cobaltstrike | hxxp://google[.]es

Analysis

max time kernel
197s
max time network
198s
platform
windows10-2004_x64
resource
win10v2004-20240611-es
resource tags

arch:x64arch:x86image:win10v2004-20240611-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
02-07-2024 14:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://google.es

Score

10^/10

cobaltstrike backdoor discovery evasion persistence privilege_escalation spyware stealer trojan

Malware Config

Signatures

Cobalt Strike reflective loader 1 IoCs
Detects the reflective loader used by Cobalt Strike.

Processes:

resource yara_rule

C:\ProgramData\ReasonLabs\EPP\SignaturesYFS.dat.tmp cobalt_reflective_dll
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Downloads MZ/PE file

resource	yara_rule
C:\ProgramData\ReasonLabs\EPP\SignaturesYFS.dat.tmp	cobalt_reflective_dll

Drops file in Drivers directory 6 IoCs

Processes:

UnifiedStub-installer.exe

description	ioc	process
File created	C:\Windows\system32\drivers\rsCamFilter020502.sys	UnifiedStub-installer.exe
File created	C:\Windows\system32\drivers\rsKernelEngine.sys	UnifiedStub-installer.exe
File created	C:\Windows\system32\drivers\rsElam.sys	UnifiedStub-installer.exe
File opened for modification	C:\Windows\system32\drivers\rsElam.sys	UnifiedStub-installer.exe
File created	C:\Windows\system32\drivers\rsDwf.sys	UnifiedStub-installer.exe
File opened for modification	C:\Windows\system32\drivers\rsDwf.sys	UnifiedStub-installer.exe

Modifies Windows Firewall 2 TTPs 2 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exenetsh.exe

pid process

1448 netsh.exe
5584 netsh.exe

pid	process
1448	netsh.exe
5584	netsh.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

rsEDRSvc.exersEngineSvc.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rsEDRSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rsEngineSvc.exe

Checks computer location settings 2 TTPs 12 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

rsAppUI.exersAppUI.exersAppUI.exersAppUI.exersAppUI.exeprod0.exersVPNSvc.exersAppUI.exersAppUI.exePlanet Coaster_pG-3BF1.tmprsAppUI.exersAppUI.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation	rsAppUI.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation	rsAppUI.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation	rsAppUI.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation	rsAppUI.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation	rsAppUI.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation	prod0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation	rsVPNSvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation	rsAppUI.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation	rsAppUI.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation	Planet Coaster_pG-3BF1.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation	rsAppUI.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation	rsAppUI.exe

Executes dropped EXE 50 IoCs

Processes:

Planet Coaster_pG-3BF1.exePlanet Coaster_pG-3BF1.tmpprod0.exedglgchzt.exeUnifiedStub-installer.exeqbittorrent.exersSyncSvc.exersSyncSvc.exersWSC.exersWSC.exersClientSvc.exersClientSvc.exersEngineSvc.exersEngineSvc.exersEDRSvc.exersEDRSvc.exersVPNClientSvc.exersVPNClientSvc.exersVPNSvc.exersVPNSvc.exersHelper.exeVPN.exersAppUI.exersAppUI.exersAppUI.exersAppUI.exersAppUI.exeEPP.exersAppUI.exersAppUI.exersAppUI.exersAppUI.exersAppUI.exePlanet Coaster_pG-3BF1.exePlanet Coaster_pG-3BF1.tmprsAppUI.exersDNSClientSvc.exersDNSClientSvc.exersDNSResolver.exersDNSResolver.exersDNSResolver.exersDNSSvc.exersDNSSvc.exeDNS.exersAppUI.exersAppUI.exersAppUI.exersAppUI.exeqbittorrent.exersLitmus.A.exe

pid	process
3628	Planet Coaster_pG-3BF1.exe
4956	Planet Coaster_pG-3BF1.tmp
3684	prod0.exe
4624	dglgchzt.exe
3972	UnifiedStub-installer.exe
2980	qbittorrent.exe
1552	rsSyncSvc.exe
4332	rsSyncSvc.exe
1864	rsWSC.exe
4108	rsWSC.exe
5996	rsClientSvc.exe
2012	rsClientSvc.exe
5680	rsEngineSvc.exe
5444	rsEngineSvc.exe
5528	rsEDRSvc.exe
7004	rsEDRSvc.exe
6872	rsVPNClientSvc.exe
5168	rsVPNClientSvc.exe
5312	rsVPNSvc.exe
1552	rsVPNSvc.exe
7204	rsHelper.exe
8056	VPN.exe
8080	rsAppUI.exe
8692	rsAppUI.exe
8824	rsAppUI.exe
9108	rsAppUI.exe
7792	rsAppUI.exe
8292	EPP.exe
8328	rsAppUI.exe
7596	rsAppUI.exe
5500	rsAppUI.exe
8872	rsAppUI.exe
3964	rsAppUI.exe
3900	Planet Coaster_pG-3BF1.exe
6336	Planet Coaster_pG-3BF1.tmp
7008	rsAppUI.exe
2424	rsDNSClientSvc.exe
6784	rsDNSClientSvc.exe
6296	rsDNSResolver.exe
6788	rsDNSResolver.exe
7772	rsDNSResolver.exe
5560	rsDNSSvc.exe
8108	rsDNSSvc.exe
5304	DNS.exe
4140	rsAppUI.exe
2236	rsAppUI.exe
8144	rsAppUI.exe
6524	rsAppUI.exe
6876	qbittorrent.exe
7216	rsLitmus.A.exe

Loads dropped DLL 55 IoCs

Processes:

Planet Coaster_pG-3BF1.tmpUnifiedStub-installer.exersEDRSvc.exersEDRSvc.exersEngineSvc.exersVPNSvc.exersAppUI.exersAppUI.exersAppUI.exersAppUI.exersAppUI.exersAppUI.exersAppUI.exersAppUI.exersAppUI.exersAppUI.exersAppUI.exePlanet Coaster_pG-3BF1.tmprsDNSSvc.exersDNSResolver.exersAppUI.exersAppUI.exersAppUI.exersAppUI.exe

pid	process
4956	Planet Coaster_pG-3BF1.tmp
4956	Planet Coaster_pG-3BF1.tmp
4956	Planet Coaster_pG-3BF1.tmp
3972	UnifiedStub-installer.exe
3972	UnifiedStub-installer.exe
5528	rsEDRSvc.exe
5528	rsEDRSvc.exe
7004	rsEDRSvc.exe
7004	rsEDRSvc.exe
5444	rsEngineSvc.exe
7004	rsEDRSvc.exe
3972	UnifiedStub-installer.exe
5444	rsEngineSvc.exe
5444	rsEngineSvc.exe
1552	rsVPNSvc.exe
8080	rsAppUI.exe
8080	rsAppUI.exe
8692	rsAppUI.exe
8824	rsAppUI.exe
8692	rsAppUI.exe
8692	rsAppUI.exe
8692	rsAppUI.exe
8692	rsAppUI.exe
9108	rsAppUI.exe
7792	rsAppUI.exe
8328	rsAppUI.exe
8328	rsAppUI.exe
8328	rsAppUI.exe
7596	rsAppUI.exe
5500	rsAppUI.exe
8872	rsAppUI.exe
7596	rsAppUI.exe
7596	rsAppUI.exe
7596	rsAppUI.exe
7596	rsAppUI.exe
3964	rsAppUI.exe
3972	UnifiedStub-installer.exe
7008	rsAppUI.exe
6336	Planet Coaster_pG-3BF1.tmp
8108	rsDNSSvc.exe
7772	rsDNSResolver.exe
7772	rsDNSResolver.exe
4140	rsAppUI.exe
4140	rsAppUI.exe
4140	rsAppUI.exe
4140	rsAppUI.exe
6336	Planet Coaster_pG-3BF1.tmp
6336	Planet Coaster_pG-3BF1.tmp
2236	rsAppUI.exe
8144	rsAppUI.exe
6524	rsAppUI.exe
2236	rsAppUI.exe
2236	rsAppUI.exe
2236	rsAppUI.exe
2236	rsAppUI.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

rundll32.exerundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	rundll32.exe

Checks for any installed AV software in registry 1 TTPs 12 IoCs

Security Software Discovery

T1518.001

Processes:

Planet Coaster_pG-3BF1.tmpPlanet Coaster_pG-3BF1.tmp

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\AVAST Software\Avast	Planet Coaster_pG-3BF1.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV\Dir	Planet Coaster_pG-3BF1.tmp
Key opened	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\AVG\AV\Dir	Planet Coaster_pG-3BF1.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast	Planet Coaster_pG-3BF1.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVG\AV\Dir	Planet Coaster_pG-3BF1.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast	Planet Coaster_pG-3BF1.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVG\AV\Dir	Planet Coaster_pG-3BF1.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast	Planet Coaster_pG-3BF1.tmp
Key opened	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\AVAST Software\Avast	Planet Coaster_pG-3BF1.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV\Dir	Planet Coaster_pG-3BF1.tmp
Key opened	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\AVG\AV\Dir	Planet Coaster_pG-3BF1.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast	Planet Coaster_pG-3BF1.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates connected drives 3 TTPs 3 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

qbittorrent.exersEngineSvc.exersEDRSvc.exe

description ioc process

File opened (read-only) \??\F: qbittorrent.exe
File opened (read-only) \??\F: rsEngineSvc.exe
File opened (read-only) \??\F: rsEDRSvc.exe
Modifies powershell logging option 1 TTPs
evasion

Modify Registry
T1112
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.

Processes:

resource yara_rule

C:\ProgramData\ReasonLabs\EPP\SignaturesYFS.dat.tmp autoit_exe

description	ioc	process
File opened (read-only)	\??\F:	qbittorrent.exe
File opened (read-only)	\??\F:	rsEngineSvc.exe
File opened (read-only)	\??\F:	rsEDRSvc.exe

resource	yara_rule
C:\ProgramData\ReasonLabs\EPP\SignaturesYFS.dat.tmp	autoit_exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

rsEDRSvc.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	rsEDRSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	rsEDRSvc.exe

Drops file in System32 directory 64 IoCs

Processes:

rsEDRSvc.exersEngineSvc.exersVPNSvc.exe

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50	rsEDRSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3E3E9689537B6B136ECF210088069D55_EF6C9357BB54DDB629FD2D79F1594F95	rsEDRSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\86844F70250DD8EF225D6B4178798C21_2CDE88B3CC9A35A2EA16DC0201366139	rsEDRSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_56DB209C155B5A05FCBF555DF7E6D1BB	rsEDRSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\206932163209AD483A44477E28192474	rsEDRSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\117308CCCD9C93758827D7CC85BB135E	rsEDRSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FA0E447C3E79584EC91182C66BBD2DB7	rsEDRSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\74FBF93595CFC8459196065CE54AD928	rsEngineSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_79CFD3DF2894C4BFDA2ADFD6675FA18B	rsEngineSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77CF52543AB0ECD9BF6546AAF6AC33DB	rsEngineSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\206932163209AD483A44477E28192474	rsEDRSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_6E4F36431D86962EFD432400DF65AC90	rsEDRSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94D451DDCFFF94F1A6B8406468FA3558_E4A7C6A10F816F002B00DE3B58B7E44E	rsEngineSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\54C62B182F5BF07FA8427C07B0A3AAF8_C0FCA017E5E8DC85A76F14D75ABCD153	rsEngineSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_6E4F36431D86962EFD432400DF65AC90	rsEDRSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_2DBE917624E9880FE0C7C5570D56E691	rsEngineSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3E3E9689537B6B136ECF210088069D55_EF6C9357BB54DDB629FD2D79F1594F95	rsEDRSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BD96F9183ADE69B6DF458457F594566C_48BDF541C9BF1B2BAD41358CD874DC4B	rsEDRSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\86844F70250DD8EF225D6B4178798C21_2CDE88B3CC9A35A2EA16DC0201366139	rsEDRSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7850C7BAFAC9456B4B92328A61976502_617BA9B1A20C7A7A9F013422932F5C48	rsEDRSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A76F24BEACC5A31C76BB70908923C3E0	rsEDRSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94D451DDCFFF94F1A6B8406468FA3558_E4A7C6A10F816F002B00DE3B58B7E44E	rsEngineSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\86844F70250DD8EF225D6B4178798C21_1FB605FD2412C4F94AD934D8134A28AC	rsEDRSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_96B11076AA4494A4A6143129F61AEC8B	rsEDRSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\439F613B3D55693954E1B080DE3085B4_C4927E03400A4F6EDB9D613E6354F864	rsEngineSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_466BAFE78D4077069B6C3828315C7C8D	rsEDRSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5080DC7A65DB6A5960ECD874088F3328_79CFD3DF2894C4BFDA2ADFD6675FA18B	rsEngineSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_E3A0B2E345AA9F5A174687564C886046	rsEngineSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\009879608CAFAEA3D83BD836A5260DFF_494C964ABB8DFAE54253C96871A2D7F3	rsEngineSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\117308CCCD9C93758827D7CC85BB135E	rsEDRSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\439F613B3D55693954E1B080DE3085B4_C4927E03400A4F6EDB9D613E6354F864	rsEngineSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ED90CF98D7FAD71C274722E4F54A256C	rsEngineSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	rsEDRSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50	rsEDRSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\rsVPNSvc\WireGuard\log.bin	rsVPNSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\74FBF93595CFC8459196065CE54AD928	rsEngineSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ED90CF98D7FAD71C274722E4F54A256C	rsEngineSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\971E98FB192CF25D1FBA2923458B97CB	rsEngineSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_56DB209C155B5A05FCBF555DF7E6D1BB	rsEDRSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3E3E9689537B6B136ECF210088069D55_A925FAB5FFC3CEDB8E62B2DCCBBBB4F2	rsEDRSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E663C78920A8217B4CBE3D45E3E6236_FAC429BFCC14A89D4D351DF26B2C8FD0	rsEDRSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7850C7BAFAC9456B4B92328A61976502_617BA9B1A20C7A7A9F013422932F5C48	rsEDRSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_466BAFE78D4077069B6C3828315C7C8D	rsEDRSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_2DBE917624E9880FE0C7C5570D56E691	rsEngineSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\48B35517638A85CA46010B026C2B955A_735A98D70471F3F6240371211712CB5C	rsEngineSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	rsEDRSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FA0E447C3E79584EC91182C66BBD2DB7	rsEDRSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\86844F70250DD8EF225D6B4178798C21_ACC1A26A3F5A815A00C8D5589432921F	rsEDRSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A76F24BEACC5A31C76BB70908923C3E0	rsEDRSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_E3A0B2E345AA9F5A174687564C886046	rsEngineSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	rsEDRSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3E3E9689537B6B136ECF210088069D55_A925FAB5FFC3CEDB8E62B2DCCBBBB4F2	rsEDRSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E663C78920A8217B4CBE3D45E3E6236_FAC429BFCC14A89D4D351DF26B2C8FD0	rsEDRSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\38D10539991D1B84467F968981C3969D_3A58CFC115108405B8F1F6C1914449B7	rsEDRSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	rsEDRSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\86844F70250DD8EF225D6B4178798C21_ACC1A26A3F5A815A00C8D5589432921F	rsEDRSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\38D10539991D1B84467F968981C3969D_3A58CFC115108405B8F1F6C1914449B7	rsEDRSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BD96F9183ADE69B6DF458457F594566C_48BDF541C9BF1B2BAD41358CD874DC4B	rsEDRSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D11549FC90445E1CE90F96A21958A17_EC4B03A84E582F11EFD1DC6D27A523EE	rsEngineSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D11549FC90445E1CE90F96A21958A17_EC4B03A84E582F11EFD1DC6D27A523EE	rsEngineSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\48B35517638A85CA46010B026C2B955A_735A98D70471F3F6240371211712CB5C	rsEngineSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\009879608CAFAEA3D83BD836A5260DFF_494C964ABB8DFAE54253C96871A2D7F3	rsEngineSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77CF52543AB0ECD9BF6546AAF6AC33DB	rsEngineSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\86844F70250DD8EF225D6B4178798C21_1FB605FD2412C4F94AD934D8134A28AC	rsEDRSvc.exe

