[nsxwolf]

Ahh. That makes sense. So the malware itself is decrypting the certificate using the password.