57efc4cf1e29c4f4e22dce2a61cf57edf50a40e2f518d61ee9902fcad3875f938a481a111de537859f2e66629a5e814e95ac555743dc538b257e3c610f8a0bbaf53fa6d78ef704565e21bb9fd76a7180bf96de7203d8d8222bf327164f38e851400cae92efbe3d7df780c64c36578495a7841548300e5227088d8ea2bd22c719c9a6ca0ea87a36db6aba615f112495a4e28e68ee19a949995ed0b434bdd6f940c710973152393529118724d3c4fba963cb7748d5fa62fc24e0047a4ed0e46edece9e385026f4217165d70925d4c907007ab8c7f377e8c5d4e255d0d31ef67f52e2498db911720c88442633660144dfe4330e21de62894807daf5 TreeSize.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\4C5D80D2CD06B1A493C49B2E9BED4A57C2F873E5\Blob = 6b000000010000002000000005e0634b1feb98ae6b4cf101728cf9d5a1793ceace301506ff332b22d4cf08eb1400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b0300000001000000140000004c5d80d2cd06b1a493c49b2e9bed4a57c2f873e50f0000000100000030000000fec727af43d1569995cea26e8eb97167165842a5b185304425a92c03b71254c5d51222837515f33e60cb8ed2e8c625ba1900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b42000000001000000a6050000308205a23082048aa00302010202107803184245708a41cf6f01b8eeb4a954300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3230303732383030303030305a170d3239303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a382017730820173300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b301f0603551d230418301680148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc307a06082b06010505070101046e306c302d06082b060105050730018621687474703a2f2f6f6373702e676c6f62616c7369676e2e636f6d2f726f6f747233303b06082b06010505073002862f687474703a2f2f7365637572652e676c6f62616c7369676e2e636f6d2f6361636572742f726f6f742d72332e63727430360603551d1f042f302d302ba029a0278625687474703a2f2f63726c2e676c6f62616c7369676e2e636f6d2f726f6f742d72332e63726c30470603551d200440303e303c0604551d20003034303206082b06010505070201162668747470733a2f2f7777772e676c6f62616c7369676e2e636f6d2f7265706f7369746f72792f300d06092a864886f70d01010c05000382010100acf7cc158b3079a81d0b28881909d71c7ffe86bd7b5a336e0d670e7b62d9e1185cb0bd135d1d23ae39507637aa44fd5f01235986564cccadbc64131430a420a8e03fe89c72dc7ef3d80c23baa82daa3cf6ec9f87310765f539a7518275e1f22f97f6d1e165968364fea11d51fbb5249bf5d27769bc852c5cfa5877d1aea7b10be2d677bba9b4344aa96f3df4f30d955de6f97a45b02517312edbf70f68e6831fa9f7e5d49d988cd3614b2fc3287e7ade930eb47da00a6d92c4b4663f7da758eeacf7ecc30801ab38fc0a1ca9c597b288c8090219f65c9a1af14d6c30d4b306ab0060480d78abcf17ad9293622077756cbdc832b4dc4debd9dfc1909629bdc17f TreeSize.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\4C5D80D2CD06B1A493C49B2E9BED4A57C2F873E5\Blob = 5c0000000100000004000000001000001900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b40f0000000100000030000000fec727af43d1569995cea26e8eb97167165842a5b185304425a92c03b71254c5d51222837515f33e60cb8ed2e8c625ba0300000001000000140000004c5d80d2cd06b1a493c49b2e9bed4a57c2f873e51400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b6b000000010000002000000005e0634b1feb98ae6b4cf101728cf9d5a1793ceace301506ff332b22d4cf08eb2000000001000000a6050000308205a23082048aa00302010202107803184245708a41cf6f01b8eeb4a954300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3230303732383030303030305a170d3239303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a382017730820173300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b301f0603551d230418301680148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc307a06082b06010505070101046e306c302d06082b060105050730018621687474703a2f2f6f6373702e676c6f62616c7369676e2e636f6d2f726f6f747233303b06082b06010505073002862f687474703a2f2f7365637572652e676c6f62616c7369676e2e636f6d2f6361636572742f726f6f742d72332e63727430360603551d1f042f302d302ba029a0278625687474703a2f2f63726c2e676c6f62616c7369676e2e636f6d2f726f6f742d72332e63726c30470603551d200440303e303c0604551d20003034303206082b06010505070201162668747470733a2f2f7777772e676c6f62616c7369676e2e636f6d2f7265706f7369746f72792f300d06092a864886f70d01010c05000382010100acf7cc158b3079a81d0b28881909d71c7ffe86bd7b5a336e0d670e7b62d9e1185cb0bd135d1d23ae39507637aa44fd5f01235986564cccadbc64131430a420a8e03fe89c72dc7ef3d80c23baa82daa3cf6ec9f87310765f539a7518275e1f22f97f6d1e165968364fea11d51fbb5249bf5d27769bc852c5cfa5877d1aea7b10be2d677bba9b4344aa96f3df4f30d955de6f97a45b02517312edbf70f68e6831fa9f7e5d49d988cd3614b2fc3287e7ade930eb47da00a6d92c4b4663f7da758eeacf7ecc30801ab38fc0a1ca9c597b288c8090219f65c9a1af14d6c30d4b306ab0060480d78abcf17ad9293622077756cbdc832b4dc4debd9dfc1909629bdc17f TreeSize.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\C10BB76AD4EE815242406A1E3E1117FFEC743D4F\Blob = 1800000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b40f0000000100000020000000d9c7db0b704f07089440c56e69a0f31d730edf77cfbf7514630e8b5390a270fe1900000001000000100000008050a1c09667687456bd1c63be8f6fcb030000000100000014000000c10bb76ad4ee815242406a1e3e1117ffec743d4f140000000100000014000000259dd0fc59098663c5ecf3b1133b571c039236116b0000000100000020000000cd0e144dd10bac221fe2fb901058d16450a0578b3c47c770908f2e9ada28ef125c0000000100000004000000001000002000000001000000ec060000308206e8308204d0a003020102021077bd0e05b7590bb61d4761531e3f75ed300d06092a864886f70d01010b05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303732383030303030305a170d3330303732383030303030305a305c310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613132303006035504031329476c6f62616c5369676e204743432052343520455620436f64655369676e696e67204341203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100cb20ef971eb9013243a05ba98a23fd205eae38128bca2cd4ff41d81a55d41953b7fda317e77a395cc0f7ce11a3f9a5ed01fab5ba93efaf93dcf8e2b3194c83b04a4450047884106aa4d696908e81f87cab2fb5a35733d2587b940e6d0fa591262ab3834f72b18a7b6492d0f0b4555f960b11e59ab52cb211cf251b7d512b981f49a35ff8139e35b80302daa4132f854aefc42f700ec1d4cc3312ecbd4095d311cae6cdb3059cc853eb52d7784c51019282de13f3078e74ba84809fd2a4150ee8afebf789f6df71f0d1bea7b241332075ccb1d5ed1d0719c4eb2677f2ab6d179349a9b7e6c3909cc6b8ecccc97b9a5ec5c52493636f7e108b61cf9855a324a28836f2f99fbe932eb2069f26c00c015612e1b28a9f0e1edc988b2ecfdae28934a61f26a0a8ae786deca188153cc2eaeeb7d8ad61a5af7036a2798edc0d73c0f1e42cab94ec5806393648d63b5ae822ce740eaf2cf115dad1b495e8acd5496de5afdd9b6b63205d8e7e3bb243d8623a94e5cdb498b3371924127273ab04b009dc85e6d42204ef402a1d2e6dc769d36eb7016c0de097a716e6268b88f70344865f62674cb5a737a855dc03368c6ecf6d3626f10e8fb03d71c0e132a782e4b6320232307cb593c821fd3c88e66963f8ee75c98bc2abefba3afde95ebfb611f1bef03dca323e6e7dde0f7e9b95c41287e71ab84eee2cc1dfa165e82483c92ac2fdb9530203010001a38201ad308201a9300e0603551d0f0101ff04040302018630130603551d25040c300a06082b0601050507030330120603551d130101ff040830060101ff020100301d0603551d0e04160414259dd0fc59098663c5ecf3b1133b571c03923611301f0603551d230418301680141f00bf46800afc7839b7a5b443d95650bbce963b30819306082b06010505070101048186308183303906082b06010505073001862d687474703a2f2f6f6373702e676c6f62616c7369676e2e636f6d2f636f64657369676e696e67726f6f74723435304606082b06010505073002863a687474703a2f2f7365637572652e676c6f62616c7369676e2e636f6d2f6361636572742f636f64657369676e696e67726f6f747234352e63727430410603551d1f043a30383036a034a0328630687474703a2f2f63726c2e676c6f62616c7369676e2e636f6d2f636f64657369676e696e67726f6f747234352e63726c30550603551d20044e304c304106092b06010401a03201023034303206082b06010505070201162668747470733a2f2f7777772e676c6f62616c7369676e2e636f6d2f7265706f7369746f72792f3007060567810c0103300d06092a864886f70d01010b050003820201002575a009c939bab7a139892f189fabd6eb1d4be8947c0d07689b1c9def71b6176a6b024fb33f864587cc659b4ce35806022266d56102c5638fd4a2f1b65e250b7796e9cd7140338829eceef3a26dbc4db53e064bc97333ca08142d3d4ce8b0ba75a6742da4583a6c1349f8a5150a149685b16a68342542af9656f410fa247df12b72c116e16bebe6a998c73e5af4d0189dfd74978677462a3d237d28738aaeef2b1b9abf6c53a7149e3c8771c05e8ec8fbd32a9233ea574d5e075ecac118ac812d1a21fa6ecf97617bdf717a3aca63f7d530443732febb4385dcbafca6ca33192b776ddbcb05f07e5f752ea2b6bf35aa3663c9ce64d9bdfcbc2cf3495600c8122bc627bb37af57efc4cf1e29c4f4e22dce2a61cf57edf50a40e2f518d61ee9902fcad3875f938a481a111de537859f2e66629a5e814e95ac555743dc538b257e3c610f8a0bbaf53fa6d78ef704565e21bb9fd76a7180bf96de7203d8d8222bf327164f38e851400cae92efbe3d7df780c64c36578495a7841548300e5227088d8ea2bd22c719c9a6ca0ea87a36db6aba615f112495a4e28e68ee19a949995ed0b434bdd6f940c710973152393529118724d3c4fba963cb7748d5fa62fc24e0047a4ed0e46edece9e385026f4217165d70925d4c907007ab8c7f377e8c5d4e255d0d31ef67f52e2498db911720c88442633660144dfe4330e21de62894807daf5 TreeSize.