Drops file in Program Files directory 64 IoCs

Processes:

UnifiedStub-installer.exersDNSResolver.exersDNSSvc.exersDNSResolver.exe

description	ioc	process
File created	C:\Program Files\ReasonLabs\EPP\TraceReloggerLib.dll	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\VPN\resources\white-blue-icon.ico	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\VPN\System.ComponentModel.EventBasedAsync.dll	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\DNS\zh-CN\Microsoft.Win32.TaskScheduler.resources.dll	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\VPN\UACHelper.dll	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\DNS\System.Resources.Writer.dll	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\Common\Client\v1.4.2\libEGL.dll	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\nb.pak	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\rsEngineSvc.RPC.JSONInterface.dll	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\System.Xml.XPath.dll	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\gu.pak	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\VPN\System.Runtime.InteropServices.RuntimeInformation.dll	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\DNS\System.Reflection.Extensions.dll	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\rsEngine.Scan.dll	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\System.Net.Security.dll	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\VPN\System.Security.Cryptography.Primitives.dll	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\System.ComponentModel.EventBasedAsync.dll	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\VPN\System.IO.MemoryMappedFiles.dll	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\Microsoft.Diagnostics.FastSerialization.dll	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\Microsoft.Win32.Registry.dll	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\System.AppContext.dll	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\VPN\rsEngine.Features.dll	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\VPN\System.IO.FileSystem.Watcher.dll	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\ko.pak	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\elam\rsElam.inf	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\System.Xml.XPath.XDocument.dll	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\VPN\System.IO.UnmanagedMemoryStream.dll	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\Microsoft.Win32.TaskScheduler.dll	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\VPN\System.Security.Claims.dll	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\DNS\lists\smart_threat_intelligence_feeds.txt	UnifiedStub-installer.exe
File opened for modification	C:\Program Files\ReasonLabs\DNS\logs\rsDNSResolver\stderr.log	rsDNSResolver.exe
File created	C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\te.pak	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\DNS\System.Diagnostics.Tracing.dll	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\x64\rsJournal-x64.dll	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.Serialization.Primitives.dll	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\VPN\System.Net.NameResolution.dll	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\pt-BR.pak	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\EDR\System.Console.dll	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\System.ComponentModel.Primitives.dll	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\VPN\System.Xml.XPath.XDocument.dll	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\DNS\rsServiceController.dll	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\DNS\System.Diagnostics.FileVersionInfo.dll	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\rsBridge.dll	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\DNS\rsBuild.Runtime.dll	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\Common\Client\v1.4.2\version	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\System.Text.Encoding.dll	UnifiedStub-installer.exe
File opened for modification	C:\Program Files\ReasonLabs\DNS\rsDNSSvc.InstallLog	rsDNSSvc.exe
File created	C:\Program Files\ReasonLabs\DNS\System.Net.Primitives.dll	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\DNS\System.Security.Cryptography.Csp.dll	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\VPN\rsBridge.dll	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\DNS\rsBridge.dll	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\DNS\System.Globalization.dll	UnifiedStub-installer.exe
File opened for modification	C:\Program Files\ReasonLabs\DNS\logs\rsDNSResolver\stderr.log	rsDNSResolver.exe
File created	C:\Program Files\ReasonLabs\EPP\rsRemediation.exe.config	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\EDR\System.Threading.ThreadPool.dll	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\VPN\rsVPNSvc.RPC.dll	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\VPN\System.Dynamic.Runtime.dll	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\DNS\rsEngine.Time.dll	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\id.pak	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\EDR\System.Net.Primitives.dll	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\WhiteList.dat	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\hu.pak	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.Numerics.dll	UnifiedStub-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\System.Resources.Writer.dll	UnifiedStub-installer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exenetsh.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Checks SCSI registry key(s) 3 TTPs 18 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

rsEDRSvc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000\LogConf	rsEDRSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\UpperFilters	rsEDRSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000\Control	rsEDRSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000\LogConf	rsEDRSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	rsEDRSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc	rsEDRSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\LowerFilters	rsEDRSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000\Control	rsEDRSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	rsEDRSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service	rsEDRSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\UpperFilters	rsEDRSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	rsEDRSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\LowerFilters	rsEDRSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	rsEDRSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	rsEDRSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	rsEDRSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	rsEDRSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	rsEDRSvc.exe

Checks processor information in registry 2 TTPs 23 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Planet Coaster_pG-3BF1.tmprsEDRSvc.exerunonce.exerunonce.exePlanet Coaster_pG-3BF1.tmp

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Planet Coaster_pG-3BF1.tmp
Key opened	\Registry\Machine\Hardware\Description\System\CentralProcessor	rsEDRSvc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rsEDRSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	rsEDRSvc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rsEDRSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	rsEDRSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	rsEDRSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\	Planet Coaster_pG-3BF1.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rsEDRSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rsEDRSvc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Planet Coaster_pG-3BF1.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	rsEDRSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	rsEDRSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rsEDRSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rsEDRSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	rsEDRSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	rsEDRSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\	Planet Coaster_pG-3BF1.tmp
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rsEDRSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

rsEDRSvc.exersWSC.exersEngineSvc.exechrome.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	rsEDRSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	rsEDRSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	rsWSC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	rsWSC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	rsEDRSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	rsEDRSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	rsEngineSvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	rsEngineSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	rsEDRSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	rsEngineSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	rsWSC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	rsEngineSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	rsEngineSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	rsWSC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	rsWSC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	rsEngineSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	rsEngineSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	rsEDRSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	rsEDRSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	rsEDRSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	rsWSC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	rsEngineSvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	rsEngineSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	rsEDRSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	rsEDRSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	rsEDRSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	rsEngineSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	rsEngineSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	rsEngineSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	rsEDRSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	rsEDRSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	rsEDRSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	rsEDRSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	rsEDRSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	rsWSC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	rsEngineSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	rsEDRSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	rsEDRSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	rsEngineSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	rsWSC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	rsWSC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	rsEngineSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	rsWSC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	rsEngineSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	rsWSC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	rsWSC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	rsWSC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	rsEngineSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	rsWSC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	rsWSC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	rsWSC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	rsEngineSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	rsWSC.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	rsEngineSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	rsEDRSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	rsWSC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	rsWSC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	rsWSC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	rsWSC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	rsEngineSvc.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	rsEDRSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	rsEngineSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	rsEngineSvc.exe

Modifies registry class 16 IoCs

Processes:

qbittorrent.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\magnet\shell	qbittorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\magnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\is-PJ5FE.tmp\\qbittorrent.exe\" \"%1\""	qbittorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\magnet\ = "URL:Magnet link"	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\magnet\shell\open\command	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\magnet\shell\open\command\	qbittorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\magnet\Content Type = "application/x-magnet"	qbittorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\magnet\URL Protocol	qbittorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\magnet\shell\ = "open"	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\magnet	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\magnet\	qbittorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\.torrent\ = "qBittorrent"	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\magnet\DefaultIcon\	qbittorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\magnet\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\is-PJ5FE.tmp\\qbittorrent.exe\",1"	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\magnet\shell\	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\magnet\shell\open	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\.torrent\	qbittorrent.exe

Modifies system certificate store 2 TTPs 23 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

rsEDRSvc.exersEngineSvc.exersEngineSvc.exersWSC.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b90f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e404000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	rsEDRSvc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c00000001000000040000000010000004000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	rsEDRSvc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	rsEDRSvc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	rsEDRSvc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0400000001000000100000001bfe69d191b71933a372a80fe155e5b50f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	rsEDRSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	rsEngineSvc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 5c000000010000000400000000080000190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0282000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	rsEngineSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E	rsEngineSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2	rsEngineSvc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 5c0000000100000004000000001000001900000001000000100000009f687581f7ef744ecfc12b9cee6238f1030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2090000000100000016000000301406082b0601050507030306082b060105050703086200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e12700b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000000f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e040000000100000010000000be954f16012122448ca8bc279602acf52000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2	rsEngineSvc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 040000000100000010000000be954f16012122448ca8bc279602acf50f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e0b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000006200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e1270090000000100000016000000301406082b0601050507030306082b06010505070308140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa21900000001000000100000009f687581f7ef744ecfc12b9cee6238f12000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2	rsEngineSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4	rsEDRSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E	rsEDRSvc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E\Blob = 040000000100000010000000d5e98140c51869fc462c8975620faa780f0000000100000014000000a8569ccd21ef9cc5737c7a12df608c2cbc545df153000000010000006500000030633021060b2a84680186f6770205010130123010060a2b0601040182373c0101030200c03021060b2a84680186f6770205010730123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b0000000100000034000000430065007200740075006d002000540072007500730074006500640020004e006500740077006f0072006b0020004300410000006200000001000000200000005c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e1400000001000000140000000876cdcb07ff24f6c5cdedbb90bce284374675f71d0000000100000010000000e3f9af952c6df2aaa41706a77a44c20303000000010000001400000007e032e020b72c3f192f0628a2593a19a70f069e1900000001000000100000001f7e750b566b128ac0b8d6576d2a70a52000000001000000bf030000308203bb308202a3a00302010202030444c0300d06092a864886f70d0101050500307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b204341301e170d3038313032323132303733375a170d3239313233313132303733375a307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e3fb7da372bac2f0c91487f56b014ee16e4007ba6d275d7ff75b2db35ac7515faba432a66187b66e0f86d2300297f8d76957a118395d6a6479c60159ac3c314a387cd204d24b28e8205f3b07a2cc4d73dbf3ae4fc756d55aa79689faf3ab68d423865927cf0927bcac6e72831c3072dfe0a2e9d2e1747519bd2a9e7b1554041bd74339ad5528c5e21abbf4c0e4ae384933cc76859f3945d2a49ef2128c51f87ce42d7ff5ac5feb169fb12dd1bacc9142774c25c990386fdbf0ccfb8e1e97593ed5604ee60528ed4979134bba48db2ff972d339cafe1fd83472f5b440cf3101c3ecde112d175d1fb850d15e19a769de073328ca5095f9a754cb54865045a9f9490203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604140876cdcb07ff24f6c5cdedbb90bce284374675f7300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100a6a8ad22ce013da6a3ff62d0489d8b5e72b07844e3dc1caf09fd2348fabd2ac4b95504b510a38d27de0b8263d0eede0c3779415b22b2b09a415ca670e0d4d077cb23d300e06c562fe1690d0dd9aabf218150d906a5a8ff9537d0aafee2b3f5992d45848ae54209d774022ff789d899e9bc27d4478dba0d461c77cf14a41cb9a431c49c28740334ff331926a5e90d74b73e97c676e82796a366dde1aef2415bca9856837370e4861ad23141ba2fbe2d135a766f4ee84e810e3f5b0322a012be6658114acb03c4b42a2a2d9617e03954bc48d376279d9a2d06a6c9ec39d2abdb9f9a0b27023529b14095e7f9e89c55881946d6b734f57ece399ad938f151f74f2c	rsEngineSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E	rsWSC.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254832000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	rsWSC.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	rsEngineSvc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	rsEngineSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD	rsEngineSvc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0280f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	rsEngineSvc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E\Blob = 5c0000000100000004000000000800001900000001000000100000001f7e750b566b128ac0b8d6576d2a70a503000000010000001400000007e032e020b72c3f192f0628a2593a19a70f069e1d0000000100000010000000e3f9af952c6df2aaa41706a77a44c2031400000001000000140000000876cdcb07ff24f6c5cdedbb90bce284374675f76200000001000000200000005c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e0b0000000100000034000000430065007200740075006d002000540072007500730074006500640020004e006500740077006f0072006b002000430041000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000006500000030633021060b2a84680186f6770205010130123010060a2b0601040182373c0101030200c03021060b2a84680186f6770205010730123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000a8569ccd21ef9cc5737c7a12df608c2cbc545df1040000000100000010000000d5e98140c51869fc462c8975620faa782000000001000000bf030000308203bb308202a3a00302010202030444c0300d06092a864886f70d0101050500307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b204341301e170d3038313032323132303733375a170d3239313233313132303733375a307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e3fb7da372bac2f0c91487f56b014ee16e4007ba6d275d7ff75b2db35ac7515faba432a66187b66e0f86d2300297f8d76957a118395d6a6479c60159ac3c314a387cd204d24b28e8205f3b07a2cc4d73dbf3ae4fc756d55aa79689faf3ab68d423865927cf0927bcac6e72831c3072dfe0a2e9d2e1747519bd2a9e7b1554041bd74339ad5528c5e21abbf4c0e4ae384933cc76859f3945d2a49ef2128c51f87ce42d7ff5ac5feb169fb12dd1bacc9142774c25c990386fdbf0ccfb8e1e97593ed5604ee60528ed4979134bba48db2ff972d339cafe1fd83472f5b440cf3101c3ecde112d175d1fb850d15e19a769de073328ca5095f9a754cb54865045a9f9490203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604140876cdcb07ff24f6c5cdedbb90bce284374675f7300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100a6a8ad22ce013da6a3ff62d0489d8b5e72b07844e3dc1caf09fd2348fabd2ac4b95504b510a38d27de0b8263d0eede0c3779415b22b2b09a415ca670e0d4d077cb23d300e06c562fe1690d0dd9aabf218150d906a5a8ff9537d0aafee2b3f5992d45848ae54209d774022ff789d899e9bc27d4478dba0d461c77cf14a41cb9a431c49c28740334ff331926a5e90d74b73e97c676e82796a366dde1aef2415bca9856837370e4861ad23141ba2fbe2d135a766f4ee84e810e3f5b0322a012be6658114acb03c4b42a2a2d9617e03954bc48d376279d9a2d06a6c9ec39d2abdb9f9a0b27023529b14095e7f9e89c55881946d6b734f57ece399ad938f151f74f2c	rsEngineSvc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	rsWSC.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254830400000001000000100000001bfe69d191b71933a372a80fe155e5b52000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	rsEDRSvc.exe

Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 331 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header 892 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

qbittorrent.exeqbittorrent.exe

pid process

2980 qbittorrent.exe
6876 qbittorrent.exe

description	flow	ioc
HTTP User-Agent header	331	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	892	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

pid	process
2980	qbittorrent.exe
6876	qbittorrent.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

chrome.exePlanet Coaster_pG-3BF1.tmpUnifiedStub-installer.exechrome.exersClientSvc.exersEngineSvc.exe

pid	process
2660	chrome.exe
2660	chrome.exe
4956	Planet Coaster_pG-3BF1.tmp
4956	Planet Coaster_pG-3BF1.tmp
4956	Planet Coaster_pG-3BF1.tmp
4956	Planet Coaster_pG-3BF1.tmp
4956	Planet Coaster_pG-3BF1.tmp
4956	Planet Coaster_pG-3BF1.tmp
4956	Planet Coaster_pG-3BF1.tmp
4956	Planet Coaster_pG-3BF1.tmp
4956	Planet Coaster_pG-3BF1.tmp
4956	Planet Coaster_pG-3BF1.tmp
4956	Planet Coaster_pG-3BF1.tmp
4956	Planet Coaster_pG-3BF1.tmp
4956	Planet Coaster_pG-3BF1.tmp
4956	Planet Coaster_pG-3BF1.tmp
4956	Planet Coaster_pG-3BF1.tmp
4956	Planet Coaster_pG-3BF1.tmp
4956	Planet Coaster_pG-3BF1.tmp
4956	Planet Coaster_pG-3BF1.tmp
4956	Planet Coaster_pG-3BF1.tmp
4956	Planet Coaster_pG-3BF1.tmp
4956	Planet Coaster_pG-3BF1.tmp
4956	Planet Coaster_pG-3BF1.tmp
3972	UnifiedStub-installer.exe
3972	UnifiedStub-installer.exe
3972	UnifiedStub-installer.exe
3972	UnifiedStub-installer.exe
3972	UnifiedStub-installer.exe
3972	UnifiedStub-installer.exe
3972	UnifiedStub-installer.exe
3972	UnifiedStub-installer.exe
3972	UnifiedStub-installer.exe
3972	UnifiedStub-installer.exe
3972	UnifiedStub-installer.exe
3972	UnifiedStub-installer.exe
3972	UnifiedStub-installer.exe
3972	UnifiedStub-installer.exe
3972	UnifiedStub-installer.exe
3972	UnifiedStub-installer.exe
3972	UnifiedStub-installer.exe
3972	UnifiedStub-installer.exe
3972	UnifiedStub-installer.exe
3972	UnifiedStub-installer.exe
3972	UnifiedStub-installer.exe
3972	UnifiedStub-installer.exe
5268	chrome.exe
5268	chrome.exe
3972	UnifiedStub-installer.exe
3972	UnifiedStub-installer.exe
2012	rsClientSvc.exe
2012	rsClientSvc.exe
5444	rsEngineSvc.exe
5444	rsEngineSvc.exe
5444	rsEngineSvc.exe
5444	rsEngineSvc.exe
5444	rsEngineSvc.exe
5444	rsEngineSvc.exe
5444	rsEngineSvc.exe
5444	rsEngineSvc.exe
5444	rsEngineSvc.exe
5444	rsEngineSvc.exe
5444	rsEngineSvc.exe
5444	rsEngineSvc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

qbittorrent.exe

pid process

2980 qbittorrent.exe
Suspicious behavior: LoadsDriver 3 IoCs

Processes:

fltmc.exe

pid process

4356 fltmc.exe
656
656
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

Processes:

chrome.exe

pid process

2660 chrome.exe
2660 chrome.exe
2660 chrome.exe
2660 chrome.exe
2660 chrome.exe
2660 chrome.exe
2660 chrome.exe
2660 chrome.exe
2660 chrome.exe
2660 chrome.exe
2660 chrome.exe
2660 chrome.exe

pid	process
2980	qbittorrent.exe

pid	process
4356	fltmc.exe
656
656

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	2660	chrome.exe
Token: SeCreatePagefilePrivilege	2660	chrome.exe
Token: SeShutdownPrivilege	2660	chrome.exe
Token: SeCreatePagefilePrivilege	2660	chrome.exe
Token: SeShutdownPrivilege	2660	chrome.exe
Token: SeCreatePagefilePrivilege	2660	chrome.exe
Token: SeShutdownPrivilege	2660	chrome.exe
Token: SeCreatePagefilePrivilege	2660	chrome.exe
Token: SeShutdownPrivilege	2660	chrome.exe
Token: SeCreatePagefilePrivilege	2660	chrome.exe
Token: SeShutdownPrivilege	2660	chrome.exe
Token: SeCreatePagefilePrivilege	2660	chrome.exe
Token: SeShutdownPrivilege	2660	chrome.exe
Token: SeCreatePagefilePrivilege	2660	chrome.exe
Token: SeShutdownPrivilege	2660	chrome.exe
Token: SeCreatePagefilePrivilege	2660	chrome.exe
Token: SeShutdownPrivilege	2660	chrome.exe
Token: SeCreatePagefilePrivilege	2660	chrome.exe
Token: SeShutdownPrivilege	2660	chrome.exe
Token: SeCreatePagefilePrivilege	2660	chrome.exe
Token: SeShutdownPrivilege	2660	chrome.exe
Token: SeCreatePagefilePrivilege	2660	chrome.exe
Token: SeShutdownPrivilege	2660	chrome.exe
Token: SeCreatePagefilePrivilege	2660	chrome.exe
Token: SeShutdownPrivilege	2660	chrome.exe
Token: SeCreatePagefilePrivilege	2660	chrome.exe
Token: SeShutdownPrivilege	2660	chrome.exe
Token: SeCreatePagefilePrivilege	2660	chrome.exe
Token: SeShutdownPrivilege	2660	chrome.exe
Token: SeCreatePagefilePrivilege	2660	chrome.exe
Token: SeShutdownPrivilege	2660	chrome.exe
Token: SeCreatePagefilePrivilege	2660	chrome.exe
Token: SeShutdownPrivilege	2660	chrome.exe
Token: SeCreatePagefilePrivilege	2660	chrome.exe
Token: SeShutdownPrivilege	2660	chrome.exe
Token: SeCreatePagefilePrivilege	2660	chrome.exe
Token: SeShutdownPrivilege	2660	chrome.exe
Token: SeCreatePagefilePrivilege	2660	chrome.exe
Token: SeShutdownPrivilege	2660	chrome.exe
Token: SeCreatePagefilePrivilege	2660	chrome.exe
Token: SeShutdownPrivilege	2660	chrome.exe
Token: SeCreatePagefilePrivilege	2660	chrome.exe
Token: SeShutdownPrivilege	2660	chrome.exe
Token: SeCreatePagefilePrivilege	2660	chrome.exe
Token: SeShutdownPrivilege	2660	chrome.exe
Token: SeCreatePagefilePrivilege	2660	chrome.exe
Token: SeShutdownPrivilege	2660	chrome.exe
Token: SeCreatePagefilePrivilege	2660	chrome.exe
Token: SeShutdownPrivilege	2660	chrome.exe
Token: SeCreatePagefilePrivilege	2660	chrome.exe
Token: SeShutdownPrivilege	2660	chrome.exe
Token: SeCreatePagefilePrivilege	2660	chrome.exe
Token: SeShutdownPrivilege	2660	chrome.exe
Token: SeCreatePagefilePrivilege	2660	chrome.exe
Token: SeShutdownPrivilege	2660	chrome.exe
Token: SeCreatePagefilePrivilege	2660	chrome.exe
Token: SeShutdownPrivilege	2660	chrome.exe
Token: SeCreatePagefilePrivilege	2660	chrome.exe
Token: SeShutdownPrivilege	2660	chrome.exe
Token: SeCreatePagefilePrivilege	2660	chrome.exe
Token: SeShutdownPrivilege	2660	chrome.exe
Token: SeCreatePagefilePrivilege	2660	chrome.exe
Token: SeShutdownPrivilege	2660	chrome.exe
Token: SeCreatePagefilePrivilege	2660	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exePlanet Coaster_pG-3BF1.tmpqbittorrent.exersAppUI.exersAppUI.exe

pid	process
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
4956	Planet Coaster_pG-3BF1.tmp
2980	qbittorrent.exe
2980	qbittorrent.exe
2980	qbittorrent.exe
2980	qbittorrent.exe
2980	qbittorrent.exe
2980	qbittorrent.exe
2980	qbittorrent.exe
2980	qbittorrent.exe
2980	qbittorrent.exe
8080	rsAppUI.exe
8080	rsAppUI.exe
8080	rsAppUI.exe
8080	rsAppUI.exe
8080	rsAppUI.exe
8328	rsAppUI.exe
8328	rsAppUI.exe
8328	rsAppUI.exe
8328	rsAppUI.exe
8328	rsAppUI.exe
8328	rsAppUI.exe
8328	rsAppUI.exe
8328	rsAppUI.exe
8328	rsAppUI.exe

Suspicious use of SendNotifyMessage 55 IoCs

Processes:

chrome.exeqbittorrent.exersAppUI.exersAppUI.exersAppUI.exe

pid	process
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2660	chrome.exe
2980	qbittorrent.exe
2980	qbittorrent.exe
2980	qbittorrent.exe
2980	qbittorrent.exe
2980	qbittorrent.exe
2980	qbittorrent.exe
2980	qbittorrent.exe
2980	qbittorrent.exe
2980	qbittorrent.exe
8080	rsAppUI.exe
8080	rsAppUI.exe
8080	rsAppUI.exe
8080	rsAppUI.exe
8080	rsAppUI.exe
8328	rsAppUI.exe
8328	rsAppUI.exe
8328	rsAppUI.exe
8328	rsAppUI.exe
8328	rsAppUI.exe
8328	rsAppUI.exe
8328	rsAppUI.exe
8328	rsAppUI.exe
8328	rsAppUI.exe
8328	rsAppUI.exe
8328	rsAppUI.exe
4140	rsAppUI.exe
4140	rsAppUI.exe
4140	rsAppUI.exe
4140	rsAppUI.exe
4140	rsAppUI.exe
4140	rsAppUI.exe

Suspicious use of SetWindowsHookEx 9 IoCs

Processes:

qbittorrent.exeqbittorrent.exe

pid process

2980 qbittorrent.exe
2980 qbittorrent.exe
2980 qbittorrent.exe
2980 qbittorrent.exe
2980 qbittorrent.exe
2980 qbittorrent.exe
2980 qbittorrent.exe
2980 qbittorrent.exe
6876 qbittorrent.exe

pid	process
2980	qbittorrent.exe
2980	qbittorrent.exe
2980	qbittorrent.exe
2980	qbittorrent.exe
2980	qbittorrent.exe
2980	qbittorrent.exe
2980	qbittorrent.exe
2980	qbittorrent.exe
6876	qbittorrent.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 2660 wrote to memory of 544	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 544	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 4980	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 4980	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 4980	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 4980	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 4980	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 4980	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 4980	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 4980	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 4980	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 4980	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 4980	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 4980	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 4980	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 4980	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 4980	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 4980	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 4980	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 4980	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 4980	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 4980	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 4980	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 4980	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 4980	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 4980	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 4980	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 4980	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 4980	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 4980	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 4980	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 4980	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 4980	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 4320	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 4320	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 1688	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 1688	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 1688	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 1688	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 1688	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 1688	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 1688	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 1688	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 1688	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 1688	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 1688	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 1688	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 1688	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 1688	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 1688	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 1688	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 1688	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 1688	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 1688	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 1688	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 1688	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 1688	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 1688	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 1688	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 1688	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 1688	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 1688	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 1688	2660	chrome.exe	chrome.exe
PID 2660 wrote to memory of 1688	2660	chrome.exe	chrome.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://google.es
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2660

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbead8ab58,0x7ffbead8ab68,0x7ffbead8ab78
2⤵
PID:544

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1592 --field-trial-handle=1904,i,15595179545010925282,8867062253420378467,131072 /prefetch:2
2⤵
PID:4980

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2012 --field-trial-handle=1904,i,15595179545010925282,8867062253420378467,131072 /prefetch:8
2⤵
PID:4320

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2228 --field-trial-handle=1904,i,15595179545010925282,8867062253420378467,131072 /prefetch:8
2⤵
PID:1688

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=1588 --field-trial-handle=1904,i,15595179545010925282,8867062253420378467,131072 /prefetch:1
2⤵
PID:2976

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2912 --field-trial-handle=1904,i,15595179545010925282,8867062253420378467,131072 /prefetch:1
2⤵
PID:3368

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4332 --field-trial-handle=1904,i,15595179545010925282,8867062253420378467,131072 /prefetch:1
2⤵
PID:2820

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4500 --field-trial-handle=1904,i,15595179545010925282,8867062253420378467,131072 /prefetch:8
2⤵
PID:4180

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4472 --field-trial-handle=1904,i,15595179545010925282,8867062253420378467,131072 /prefetch:8
2⤵
PID:5032

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4840 --field-trial-handle=1904,i,15595179545010925282,8867062253420378467,131072 /prefetch:1
2⤵
PID:1980

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4896 --field-trial-handle=1904,i,15595179545010925282,8867062253420378467,131072 /prefetch:1
2⤵
PID:3784

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5112 --field-trial-handle=1904,i,15595179545010925282,8867062253420378467,131072 /prefetch:1
2⤵
PID:4132

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3224 --field-trial-handle=1904,i,15595179545010925282,8867062253420378467,131072 /prefetch:1
2⤵
PID:1892

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 --field-trial-handle=1904,i,15595179545010925282,8867062253420378467,131072 /prefetch:8
2⤵
PID:1596

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5064 --field-trial-handle=1904,i,15595179545010925282,8867062253420378467,131072 /prefetch:1
2⤵
PID:2204

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4940 --field-trial-handle=1904,i,15595179545010925282,8867062253420378467,131072 /prefetch:1
2⤵
PID:1712

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 --field-trial-handle=1904,i,15595179545010925282,8867062253420378467,131072 /prefetch:8
2⤵
PID:1380

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=1720 --field-trial-handle=1904,i,15595179545010925282,8867062253420378467,131072 /prefetch:1
2⤵
PID:1500

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=4432 --field-trial-handle=1904,i,15595179545010925282,8867062253420378467,131072 /prefetch:1
2⤵
PID:3464

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1720 --field-trial-handle=1904,i,15595179545010925282,8867062253420378467,131072 /prefetch:8
2⤵
PID:4644

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5476 --field-trial-handle=1904,i,15595179545010925282,8867062253420378467,131072 /prefetch:8
2⤵
PID:2720

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5520 --field-trial-handle=1904,i,15595179545010925282,8867062253420378467,131072 /prefetch:8
2⤵
PID:4376

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=5812 --field-trial-handle=1904,i,15595179545010925282,8867062253420378467,131072 /prefetch:1
2⤵
PID:1364

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 --field-trial-handle=1904,i,15595179545010925282,8867062253420378467,131072 /prefetch:8
2⤵
PID:3636

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4496 --field-trial-handle=1904,i,15595179545010925282,8867062253420378467,131072 /prefetch:8
2⤵
PID:5000

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5792 --field-trial-handle=1904,i,15595179545010925282,8867062253420378467,131072 /prefetch:8
2⤵
PID:4772

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 --field-trial-handle=1904,i,15595179545010925282,8867062253420378467,131072 /prefetch:8
2⤵
PID:2864

C:\Users\Admin\Downloads\Planet Coaster_pG-3BF1.exe
"C:\Users\Admin\Downloads\Planet Coaster_pG-3BF1.exe"
2⤵
- Executes dropped EXE
PID:3628

C:\Users\Admin\AppData\Local\Temp\is-LSB5N.tmp\Planet Coaster_pG-3BF1.tmp
"C:\Users\Admin\AppData\Local\Temp\is-LSB5N.tmp\Planet Coaster_pG-3BF1.tmp" /SL5="$110028,13603942,780800,C:\Users\Admin\Downloads\Planet Coaster_pG-3BF1.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:4956

C:\Users\Admin\AppData\Local\Temp\is-PJ5FE.tmp\prod0.exe
"C:\Users\Admin\AppData\Local\Temp\is-PJ5FE.tmp\prod0.exe" -ip:"dui=50b25195-d6c8-43bb-b2ca-a8bd616967ef&dit=20240702140325&is_silent=true&oc=ZB_RAV_Cross_Tri_NCB&p=d267&a=100&b=ch&se=true" -vp:"dui=50b25195-d6c8-43bb-b2ca-a8bd616967ef&dit=20240702140325&oc=ZB_RAV_Cross_Tri_NCB&p=d267&a=100&oip=26&ptl=7&dta=true" -dp:"dui=50b25195-d6c8-43bb-b2ca-a8bd616967ef&dit=20240702140325&oc=ZB_RAV_Cross_Tri_NCB&p=d267&a=100" -i -v -d -se=true
4⤵
- Checks computer location settings
- Executes dropped EXE
PID:3684

C:\Users\Admin\AppData\Local\Temp\dglgchzt.exe
"C:\Users\Admin\AppData\Local\Temp\dglgchzt.exe" /silent
5⤵
- Executes dropped EXE
PID:4624

C:\Users\Admin\AppData\Local\Temp\7zS012BFE98\UnifiedStub-installer.exe
.\UnifiedStub-installer.exe /silent
6⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:3972

C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe
"C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe" -i -bn:ReasonLabs -pn:EPP -lpn:rav_antivirus -url:https://update.reasonsecurity.com/v2/live -dt:10
7⤵
- Executes dropped EXE
PID:1552

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" setupapi.dll,InstallHinfSection DefaultInstall 128 C:\Program Files\ReasonLabs\EPP\x64\rsKernelEngine.inf
7⤵
- Adds Run key to start application
PID:6764

C:\Windows\system32\runonce.exe
"C:\Windows\system32\runonce.exe" -r
8⤵
- Checks processor information in registry
PID:2224

