The certificate is added to a specific system store (e.g., Root , CA , My , TrustedPeople ). Unlike simpler add functions, this export often defaults to the store or the Intermediate Certification Authorities store. Evidence from API monitors suggests it primarily targets the Root or CA system stores relevant to machine trust.
DWORD CryptExtAddCERMachineOnlyAndHwnd( HWND hWnd, LPCWSTR lpszFileName, DWORD dwStoreLocation, DWORD dwAddFlags ); cryptextdll cryptextaddcermachineonlyandhwnd work
cryptext.dll contains several variations of this function to handle different scenarios: The certificate is added to a specific system store (e
: It is commonly executed via rundll32.exe . For example: rundll32.exe cryptext.dll,CryptExtAddCERMachineOnlyAndHwnd [path_to_certificate] Is it a "Good Paper"? TrustedPeople ). Unlike simpler add functions
HRESULT CryptExtAddCERMachineOnlyAndHwnd( HWND hWndParent, DWORD dwFlags, LPCWSTR wszFileName, // possibly additional parameters );