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\4C5D80D2CD06B1A493C49B2E9BED4A57C2F873E5\Blob = 0f0000000100000030000000fec727af43d1569995cea26e8eb97167165842a5b185304425a92c03b71254c5d51222837515f33e60cb8ed2e8c625ba0300000001000000140000004c5d80d2cd06b1a493c49b2e9bed4a57c2f873e52000000001000000a6050000308205a23082048aa00302010202107803184245708a41cf6f01b8eeb4a954300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3230303732383030303030305a170d3239303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a382017730820173300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b301f0603551d230418301680148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc307a06082b06010505070101046e306c302d06082b060105050730018621687474703a2f2f6f6373702e676c6f62616c7369676e2e636f6d2f726f6f747233303b06082b06010505073002862f687474703a2f2f7365637572652e676c6f62616c7369676e2e636f6d2f6361636572742f726f6f742d72332e63727430360603551d1f042f302d302ba029a0278625687474703a2f2f63726c2e676c6f62616c7369676e2e636f6d2f726f6f742d72332e63726c30470603551d200440303e303c0604551d20003034303206082b06010505070201162668747470733a2f2f7777772e676c6f62616c7369676e2e636f6d2f7265706f7369746f72792f300d06092a864886f70d01010c05000382010100acf7cc158b3079a81d0b28881909d71c7ffe86bd7b5a336e0d670e7b62d9e1185cb0bd135d1d23ae39507637aa44fd5f01235986564cccadbc64131430a420a8e03fe89c72dc7ef3d80c23baa82daa3cf6ec9f87310765f539a7518275e1f22f97f6d1e165968364fea11d51fbb5249bf5d27769bc852c5cfa5877d1aea7b10be2d677bba9b4344aa96f3df4f30d955de6f97a45b02517312edbf70f68e6831fa9f7e5d49d988cd3614b2fc3287e7ade930eb47da00a6d92c4b4663f7da758eeacf7ecc30801ab38fc0a1ca9c597b288c8090219f65c9a1af14d6c30d4b306ab0060480d78abcf17ad9293622077756cbdc832b4dc4debd9dfc1909629bdc17f TreeSize.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\4C5D80D2CD06B1A493C49B2E9BED4A57C2F873E5\Blob = 1400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b0300000001000000140000004c5d80d2cd06b1a493c49b2e9bed4a57c2f873e50f0000000100000030000000fec727af43d1569995cea26e8eb97167165842a5b185304425a92c03b71254c5d51222837515f33e60cb8ed2e8c625ba2000000001000000a6050000308205a23082048aa00302010202107803184245708a41cf6f01b8eeb4a954300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3230303732383030303030305a170d3239303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a382017730820173300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b301f0603551d230418301680148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc307a06082b06010505070101046e306c302d06082b060105050730018621687474703a2f2f6f6373702e676c6f62616c7369676e2e636f6d2f726f6f747233303b06082b06010505073002862f687474703a2f2f7365637572652e676c6f62616c7369676e2e636f6d2f6361636572742f726f6f742d72332e63727430360603551d1f042f302d302ba029a0278625687474703a2f2f63726c2e676c6f62616c7369676e2e636f6d2f726f6f742d72332e63726c30470603551d200440303e303c0604551d20003034303206082b06010505070201162668747470733a2f2f7777772e676c6f62616c7369676e2e636f6d2f7265706f7369746f72792f300d06092a864886f70d01010c05000382010100acf7cc158b3079a81d0b28881909d71c7ffe86bd7b5a336e0d670e7b62d9e1185cb0bd135d1d23ae39507637aa44fd5f01235986564cccadbc64131430a420a8e03fe89c72dc7ef3d80c23baa82daa3cf6ec9f87310765f539a7518275e1f22f97f6d1e165968364fea11d51fbb5249bf5d27769bc852c5cfa5877d1aea7b10be2d677bba9b4344aa96f3df4f30d955de6f97a45b02517312edbf70f68e6831fa9f7e5d49d988cd3614b2fc3287e7ade930eb47da00a6d92c4b4663f7da758eeacf7ecc30801ab38fc0a1ca9c597b288c8090219f65c9a1af14d6c30d4b306ab0060480d78abcf17ad9293622077756cbdc832b4dc4debd9dfc1909629bdc17f TreeSize.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\C10BB76AD4EE815242406A1E3E1117FFEC743D4F\Blob = 6b0000000100000020000000cd0e144dd10bac221fe2fb901058d16450a0578b3c47c770908f2e9ada28ef12140000000100000014000000259dd0fc59098663c5ecf3b1133b571c03923611030000000100000014000000c10bb76ad4ee815242406a1e3e1117ffec743d4f1900000001000000100000008050a1c09667687456bd1c63be8f6fcb2000000001000000ec060000308206e8308204d0a003020102021077bd0e05b7590bb61d4761531e3f75ed300d06092a864886f70d01010b05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303732383030303030305a170d3330303732383030303030305a305c310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613132303006035504031329476c6f62616c5369676e204743432052343520455620436f64655369676e696e67204341203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100cb20ef971eb9013243a05ba98a23fd205eae38128bca2cd4ff41d81a55d41953b7fda317e77a395cc0f7ce11a3f9a5ed01fab5ba93efaf93dcf8e2b3194c83b04a4450047884106aa4d696908e81f87cab2fb5a35733d2587b940e6d0fa591262ab3834f72b18a7b6492d0f0b4555f960b11e59ab52cb211cf251b7d512b981f49a35ff8139e35b80302daa4132f854aefc42f700ec1d4cc3312ecbd4095d311cae6cdb3059cc853eb52d7784c51019282de13f3078e74ba84809fd2a4150ee8afebf789f6df71f0d1bea7b241332075ccb1d5ed1d0719c4eb2677f2ab6d179349a9b7e6c3909cc6b8ecccc97b9a5ec5c52493636f7e108b61cf9855a324a28836f2f99fbe932eb2069f26c00c015612e1b28a9f0e1edc988b2ecfdae28934a61f26a0a8ae786deca188153cc2eaeeb7d8ad61a5af7036a2798edc0d73c0f1e42cab94ec5806393648d63b5ae822ce740eaf2cf115dad1b495e8acd5496de5afdd9b6b63205d8e7e3bb243d8623a94e5cdb498b3371924127273ab04b009dc85e6d42204ef402a1d2e6dc769d36eb7016c0de097a716e6268b88f70344865f62674cb5a737a855dc03368c6ecf6d3626f10e8fb03d71c0e132a782e4b6320232307cb593c821fd3c88e66963f8ee75c98bc2abefba3afde95ebfb611f1bef03dca323e6e7dde0f7e9b95c41287e71ab84eee2cc1dfa165e82483c92ac2fdb9530203010001a38201ad308201a9300e0603551d0f0101ff04040302018630130603551d25040c300a06082b0601050507030330120603551d130101ff040830060101ff020100301d0603551d0e04160414259dd0fc59098663c5ecf3b1133b571c03923611301f0603551d230418301680141f00bf46800afc7839b7a5b443d95650bbce963b30819306082b06010505070101048186308183303906082b06010505073001862d687474703a2f2f6f6373702e676c6f62616c7369676e2e636f6d2f636f64657369676e696e67726f6f74723435304606082b06010505073002863a687474703a2f2f7365637572652e676c6f62616c7369676e2e636f6d2f6361636572742f636f64657369676e696e67726f6f747234352e63727430410603551d1f043a30383036a034a0328630687474703a2f2f63726c2e676c6f62616c7369676e2e636f6d2f636f64657369676e696e67726f6f747234352e63726c30550603551d20044e304c304106092b06010401a03201023034303206082b06010505070201162668747470733a2f2f7777772e676c6f62616c7369676e2e636f6d2f7265706f7369746f72792f3007060567810c0103300d06092a864886f70d01010b050003820201002575a009c939bab7a139892f189fabd6eb1d4be8947c0d07689b1c9def71b6176a6b024fb33f864587cc659b4ce35806022266d56102c5638fd4a2f1b65e250b7796e9cd7140338829eceef3a26dbc4db53e064bc97333ca08142d3d4ce8b0ba75a6742da4583a6c1349f8a5150a149685b16a68342542af9656f410fa247df12b72c116e16bebe6a998c73e5af4d0189dfd74978677462a3d237d28738aaeef2b1b9abf6c53a7149e3c8771c05e8ec8fbd32a9233ea574d5e075ecac118ac812d1a21fa6ecf97617bdf717a3aca63f7d530443732febb4385dcbafca6ca33192b776ddbcb05f07e5f752ea2b6bf35aa3663c9ce64d9bdfcbc2cf3495600c8122bc627bb37af57efc4cf1e29c4f4e22dce2a61cf57edf50a40e2f518d61ee9902fcad3875f938a481a111de537859f2e66629a5e814e95ac555743dc538b257e3c610f8a0bbaf53fa6d78ef704565e21bb9fd76a7180bf96de7203d8d8222bf327164f38e851400cae92efbe3d7df780c64c36578495a7841548300e5227088d8ea2bd22c719c9a6ca0ea87a36db6aba615f112495a4e28e68ee19a949995ed0b434bdd6f940c710973152393529118724d3c4fba963cb7748d5fa62fc24e0047a4ed0e46edece9e385026f4217165d70925d4c907007ab8c7f377e8c5d4e255d0d31ef67f52e2498db911720c88442633660144dfe4330e21de62894807daf5 TreeSize.