C:\Windows\System32\grpconv.exe
"C:\Windows\System32\grpconv.exe" -o
9⤵
PID:532

C:\Windows\system32\wevtutil.exe
"C:\Windows\system32\wevtutil.exe" im C:\Program Files\ReasonLabs\EPP\x64\rsKernelEngineEvents.xml
7⤵
PID:5396

C:\Windows\SYSTEM32\fltmc.exe
"fltmc.exe" load rsKernelEngine
7⤵
- Suspicious behavior: LoadsDriver
PID:4356

C:\Windows\system32\wevtutil.exe
"C:\Windows\system32\wevtutil.exe" im C:\Program Files\ReasonLabs\EPP\elam\evntdrv.xml
7⤵
PID:5464

C:\Program Files\ReasonLabs\EPP\rsWSC.exe
"C:\Program Files\ReasonLabs\EPP\rsWSC.exe" -i -i
7⤵
- Executes dropped EXE
- Modifies system certificate store
PID:1864

C:\Program Files\ReasonLabs\EPP\rsClientSvc.exe
"C:\Program Files\ReasonLabs\EPP\rsClientSvc.exe" -i -i
7⤵
- Executes dropped EXE
PID:5996

C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe
"C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe" -i -i
7⤵
- Executes dropped EXE
- Modifies system certificate store
PID:5680

C:\Program Files\ReasonLabs\EDR\rsEDRSvc.exe
"C:\Program Files\ReasonLabs\EDR\rsEDRSvc.exe" -i -i
7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5528

C:\Program Files\ReasonLabs\VPN\rsVPNClientSvc.exe
"C:\Program Files\ReasonLabs\VPN\rsVPNClientSvc.exe" -i -i
7⤵
- Executes dropped EXE
PID:6872

C:\Program Files\ReasonLabs\VPN\rsVPNSvc.exe
"C:\Program Files\ReasonLabs\VPN\rsVPNSvc.exe" -i -i
7⤵
- Executes dropped EXE
PID:5312

\??\c:\windows\system32\rundll32.exe
"c:\windows\system32\rundll32.exe" setupapi.dll,InstallHinfSection DefaultInstall 128 C:\Program Files\ReasonLabs\DNS\rsDwf.inf
7⤵
- Adds Run key to start application
PID:5764

C:\Windows\system32\runonce.exe
"C:\Windows\system32\runonce.exe" -r
8⤵
- Checks processor information in registry
PID:5308

C:\Windows\System32\grpconv.exe
"C:\Windows\System32\grpconv.exe" -o
9⤵
PID:8512

C:\Program Files\ReasonLabs\DNS\rsDNSClientSvc.exe
"C:\Program Files\ReasonLabs\DNS\rsDNSClientSvc.exe" -i -i
7⤵
- Executes dropped EXE
PID:2424

C:\Program Files\ReasonLabs\DNS\rsDNSResolver.exe
"C:\Program Files\ReasonLabs\DNS\rsDNSResolver.exe" -i -service install
7⤵
- Executes dropped EXE
PID:6296

C:\Program Files\ReasonLabs\DNS\rsDNSResolver.exe
"C:\Program Files\ReasonLabs\DNS\rsDNSResolver.exe" -service install
7⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:6788

C:\Program Files\ReasonLabs\DNS\rsDNSSvc.exe
"C:\Program Files\ReasonLabs\DNS\rsDNSSvc.exe" -i -i
7⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5560

C:\Windows\SysWOW64\netsh.exe
"netsh" firewall add allowedprogramC:\Users\Admin\AppData\Local\Temp\is-PJ5FE.tmp\qbittorrent.exe "qBittorrent" ENABLE
4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:1448

C:\Users\Admin\AppData\Local\Temp\is-PJ5FE.tmp\qbittorrent.exe
"C:\Users\Admin\AppData\Local\Temp\is-PJ5FE.tmp\qbittorrent.exe" magnet:?xt=urn:btih:C1E63DF4D4FB2165C2CD3F68FD509EE0B82C3614
4⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2980

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1672 --field-trial-handle=1904,i,15595179545010925282,8867062253420378467,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5268

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:2112

C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe
"C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe" -pn:EPP -lpn:rav_antivirus -url:https://update.reasonsecurity.com/v2/live -bn:ReasonLabs -dt:10
1⤵
- Executes dropped EXE
PID:4332

C:\Program Files\ReasonLabs\EPP\rsWSC.exe
"C:\Program Files\ReasonLabs\EPP\rsWSC.exe"
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4108

C:\Program Files\ReasonLabs\EPP\rsClientSvc.exe
"C:\Program Files\ReasonLabs\EPP\rsClientSvc.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2012

C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe
"C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe"
1⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:5444

\??\c:\program files\reasonlabs\epp\rsHelper.exe
"c:\program files\reasonlabs\epp\rsHelper.exe"
2⤵
- Executes dropped EXE
PID:7204

\??\c:\program files\reasonlabs\EPP\ui\EPP.exe
"c:\program files\reasonlabs\EPP\ui\EPP.exe" --minimized --first-run
2⤵
- Executes dropped EXE
PID:8292

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe
"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" "c:\program files\reasonlabs\EPP\ui\app.asar" --engine-path="c:\program files\reasonlabs\EPP" --minimized --first-run
3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:8328

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe
"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\EPP" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2244 --field-trial-handle=2248,i,16116826954084441056,11149565270909310435,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:7596

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe
"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\EPP" --standard-schemes=mc --secure-schemes=mc --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=2704 --field-trial-handle=2248,i,16116826954084441056,11149565270909310435,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5500

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe
"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\EPP" --standard-schemes=mc --secure-schemes=mc --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-user-model-id=com.reasonlabs.epp --app-path="C:\Program Files\ReasonLabs\Common\Client\v1.4.2\resources\app.asar" --enable-sandbox --first-renderer-process --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2828 --field-trial-handle=2248,i,16116826954084441056,11149565270909310435,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:8872

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe
"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\EPP" --standard-schemes=mc --secure-schemes=mc --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-user-model-id=com.reasonlabs.epp --app-path="C:\Program Files\ReasonLabs\Common\Client\v1.4.2\resources\app.asar" --enable-sandbox --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3844 --field-trial-handle=2248,i,16116826954084441056,11149565270909310435,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:3964

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe
"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\EPP" --standard-schemes=mc --secure-schemes=mc --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-user-model-id=com.reasonlabs.epp --app-path="C:\Program Files\ReasonLabs\Common\Client\v1.4.2\resources\app.asar" --enable-sandbox --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4196 --field-trial-handle=2248,i,16116826954084441056,11149565270909310435,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:7008

C:\program files\reasonlabs\epp\rsLitmus.A.exe
"C:\program files\reasonlabs\epp\rsLitmus.A.exe"
2⤵
- Executes dropped EXE
PID:7216

C:\Program Files\ReasonLabs\EDR\rsEDRSvc.exe
"C:\Program Files\ReasonLabs\EDR\rsEDRSvc.exe"
1⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Checks system information in the registry
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies system certificate store
PID:7004

C:\Program Files\ReasonLabs\VPN\rsVPNClientSvc.exe
"C:\Program Files\ReasonLabs\VPN\rsVPNClientSvc.exe"
1⤵
- Executes dropped EXE
PID:5168

C:\Program Files\ReasonLabs\VPN\rsVPNSvc.exe
"C:\Program Files\ReasonLabs\VPN\rsVPNSvc.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1552

\??\c:\program files\reasonlabs\VPN\ui\VPN.exe
"c:\program files\reasonlabs\VPN\ui\VPN.exe" --minimized --focused --first-run
2⤵
- Executes dropped EXE
PID:8056

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe
"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" "c:\program files\reasonlabs\VPN\ui\app.asar" --engine-path="c:\program files\reasonlabs\VPN" --minimized --focused --first-run
3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:8080

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe
"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\VPN" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2236 --field-trial-handle=2244,i,2770029850964960733,9507212964929719070,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:8692

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe
"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\VPN" --mojo-platform-channel-handle=2548 --field-trial-handle=2244,i,2770029850964960733,9507212964929719070,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:8824

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe
"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\VPN" --app-user-model-id=com.reasonlabs.vpn --app-path="C:\Program Files\ReasonLabs\Common\Client\v1.4.2\resources\app.asar" --enable-sandbox --first-renderer-process --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2792 --field-trial-handle=2244,i,2770029850964960733,9507212964929719070,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:9108

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe
"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\VPN" --app-user-model-id=com.reasonlabs.vpn --app-path="C:\Program Files\ReasonLabs\Common\Client\v1.4.2\resources\app.asar" --enable-sandbox --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3792 --field-trial-handle=2244,i,2770029850964960733,9507212964929719070,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:7792

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4644

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:8212

C:\Users\Admin\Downloads\Planet Coaster_pG-3BF1.exe
"C:\Users\Admin\Downloads\Planet Coaster_pG-3BF1.exe"
1⤵
- Executes dropped EXE
PID:3900

C:\Users\Admin\AppData\Local\Temp\is-75CEC.tmp\Planet Coaster_pG-3BF1.tmp
"C:\Users\Admin\AppData\Local\Temp\is-75CEC.tmp\Planet Coaster_pG-3BF1.tmp" /SL5="$50332,13603942,780800,C:\Users\Admin\Downloads\Planet Coaster_pG-3BF1.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Checks processor information in registry
PID:6336

C:\Windows\SysWOW64\netsh.exe
"netsh" firewall add allowedprogramC:\Users\Admin\AppData\Local\Temp\is-2OI99.tmp\qbittorrent.exe "qBittorrent" ENABLE
3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:5584

C:\Users\Admin\AppData\Local\Temp\is-2OI99.tmp\qbittorrent.exe
"C:\Users\Admin\AppData\Local\Temp\is-2OI99.tmp\qbittorrent.exe" magnet:?xt=urn:btih:C1E63DF4D4FB2165C2CD3F68FD509EE0B82C3614
3⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:6876

C:\Program Files\ReasonLabs\DNS\rsDNSClientSvc.exe
"C:\Program Files\ReasonLabs\DNS\rsDNSClientSvc.exe"
1⤵
- Executes dropped EXE
PID:6784

C:\Program Files\ReasonLabs\DNS\rsDNSResolver.exe
"C:\Program Files\ReasonLabs\DNS\rsDNSResolver.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:7772

C:\Program Files\ReasonLabs\DNS\rsDNSSvc.exe
"C:\Program Files\ReasonLabs\DNS\rsDNSSvc.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:8108

\??\c:\program files\reasonlabs\DNS\ui\DNS.exe
"c:\program files\reasonlabs\DNS\ui\DNS.exe" --minimized --focused --first-run
2⤵
- Executes dropped EXE
PID:5304

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe
"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" "c:\program files\reasonlabs\DNS\ui\app.asar" --engine-path="c:\program files\reasonlabs\DNS" --minimized --focused --first-run
3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SendNotifyMessage
PID:4140

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe
"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\DNS" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2256 --field-trial-handle=2260,i,17953528525458659063,6333850963569677914,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2236

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe
"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\DNS" --mojo-platform-channel-handle=2608 --field-trial-handle=2260,i,17953528525458659063,6333850963569677914,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:8144

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe
"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\DNS" --app-user-model-id=com.reasonlabs.dns --app-path="C:\Program Files\ReasonLabs\Common\Client\v1.4.2\resources\app.asar" --enable-sandbox --first-renderer-process --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2740 --field-trial-handle=2260,i,17953528525458659063,6333850963569677914,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:6524

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:8216

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x458 0x460
1⤵
PID:2208

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:5020

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\f1b4949d5912430ca1ffa49e85a838c1 /t 1596 /p 2980
1⤵
PID:5276

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Software Discovery

T1518

Security Software Discovery

T1518.001

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\ReasonLabs\DNS\rsDNSSvc.InstallLog
Filesize
669B

MD5
e37047bc247256654b02753da7426053

SHA1
58c67d6554520543f82a9107689caf305728f88c

SHA256
001410b9d4a97411e00201fe23582bdbde9333852edc43b3afcf6abe2cc048dc

SHA512
5197a43f5c3b440ac3d66fa0ae830565cb4677336b0e5cb9480d66ef46d15866dc42187c8d5e17ce8900b8a698c19e89cdbf8a7021be923765e607334fad97bc

Download Submit
C:\Program Files\ReasonLabs\EDR\InstallUtil.InstallLog
Filesize
731B

MD5
261472b34bf7dc594eb22cb704741e66

SHA1
453f68b2e846b253633acfcf76feb918dd06de40

SHA256
5b00f59add10e321b5e5f734306505bd749aa7c31c2045938cf5541d17e9ad72

SHA512
7e59104be9aeeff831793633861a49ea0b4e8d541c12b471b2b401e57ae413c407c11c2c074154193914ccbd62621800c24dcdf7011a2b08687d9d8931848f79

Download Submit
C:\Program Files\ReasonLabs\EDR\rsEDRSvc.InstallLog
Filesize
415B

MD5
76c107cfb826e971e9c3db6fb440a07c

SHA1
e86194fdd784921d8962eaba98722e628fcb6ef6

SHA256
cc451ee543525ef2a243e436653f6f79dcc3876398d0537c4bb38e8f443b9015

SHA512
ef7ab1da4d93d1dc4692a16cc6e5de9dd4cfa9c7f2a1aa4fa5cfd59df3ff50da04933067e8845befdc5dcf4bae247b822c03316df82c6682a8850f6096c80dc6

Download Submit
C:\Program Files\ReasonLabs\EDR\rsEDRSvc.InstallLog
Filesize
669B

MD5
92ce8ed8e58bb8d09834ab7dd6119f0f

SHA1
8ecb601ce89b5f28a31685fd26eaa8048de8731d

SHA256
ac12e00d314f9b523c29433e756625029cc52cf9e1299eea08eb71b27ec003d3

SHA512
6e66af3b0e03dfc4cd03bcdee3fa53c845088ead0dde97ab4b23fbbc7072d80cd19f72799e9afa75dbd1ac036d2f2a9c49c8bc74bd165e464c313606e396fd6c

Download Submit
C:\Program Files\ReasonLabs\EDR\rsEDRSvc.InstallState
Filesize
7KB

MD5
362ce475f5d1e84641bad999c16727a0

SHA1
6b613c73acb58d259c6379bd820cca6f785cc812

SHA256
1f78f1056761c6ebd8965ed2c06295bafa704b253aff56c492b93151ab642899

SHA512
7630e1629cf4abecd9d3ddea58227b232d5c775cb480967762a6a6466be872e1d57123b08a6179fe1cfbc09403117d0f81bc13724f259a1d25c1325f1eac645b

Download Submit
C:\Program Files\ReasonLabs\EPP\InstallerLib.dll
Filesize
335KB

MD5
5e2b4c627d4afac7b138fb229f3ba8cf

SHA1
7b8b27bfcbc2603f7e10474d3895e6dc821992c0

SHA256
b3df61de305444755aa5c79b4a88f10d5474980db8da0d674856ba158eb1c3b6

SHA512
325d151197bce5ba7a9ba76cdaaf5f9f5a3fc546542e78dc2b3b35337654a65ee2d19d20112d82b496104f148acb6b25e8c3d27a567b5eb6f0b2aa38aa4093ed

Download Submit
C:\Program Files\ReasonLabs\EPP\elam\rsElam.sys
Filesize
19KB

MD5
8129c96d6ebdaebbe771ee034555bf8f

SHA1
9b41fb541a273086d3eef0ba4149f88022efbaff

SHA256
8bcc210669bc5931a3a69fc63ed288cb74013a92c84ca0aba89e3f4e56e3ae51

SHA512
ccd92987da4bda7a0f6386308611afb7951395158fc6d10a0596b0a0db4a61df202120460e2383d2d2f34cbb4d4e33e4f2e091a717d2fc1859ed7f58db3b7a18

Download Submit
C:\Program Files\ReasonLabs\EPP\mc.dll
Filesize
1.1MB

MD5
5761d96590d91fa336c068269a7dbd93

SHA1
5a1b0a8b4f255680a7549b2b27c28dd65a5a3e47

SHA256
7dc02294611987dcffef0d1ce99ff316926901fc872099cbea2fb76997e29f65

SHA512
f8f5743547c96aeb579b7786fc9af64102bef3cf46a6df270cccf5d51a48467d9547732ff49f8d5258e7f28a5bf2d234d3344c2862a5a67f5054de81ec6f4ea2