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\C10BB76AD4EE815242406A1E3E1117FFEC743D4F\Blob = 0f0000000100000020000000d9c7db0b704f07089440c56e69a0f31d730edf77cfbf7514630e8b5390a270fe1900000001000000100000008050a1c09667687456bd1c63be8f6fcb030000000100000014000000c10bb76ad4ee815242406a1e3e1117ffec743d4f140000000100000014000000259dd0fc59098663c5ecf3b1133b571c039236116b0000000100000020000000cd0e144dd10bac221fe2fb901058d16450a0578b3c47c770908f2e9ada28ef122000000001000000ec060000308206e8308204d0a003020102021077bd0e05b7590bb61d4761531e3f75ed300d06092a864886f70d01010b05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303732383030303030305a170d3330303732383030303030305a305c310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613132303006035504031329476c6f62616c5369676e204743432052343520455620436f64655369676e696e67204341203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100cb20ef971eb9013243a05ba98a23fd205eae38128bca2cd4ff41d81a55d41953b7fda317e77a395cc0f7ce11a3f9a5ed01fab5ba93efaf93dcf8e2b3194c83b04a4450047884106aa4d696908e81f87cab2fb5a35733d2587b940e6d0fa591262ab3834f72b18a7b6492d0f0b4555f960b11e59ab52cb211cf251b7d512b981f49a35ff8139e35b80302daa4132f854aefc42f700ec1d4cc3312ecbd4095d311cae6cdb3059cc853eb52d7784c51019282de13f3078e74ba84809fd2a4150ee8afebf789f6df71f0d1bea7b241332075ccb1d5ed1d0719c4eb2677f2ab6d179349a9b7e6c3909cc6b8ecccc97b9a5ec5c52493636f7e108b61cf9855a324a28836f2f99fbe932eb2069f26c00c015612e1b28a9f0e1edc988b2ecfdae28934a61f26a0a8ae786deca188153cc2eaeeb7d8ad61a5af7036a2798edc0d73c0f1e42cab94ec5806393648d63b5ae822ce740eaf2cf115dad1b495e8acd5496de5afdd9b6b63205d8e7e3bb243d8623a94e5cdb498b3371924127273ab04b009dc85e6d42204ef402a1d2e6dc769d36eb7016c0de097a716e6268b88f70344865f62674cb5a737a855dc03368c6ecf6d3626f10e8fb03d71c0e132a782e4b6320232307cb593c821fd3c88e66963f8ee75c98bc2abefba3afde95ebfb611f1bef03dca323e6e7dde0f7e9b95c41287e71ab84eee2cc1dfa165e82483c92ac2fdb9530203010001a38201ad308201a9300e0603551d0f0101ff04040302018630130603551d25040c300a06082b0601050507030330120603551d130101ff040830060101ff020100301d0603551d0e04160414259dd0fc59098663c5ecf3b1133b571c03923611301f0603551d230418301680141f00bf46800afc7839b7a5b443d95650bbce963b30819306082b06010505070101048186308183303906082b06010505073001862d687474703a2f2f6f6373702e676c6f62616c7369676e2e636f6d2f636f64657369676e696e67726f6f74723435304606082b06010505073002863a687474703a2f2f7365637572652e676c6f62616c7369676e2e636f6d2f6361636572742f636f64657369676e696e67726f6f747234352e63727430410603551d1f043a30383036a034a0328630687474703a2f2f63726c2e676c6f62616c7369676e2e636f6d2f636f64657369676e696e67726f6f747234352e63726c30550603551d20044e304c304106092b06010401a03201023034303206082b06010505070201162668747470733a2f2f7777772e676c6f62616c7369676e2e636f6d2f7265706f7369746f72792f3007060567810c0103300d06092a864886f70d01010b050003820201002575a009c939bab7a139892f189fabd6eb1d4be8947c0d07689b1c9def71b6176a6b024fb33f864587cc659b4ce35806022266d56102c5638fd4a2f1b65e250b7796e9cd7140338829eceef3a26dbc4db53e064bc97333ca08142d3d4ce8b0ba75a6742da4583a6c1349f8a5150a149685b16a68342542af9656f410fa247df12b72c116e16bebe6a998c73e5af4d0189dfd74978677462a3d237d28738aaeef2b1b9abf6c53a7149e3c8771c05e8ec8fbd32a9233ea574d5e075ecac118ac812d1a21fa6ecf97617bdf717a3aca63f7d530443732febb4385dcbafca6ca33192b776ddbcb05f07e5f752ea2b6bf35aa3663c9ce64d9bdfcbc2cf3495600c8122bc627bb37af57efc4cf1e29c4f4e22dce2a61cf57edf50a40e2f518d61ee9902fcad3875f938a481a111de537859f2e66629a5e814e95ac555743dc538b257e3c610f8a0bbaf53fa6d78ef704565e21bb9fd76a7180bf96de7203d8d8222bf327164f38e851400cae92efbe3d7df780c64c36578495a7841548300e5227088d8ea2bd22c719c9a6ca0ea87a36db6aba615f112495a4e28e68ee19a949995ed0b434bdd6f940c710973152393529118724d3c4fba963cb7748d5fa62fc24e0047a4ed0e46edece9e385026f4217165d70925d4c907007ab8c7f377e8c5d4e255d0d31ef67f52e2498db911720c88442633660144dfe4330e21de62894807daf5 TreeSize.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\4C5D80D2CD06B1A493C49B2E9BED4A57C2F873E5\Blob = 180000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f6b000000010000002000000005e0634b1feb98ae6b4cf101728cf9d5a1793ceace301506ff332b22d4cf08eb1400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b0300000001000000140000004c5d80d2cd06b1a493c49b2e9bed4a57c2f873e50f0000000100000030000000fec727af43d1569995cea26e8eb97167165842a5b185304425a92c03b71254c5d51222837515f33e60cb8ed2e8c625ba1900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b45c0000000100000004000000001000002000000001000000a6050000308205a23082048aa00302010202107803184245708a41cf6f01b8eeb4a954300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3230303732383030303030305a170d3239303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a382017730820173300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b301f0603551d230418301680148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc307a06082b06010505070101046e306c302d06082b060105050730018621687474703a2f2f6f6373702e676c6f62616c7369676e2e636f6d2f726f6f747233303b06082b06010505073002862f687474703a2f2f7365637572652e676c6f62616c7369676e2e636f6d2f6361636572742f726f6f742d72332e63727430360603551d1f042f302d302ba029a0278625687474703a2f2f63726c2e676c6f62616c7369676e2e636f6d2f726f6f742d72332e63726c30470603551d200440303e303c0604551d20003034303206082b06010505070201162668747470733a2f2f7777772e676c6f62616c7369676e2e636f6d2f7265706f7369746f72792f300d06092a864886f70d01010c05000382010100acf7cc158b3079a81d0b28881909d71c7ffe86bd7b5a336e0d670e7b62d9e1185cb0bd135d1d23ae39507637aa44fd5f01235986564cccadbc64131430a420a8e03fe89c72dc7ef3d80c23baa82daa3cf6ec9f87310765f539a7518275e1f22f97f6d1e165968364fea11d51fbb5249bf5d27769bc852c5cfa5877d1aea7b10be2d677bba9b4344aa96f3df4f30d955de6f97a45b02517312edbf70f68e6831fa9f7e5d49d988cd3614b2fc3287e7ade930eb47da00a6d92c4b4663f7da758eeacf7ecc30801ab38fc0a1ca9c597b288c8090219f65c9a1af14d6c30d4b306ab0060480d78abcf17ad9293622077756cbdc832b4dc4debd9dfc1909629bdc17f TreeSize.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\C10BB76AD4EE815242406A1E3E1117FFEC743D4F\Blob = 4b0000000100000044000000390043004200340033003700330041003400320035003200440045003800440032003200310032003900320039003800330036003300300034004500430035005f0000005c0000000100000004000000001000006b0000000100000020000000cd0e144dd10bac221fe2fb901058d16450a0578b3c47c770908f2e9ada28ef12140000000100000014000000259dd0fc59098663c5ecf3b1133b571c03923611030000000100000014000000c10bb76ad4ee815242406a1e3e1117ffec743d4f1900000001000000100000008050a1c09667687456bd1c63be8f6fcb0f0000000100000020000000d9c7db0b704f07089440c56e69a0f31d730edf77cfbf7514630e8b5390a270fe1800000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b42000000001000000ec060000308206e8308204d0a003020102021077bd0e05b7590bb61d4761531e3f75ed300d06092a864886f70d01010b05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303732383030303030305a170d3330303732383030303030305a305c310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613132303006035504031329476c6f62616c5369676e204743432052343520455620436f64655369676e696e67204341203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100cb20ef971eb9013243a05ba98a23fd205eae38128bca2cd4ff41d81a55d41953b7fda317e77a395cc0f7ce11a3f9a5ed01fab5ba93efaf93dcf8e2b3194c83b04a4450047884106aa4d696908e81f87cab2fb5a35733d2587b940e6d0fa591262ab3834f72b18a7b6492d0f0b4555f960b11e59ab52cb211cf251b7d512b981f49a35ff8139e35b80302daa4132f854aefc42f700ec1d4cc3312ecbd4095d311cae6cdb3059cc853eb52d7784c51019282de13f3078e74ba84809fd2a4150ee8afebf789f6df71f0d1bea7b241332075ccb1d5ed1d0719c4eb2677f2ab6d179349a9b7e6c3909cc6b8ecccc97b9a5ec5c52493636f7e108b61cf9855a324a28836f2f99fbe932eb2069f26c00c015612e1b28a9f0e1edc988b2ecfdae28934a61f26a0a8ae786deca188153cc2eaeeb7d8ad61a5af7036a2798edc0d73c0f1e42cab94ec5806393648d63b5ae822ce740eaf2cf115dad1b495e8acd5496de5afdd9b6b63205d8e7e3bb243d8623a94e5cdb498b3371924127273ab04b009dc85e6d42204ef402a1d2e6dc769d36eb7016c0de097a716e6268b88f70344865f62674cb5a737a855dc03368c