Download Submit
C:\Program Files\ReasonLabs\EPP\rsClientSvc.exe
Filesize
657KB

MD5
b517d9e1403270cd5923337588a0b542

SHA1
9c46a5d2229a198468b67d51319b4bd1e376dbfd

SHA256
99935ab725fbd1e5426d1950d439baa60e025bba9ef5004f4ada0a9317f519b0

SHA512
b5bb24fac248504c5711fc4ef7890004b58168ca081ad8d3705380120a63c8f106e0beb2d5be085d23da9da4e4772c8db93b8861720ca8498ec8f3c1e3a90b25

Download Submit
C:\Program Files\ReasonLabs\EPP\rsEngine.Core.dll
Filesize
352KB

MD5
b3b1147d7bcff3698ed64b9ca31dd75d

SHA1
cfcfecdfef6103e606e6559920b0164e6ddec856

SHA256
1f260a7cf65d80332a58a16b713570054e83d2d842b17ca76262dedef69922f8

SHA512
8638c0c96ed95c6ce5b00444b7287b0017b2ad1c1aab874b9caa9210fcaf4f7e7a3aac6b261e6e2686b66bbb02d6a68827541bf7a78a922d057a0c0846884614

Download Submit
C:\Program Files\ReasonLabs\EPP\rsEngine.config
Filesize
5KB

MD5
3149ca79d09c362307bed37960f0fd04

SHA1
f5f43f511ef581dc7b88ed194bb8e86e42f45bd3

SHA256
5481ccc72cad44173cdfbf746a701bb79e2b75927ef71aee1226e07e1265d31b

SHA512
d7c519a58bdefd24bcc26ec681b27a72a0aabbf4135d8e47a493abe1e4affd7cb5740b132d445aa9ecf66247de7406d5974557ae671d5977e40d877167b94a70

Download Submit
C:\Program Files\ReasonLabs\EPP\rsEngineSvc.InstallLog
Filesize
265B

MD5
3da14b62d9c5c74f8fe90597a63fd1f2

SHA1
12f2472e5f457edbcfd5b72a1862807a7617bb4f

SHA256
f79f4837b99c0782f2eeb6c7a6193ea407a1cb6f2761e7e8e40ea951f2ad0f52

SHA512
e0c626cace22f2caac7352a827d7476b6cec7e6e86f2bbaa36a00edfe45ed4ad8fd8246ac61799383608626456b59894282e2128240a75e5083e90bc1358beab

Download Submit
C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe
Filesize
358KB

MD5
ac8fb094a802a2770a0470c6215b1184

SHA1
330c57ba3f3b31193651f51bf11c580b151d231d

SHA256
23d54826f6142d40c9008613cfa9e4ea2a49dc3c9eb7f0f9bb706faeca42fc93

SHA512
e6b9a9e6c1143c50625fdbe84307efe2a79495743f77158764c90386163ed2520800ac7db8cfc374b9995e52a876aea39733a95ec2dcb47764ae26cb06b582d2

Download Submit
C:\Program Files\ReasonLabs\EPP\rsWSC.InstallLog
Filesize
247B

MD5
b1889f5917ecbbf8a87e0243d17ea7f7

SHA1
41bea98e7e914a72c05c0997da6d9bba04e4ea25

SHA256
fcc1fa3cbcf44e04a6c1c70460d540cdd2cc17b6aac2fd91c5a6dfda4330ac2c

SHA512
032e3b88fb787a7a914ff9ec9aa4421bd944fd3ba3514991c9c728d94481f5ce1737af35361fd192aa3bea43bfa648eb710f0738d5f6c56158acc30bde0dda61

Download Submit
C:\Program Files\ReasonLabs\EPP\rsWSC.InstallLog
Filesize
642B

MD5
b5b00e949d6c56f996928f715a36c43f

SHA1
41224c5ab89612effc928198cafa06fd71ed29a6

SHA256
aeab1b15b92f5d39c3dc6f84160d977b9f9cc0e0ceb0f80c6ff22b30326206b1

SHA512
036dad6c74c32ee91a0ae5f39348c0901b9352d6b70523b7bb49aafb67fcf743745fccedbbee7aa33be08a09af252c15c918d58dd8361259804161b23ad04f30

Download Submit
C:\Program Files\ReasonLabs\EPP\rsWSC.exe
Filesize
203KB

MD5
449a5c22e748797a6e339942d489bf9e

SHA1
7e9c0c80dd5611b5895e1f96861144b2b89b79af

SHA256
03045643cbac6d3f6b3da1000cc78115ac23f9f157b206cb9da9e7873defef9f

SHA512
dd76ace975b1a0b45f596575b3da96856b2c4da6d785a73290453a975008ea58ec3aaf8c768d10952cb95893e33d56f0a47bd2a92425347a59400a0f5b988307

Download Submit
C:\Program Files\ReasonLabs\EPP\ui\EPP.exe
Filesize
2.2MB

MD5
09e2401f12f54289c04af17d90f0798f

SHA1
2f95c7a2684338f5fc66b0c20e148b2a9938b154

SHA256
3efd3ea030a60cf4c5e0c6b93fdd24f1743e56cecd3a30329375ff80ef47091d

SHA512
8337b3f7bb29f546eaefe9adb8b7674007176c0f6d429d9b51df7eacf41b09042359d028ded0c934f71ce11e308252b86846027e10e07529327a451cfe7c2206

Download Submit
C:\Program Files\ReasonLabs\EPP\x64\rsKernelEngine.inf
Filesize
2KB

MD5
e8ef8570898c8ed883b4f9354d8207ae

SHA1
5cc645ef9926fd6a3e85dbc87d62e7d62ab8246d

SHA256
edc8579dea9faf89275f0a0babea442ed1c6dcc7b4f436424e6e495c6805d988

SHA512
971dd20773288c7d68fb19b39f9f5ed4af15868ba564814199d149c32f6e16f1fd3da05de0f3c2ada02c0f3d1ff665b1b7d13ce91d2164e01b77ce1a125de397

Download Submit
C:\Program Files\ReasonLabs\VPN\InstallerLib.dll
Filesize
304KB

MD5
7f71e17ea818a034696f00eb6af48da8

SHA1
2b56401c7a8b5025cda775a2cde652c13a91a768

SHA256
acfba0c2c37c62b4101adc68a12d1f5499e0ba66ccaa834ab07736705e0277db

SHA512
4f2957bdbe473badf22c78050175201dad3ee25c4d86483288aab9a8b72daef5ef2fac2d9939efd843dccbace27052a447c9e6a31a24443e3f3678f764080246

Download Submit
C:\Program Files\ReasonLabs\VPN\Uninstall.exe
Filesize
197KB

MD5
410d4e81be560d860339e12ac63acb68

SHA1
06a9f74874c76eba0110cdd720dd1e66aa9c271a

SHA256
e4a8d1e07f851be8070dd9b74255e9dd8b49262c338bfb6ef1537edd8f088498

SHA512
4bbffeef276ce9b8fdd6d767ba00066309eee0f65e49cea999d48d1e8688c73d7011ed1301a668c69814457caad3981167a1e3fe2021329dd8fc05659103fb3a

Download Submit
C:\Program Files\ReasonLabs\VPN\rsEngine.Core.dll
Filesize
341KB

MD5
68c793ef8708fb328cb3e9c3c3b98711

SHA1
cc6c6eb33a90a812f40dbe2b483a79bec0c50bca

SHA256
87127bcfbcc382944e82f396d6764ef9e8f063ac8455dbae71b2ddafbda0adb3

SHA512
518293df2992ed9bdfa7857e5528a589340b23f1a9391b5497cf0690fc1a79c10c66f382c27da793645a8901356ab5270b009b085a98b3308926848713c90e00

Download Submit
C:\Program Files\ReasonLabs\VPN\rsEngine.config
Filesize
4KB

MD5
9958dec97033b479f02b293f7cf9eba4

SHA1
5732243fc6e984e06c20c87471a7ba662b726b6f

SHA256
37dbfcbab97b7ca9b6d6195fb76a257e7b927af26e86405e462f3a961f4c2adb

SHA512
5565df09d6da0dfbe06f4ee73d4dd4a41165ebeeec3d9b58c03fe0e57ecbbf96e5dc78fcbf2ab4eb9b7cb1295fce1372b7ce178c9713937cf1220c1ba3089433

Download Submit
C:\Program Files\ReasonLabs\VPN\rsVPNSvc.InstallLog
Filesize
415B

MD5
8bef4573029cc3ee91ed78ae7e47750c

SHA1
10433355fd3b18348fa2c5ebdb4c1439e8c8d2c8

SHA256
bee7dc53239dbc6cf741dc6d46a585afa4a6c0653884ecef7c85c9876e871c71

SHA512
e2d2bf1f1fc6932b4c1080cc8df1ee5ff41074f29dacc9096a4709e1fd300b08dd9c9f6472390da3016ff290c97f557dc8ce279d860efc0eeb6fef72f2520dee

Download Submit
C:\Program Files\ReasonLabs\VPN\rsVPNSvc.InstallLog
Filesize
669B

MD5
ccd998f886ab487c3e070861101eb2fe

SHA1
eaea7bf8ee623dba71a63e1fba0c50ac66ad3cd4

SHA256
eacc65689a0c208f8922637415b2343b03bbdae3d3476bf40e29dbe7ee95c065

SHA512
ff97b2ca5824cb72b51cea48abc56319653bc55dad77cc167c88d92ca2b31d8dc14f567989703eb564213dadcfe39090aa7db8be4a883bb6c677a70fdbcc3601

Download Submit
C:\Program Files\ReasonLabs\VPN\ui\VPN.exe
Filesize
431KB

MD5
5aeb9093ed4db14fffd31c64428f7542

SHA1
5e6769b3e47d22896b64480b4e026733cf44be63

SHA256
153a96a3255147fdb0abb6b1236b7c4e5ef23447a5fbf53137b9bdbc4d556a32

SHA512
c3e78cacf3fc246a08abada3606fffd323cdc14c822a85796bb3f27b8bb13a559a0d65d9f2d80718a59052414aa66d621b08c9a2c1231be6563dae17f74a4910

Download Submit
C:\ProgramData\ReasonLabs\EPP\SignaturesYF.dat.tmp
Filesize
5.1MB

MD5
d13bddae18c3ee69e044ccf845e92116

SHA1
31129f1e8074a4259f38641d4f74f02ca980ec60

SHA256
1fac07374505f68520aa60852e3a3a656449fceacb7476df7414c73f394ad9e0

SHA512
70b2b752c2a61dcf52f0aadcd0ab0fdf4d06dc140aee6520a8c9d428379deb9fdcc101140c37029d2bac65a6cfcf5ed4216db45e4a162acbc7c8c8b666cd15dd

Download Submit
C:\ProgramData\ReasonLabs\EPP\SignaturesYFS.dat.tmp
Filesize
2.9MB

MD5
10a8f2f82452e5aaf2484d7230ec5758

SHA1
1bf814ddace7c3915547c2085f14e361bbd91959

SHA256
97bffb5fc024494f5b4ad1e50fdb8fad37559c05e5d177107895de0a1741b50b

SHA512
6df8953699e8f5ccff900074fd302d5eb7cad9a55d257ac1ef2cb3b60ba1c54afe74aee62dc4b06b3f6edf14617c2d236749357c5e80c5a13d4f9afcb4efa097

Download Submit
C:\ProgramData\ReasonLabs\EPP\SignaturesYS.dat.tmp
Filesize
550KB

MD5
afb68bc4ae0b7040878a0b0c2a5177de

SHA1
ed4cac2f19b504a8fe27ad05805dd03aa552654e

SHA256
76e6f11076cc48eb453abbdbd616c1c46f280d2b4c521c906adf12bb3129067b

SHA512
ebc4c1f2da977d359791859495f9e37b05491e47d39e88a001cb6f2b7b1836b1470b6904c026142c2b1b4fe835560017641d6810a7e8a5c89766e55dd26e8c43

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\2177d2a3-6bcc-4afb-af10-539d29ecceb3.tmp
Filesize
138KB

MD5
2e9b8cbbc71bc7682e9825016a7ab0ce

SHA1
e519fe2775931d41799c63288d25fa0f588b6e27

SHA256
949324d1626d3e4c7cf04da380d11bf233eed871c5764db5c9c74e6c52ae0eef

SHA512
89258074f0bc0efc013bb537547f3f31721ee030ad1c081ecd6c1444a865d9ec4bb1ea083a85eefbfb2e7bc5c08b3710b51f93154144f969a62ffd6cdcd87773

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
3KB

MD5
774b473438d0a16315ccecf513560340

SHA1
99046342ee02332056776b96392868b217ffcc99

SHA256
bba19d71c1bcce3833ef1b59c11d097b54c6b022c6507dfe7e2aad3fa0e89d28

SHA512
4f1dcee4b0373a965bbc520576be2855826b8e795fb97d18e5a7b11bad2f8d7cf9834e660cb495b86b19aadbf371a335f076d6860aa92818d28eeb692887fc3f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_lujsn.dwhitdoedsrag.org_0.indexeddb.leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_lujsn.dwhitdoedsrag.org_0.indexeddb.leveldb\MANIFEST-000001
Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
11KB

MD5
5bc387c8c6ae508e1ec10fb68b29cdf9

SHA1
4dba5cd35ab272fa8a2b870cc20aaabfc4699d4b

SHA256
bda72a31b0484d85d1ea2ecd3155b6869062bc49b6a8500d67bcf4106aafbeb5

SHA512
57a054252aad6bb5d17131c43cf8441b0674eed1056c7ef2c1bc2e395a9d17e89e03f4120fccb185ff4500c7a1c8561ced9e89afe9985559c83f065dfc715939

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
9KB

MD5
b244dbb48155027e4d59ba05d05603f6

SHA1
92e45b4b1cd4f70735951a924ccb598cddfaff3a

SHA256
625fbc5ad11578b315ac1beedbc30e3db22386d209849b15b9a3e81fe46272dd

SHA512
bbaf9fbbf123c0df74bea882ba9dc22497629facfc8f9ad4fc731e5edc50d487ea49f809690fc9744c43dcf53aae666ae3fd0da36d72890c30fe0e3063bfdae9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
524B

MD5
70cfaef80f0ed5e3a081903ae610499e

SHA1
83bf18feb6544b14a17e502a9b2e96c6e6b127a5

SHA256
0b64a634d87191f6ee756888bec00bda08b9071303f98bd9f9a195a3b93ea259

SHA512
7daa6d80f6bfea90d4613ecce1caf963eb6f6d80ec947993127abd1602e54aca41f9cd26fb9475520ce04d650fec1f6f5f9da7d279294bf0dbbd8eef8782a0b2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
35beb040189b2807521e6e224ee71c92

SHA1
08d562a2f3018425f5ca40be7108719ad987f9d0

SHA256
e2039bda115bb627e1aac4c0dcbf1bae2d17cd3bea1d27cf7acec249aed74c21

SHA512
1fd3330eed01493d323a5a58172a79d491bdccb46c67e057501e25495fa1e507da4103c71c9fb7e7214684832b044c46a23af5462453bf4d31747923a9fddb6f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
692B

MD5
85e1e989bad509400a174a6e7ee3739f

SHA1
55660be8549a568aeefd8b9c47b8679ad13d00f0

SHA256
16d45ae377bb861d799f0c49bd5f6d435fc95d41b80ad93b0aa4b437b7292aea

SHA512
e55cf4ba758c405ddb02008a3923ca2a85d38e9a660160da2b5062af01f701aa36df9e624a688450f399f1cede43ba071d16cb8b084d92433aa9e41adb125036

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
989dbc528b91d57fd47e7934cc5bdfdc

SHA1
1856fd6497b6bbffca9df1e0a4346a83239cb793

SHA256
d9df7de049cfcd22f60f06db34ffdc1f07b2b4dd066ef16268d9d918a39bf8d1

SHA512
87d20d5e2c3da23705191dca7dd0e541f0159cf2339468692419a20d1275da8f0a695d5eaab35d8fae9e6c48718efe4ff2511628a4def2fa3a9a213166f6ea03

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
60233d4b87cb739eb50fcfdc4b605c88

SHA1
d02ffa2672289e000f843101f961ed58dd4958d9

SHA256
ff733fe3bd7b7d4fd294d73e2964fcf4b9a9ded33842223ad48c8658a42ba66c

SHA512
725313de89bf1887cf9becbb79dcadcaa488584864fb77ab543deaa39c14b6420b75a2adf3aa1009c7a04fd33059dcd03c577d0e20ce1141a95b94733e179c0f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
626351b960f82ffdf68cd11356d6dd1f

SHA1
251027adf69400a244d192e0b582b7e9823af7b3

SHA256
55536b2ebe2520b3cedf4ef67993f7adbe42e7c0b3676a7203ae602fdd14a86c

SHA512
81dff83e38c80d65805bc95e8a091c75594a58ffafe3b2b2f90c944526f632d8dbf3ce5904f33cf31bb20668596d01fc49a4f6c8eb269a892b5e638ac1c87f09

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
8KB

MD5
a614dd0976fedc816fbb7d1b30e813dc

SHA1
0f47c015d560620ab85c64db688d135defbf07ee

SHA256
e7d804a39f150f1d2aeaf069a406e233f1d41539796ad71149d0fd0c83fcf1af

SHA512
5d9d4dda0b6203dc30ed6ccacd0b377d883408a9138a2008f2c56612bdbfe3ca0257a3d2ac6bf461f366ce18b629fed6cb54052f0d9d4184f0ae6825ccfe6919

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
c4aef78b2cf66429dc2157ce039cc2c5

SHA1
8dfc5e02afb6c2b174df5aa465b16307c3d4a4fd

SHA256
3918a0d30796e7349fc527cbd90d768615e49e6f35061649f709ade0704867f3

SHA512
0792f9dc4217932e07d6b2df483ad963e0859249ee9532ad3a1090afa627779d7c53a1dd4399270a2b868b241c96b12eca0e1067c2104b6f783cdcb25e9b64d7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
be72354a627ff459b8bd7ebbcf0bbf9e

SHA1
3834ab9da678974aa1ab4eb26776c92bfd1c4e24

SHA256
0b4078645b9a9f951a7614fae3905e362d09150061d0fb8ce1adc13ece00971b

SHA512
865be5de73fca0fa669c5fc6553c5f64bb5dba15cd790b8384edb319451cca57d0276aefeb0dd6750270b84fd62b7a5ec55b0212befef321283cdf5d54c5f297

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
b2306cdaee9a3b2fe61480d01b00868d

SHA1
501ca393cb26b4a8b6846370d33ae712435812eb

SHA256
f73804157859970fb74b50d5643574d9273d3f869da9b8c5edb5a247065e2353

SHA512
66d57a196e4fb05cdad4fb2fae8bfc65d4f7f35bf497579dc4c3b596f2a8d29cdeb57ee47950ea7c3afe0d6055ff454f81ebc7254566529681423d7db8f452c9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
8KB

MD5
846cea035942b3c3467a5c1c61132f36

SHA1
db5929335a3039bcdf70ec8fa2f12d90ad93a660

SHA256
e0db6d28c23f6321ab6e6e89671631a9cfc281ba8243226de50488371f82912b

SHA512
003d936032fbfbb4bd61c12724054325a87dc57c22c68a7ca38dd4db14b76837c444da956c368a723686bf2b1ff57a12515ff9b2ba9fd32b15aa7f14d94ab86e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
8KB

MD5
c77c2c3f6c511bc3878f94e97fa258d3

SHA1
1a60c8c13e7348fd3f5377d11ec72f2cbd91df93

SHA256
ac8fc6b7a063fb7181fdfad3b5070ee396fe30bdc9df6a852a5739cf9c1fd151

SHA512
1760896a7f92dc71149a4a07ba3196bbea196d307348782f8ea67fbf0c6e36e6a1403b79688b895c594ce2909ac75aec0831969f51c1db4c6c3a90f10b483eb3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
326624d33d63105011e2b6f317d6c826

SHA1
bb78c7cb064abc71d4b85a4fa18a0211ca07b612

SHA256
18d1303d2f6d03ccd78bc77dd29ff1ccb007cb3f8cbe9354ab8996a1b651f646

SHA512
03125da26051f443da7b9feeb57481934347c259f5b3c53b246258381a8cd1d5b69a766cd0f1a3a92c7791648d06e920fb89e302c93619ae0e611751a41aa99b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
8KB

MD5
151c3656655002986f7d7ecae69499e9

SHA1
b742501724a6d7c97b65c9641c752e7db745a233

SHA256
0c98bc546e80ec171e56cc40d4ff78394b5892cd2c991b195f5c7e952dcf2bb1

SHA512
4d563bec9634204391774f3eea6613d27785fbdecb3a1981a8e8e977c71330b33eff73fc2ed6bde320700cdfd274e68b1428bdf3cf123b5f5183e3621a7835cc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
56B

MD5
94275bde03760c160b707ba8806ef545

SHA1
aad8d87b0796de7baca00ab000b2b12a26427859

SHA256
c58cb79fa4a9ade48ed821dd9f98957b0adfda7c2d267e3d07951c2d371aa968

SHA512
2aabd49bc9f0ed3a5c690773f48a92dbbbd60264090a0db2fe0f166f8c20c767a74d1e1d7cc6a46c34cfbd1587ddb565e791d494cd0d2ca375ab8cc11cd8f930

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe57827e.TMP
Filesize
120B

MD5
ee9437e6bf3260f3d0268ac8e8d857ce

SHA1
c1a9fcfd18b76a8a20bea491a36a61d2400b4ded

SHA256
3527469c1b37f9d74247fa15b2d098463f818db9fde392dca6c8c85c8d19a33d

SHA512
386416e51396edf49a2c596a406f8dd1ae6f6ffca6726eff7abf3b4101a3b6125e64f62a082cc9d9acf8d0c70d153d923975fec4d9002fb321da4018cc4739b7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize
72B

MD5
814db41dbb632af3678679e1590a66f9

SHA1
d9e00f8bd41368d10246bc0a7e6ef949b66c6176

SHA256
dd9bd92f80ef85eae7ae6244f0da9b8a05f2ce80af04e2a671256d7ad1b56824

SHA512
b15adc03c2ca88c411067596fc4d073f65ea477c02a5bfd9c124edb6a9e201d9dd089bd9efaf0c2b57cbe4114f1124510b21199d0b1f6b56b11074720147e581

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
138KB

MD5
b8a117014003d6420779abdadfc74cb5

SHA1
7c9d031e85b095ecc36c2d5105f6d41c3fa2d87c

SHA256
2463bc39f5db41ac4478ee2306629e4646fd918135a272bd05a35447314202d4

SHA512
db4cdc565d77e86db05dcdef95a16452166084708842b1bbd88aa98c63366bf0af485e123b27685951eef98368a74899c75a167a6fc0e82e4fe4018b1c1bb4b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
138KB

MD5
fd696281902c1cce0e8b6f97dce02763

SHA1
37a47cd5d15fb0b54c6a6af86d995e3c446b6c7b

SHA256
cbc5d8ad7f676aca43ec2d9b598b8a7ee7e5895ded0ecf1972295fb1ac7cd399

SHA512
f06a96dad07364da57b33a21cb4568dd5b3605128f6b05bf3eaa918d2037d4fa0c058af98ef0b5af5a27482d3dbbbfc597732fbadb6958894e691b25226fe98e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
138KB

MD5
9dac63f9357f5aff98e33813f91f899c

SHA1
4d98186e2337ed641d6d30b719756145137d4faf

SHA256
b40bea516540a9809d5f910aa6da50c02681fadc2560784977f8e54eec2b923c

SHA512
33fe1ddcf4b569215b01c9d3a9cadb954f71548bfe84db8dce96f68c5a9e7a76e0fa64e16562997f1e029aaf50768df1f461024127ab18e0f5dead60d5e2398a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
138KB

MD5
fd8149be5b81f4dddf5331107f24c300

SHA1
c9eab6a169a11890fce506752ef96f5f653ca512

SHA256
01d283a73f03324f38de10205378aa6978e27bc494c132e067ed2763c0ff4ab9

SHA512
a19b13943edc8176bd347167bad21c321d241523d9d00a60fdabdde369ad8b1c383582e2d4c221e6a2877c809a96c15b29175dcc69a3f3b1f59afb41996ac455

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
109KB

MD5
0beaa4a1698e6d4bc556cff938e8bf06

SHA1
f8f13e190b6092b6455ff4257edb23f9405b8ab1

SHA256
179551825243c16ea3c5819a80d961f2ab93b68cc2d0e6b8341705e8abcbcee6

SHA512
c47c89a951c30fb0988497002292a63dc4b2d15d0911c5a77988874420d454357ccc83e918250622201a688ad82a5934257fd6a4d9449b9ca2ff64fcb850ff1d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
98KB

MD5
426e6a45c1f858c9dc18462d33d4c0c3

SHA1
0935717c759dc65f0288c70085b4ea6f796f8035

SHA256
11348c67e5888e558e8312521d161a5f6e7aa16d80ba8145add61f335fbed960

SHA512
45172d803b36bfd56724ba4b61d1226d6b9c160cd6cd8e56f01fd2dde771c58507f423474a98544d77815c06fae7be3c5bf29506025682cab741a6631748b875

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe581e80.TMP
Filesize
89KB

MD5
5b3ba5f43c4cb58bd196b6a51e6caf09

SHA1
fa5f339ce8a8c1c266b7f7c457dde2596d95d2a8

SHA256
c61ea240298c1d710793afc8292463689dc35590938dfaef81e9f5ff3a0edf46

SHA512
5beeead1aeba7ba6a6b8b8a872b485f99050bec040e8e98508d00638319fa8e55bffbdab8cefa7b94cadc0d335b9783bb07294b76c86ea59cae01120e0a9ee97

Download Submit
C:\Users\Admin\AppData\Local\Temp\636c3fae-0fd5-4932-b644-66d3e16a689b.tmp.ico
Filesize
278KB

MD5
ce47ffa45262e16ea4b64f800985c003

SHA1
cb85f6ddda1e857eff6fda7745bb27b68752fc0e

SHA256
d7c1f9c02798c362f09e66876ab6fc098f59e85b29125f0ef86080c27b56b919

SHA512
49255af3513a582c6b330af4bbe8b00bbda49289935eafa580992c84ecd0dfcfffdfa5ce903e5446c1698c4cffdbb714830d214367169903921840d8ca7ffc30

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS012BFE98\5dd77c00-dfbd-4bd9-b9e7-9c2dd86327fd\UnifiedStub-installer.exe\assembly\dl3\00ec2973\1fd94dbc_88ccda01\rsServiceController.DLL
Filesize
173KB

MD5
068958f78fab4b76e5196051df3af162

SHA1
6f7489e40d3c48b922511622238fdb8383560ac3

SHA256
c3009c36e9353ee749a69b1569efc81b91dc1e7af403c8742787a412a7429aa8

SHA512
8a7daf88049912f00434b0cc239bad4b07682532d96a9f3e30e2f1cdb33e0441e2e7742ab727854f7b9372d4168ebd24af5350b0ee36247719c026e018975e2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS012BFE98\5dd77c00-dfbd-4bd9-b9e7-9c2dd86327fd\UnifiedStub-installer.exe\assembly\dl3\19ffe268\3a674bbc_88ccda01\rsAtom.DLL
Filesize
157KB

MD5
4bc064996097db51318511ed2566851d

SHA1
413e6d0217172bc1a86d1c916dc575d080d7ff3f

SHA256
1caf633d64246a4a0597232c7fb87f2b8a3e35648f3d30f575cbc69249959203

SHA512
332dfe6c28d932d8d4868432edded14fe816f17d80d9c543da0ce3cf87f796e70acb1a0c8a3e1653c5f9994834c17b972047cc8679508634217362e7205f281e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS012BFE98\5dd77c00-dfbd-4bd9-b9e7-9c2dd86327fd\UnifiedStub-installer.exe\assembly\dl3\1a497230\c7b24dbc_88ccda01\rsLogger.DLL
Filesize
178KB

MD5
2f2164b351afc5d08420257cd32b9c4e

SHA1
1ea3c935c7c72a94f863e7dbe7dacccd39980970

SHA256
ec54e4f32f3ea10486839080cffb4c13aecf12b278622bf048f5b5fa64c98437

SHA512
949179ceef6995b3c9692110b22cf07fb7f187adbb22a78b15d239b93fc12c461ca1008c3cbc87c62fd68e1482a10710fea40679b3e82a11ca5fdec6df6174fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS012BFE98\5dd77c00-dfbd-4bd9-b9e7-9c2dd86327fd\UnifiedStub-installer.exe\assembly\dl3\b6ec106f\5c8a4dbc_88ccda01\rsJSON.DLL
Filesize
216KB

MD5
7dd406fa2b496d691f866eddc790d6cc

SHA1
692422b46102af2ab31f7902a970c912a2ba000d

SHA256
bd7b33b101f222846b09f057bc54bc586ed5da63fe189e9ab19bcc43ecf85956

SHA512
c8ac9e9491f6695de1d9c3fee1ddbdd0261b8e32928bc228858021851fed501cb6b12adc5dc282e703a1e8efdf372073c1794f202943149e7320831846708979

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS012BFE98\9b7b4ed2-8387-444a-a96c-137a4c7857ca\UnifiedStub-installer.exe\assembly\dl3\95781e48\b3e56fc8_88ccda01\rsJSON.DLL
Filesize
216KB

MD5
fc1389953c0615649a6dbd09ebfb5f4f

SHA1
dee3fd5cb018b18b5bdc58c4963d636cfde9b5cc

SHA256
cb817aa3c98f725c01ec58621415df56bb8c699aaed8665929800efb9593fcc0

SHA512
7f5a61dd1f621a539ed99b68da00552e0cda5ad24b61e7dbf223a3697e73e18970e263fda889c08c3c61252c844a49c54c4705e1f3232274cbe787a3dbd34542

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS012BFE98\9b7b4ed2-8387-444a-a96c-137a4c7857ca\UnifiedStub-installer.exe\assembly\dl3\a8a12d46\680c70c8_88ccda01\rsServiceController.DLL
Filesize
173KB

MD5
860ced15986dbdc0a45faf99543b32f8

SHA1
060f41386085062592aed9c856278096180208de

SHA256
6113bd5364af85fd4251e6fa416a190a7636ac300618af74876200f21249e58a

SHA512
d84a94673a8aa84f35efb1242e20775f6e099f860a8f1fe53ba8d3aebffd842499c7ac4d0088a4cded14bd45dad8534d824c5282668ca4a151ac28617334a823

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS012BFE98\9b7b4ed2-8387-444a-a96c-137a4c7857ca\UnifiedStub-installer.exe\assembly\tmp\01M3MY22\__AssemblyInfo__.ini
Filesize
176B

MD5
8f624c52fd25ee560f6758eb17dbd0eb

SHA1
0d7346cf8a7d155a74b250aabd40a8770ad96968

SHA256
d644dc81fa705f126c4374b85305f2285f86a5c5d7defc3018eb024919e663e0

SHA512
70910808dbfa358d28b11e5954fe60e81affafd7bd1099f9bcc987e6ff5ca8c0e93a854e945e35758fbbad6c78be18bac08c811a794335e891970441cdf5359c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS012BFE98\ArchiveUtilityx64.dll
Filesize
154KB