6ecf6d3626f10e8fb03d71c0e132a782e4b6320232307cb593c821fd3c88e66963f8ee75c98bc2abefba3afde95ebfb611f1bef03dca323e6e7dde0f7e9b95c41287e71ab84eee2cc1dfa165e82483c92ac2fdb9530203010001a38201ad308201a9300e0603551d0f0101ff04040302018630130603551d25040c300a06082b0601050507030330120603551d130101ff040830060101ff020100301d0603551d0e04160414259dd0fc59098663c5ecf3b1133b571c03923611301f0603551d230418301680141f00bf46800afc7839b7a5b443d95650bbce963b30819306082b06010505070101048186308183303906082b06010505073001862d687474703a2f2f6f6373702e676c6f62616c7369676e2e636f6d2f636f64657369676e696e67726f6f74723435304606082b06010505073002863a687474703a2f2f7365637572652e676c6f62616c7369676e2e636f6d2f6361636572742f636f64657369676e696e67726f6f747234352e63727430410603551d1f043a30383036a034a0328630687474703a2f2f63726c2e676c6f62616c7369676e2e636f6d2f636f64657369676e696e67726f6f747234352e63726c30550603551d20044e304c304106092b06010401a03201023034303206082b06010505070201162668747470733a2f2f7777772e676c6f62616c7369676e2e636f6d2f7265706f7369746f72792f3007060567810c0103300d06092a864886f70d01010b050003820201002575a009c939bab7a139892f189fabd6eb1d4be8947c0d07689b1c9def71b6176a6b024fb33f864587cc659b4ce35806022266d56102c5638fd4a2f1b65e250b7796e9cd7140338829eceef3a26dbc4db53e064bc97333ca08142d3d4ce8b0ba75a6742da4583a6c1349f8a5150a149685b16a68342542af9656f410fa247df12b72c116e16bebe6a998c73e5af4d0189dfd74978677462a3d237d28738aaeef2b1b9abf6c53a7149e3c8771c05e8ec8fbd32a9233ea574d5e075ecac118ac812d1a21fa6ecf97617bdf717a3aca63f7d530443732febb4385dcbafca6ca33192b776ddbcb05f07e5f752ea2b6bf35aa3663c9ce64d9bdfcbc2cf3495600c8122bc627bb37af57efc4cf1e29c4f4e22dce2a61cf57edf50a40e2f518d61ee9902fcad3875f938a481a111de537859f2e66629a5e814e95ac555743dc538b257e3c610f8a0bbaf53fa6d78ef704565e21bb9fd76a7180bf96de7203d8d8222bf327164f38e851400cae92efbe3d7df780c64c36578495a7841548300e5227088d8ea2bd22c719c9a6ca0ea87a36db6aba615f112495a4e28e68ee19a949995ed0b434bdd6f940c710973152393529118724d3c4fba963cb7748d5fa62fc24e0047a4ed0e46edece9e385026f4217165d70925d4c907007ab8c7f377e8c5d4e255d0d31ef67f52e2498db911720c88442633660144dfe4330e21de62894807daf5 TreeSize.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\C10BB76AD4EE815242406A1E3E1117FFEC743D4F\Blob = 030000000100000014000000c10bb76ad4ee815242406a1e3e1117ffec743d4f2000000001000000ec060000308206e8308204d0a003020102021077bd0e05b7590bb61d4761531e3f75ed300d06092a864886f70d01010b05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303732383030303030305a170d3330303732383030303030305a305c310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613132303006035504031329476c6f62616c5369676e204743432052343520455620436f64655369676e696e67204341203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100cb20ef971eb9013243a05ba98a23fd205eae38128bca2cd4ff41d81a55d41953b7fda317e77a395cc0f7ce11a3f9a5ed01fab5ba93efaf93dcf8e2b3194c83b04a4450047884106aa4d696908e81f87cab2fb5a35733d2587b940e6d0fa591262ab3834f72b18a7b6492d0f0b4555f960b11e59ab52cb211cf251b7d512b981f49a35ff8139e35b80302daa4132f854aefc42f700ec1d4cc3312ecbd4095d311cae6cdb3059cc853eb52d7784c51019282de13f3078e74ba84809fd2a4150ee8afebf789f6df71f0d1bea7b241332075ccb1d5ed1d0719c4eb2677f2ab6d179349a9b7e6c3909cc6b8ecccc97b9a5ec5c52493636f7e108b61cf9855a324a28836f2f99fbe932eb2069f26c00c015612e1b28a9f0e1edc988b2ecfdae28934a61f26a0a8ae786deca188153cc2eaeeb7d8ad61a5af7036a2798edc0d73c0f1e42cab94ec5806393648d63b5ae822ce740eaf2cf115dad1b495e8acd5496de5afdd9b6b63205d8e7e3bb243d8623a94e5cdb498b3371924127273ab04b009dc85e6d42204ef402a1d2e6dc769d36eb7016c0de097a716e6268b88f70344865f62674cb5a737a855dc03368c6ecf6d3626f10e8fb03d71c0e132a782e4b6320232307cb593c821fd3c88e66963f8ee75c98bc2abefba3afde95ebfb611f1bef03dca323e6e7dde0f7e9b95c41287e71ab84eee2cc1dfa165e82483c92ac2fdb9530203010001a38201ad308201a9300e0603551d0f0101ff04040302018630130603551d25040c300a06082b0601050507030330120603551d130101ff040830060101ff020100301d0603551d0e04160414259dd0fc59098663c5ecf3b1133b571c03923611301f0603551d230418301680141f00bf46800afc7839b7a5b443d95650bbce963b30819306082b06010505070101048186308183303906082b06010505073001862d687474703a2f2f6f6373702e676c6f62616c7369676e2e636f6d2f636f64657369676e696e67726f6f74723435304606082b06010505073002863a687474703a2f2f7365637572652e676c6f62616c7369676e2e636f6d2f6361636572742f636f64657369676e696e67726f6f747234352e63727430410603551d1f043a30383036a034a0328630687474703a2f2f63726c2e676c6f62616c7369676e2e636f6d2f636f64657369676e696e67726f6f747234352e63726c30550603551d20044e304c304106092b06010401a03201023034303206082b06010505070201162668747470733a2f2f7777772e676c6f62616c7369676e2e636f6d2f7265706f7369746f72792f3007060567810c0103300d06092a864886f70d01010b050003820201002575a009c939bab7a139892f189fabd6eb1d4be8947c0d07689b1c9def71b6176a6b024fb33f864587cc659b4ce35806022266d56102c5638fd4a2f1b65e250b7796e9cd7140338829eceef3a26dbc4db53e064bc97333ca08142d3d4ce8b0ba75a6742da4583a6c1349f8a5150a149685b16a68342542af9656f410fa247df12b72c116e16bebe6a998c73e5af4d0189dfd74978677462a3d237d28738aaeef2b1b9abf6c53a7149e3c8771c05e8ec8fbd32a9233ea574d5e075ecac118ac812d1a21fa6ecf97617bdf717a3aca63f7d530443732febb4385dcbafca6ca33192b776ddbcb05f07e5f752ea2b6bf35aa3663c9ce64d9bdfcbc2cf3495600c8122bc627bb37af57efc4cf1e29c4f4e22dce2a61cf57edf50a40e2f518d61ee9902fcad3875f938a481a111de537859f2e66629a5e814e95ac555743dc538b257e3c610f8a0bbaf53fa6d78ef704565e21bb9fd76a7180bf96de7203d8d8222bf327164f38e851400cae92efbe3d7df780c64c36578495a7841548300e5227088d8ea2bd22c719c9a6ca0ea87a36db6aba615f112495a4e28e68ee19a949995ed0b434bdd6f940c710973152393529118724d3c4fba963cb7748d5fa62fc24e0047a4ed0e46edece9e385026f4217165d70925d4c907007ab8c7f377e8c5d4e255d0d31ef67f52e2498db911720c88442633660144dfe4330e21de62894807daf5 TreeSize.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\C10BB76AD4EE815242406A1E3E1117FFEC743D4F\Blob = 140000000100000014000000259dd0fc59098663c5ecf3b1133b571c03923611030000000100000014000000c10bb76ad4ee815242406a1e3e1117ffec743d4f2000000001000000ec060000308206e8308204d0a003020102021077bd0e05b7590bb61d4761531e3f75ed300d06092a864886f70d01010b05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303732383030303030305a170d3330303732383030303030305a305c310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613132303006035504031329476c6f62616c5369676e204743432052343520455620436f64655369676e696e67204341203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100cb20ef971eb9013243a05ba98a23fd205eae38128bca2cd4ff41d81a55d41953b7fda317e77a395cc0f7ce11a3f9a5ed01fab5ba93efaf93dcf8e2b3194c83b04a4450047884106aa4d696908e81f87cab2fb5a35733d2587b940e6d0fa591262ab3834f72b18a7b6492d0f0b4555f960b11e59ab52cb211cf251b7d512b981f49a35ff8139e35b80302daa4132f854aefc42f700ec1d4cc3312ecbd4095d311cae6cdb3059cc853eb52d7784c51019282de13f3078e74ba84809fd2a4150ee8afebf789f6df71f0d1bea7b241332075ccb1d5ed1d0719c4eb2677f2ab6d179349a9b7e6c3909cc6b8ecccc97b9a5ec5c52493636f7e108b61cf9855a324a28836f2f99fbe932eb2069f26c00c015612e1b28a9f0e1edc988b2ecfdae28934a61f26a0a8ae786deca188153cc2eaeeb7d8ad61a5af7036a2798edc0d73c0f1e42cab94ec5806393648d63b5ae822ce740eaf2cf115dad1b495e8acd5496de5afdd9b6b63205d8e7e3bb243d8623a94e5cdb498b3371924127273ab04b009dc85e6d42204ef402a1d2e6dc769d36eb7016c0de097a716e6268b88f70344865f62674cb5a737a855dc03368c6ecf6d3626f10e8fb03d71c0e132a782e4b6320232307cb593c821fd3c88e66963f8ee75c98bc2abefba3afde95ebfb611f1bef03dca323e6e7dde0f7e9b95c41287e71ab84eee2cc1dfa165e82483c92ac2fdb9530203010001a38201ad308201a9300e0603551d0f0101ff04040302018630130603551d25040c300a06082b0601050507030330120603551d130101ff040830060101ff020100301d0603551d0e04160414259dd0fc59098663c5ecf3b1133b571c03923611301f0603551d230418301680141f00bf46800afc7839b7a5b443d95650bbce963b30819306082b06010505070101048186308183303906082b06010505073001862d687474703a2f2f6f6373702e676c6f62616c7369676e2e636f6d2f636f64657369676e696e67726f6f74723435304606082b06010505073002863a687474703a2f2f7365637572652e676c6f62616c7369676e2e636f6d2f6361636572742f636f64657369676e696e67726f6f747234352e63727430410603551d1f043a30383036a034a0328630687474703a2f2f63726c2e676c6f62616c7369676e2e636f6d2f636f64657369676e696e67726f6f747234352e63726c30550603551d20044e304c304106092b06010401a03201023034303206082b06010505070201162668747470733a2f2f7777772e676c6f62616c7369676e2e636f6d2f7265706f7369746f72792f3007060567810c0103300d06092a864886f70d01010b050003820201002575a009c939bab7a139892f189fabd6eb1d4be8947c0d07689b1c9def71b6176a6b024fb33f864587cc659b4ce35806022266d56102c5638fd4a2f1b65e250b7796e9cd7140338829eceef3a26dbc4db53e064bc97333ca08142d3d4ce8b0ba75a6742da4583a6c1349f8a5150a149685b16a68342542af9656f410fa247df12b72c116e16bebe6a998c73e5af4d0189dfd74978677462a3d237d28738aaeef2b1b9abf6c53a7149e3c8771c05e8ec8fbd32a9233ea574d5e075ecac118ac812d1a21fa6ecf97617bdf717a3aca63f7d530443732febb4385dcbafca6ca33192b776ddbcb05f07e5f752ea2b6bf35aa3663c9ce64d9bdfcbc2cf3495600c8122bc627bb37af57efc4cf1e29c4f4e22dce2a61cf57edf50a40e2f518d61ee9902fcad3875f938a481a111de537859f2e66629a5e814e95ac555743dc538b257e3c610f8a0bbaf53fa6d78ef704565e21bb9fd76a7180bf96de7203d8d8222bf327164f38e851400cae92efbe3d7df780c64c36578495a7841548300e5227088d8ea2bd22c719c9a6ca0ea87a36db6aba615f112495a4e28e68ee19a949995ed0b434bdd6f940c710973152393529118724d3c4fba963cb7748d5fa62fc24e0047a4ed0e46edece9e385026f4217165d70925d4c907007ab8c7f377e8c5d4e255d0d31ef67f52e2498db911720c88442633660144dfe4330e21de62894807daf5 TreeSize.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\4C5D80D2CD06B1A493C49B2E9BED4A57C2F873E5\Blob = 1900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b40f0000000100000030000000fec727af43d1569995cea26e8eb97167165842a5b185304425a92c03b71254c5d51222837515f33e60cb8ed2e8c625ba0300000001000000140000004c5d80d2cd06b1a493c49b2e9bed4a57c2f873e51400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b2000000001000000a6050000308205a23082048aa00302010202107803184245708a41cf6f01b8eeb4a954300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3230303732383030303030305a170d3239303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a382017730820173300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b301f0603551d230418301680148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc307a06082b06010505070101046e306c302d06082b060105050730018621687474703a2f2f6f6373702e676c6f62616c7369676e2e636f6d2f726f6f747233303b06082b06010505073002862f687474703a2f2f7365637572652e676c6f62616c7369676e2e636f6d2f6361636572742f726f6f742d72332e63727430360603551d1f042f302d302ba029a0278625687474703a2f2f63726c2e676c6f62616c7369676e2e636f6d2f726f6f742d72332e63726c30470603551d200440303e303c0604551d20003034303206082b06010505070201162668747470733a2f2f7777772e676c6f62616c7369676e2e636f6d2f7265706f7369746f72792f300d06092a864886f70d01010c05000382010100acf7cc158b3079a81d0b28881909d71c7ffe86bd7b5a336e0d670e7b62d9e1185cb0bd135d1d23ae39507637aa44fd5f01235986564cccadbc64131430a420a8e03fe89c72dc7ef3d80c23baa82daa3cf6ec9f87310765f539a7518275e1f22f97f6d1e165968364fea11d51fbb5249bf5d27769bc852c5cfa5877d1aea7b10be2d677bba9b4344aa96f3df4f30d955de6f97a45b02517312edbf70f68e6831fa9f7e5d49d988cd3614b2fc3287e7ade930eb47da00a6d92c4b4663f7da758eeacf7ecc30801ab38fc0a1ca9c597b288c8090219f65c9a1af14d6c30d4b306ab0060480d78abcf17ad9293622077756cbdc832b4dc4debd9dfc1909629bdc17f TreeSize.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\4C5D80D2CD06B1A493C49B2E9BED4A57C2F873E5\Blob = 4b0000000100000044000000420030003300390046004500410034003500430042003400430043003400420042004100430046004300300031003300430037004300350035003600300034005f0000005c0000000100000004000000001000001900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b40f0000000100000030000000fec727af43d1569995cea26e8eb97167165842a5b185304425a92c03b71254c5d51222837515f33e60cb8ed2e8c625ba0300000001000000140000004c5d80d2cd06b1a493c49b2e9bed4a57c2f873e51400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b6b000000010000002000000005e0634b1feb98ae6b4cf101728cf9d5a1793ceace301506ff332b22d4cf08eb180000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f2000000001000000a6050000308205a23082048aa00302010202107803184245708a41cf6f01b8eeb4a954300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3230303732383030303030305a170d3239303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a382017730820173300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b301f0603551d230418301680148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc307a06082b06010505070101046e306c302d06082b060105050730018621687474703a2f2f6f6373702e676c6f62616c7369676e2e636f6d2f726f6f747233303b06082b06010505073002862f687474703a2f2f7365637572652e676c6f62616c7369676e2e636f6d2f6361636572742f726f6f742d72332e63727430360603551d1f042f302d302ba029a0278625687474703a2f2f63726c2e676c6f62616c7369676e2e636f6d2f726f6f742d72332e63726c30470603551d200440303e303c0604551d20003034303206082b06010505070201162668747470733a2f2f7777772e676c6f62616c7369676e2e636f6d2f7265706f7369746f72792f300d06092a864886f70d01010c05000382010100acf7cc158b3079a81d0b28881909d71c7ffe86bd7b5a336e0d670e7b62d9e1185cb0bd135d1d23ae39507637aa44fd5f01235986564cccadbc64131430a420a8e03fe89c72dc7ef3d80c23baa82daa3cf6ec9f87310765f539a7518275e1f22f97f6d1e165968364fea11d51fbb5249bf5d27769bc852c5cfa5877d1aea7b10be2d677bba9b4344aa96f3df4f30d955de6f97a45b02517312edbf70f68e6831fa9f7e5d49d988cd3614b2fc3287e7ade930eb47da00a6d92c4b4663f7da758eeacf7ecc30801ab38fc0a1ca9c597b288c8090219f65c9a1af14d6c30d4b306ab0060480d78abcf17ad9293622077756cbdc832b4dc4debd9dfc1909629bdc17f TreeSize.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\4C5D80D2CD06B1A493C49B2E9BED4A57C2F873E5\Blob = 0300000001000000140000004c5d80d2cd06b1a493c49b2e9bed4a57c2f873e52000000001000000a6050000308205a23082048aa00302010202107803184245708a41cf6f01b8eeb4a954300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3230303732383030303030305a170d3239303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a382017730820173300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b301f0603551d230418301680148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc307a06082b06010505070101046e306c302d06082b060105050730018621687474703a2f2f6f6373702e676c6f62616c7369676e2e636f6d2f726f6f747233303b06082b06010505073002862f687474703a2f2f7365637572652e676c6f62616c7369676e2e636f6d2f6361636572742f726f6f742d72332e63727430360603551d1f042f302d302ba029a0278625687474703a2f2f63726c2e676c6f62616c7369676e2e636f6d2f726f6f742d72332e63726c30470603551d200440303e303c0604551d20003034303206082b06010505070201162668747470733a2f2f7777772e676c6f62616c7369676e2e636f6d2f7265706f7369746f72792f300d06092a864886f70d01010c05000382010100acf7cc158b3079a81d0b28881909d71c7ffe86bd7b5a336e0d670e7b62d9e1185cb0bd135d1d23ae39507637aa44fd5f01235986564cccadbc64131430a420a8e03fe89c72dc7ef3d80c23baa82daa3cf6ec9f87310765f539a7518275e1f22f97f6d1e165968364fea11d51fbb5249bf5d27769bc852c5cfa5877d1aea7b10be2d677bba9b4344aa96f3df4f30d955de6f97a45b02517312edbf70f68e6831fa9f7e5d49d988cd3614b2fc3287e7ade930eb47da00a6d92c4b4663f7da758eeacf7ecc30801ab38fc0a1ca9c597b288c8090219f65c9a1af14d6c30d4b306ab0060480d78abcf17ad9293622077756cbdc832b4dc4debd9dfc1909629bdc17f TreeSize.