MD5
c70238bd9fb1a0b38f50a30be7623eb7

SHA1
17b1452d783ed9fae8ff00f1290498c397810d45

SHA256
88fb2446d4eac42a41036354006afadfca5acd38a0811110f7337dc5ec434884

SHA512
dd77e5c5cf0bf76ba480eb4682c965d0030171a7b7a165a6d1c3ba49895bc13388d17ddbb0fe3ac5d47b3d7d8110942c0d5b40e2fe3df0a022e051696ec4feb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS012BFE98\Microsoft.Win32.TaskScheduler.dll
Filesize
340KB

MD5
87d7fb0770406bc9b4dc292fa9e1e116

SHA1
6c2d9d5e290df29cf4d95a4564da541489a92511

SHA256
aaeb1eacbdaeb5425fd4b5c28ce2fd3714f065756664fa9f812afdc367fbbb46

SHA512
25f7c875899c1f0b67f1ecee82fe436b54c9a615f3e26a6bec6233eb37f27ca09ae5ce7cf3df9c3902207e1d5ddd394be21a7b20608adb0f730128be978bec9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS012BFE98\UnifiedStub-installer.exe
Filesize
1.1MB

MD5
c7fe1eb6a82b9ffaaf8dca0d86def7ca

SHA1
3cd3d6592bbe9c06d51589e483cce814bab095ee

SHA256
61d225eefb7d7af3519a7e251217a7f803a07a6ddf42c278417c140b15d04b0b

SHA512
348a48b41c2978e48ddbeb8b46ad63ef7dde805a5998f1730594899792462762a9eee6e4fe474389923d6b995eca6518c58563f9d1765087b7ac05ce2d91c096

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS012BFE98\d058f607-87d7-4661-b3b9-1f5db47e3eaa\UnifiedStub-installer.exe\assembly\dl3\1b523762\0104ffb3_88ccda01\rsServiceController.DLL
Filesize
175KB

MD5
3c11f1f4ab1b51e92af5210a25cb1a98

SHA1
f34e01f036d6279cb99ad36b7ad4f93875055ef1

SHA256
aadf52eefbc4330a9af62a2554635bc4f6d9503e0689ba86ee56c194b34d6382

SHA512
f872d8ec41c38e2c6527e4dd5285f7f877fe0714e94fde304f62b37b6f300d5bae38943df0c62dfa829886b0adbed01f6af14bdb8353ff6fdf73acedeb5ffcb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS012BFE98\d058f607-87d7-4661-b3b9-1f5db47e3eaa\UnifiedStub-installer.exe\assembly\dl3\74d1e7f8\c2acf9b3_88ccda01\rsAtom.DLL
Filesize
158KB

MD5
f2c6d0704191203c591b7257beff2d57

SHA1
0f8e468f8c26b71c5162b33caa812fa48bac8dd6

SHA256
ea791c403f402fbe8763d1adbb3a317463562a42757aa74d96505f2a4997585e

SHA512
2637921c04e98b14085778f85716e92efb76f9a50a0a9c1793b0310043ad60413642199e49f72eccdb4d2cbdbaeccf87ed83bd49976e6409b10916ef0218be08

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS012BFE98\d058f607-87d7-4661-b3b9-1f5db47e3eaa\UnifiedStub-installer.exe\assembly\dl3\85bc69b7\a9b5feb3_88ccda01\rsLogger.DLL
Filesize
179KB

MD5
683e19faf979c5ab2ae5919f0b3d1485

SHA1
8453dbc5029e96e4c42cf96b327aef987b15b9e8

SHA256
60834a138a215289237b1f99c05489e7bda8e8c4357ef8e96d7914ef270e5ca8

SHA512
0b3764b1fe3b7fe10f7b78243f5a91c8563816eb19dad8d06e31dcaf6898ecfce667fe2585cff4dacc2a2650cd09428b5e4f2ff58baa54855e9749dc4f5d44f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS012BFE98\d058f607-87d7-4661-b3b9-1f5db47e3eaa\UnifiedStub-installer.exe\assembly\dl3\a370f75a\6140feb3_88ccda01\rsJSON.DLL
Filesize
219KB

MD5
8740daedb5e9ab8a48389ee3088a9c16

SHA1
4d821d8523ee72ebe2cd3e74e3c0cdcea7038d92

SHA256
8c0123b38ef50dc9aa0cb7c56028ae9c031425ab812ee0b56ff396c35b7af95a

SHA512
e847f7bd7c02662196b1bdbbd1073e21bb185c4a2d19c351b643de80c3efca661c126f9ebd834373d1baf56e8a67d03ce9624132d35f4a8deeec00d4a3236b26

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS012BFE98\rsAtom.dll
Filesize
156KB

MD5
f5cf4f3e8deddc2bf3967b6bff3e4499

SHA1
0b236042602a645c5068f44f8fcbcc000c673bfe

SHA256
9d31024a76dcad5e2b39810dff530450ee5a1b3ecbc08c72523e6e7ea7365a0b

SHA512
48905a9ff4a2ec31a605030485925a8048e7b79ad3319391bc248f8f022813801d82eb2ff9900ebcb82812f16d89fdff767efa3d087303df07c6c66d2dcb2473

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS012BFE98\rsJSON.dll
Filesize
217KB

MD5
927934736c03a05209cb3dcc575daf6a

SHA1
a95562897311122bb451791d6e4749bf49d8275f

SHA256
589c228e22dab9b848a9bd91292394e3bef327d16b4c8fdd1cc37133eb7d2da7

SHA512
12d4a116aee39eb53a6be1078d4f56f0ebd9d88b8777c7bd5c0a549ab5cff1db7f963914552ef0a68ff1096b1e1dc0f378f2d7e03ff97d2850ca6b766c4d6683

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS012BFE98\rsLogger.dll
Filesize
176KB

MD5
f55948a2538a1ab3f6edfeefba1a68ad

SHA1
a0f4827983f1bf05da9825007b922c9f4d0b2920

SHA256
de487eda80e7f3bce9cd553bc2a766985e169c3a2cae9e31730644b8a2a4ad26

SHA512
e9b52a9f90baecb922c23df9c6925b231827b8a953479e13f098d5e2c0dabd67263eeeced9a304a80b597010b863055f16196e0923922fef2a63eb000cff04c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS012BFE98\rsStubLib.dll
Filesize
255KB

MD5
fa4e3d9b299da1abc5f33f1fb00bfa4f

SHA1
9919b46034b9eff849af8b34bc48aa39fb5b6386

SHA256
9631939542e366730a9284a63f1d0d5459c77ec0b3d94de41196f719fc642a96

SHA512
d21cf55d6b537ef9882eacd737e153812c0990e6bdea44f5352dfe0b1320e530f89f150662e88db63bedf7f691a11d89f432a3c32c8a14d1eb5fc99387420680

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS012BFE98\rsSyncSvc.exe
Filesize
795KB

MD5
cc7167823d2d6d25e121fc437ae6a596

SHA1
559c334cd3986879947653b7b37e139e0c3c6262

SHA256
6138d9ea038014b293dac1c8fde8c0d051c0435c72cd6e7df08b2f095b27d916

SHA512
d4945c528e4687af03b40c27f29b3cbf1a8d1daf0ee7de10cd0cb19288b7bc47fae979e1462b3fa03692bf67da51ab6fa562eb0e30b73e55828f3735bbfffa48

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS012BFE98\uninstall-epp.exe
Filesize
324KB

MD5
8157d03d4cd74d7df9f49555a04f4272

SHA1
eae3dad1a3794c884fae0d92b101f55393153f4e

SHA256
cdf775b4d83864b071dbcfeed6d5da930a9f065919d195bb801b6ffaf9645b74

SHA512
64a764068810a49a8d3191bc534cd6d7031e636ae306d2204af478b35d102012d8c7e502ed31af88280689012dc8e6afd3f7b2a1fe1e25da6142388713b67fa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\dglgchzt.exe
Filesize
2.3MB

MD5
5b4657fc424bb438397fbc536206d13f

SHA1
dc715a36165b22b137fc31dccc15c62029dd73f2

SHA256
f4eab3cda8596b26e1060c09ae035d7e1e548aa1b214cc40308484cb46644cba

SHA512
4a83b8f72451851d84a63d4485da40a7073cdcdf1d45336f9f89edf8c06bc536f2dade3293dda8428c25b0d350919546d9f2751b908e161d37d845c55ee97bb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-LSB5N.tmp\Planet Coaster_pG-3BF1.tmp
Filesize
2.9MB

MD5
392188858aab78d544835de0fe665a04

SHA1
e2c06e4d926bbecee75887c83b5a9e732b0103b8

SHA256
eaa483432e2cae37fcf1350c160b848948f8e512ed085fab67d901bfcd8d5d07

SHA512
0d0d1d1196d705af2a755d054372b45e8540edeb201d2b9ac2d48a08240399314130f3e78e7e962ce708d3da90ed933fa848023f7db9ecaf7fc6ec7979cb05a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PJ5FE.tmp\Opera_new.png
Filesize
51KB

MD5
204ffb3a1a67eb809576c5f91de506cf

SHA1
6fc0cccaf73f44755de0989209db552087b12538

SHA256
69851d49e3897e612071cb225255615dd1d575e35eb5a2ac5343947994e60f84

SHA512
e5ca99d1283b5a3c0677d31b10f09160b3dbc0305557581847b735b547f12972d83b69ece9996a1accb34fc4923017986144628b91c5dded282c0f61db63ffda

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PJ5FE.tmp\RAV_Cross.png
Filesize
74KB

MD5
12d8f157696852a6e988a25f95e9c297

SHA1
b5d84b53a4df7e4847014b841f62b52dcdcbf991

SHA256
5b68c81cf76c8594441f5ecebe9cf5a166a53a6f4e84dbe7d5fb88fdff01a59f

SHA512
f88deea48d7845119dbf6c7ba56d91899381d653428de9259a667c0d1bd63beb5fe357958916ce182f65f80c4dfdc703cdcbd8f28811a2d483decedba0ac3b9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PJ5FE.tmp\WebAdvisor.png
Filesize
37KB

MD5
f4ecf398ac5fd32d7dbe994fa14ea9a4

SHA1
b430b6076bc3f80b8226b1acc07f447f1e3fa3e7

SHA256
2df3caec100ce3f7943af62664897866f3a8e65083ddc7a0bcc3cea5821fc553

SHA512
cc74e8593dbc8a1cc6922a0586ca564679949874ace46d1582108a2bd16bfc72cb2fcdbf4a7e6d259d0a71f9019d547d1904ad9fcd23220c8b0baac36691ddf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PJ5FE.tmp\botva2.dll
Filesize
37KB

MD5
67965a5957a61867d661f05ae1f4773e

SHA1
f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

SHA256
450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

SHA512
c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PJ5FE.tmp\finish.png
Filesize
2KB

MD5
7afaf9e0e99fd80fa1023a77524f5587

SHA1
e20c9c27691810b388c73d2ca3e67e109c2b69b6

SHA256
760b70612bb9bd967c2d15a5133a50ccce8c0bd46a6464d76875298dcc45dea0

SHA512
a090626e7b7f67fb5aa207aae0cf65c3a27e1b85e22c9728eee7475bd9bb7375ca93baaecc662473f9a427b4f505d55f2c61ba36bda460e4e6947fe22eedb044

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PJ5FE.tmp\prod0.exe
Filesize
32KB

MD5
071389ded3f53f85d4dce08a53dd0cea

SHA1
78f6a8417763385d889746e3dd0cf872ba4f440c

SHA256
73f38c79e3763609cbf3bf6f6bba878afb43e4202f9719f0f4b1e8ed54ef2c07

SHA512
8272f9a89ab3bd26a5f77342b9870a1a6963585cc45e589867b39c9e8ab04647292b252c95ab0436953cac02e3300c3112d247c6c8e4fa62b979821f14b6ed8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PJ5FE.tmp\qbittorrent.exe
Filesize
22.8MB

MD5
22a34900ada67ead7e634eb693bd3095

SHA1
2913c78bcaaa6f4ee22b0977be72333d2077191d

SHA256
3cec1e40e8116a35aac6df3da0356864e5d14bc7687c502c7936ee9b7c1b9c58

SHA512
88d90646f047f86adf3d9fc5c04d97649b0e01bac3c973b2477bb0e9a02e97f56665b7ede1800b68edd87115aed6559412c48a79942a8c2a656dfae519e2c36f

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PJ5FE.tmp\zbShieldUtils.dll
Filesize
2.0MB

MD5
c79e3df659cdee033a447a8f372760ce

SHA1
f402273e29a6fa39572163e4595e72bde3d9330a

SHA256
7d09715c4e0735a0832bf81d92d84600df1815a2ba451586bd25eb16f7c450a5

SHA512
490cc30ccfac209f1f5332ce4168b0dc849d7e4d86f3c198ddd23b39ddc950001928a1e071c2ace74c4710508265c0872adb02e3f068e521d28ed8b19ea36492

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Filesize
7KB

MD5
61c1ca7c12676cac1d2332ef337baec4

SHA1
23cbc7a1330442b7e2eaa9e4041255c9a3b5b593

SHA256
e996b33cde4fd4c5ff566f06a9fcea62bb4e8e74b90806f39cd96afc508679ad

SHA512
48a101c4b7b8d5efe74bfd178bf9b019f74ac680088d8ff7bd21513e59f0f5ba1a6f6d8c11758d97352efa7a727fee7a288ecdb879c12dbdd5e4a6d94c8501f2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Filesize
8KB

MD5
6f2487f86896d1dcdb5a7e3be5f93d5a

SHA1
9093a5731326dfd937c997f475b3a9a994b6b517

SHA256
6f48b6d8102794ed6798afda6fd5de88ad0f104bdaded655877d855268fddefb

SHA512
c1f7f5007a4a5d100668ba685a10c452c36ee4e4dbc16198ede1f691ef93fb0c19f63ad3d365098fe700d79f17ae91a0839dc7deb0f4fb37c5044d9731534c95

Download Submit
C:\Users\Admin\AppData\Roaming\ReasonLabs\EPP\516f459b-6a6c-4d88-8269-ed7863a7d2f9.tmp
Filesize
86B

MD5
8a9bbc2f833ed90104d3e81732369d1c

SHA1
488256a8361ef1496ad01a67dbf5eb4149aef667

SHA256
eccd0ffbf81c7646a3a23e4727206b08596cbc0c36597ddb13a8c6906ed89115

SHA512
ee423d4ceb3bfbd8a6d61cc48077e92c2f764d0135d58d07f2c742de9e936a86059d60c08998918fadb0e3e66eb25b3bdd49e4bb95e7a67dada71fc487a345ef

Download Submit
C:\Users\Admin\AppData\Roaming\ReasonLabs\EPP\GPUCache\data_1
Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Roaming\ReasonLabs\EPP\Local Storage\leveldb\MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Roaming\ReasonLabs\EPP\Network\b09d072b-5960-4a3b-ad7d-7a733bd427f6.tmp
Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Roaming\ReasonLabs\VPN\Dictionaries\es-ES-3-0.bdic
Filesize
766KB

MD5
471061756215fd1f387f076ac014303c

SHA1
d8397cb5900f52a5cad2416ed8ebf53caa1a3adc

SHA256
e6334dcf080aaeca679db70565762a2c296ff5780c1af263530ac7345736bfa9

SHA512
ba9d0f2deb2fcd77e75bfe8a9c6241da25c7eb9012d0374ccca8e9cd9cd1c9615efd5f3980166b0b3431c7e3e55ef013cbc37f0d53bd1e2411afb9363ceccb05

Download Submit
C:\Users\Admin\AppData\Roaming\ReasonLabs\VPN\Partitions\plan-picker_2.18.0\Cache\Cache_Data\data_0
Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Roaming\ReasonLabs\VPN\Partitions\plan-picker_2.18.0\Code Cache\js\index
Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Roaming\ReasonLabs\VPN\Partitions\plan-picker_2.18.0\DawnCache\data_2
Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Roaming\ReasonLabs\VPN\Partitions\plan-picker_2.18.0\DawnCache\data_3
Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Roaming\qBittorrent\qBittorrent.ini
Filesize
1KB