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\C10BB76AD4EE815242406A1E3E1117FFEC743D4F\Blob = 1900000001000000100000008050a1c09667687456bd1c63be8f6fcb030000000100000014000000c10bb76ad4ee815242406a1e3e1117ffec743d4f140000000100000014000000259dd0fc59098663c5ecf3b1133b571c039236112000000001000000ec060000308206e8308204d0a003020102021077bd0e05b7590bb61d4761531e3f75ed300d06092a864886f70d01010b05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303732383030303030305a170d3330303732383030303030305a305c310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613132303006035504031329476c6f62616c5369676e204743432052343520455620436f64655369676e696e67204341203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100cb20ef971eb9013243a05ba98a23fd205eae38128bca2cd4ff41d81a55d41953b7fda317e77a395cc0f7ce11a3f9a5ed01fab5ba93efaf93dcf8e2b3194c83b04a4450047884106aa4d696908e81f87cab2fb5a35733d2587b940e6d0fa591262ab3834f72b18a7b6492d0f0b4555f960b11e59ab52cb211cf251b7d512b981f49a35ff8139e35b80302daa4132f854aefc42f700ec1d4cc3312ecbd4095d311cae6cdb3059cc853eb52d7784c51019282de13f3078e74ba84809fd2a4150ee8afebf789f6df71f0d1bea7b241332075ccb1d5ed1d0719c4eb2677f2ab6d179349a9b7e6c3909cc6b8ecccc97b9a5ec5c52493636f7e108b61cf9855a324a28836f2f99fbe932eb2069f26c00c015612e1b28a9f0e1edc988b2ecfdae28934a61f26a0a8ae786deca188153cc2eaeeb7d8ad61a5af7036a2798edc0d73c0f1e42cab94ec5806393648d63b5ae822ce740eaf2cf115dad1b495e8acd5496de5afdd9b6b63205d8e7e3bb243d8623a94e5cdb498b3371924127273ab04b009dc85e6d42204ef402a1d2e6dc769d36eb7016c0de097a716e6268b88f70344865f62674cb5a737a855dc03368c6ecf6d3626f10e8fb03d71c0e132a782e4b6320232307cb593c821fd3c88e66963f8ee75c98bc2abefba3afde95ebfb611f1bef03dca323e6e7dde0f7e9b95c41287e71ab84eee2cc1dfa165e82483c92ac2fdb9530203010001a38201ad308201a9300e0603551d0f0101ff04040302018630130603551d25040c300a06082b0601050507030330120603551d130101ff040830060101ff020100301d0603551d0e04160414259dd0fc59098663c5ecf3b1133b571c03923611301f0603551d230418301680141f00bf46800afc7839b7a5b443d95650bbce963b30819306082b06010505070101048186308183303906082b06010505073001862d687474703a2f2f6f6373702e676c6f62616c7369676e2e636f6d2f636f64657369676e696e67726f6f74723435304606082b06010505073002863a687474703a2f2f7365637572652e676c6f62616c7369676e2e636f6d2f6361636572742f636f64657369676e696e67726f6f747234352e63727430410603551d1f043a30383036a034a0328630687474703a2f2f63726c2e676c6f62616c7369676e2e636f6d2f636f64657369676e696e67726f6f747234352e63726c30550603551d20044e304c304106092b06010401a03201023034303206082b06010505070201162668747470733a2f2f7777772e676c6f62616c7369676e2e636f6d2f7265706f7369746f72792f3007060567810c0103300d06092a864886f70d01010b050003820201002575a009c939bab7a139892f189fabd6eb1d4be8947c0d07689b1c9def71b6176a6b024fb33f864587cc659b4ce35806022266d56102c5638fd4a2f1b65e250b7796e9cd7140338829eceef3a26dbc4db53e064bc97333ca08142d3d4ce8b0ba75a6742da4583a6c1349f8a5150a149685b16a68342542af9656f410fa247df12b72c116e16bebe6a998c73e5af4d0189dfd74978677462a3d237d28738aaeef2b1b9abf6c53a7149e3c8771c05e8ec8fbd32a9233ea574d5e075ecac118ac812d1a21fa6ecf97617bdf717a3aca63f7d530443732febb4385dcbafca6ca33192b776ddbcb05f07e5f752ea2b6bf35aa3663c9ce64d9bdfcbc2cf3495600c8122bc627bb37af57efc4cf1e29c4f4e22dce2a61cf57edf50a40e2f518d61ee9902fcad3875f938a481a111de537859f2e66629a5e814e95ac555743dc538b257e3c610f8a0bbaf53fa6d78ef704565e21bb9fd76a7180bf96de7203d8d8222bf327164f38e851400cae92efbe3d7df780c64c36578495a7841548300e5227088d8ea2bd22c719c9a6ca0ea87a36db6aba615f112495a4e28e68ee19a949995ed0b434bdd6f940c710973152393529118724d3c4fba963cb7748d5fa62fc24e0047a4ed0e46edece9e385026f4217165d70925d4c907007ab8c7f377e8c5d4e255d0d31ef67f52e2498db911720c88442633660144dfe4330e21de62894807daf5 TreeSize.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ~tmktgnp.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ~tmktgnp.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe - Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
resource yara_rule behavioral2/files/0x000400000000043e-8.dat innosetup behavioral2/memory/4928-9-0x0000000000400000-0x0000000000417000-memory.dmp innosetup behavioral2/memory/4928-1015-0x0000000000400000-0x0000000000417000-memory.dmp innosetup - Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 TreeSize.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString TreeSize.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 TreeSize.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString TreeSize.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 TreeSize.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString TreeSize.exe - Enumerates system info in registry 2 TTPs 12 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer TreeSize.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName TreeSize.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer TreeSize.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName TreeSize.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion TreeSize.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS TreeSize.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion TreeSize.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS TreeSize.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion TreeSize.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS TreeSize.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer TreeSize.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName TreeSize.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ TreeSize.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ TreeSize.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ TreeSize.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ TreeSize.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ TreeSize.exe - Modifies system certificate store 2 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\B46183154587CA995A00B1AF68C497B8395FCC3A TreeSize.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\B46183154587CA995A00B1AF68C497B8395FCC3A\Blob = 030000000100000014000000b46183154587ca995a00b1af68c497b8395fcc3a2000000001000000b5070000308207b130820599a003020102020c01a9c1bad3f800e4f7393d5b300d06092a864886f70d01010b0500305c310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613132303006035504031329476c6f62616c5369676e204743432052343520455620436f64655369676e696e672043412032303230301e170d3236303632343038303835315a170d3237303833313134343232305a30820115311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e3111300f06035504051308485242203439323031133011060b2b0601040182373c020103130244453120301e060b2b0601040182373c020102130f526865696e6c616e642d5066616c7a31193017060b2b0601040182373c0201011308576974746c696368310b3009060355040613024445311830160603550408130f526865696e6c616e642d5066616c7a310e300c0603550407130554726965723120301e06035504091317416d2057697373656e736368616674737061726b203236311a3018060355040a13114a414d20536f66747761726520476d6248311a3018060355040313114a414d20536f66747761726520476d624830820222300d06092a864886f70d01010105000382020f003082020a0282020100b14c0e80010c2a514c169805b3ff501f059f592922c9e5cf9e7b88ad488a98943027526cc830461bd9c85643844ca652156fe3c9cf78f4a1075d6ad575fd6d6df155b91cc11f4ef5aeedb5dec5aeb8820421c3c0cb0c0d72c00f7c15e7c88155dcaf0f44edf9fe1894caa55b05921d0ab47bad9db2ad5360fb16fd3919f8727ad8934d66cbbd2bc3a7b2888cff8c0134fe7e7288926df2a2817ed2a2ebd9831c93323c33db8c7bbceb39ee64fcf61bc03c441e6de9357cb790b320ca41cfa41e36a77584610e9c8dbe7c5c8c9e426b5d497098598a3a4407eacba2544f8b872230a916e1045e0fde3c24264eef65fac97122050e8f1bd07e91d01a769c23620c7680f0e838b5cbde5e9d5cbb88faef583a0f34fd1385b2847f55ff329358ecfcc910ef5f2b583d9f3e472d5c1651dc772dbb2d1bf21f68c84c744a9ce86ceb2a9e2db348d9635a1902e5c82be1621579f9fb606d03bfb383cc907736aff9806e9a8a36c1cbce1eca2bfa3cc7e3d10335c7f1c3ce3c938e88322bca45dc3ec412bf2a55638030fddaf64c180b49bc425fe923d506135306b8f4718e6ebc143d59eb36a4e24ff7e786182242caff3e93b454ec03be1e05fb22e7b229ba1240399364b939cacdea4776da525b332aeee5279207b7fc936578b4769fc40513da8db0ca528a9cc23b0d366df2d1b15a773b31afedb51b338d471b3c8aa2b2c1347ba70203010001a38201b6308201b2300e0603551d0f0101ff04040302078030819f06082b0601050507010104819230818f304c06082b060105050730028640687474703a2f2f7365637572652e676c6f62616c7369676e2e636f6d2f6361636572742f67736763637234356576636f64657369676e6361323032302e637274303f06082b060105050730018633687474703a2f2f6f6373702e676c6f62616c7369676e2e636f6d2f67736763637234356576636f64657369676e63613230323030550603551d20044e304c304106092b06010401a03201023034303206082b06010505070201162668747470733a2f2f7777772e676c6f62616c7369676e2e636f6d2f7265706f7369746f72792f3007060567810c010330090603551d130402300030470603551d1f0440303e303ca03aa0388636687474703a2f2f63726c2e676c6f62616c7369676e2e636f6d2f67736763637234356576636f64657369676e6361323032302e63726c30130603551d25040c300a06082b06010505070303301f0603551d23041830168014259dd0fc59098663c5ecf3b1133b571c03923611301d0603551d0e04160414825617d6b9ecb5901b7a2f9c5a1fc0f31b5bab69300d06092a864886f70d01010b050003820201009aa63014699f6735700806a617185f27deab8178a5fc32e7b803bbbc4d787577efbb99dc278871cd10e5cdda18488af0d8ee9ecc6a851081a9cbbbbdcddcb43bea05e1a7ebcbc8579892f3286f5d6cf56ed2ac41036fb67d377fafc2a58024848110e6a7ebcefbd1914afc385bc25e80f5d583a44dbc966a644cf337f83fd941ddce8eec6e96aae693475bf83acdf2f8b4aef4127164fbb483613c9b93058c166a70f97e7862613f6aea1f373ab4f0e7f0ab4ec674cec1a15b6220632b41e141dd969bfe68cb24ec3656bb21aeb3f562751389757f240deecc6272e4cef14951aa3bc1434f19b83849bcf73ae867080bd950bc29ccb36bdd01f30fa2f1b111fcc368f408e1581969416487cba04d4a9975b3dad55e6f37e28d22cd030f642633375f0fd02748264dcead61fd69048181b0bf6f2865c77e37825fbfb660f5002889c70c7a04ae52248a58d67e2a91d51a8d5813680a34fb8f8c20d4a8b575a6bb0f151f91206421703308c6ad106f5c3411ca82bb11fab1f2a8cc2acd461d0e523cf11e8fecb0dc68fefc11f00be41a2e73753dead40cbf3b22dc4757023fa298abc54ab1a50665980b387aae5aae86c92d9549ea8967c8e42f9501aa7696126bad30ffe056ddb3577b56af73554d1703f780d6954610208a905953190e65cf76ed3d8f061b67a365e9c239bef9fb1f0c4526ce73cea01637d4b5d3d8f70768ae TreeSize.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 5c000000010000000400000000100000190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd0300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd17e00000001000000080000000080c82b6886d7017a000000010000000c000000300a06082b060105050703091d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a07f0000000100000016000000301406082b0601050507030306082b060105050703096200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf690b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520036000000090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff16b00000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf69200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 TreeSize.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8 TreeSize.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 6b00000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df860f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c0b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000006200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df8653000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c01400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b1d00000001000000100000005467b0adde8d858e30ee517b1a19ecd909000000010000000c000000300a06082b060105050703030300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b81900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b4200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82 TreeSize.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 5c0000000100000004000000001000001900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b40300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b809000000010000000c000000300a06082b060105050703031d00000001000000100000005467b0adde8d858e30ee517b1a19ecd91400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b53000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df860b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000000f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c6b00000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df86200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82 TreeSize.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\4C5D80D2CD06B1A493C49B2E9BED4A57C2F873E5 TreeSize.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\C10BB76AD4EE815242406A1E3E1117FFEC743D4F TreeSize.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1 TreeSize.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 6b00000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf690f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 TreeSize.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 3760 ~tmktgnp.tmp 3760 ~tmktgnp.tmp 3760 ~tmktgnp.tmp 3760 ~tmktgnp.tmp 3760 ~tmktgnp.tmp 3760 ~tmktgnp.tmp 3760 ~tmktgnp.tmp 3760 ~tmktgnp.tmp 3760 ~tmktgnp.tmp 3760 ~tmktgnp.tmp 3760 ~tmktgnp.tmp 3760 ~tmktgnp.tmp 3760 ~tmktgnp.tmp 3760 ~tmktgnp.tmp 3760 ~tmktgnp.tmp 3760 ~tmktgnp.tmp 3760 ~tmktgnp.tmp 3760 ~tmktgnp.tmp 3760 ~tmktgnp.tmp 3760 ~tmktgnp.tmp 3760 ~tmktgnp.tmp 3760 ~tmktgnp.tmp 3760 ~tmktgnp.tmp 3760 ~tmktgnp.tmp 3760 ~tmktgnp.tmp 3760 ~tmktgnp.tmp 3760 ~tmktgnp.tmp 3760 ~tmktgnp.tmp 3760 ~tmktgnp.tmp 3760 ~tmktgnp.tmp 3760 ~tmktgnp.tmp 3760 ~tmktgnp.tmp 3760 ~tmktgnp.tmp 3760 ~tmktgnp.tmp 3760 ~tmktgnp.tmp 3760 ~tmktgnp.tmp 5868 TreeSize.exe 5868 TreeSize.exe 5868 TreeSize.exe 5868 TreeSize.exe 5868 TreeSize.exe 5868 TreeSize.exe 5868 TreeSize.exe 5868 TreeSize.exe 5868 TreeSize.exe 5868 TreeSize.exe 5868 TreeSize.exe 5868 TreeSize.exe 5868 TreeSize.exe 5868 TreeSize.exe 5868 TreeSize.exe 5868 TreeSize.exe 5868 TreeSize.exe 5868 TreeSize.exe 5868 TreeSize.exe 5868 TreeSize.exe 5868 TreeSize.exe 5868 TreeSize.exe 5868 TreeSize.exe 5868 TreeSize.exe - Suspicious use of FindShellTrayWindow 41 IoCs
pid Process 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 3760 ~tmktgnp.tmp 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 1492 TreeSize.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe - Suspicious use of SendNotifyMessage 39 IoCs
pid Process 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe - Suspicious use of SetWindowsHookEx 11 IoCs
pid Process 3760 ~tmktgnp.tmp 3760 ~tmktgnp.tmp 3760 ~tmktgnp.tmp 5868 TreeSize.exe 5868 TreeSize.exe 3000 TreeSize.exe 3000 TreeSize.exe 1492 TreeSize.exe 1492 TreeSize.exe 1492 TreeSize.exe 1492 TreeSize.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2356 wrote to memory of 4928 2356 2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 89 PID 4928 wrote to memory of 3760 4928 ~tmktgnp.tmp 90 PID 3760 wrote to memory of 5868 3760 ~tmktgnp.tmp 92 PID 3760 wrote to memory of 3000 3760 ~tmktgnp.tmp 93 PID 3760 wrote to memory of 1492 3760 ~tmktgnp.tmp 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_34f63ec83a24c5841b88672b37c28b77_agent-tesla_amadey_icedid_luca-stealer_njrat.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Program Files\Common Files\~tmktgnp.tmp"C:\Program Files\Common Files\~tmktgnp.tmp" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP- /LOADINF="C:\Program Files\Common Files\~bvpsqcx.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\is-146EQ.tmp\~tmktgnp.tmp"C:\Users\Admin\AppData\Local\Temp\is-146EQ.tmp\~tmktgnp.tmp" /SL5="$300CA,27799411,64512,C:\Program Files\Common Files\~tmktgnp.tmp" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP- /LOADINF="C:\Program Files\Common Files\~bvpsqcx.tmp"3⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Program Files\JAM Software\TreeSize\TreeSize.exe"C:\Program Files\JAM Software\TreeSize\TreeSize.exe" /nogui /installcertificate4⤵
- Manipulates Digital Signatures
- Executes dropped EXE
- Modifies trusted root certificate store through registry
- Checks processor information in registry
- Enumerates system info in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5868
-
-
C:\Program Files\JAM Software\TreeSize\TreeSize.exe"C:\Program Files\JAM Software\TreeSize\TreeSize.exe" /NOGUI /SETADMINFLAG "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TreeSize\TreeSize (Administrator).LNK" /SETADMINFLAG "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TreeSize\TreeSize File Search (Administrator).LNK" /SETADMINFLAG "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TreeSize\TreeSize Duplicate File Search (Administrator).LNK"4⤵
- Executes dropped EXE
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:3000
-
-
C:\Program Files\JAM Software\TreeSize\TreeSize.exe"C:\Program Files\JAM Software\TreeSize\TreeSize.exe" /NOGUI /ContextMenuEntries 6 /INSTALL /SAVESETTINGS /REGISTERPACKAGE4⤵
- Executes dropped EXE
- Enumerates connected drives
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1492
-
-
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Event Triggered Execution
1Image File Execution Options Injection
1Defense Evasion
Modify Registry
1Subvert Trust Controls
3Install Root Certificate
2SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\~bvpsqcx.tmp
- Size 157B
- SHA256 b5f3e5557599c1e0684464199db9fe7638113f845a5aa587c9e7864fb7f56c9b
- MD5 1e512b0437fed5f7d77008132b8c7e86
- SHA1 fcac08dae680fa9a630dc1f4a0c0e328d6d4e4e8
- SHA512 657cd44323fce77223ae67ee1861c55f09d8fc1319b75c534bfb1fe2bdede167d28e440399b848a4182e4d56c0c7c0b621610e0d6ffe3cb831635149c99f6929
- TLSH T10BC08C2D3680A0F4332DA4C54120B0084393CBC896C8EC298386898E99E282414EDE71
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Common Files\~tmktgnp.tmp
- Size 26.8MB
- SHA256 1197ead21bc375a3ba8b34750b544e0113e0d257d4d68eb88932efddae720a57
- MD5 10d76897996b4549f912bf9fb1d1e225
- SHA1 81ee1971f6d8f79b4923c9bd6c439ccbe4cfd7cd
- SHA512 84f40abfd1f1fc637784b0a2d447a39b075656abcf4c0dc17f252725441efb806e504eb5dd83393357cd409321d625765280389cf8b587e23b9de7b362fad0be
- SSDEEP 786432:8TYZ4Lem6aZCBa5L1CdS50HRF6i6Y0P1852uB2YPK0:vm3ZjxCNHRMDY06LoYC0
- TLSH T143573358718D0DC3DB2566B046B129B1CC9F215639EA96BB6E7C32C809F3B70673316B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\JAM Software\TreeSize\HELP_RU\_images\is-61LRP.tmp
- Size 20KB
- SHA256 e126adbb19f210a5c43e088f64e59b7e77944c559b1b8cc2b37f9a540dacc75d
- MD5 a1c40736217b9425006a4fbaf4d781ae
- SHA1 96b9d33e0c0c60d96e2be9b7036b28a10d824f30
- SHA512 7461cb736550f9bb67db27460b610638cb00a2513a35cb0ca5d025458123b87e8cb50c195e81e2f906c44eaab7462484c3d2fccc79073deb2be825c0185dadd3
- SSDEEP 384:se1jMxonYOMzBh+nc2SGlden+K7u47gbArmDyo5Bh2G:sej7iBwncZqdenJ7uU5ozN
- TLSH T1A692D0682C56F4220145068A4C2E6F80F867F6E8F5B52FBEFE05616EC88AB55615CC31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\JAM Software\TreeSize\Jam.Interop.dll
- Size 57KB
- SHA256 e6253e57c17e07a06140437400cd5485aadfdb233e3a79b3d829f6f35095f2f3
- MD5 6dbb6f7067673053fcad97a8fb77fb29
- SHA1 4f6971a767dbfc9c29f7d9d3e543e8576ad98357
- SHA512 0873ed7656a832a4c5ea818106c4bdee4053c5e8d6aff8702d9c0a5016a5ef6b4eb442b0537cfafde2eb7eb65a7ca05c5f38112c0f6bdd6410810e60231ef2b7
- SSDEEP 768:ifNf/LVdhjsMqcBvJf5yZFMgtlr30bgGDYxfral4F2H5xQwHDHf/ckoV:gfRV5BJ5AFMgH30bXmOy43jHW
- TLSH T1D1437C4427BCD227F6ED0F7D7CF106009A7AE38265A3D20F9DC1648E58537589B10BAB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\JAM Software\TreeSize\Jam.Logging.dll
- Size 21KB
- SHA256 f82562b0b6cad52f514290dee76cf330e7289a8f571325a624e97d87652229c7
- MD5 16bd9f798fda178c404608ca8b261ccd
- SHA1 aea571dcff9b4f13c1e1a468621648d1e462fd8a
- SHA512 4c152cae25f45481e454bb4af0a20913e023f09dd56268e2185a60ce440224c0c78b75b226eddee48d3a87d831397d54d8923d6daf299f6f85fa88e74eda7992
- SSDEEP 384:FM6VJcvSpZpSxO0Z6u0QKhq6ki2A6ii5x5ck3wKFKjqfvGBkS1:FxVJcmcfw7QOF2H5x5rwKFKcMk
- TLSH T124A26C079BADC117EFA64B3AB8E296036E7CFE4188EFC11B141D572D1C42B851B94B19
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\JAM Software\TreeSize\LicenseManager.exe
- Size 2.0MB
- SHA256 ba8eb0634d4b7476e93c1da8ee923adbcc98f28e269b4cc1f43dac1ebe1fcdbb
- MD5 25e112ccf61bde90b63bc2a1a4243db4
- SHA1 5284b1d00537fc76f0098880e683e85e5836c0bf
- SHA512 30d9c8ecd4945989f104c5f3741ced4c3ec0ab71e15571004af8e9604b66b55dcafcffacffe1eec35f003452d237e0d4d825a9f19575fca185c4640a39997546
- SSDEEP 49152:tszhaK6uK0QjA8KUvn78ZVoYEA0bReyWchH+Kyd:OUK6H0+vKUvKVxeBhex
- TLSH T1F7A5234A739C8622C6AFBB3558AE7A033036F9D54855F3F711D9949D0CF3B289522E83
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TreeSize\TreeSize (Administrator).LNK
- Size 1KB
- SHA256 c84d3cd7eae5b2f95724247c86c0b6b9a2ebcc86b8c83a9c7bc2a5716e7f3ae9
- MD5 822ecd5968870e2e860ae32bbd158f4e
- SHA1 d9b7955ba9618ee1cfd9986f77d92040b5bb60ff
- SHA512 36a9463e578af0c1c78175bef06e26de424243a011985333f6bc6c2d9b8bb7431f403b4f8d54e1f0f7805543a0f63e323566966ae9fc69b1429a540d37d04340
- TLSH T1D811991827E14FB6F5D719310A7212284B33BE80E3EC575D00C50285AC7B6215A9AF2A
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TreeSize\TreeSize Duplicate File Search (Administrator).LNK
- Size 1KB
- SHA256 1e539083fd6b025195375d66c31cd13df906ec31f635402c881a57ee0f581bf8
- MD5 3a09b0e37db9eacf629e63ef943342f8
- SHA1 623af51b6220868b2db6d64df0e947cdc5905637
- SHA512 3e7fa45ebf0a2343e6268bbf53d78838ff822a554baf7fa104ce80c9f24304d4b35f7198949aaa48f1ff08fb7bf756a8356a04d306d98e609437f518d2fd6c54
- TLSH T1AB41CB1837E54B73F6E728710A72122C0B73B9D0A2AC975D41C40285987B5205BAAF2A
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TreeSize\TreeSize File Search (Administrator).LNK
- Size 1KB
- SHA256 fa5930cf18cf1d339ba1ce095ded32e1b3e4e7b6cb0c3d6440944f741fec3cf6
- MD5 092a019737819b876583ae9accb9e56a
- SHA1 24d6b5eea07e6ed3d48a5e963528fc41e10b584f
- SHA512 35611f96185a6e67e1c1d08a351ecabb958997dbcf470afe8cd7e0abd9f5826a147e49c24595c4b03e3d71bc14bd2658351bdc8028380417b17f8689905f07f2
- TLSH T1A1419B1837E54B72F6E728710A72221C0B73B9D0E69C975D41C50285E87B5205BAAF6B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-146EQ.tmp\~tmktgnp.tmp
- Size 911KB
- SHA256 0613eb6c1e518a717471306d1b4a8ab4dcb4fa83d0dfadc69ddd8d0d822c6d02
- MD5 5eb6815d95e9bbaef74ba37d2e87432e
- SHA1 9daf506a422e4879a8d556d863920993ed13b788
- SHA512 5d2a2fa1380ed9e282ecfd59364982350c749515640df2209671d38077a51ca0081810586b06244c6c132bc9438945120d78492e93554f96371e1e78c8b7036a
- SSDEEP 24576:wkHgKPNrPA37hzHIA6/oR36vln6sYEubnhRgZtnTxxDExlDr:w6frPA37hzHIA6/3UvjhRgZ9Tx2B
- TLSH T1CC157C22F280C43BC1A31A749E5786F5AD37BD042E3869DB7BF91F4C4E7964139262D2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-88VOM.tmp\ISTask.dll
- Size 66KB
- SHA256 e916bdf232744e00cbd8d608168a019c9f41a68a7e8390aa48cfb525276c483d
- MD5 86a1311d51c00b278cb7f27796ea442e
- SHA1 ac08ac9d08f8f5380e2a9a65f4117862aa861a19
- SHA512 129e4b8dd2665bcfc5e72b4585343c51127b5d027dbb0234291e7a197baeca1bab5ed074e65e5e8c969ee01f9f65cc52c9993037416de9bfff2f872e5aeba7ec
- SSDEEP 1536:KVqiEnH9RGX9xXLUWB1GOlb3MvH4xK+RRlm9A:isGX3Vwwbc6Rlm9A
- TLSH T138635C07B6D08676E072AFBC5C39A214A63B7D353D35D0ADABB90D8D4E282C29D4C357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-88VOM.tmp\VclStylesInno.dll
- Size 3.0MB
- SHA256 0e93313f42084d804b9ac4be53d844e549cfcaf19e6f276a3b0f82f01b9b2246
- MD5 b0ca93ceb050a2feff0b19e65072bbb5
- SHA1 7ebbbbe2d2acd8fd516f824338d254a33b69f08d
- SHA512 37242423e62af30179906660c6dbbadca3dc2ba9e562f84315a69f3114765bc08e88321632843dbd78ba1728f8d1ce54a4edfa3b96a9d13e540aee895ae2d8e2
- SSDEEP 49152:fvdCka90J5FJ8n2uRrH12SSSAt4VOZkT7LZc8/:fg65FOnRZAt4VObK
- TLSH T12EE56C27B2447A3EC0AB1B3D983BA294AD3FB71177179C5A5BF40C8C8E35580393A597
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\jam_1508240755984447058245.config
- Size 4KB
- SHA256 685321f287e81c68312ead10e30d4fdef0c7394d8744068e2b6bfea54297fd9c
- MD5 82f9976c6c6a030c0f7744df3e2f0343
- SHA1 10e8a47cfd1058de162db06895f21d3037b6734c
- SHA512 6c2a69ca41236807d6d81f309a207ff7d27cda34a2aa34439b0a6b07c06d2c24f59a649fc2ce546855ca082b70b6ba040904214c6317c0077a209936f20fc7e6
- SSDEEP 96:wVULkKa3swClfJM7jSOjkbaDE/tYy1RCbnJ9p/:wVSkH3sDmXPwplYy1MnJD/
- TLSH T162A13F7BC349A9BC24461A395A178B018B7866B9E22CBC55FEF60C44F1DF7784B3254C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\JAM Software\TreeSize\GlobalOptions.xml
- Size 1KB
- SHA256 2b07a8fbf0fb36fd4aa2161b7495faeba08815057020d3a999949a78e97bce5d
- MD5 ed3bf6165e4d0cdd725ca11aebc81c73
- SHA1 3b8046f0fa1aa091257b3ee251b721a283ccf6ce
- SHA512 c9d9c1acb2ef6a65899589d30c146edbacfe6fd97f111702e18eb5b6de947c623d758bd9e32c1d2d021b08ee3074168ba92ec79337a2035f935f94e0b5767019
- TLSH T109116D307589D2723BADDB6C40712B57576AC27185F2043C49488D37F7E242EA1DF19E
- MD5 SHA1 SHA512 TLSH