MD5
a546208c2566fe8a1a3319df590956cc

SHA1
5d85704e528379336ecc41f411f5d7614473e7b0

SHA256
0647b4bfe032e8b0b3fbdbba72e762092eec818f113bb593ead786c3f61fb1aa

SHA512
ed2505974343426d5156ebf28e4b47e124447855f6700cbc24a127d64dacad6de20d205b5fb368390feb628ef7f2398d30eb01c792a3e657d0ee97d90cc834d5

Download Submit
C:\Users\Admin\AppData\Roaming\qBittorrent\watched_folders.json
Filesize
4B

MD5
5b76b0eef9af8a2300673e0553f609f9

SHA1
0b56d40c0630a74abec5398e01c6cd83263feddc

SHA256
d914176fd50bd7f565700006a31aa97b79d3ad17cee20c8e5ff2061d5cb74817

SHA512
cf06a50de1bf63b7052c19ad53766fa0d99a4d88db76a7cbc672e33276e3d423e4c5f5cb4a8ae188c5c0e17d93bb740eaab6f25753f0d26501c5f84aeded075d

Download Submit
C:\Users\Admin\Downloads\Planet Coaster_pG-3BF1.exe
Filesize
13.8MB

MD5
36f8adb499e6f6f9318f7bdb1d2bbd75

SHA1
709296223ebc2a31c0f0d37b535b62431c4e5991

SHA256
a7d9bb906fbff13c6d394325e32a77d6286711e74611bfc993fc9a48507906dd

SHA512
46c41a5300231aa83cc2445e1310d8ae878c590f06d1fc78b0d56e5370acff207fcb3e468666cb920308c9c0966119427f5a940d2849d4babee3806493ad1152

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\54C62B182F5BF07FA8427C07B0A3AAF8_C0FCA017E5E8DC85A76F14D75ABCD153
Filesize
727B

MD5
ce5569ae0a2f98833ab815f80e936af8

SHA1
c770d1007c2b745dc7a0039c9cd7aca5ae577491

SHA256
d14a0fa7b924a1ed93936bd95b744204104679bb5ae17cfdc557bfb6505f0754

SHA512
9fde390b814d1595b8eea47d85d82f97cb6b2ef0d14a61748cc8d12c7b6cde956113e5d37063e8c31ff04bc2fec1c136d3bb8ec594d4455d54029a76a6834d35

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77CF52543AB0ECD9BF6546AAF6AC33DB
Filesize
2KB

MD5
30b422749de52f643d0b82f4fa0eec08

SHA1
53ff45d98808aae7c2edaf7847fa8ae2bb2780a8

SHA256
78e1550525bd380b406698087a3d001970fc6e962f9c355bd999663903162de9

SHA512
6b321219bc2c89ad69c38995ea0514d695da93092dbe6966fbeef27088af5107f056a3e976d2735e49341e49ed2ce913d6ae3c5c0a3ff920a95cdafb4cc63248

Download Submit
\??\pipe\crashpad_2660_DPWNLQOGVJKKDING
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1864-3201-0x00000279C9630000-0x00000279C966C000-memory.dmp

Filesize
240KB

Download
memory/1864-3200-0x00000279C95A0000-0x00000279C95B2000-memory.dmp

Filesize
72KB

Download
memory/1864-3187-0x00000279AF650000-0x00000279AF65A000-memory.dmp

Filesize
40KB

Download
memory/1864-3186-0x00000279AF0A0000-0x00000279AF0CE000-memory.dmp

Filesize
184KB

Download
memory/1864-3185-0x00000279AF0A0000-0x00000279AF0CE000-memory.dmp

Filesize
184KB

Download
memory/3628-689-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3628-690-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/3628-772-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3628-1021-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3684-837-0x0000020F6D2E0000-0x0000020F6D808000-memory.dmp

Filesize
5.2MB

Download
memory/3684-836-0x0000020F52940000-0x0000020F52948000-memory.dmp

Filesize
32KB

Download
memory/3972-5163-0x000002CBFCFA0000-0x000002CBFCFCE000-memory.dmp

Filesize
184KB

Download
memory/3972-990-0x000002CBFCB00000-0x000002CBFCB58000-memory.dmp

Filesize
352KB

Download
memory/3972-3164-0x000002CBFCCD0000-0x000002CBFCCDE000-memory.dmp

Filesize
56KB

Download
memory/3972-3157-0x000002CBFCFA0000-0x000002CBFCFCE000-memory.dmp

Filesize
184KB

Download
memory/3972-1507-0x000002CB80020000-0x000002CB80074000-memory.dmp

Filesize
336KB

Download
memory/3972-974-0x000002CBFC700000-0x000002CBFC72A000-memory.dmp

Filesize
168KB

Download
memory/3972-1011-0x000002CBFCE60000-0x000002CBFCF62000-memory.dmp

Filesize
1.0MB

Download
memory/3972-3146-0x000002CBFCD50000-0x000002CBFCD7A000-memory.dmp

Filesize
168KB

Download
memory/3972-972-0x000002CBE3F40000-0x000002CBE3F7A000-memory.dmp

Filesize
232KB

Download
memory/3972-3767-0x000002CB80030000-0x000002CB8007E000-memory.dmp

Filesize
312KB

Download
memory/3972-5110-0x000002CBFCD50000-0x000002CBFCD88000-memory.dmp

Filesize
224KB

Download
memory/3972-1517-0x000002CB80020000-0x000002CB80074000-memory.dmp

Filesize
336KB

Download
memory/3972-5119-0x000002CBFCD50000-0x000002CBFCD80000-memory.dmp

Filesize
192KB

Download
memory/3972-1010-0x000002CBFCD10000-0x000002CBFCD50000-memory.dmp

Filesize
256KB

Download
memory/3972-970-0x000002CBE2580000-0x000002CBE25B0000-memory.dmp

Filesize
192KB

Download
memory/3972-1493-0x000002CB80020000-0x000002CB80076000-memory.dmp

Filesize
344KB

Download
memory/3972-1509-0x000002CB80020000-0x000002CB80074000-memory.dmp

Filesize
336KB

Download
memory/3972-1513-0x000002CB80020000-0x000002CB80074000-memory.dmp

Filesize
336KB

Download
memory/3972-3134-0x000002CBFCD50000-0x000002CBFCD80000-memory.dmp

Filesize
192KB

Download
memory/3972-1543-0x000002CB80020000-0x000002CB80074000-memory.dmp

Filesize
336KB

Download
memory/3972-5132-0x000002CBFCD50000-0x000002CBFCD7A000-memory.dmp

Filesize
168KB

Download
memory/3972-1541-0x000002CB80020000-0x000002CB80074000-memory.dmp

Filesize
336KB

Download
memory/3972-1539-0x000002CB80020000-0x000002CB80074000-memory.dmp

Filesize
336KB

Download
memory/3972-1537-0x000002CB80020000-0x000002CB80074000-memory.dmp

Filesize
336KB

Download
memory/3972-1535-0x000002CB80020000-0x000002CB80074000-memory.dmp

Filesize
336KB

Download
memory/3972-1494-0x000002CB80020000-0x000002CB80074000-memory.dmp

Filesize
336KB

Download
memory/3972-1531-0x000002CB80020000-0x000002CB80074000-memory.dmp

Filesize
336KB

Download
memory/3972-1529-0x000002CB80020000-0x000002CB80074000-memory.dmp

Filesize
336KB

Download
memory/3972-1527-0x000002CB80020000-0x000002CB80074000-memory.dmp

Filesize
336KB

Download
memory/3972-1525-0x000002CB80020000-0x000002CB80074000-memory.dmp

Filesize
336KB

Download
memory/3972-1524-0x000002CB80020000-0x000002CB80074000-memory.dmp

Filesize
336KB

Download
memory/3972-1505-0x000002CB80020000-0x000002CB80074000-memory.dmp

Filesize
336KB

Download
memory/3972-1521-0x000002CB80020000-0x000002CB80074000-memory.dmp

Filesize
336KB

Download
memory/3972-1519-0x000002CB80020000-0x000002CB80074000-memory.dmp

Filesize
336KB

Download
memory/3972-968-0x000002CBE2760000-0x000002CBE27A2000-memory.dmp

Filesize
264KB

Download
memory/3972-1515-0x000002CB80020000-0x000002CB80074000-memory.dmp

Filesize
336KB

Download
memory/3972-966-0x000002CBE20B0000-0x000002CBE21C0000-memory.dmp

Filesize
1.1MB

Download
memory/3972-3125-0x000002CBFCD50000-0x000002CBFCD8A000-memory.dmp

Filesize
232KB

Download
memory/3972-1495-0x000002CB80020000-0x000002CB80074000-memory.dmp

Filesize
336KB

Download
memory/3972-1511-0x000002CB80020000-0x000002CB80074000-memory.dmp

Filesize
336KB

Download
memory/3972-1501-0x000002CB80020000-0x000002CB80074000-memory.dmp

Filesize
336KB

Download
memory/3972-1497-0x000002CB80020000-0x000002CB80074000-memory.dmp

Filesize
336KB

Download
memory/3972-1533-0x000002CB80020000-0x000002CB80074000-memory.dmp

Filesize
336KB

Download
memory/3972-1545-0x000002CB80020000-0x000002CB80074000-memory.dmp

Filesize
336KB

Download
memory/3972-1503-0x000002CB80020000-0x000002CB80074000-memory.dmp

Filesize
336KB

Download
memory/3972-1499-0x000002CB80020000-0x000002CB80074000-memory.dmp

Filesize
336KB

Download
memory/4108-3225-0x0000012F6DF90000-0x0000012F6DFB2000-memory.dmp

Filesize
136KB

Download
memory/4108-3222-0x0000012F6E260000-0x0000012F6E5C6000-memory.dmp

Filesize
3.4MB

Download
memory/4108-3223-0x0000012F6E5D0000-0x0000012F6E74C000-memory.dmp

Filesize
1.5MB

Download
memory/4108-3224-0x0000012F6DF10000-0x0000012F6DF2A000-memory.dmp

Filesize
104KB

Download
memory/4956-779-0x0000000004E80000-0x0000000004E8F000-memory.dmp

Filesize
60KB

Download
memory/4956-816-0x0000000004E80000-0x0000000004E8F000-memory.dmp

Filesize
60KB

Download
memory/4956-773-0x0000000000400000-0x00000000006EE000-memory.dmp

Filesize
2.9MB

Download
memory/4956-1009-0x0000000000400000-0x00000000006EE000-memory.dmp

Filesize
2.9MB

Download
memory/4956-815-0x0000000000400000-0x00000000006EE000-memory.dmp

Filesize
2.9MB

Download
memory/4956-704-0x0000000000400000-0x00000000006EE000-memory.dmp

Filesize
2.9MB

Download
memory/4956-1020-0x0000000000400000-0x00000000006EE000-memory.dmp

Filesize
2.9MB

Download
memory/5312-5198-0x00000248FBEF0000-0x00000248FBF48000-memory.dmp

Filesize
352KB

Download
memory/5312-5206-0x00000248FBE70000-0x00000248FBE9E000-memory.dmp

Filesize
184KB

Download
memory/5312-5197-0x00000248F9A80000-0x00000248F9ABA000-memory.dmp

Filesize
232KB

Download
memory/5312-5229-0x00000248FC050000-0x00000248FC08C000-memory.dmp

Filesize
240KB

Download
memory/5312-5230-0x00000248FC090000-0x00000248FC0C2000-memory.dmp

Filesize
200KB

Download
memory/5312-5218-0x00000248F9A80000-0x00000248F9ABA000-memory.dmp

Filesize
232KB

Download
memory/5312-5233-0x00000248FBEA0000-0x00000248FBEC4000-memory.dmp

Filesize
144KB

Download
memory/5444-3422-0x000001D033730000-0x000001D033762000-memory.dmp

Filesize
200KB

Download
memory/5444-5239-0x000001D035720000-0x000001D0357A0000-memory.dmp

Filesize
512KB

Download
memory/5444-3295-0x000001D032F80000-0x000001D032FB0000-memory.dmp

Filesize
192KB

Download
memory/5444-3296-0x000001D033120000-0x000001D033180000-memory.dmp

Filesize
384KB

Download
memory/5444-3418-0x000001D032FB0000-0x000001D032FD6000-memory.dmp

Filesize
152KB

Download
memory/5444-4218-0x000001D0344F0000-0x000001D034532000-memory.dmp

Filesize
264KB

Download
memory/5444-5108-0x000001D035EE0000-0x000001D036160000-memory.dmp

Filesize
2.5MB

Download
memory/5444-3421-0x000001D0331F0000-0x000001D033228000-memory.dmp

Filesize
224KB

Download
memory/5444-3523-0x000001D035930000-0x000001D035ED4000-memory.dmp

Filesize
5.6MB

Download
memory/5444-3419-0x000001D033180000-0x000001D0331A8000-memory.dmp

Filesize
160KB

Download
memory/5444-3423-0x000001D033800000-0x000001D033886000-memory.dmp

Filesize
536KB

Download
memory/5444-3520-0x000001D034480000-0x000001D0344E6000-memory.dmp

Filesize
408KB

Download
memory/5444-3434-0x000001D0331B0000-0x000001D0331D6000-memory.dmp

Filesize
152KB

Download
memory/5444-3518-0x000001D034130000-0x000001D03415A000-memory.dmp

Filesize
168KB

Download
memory/5444-3517-0x000001D0340F0000-0x000001D034124000-memory.dmp

Filesize
208KB

Download
memory/5444-3514-0x000001D034080000-0x000001D0340A8000-memory.dmp

Filesize
160KB

Download
memory/5444-5184-0x000001D0341A0000-0x000001D0341D2000-memory.dmp

Filesize
200KB

Download
memory/5444-5188-0x000001D034170000-0x000001D034178000-memory.dmp

Filesize
32KB

Download
memory/5444-5190-0x000001D034570000-0x000001D034596000-memory.dmp

Filesize
152KB

Download
memory/5444-3511-0x000001D033F60000-0x000001D033F86000-memory.dmp

Filesize
152KB

Download
memory/5444-3510-0x000001D034040000-0x000001D03407A000-memory.dmp

Filesize
232KB

Download
memory/5444-5202-0x000001D034190000-0x000001D034198000-memory.dmp

Filesize
32KB

Download
memory/5444-3509-0x000001D033FD0000-0x000001D034036000-memory.dmp

Filesize
408KB

Download
memory/5444-3451-0x000001D0337B0000-0x000001D0337DE000-memory.dmp

Filesize
184KB

Download
memory/5444-5219-0x000001D036160000-0x000001D036406000-memory.dmp

Filesize
2.6MB

Download
memory/5444-3460-0x000001D0341F0000-0x000001D034476000-memory.dmp

Filesize
2.5MB

Download
memory/5444-3456-0x000001D033890000-0x000001D0338DF000-memory.dmp

Filesize
316KB

Download
memory/5444-3454-0x000001D0338F0000-0x000001D03394E000-memory.dmp

Filesize
376KB

Download
memory/5444-3455-0x000001D033BF0000-0x000001D033F59000-memory.dmp

Filesize
3.4MB

Download
memory/5444-5238-0x000001D035670000-0x000001D03569C000-memory.dmp

Filesize
176KB

Download
memory/5444-5256-0x000001D036470000-0x000001D0364C4000-memory.dmp

Filesize
336KB

Download
memory/5444-5240-0x000001D0357A0000-0x000001D035808000-memory.dmp

Filesize
416KB

Download
memory/5444-5241-0x000001D0356A0000-0x000001D0356CA000-memory.dmp

Filesize
168KB

Download
memory/5444-5242-0x000001D035890000-0x000001D035906000-memory.dmp

Filesize
472KB

Download
memory/5444-5250-0x000001D036590000-0x000001D036706000-memory.dmp

Filesize
1.5MB

Download
memory/5444-5253-0x000001D035810000-0x000001D035842000-memory.dmp

Filesize
200KB

Download
memory/5528-3424-0x00000192AD580000-0x00000192AD5A8000-memory.dmp

Filesize
160KB

Download
memory/5528-3417-0x00000192AD580000-0x00000192AD5A8000-memory.dmp

Filesize
160KB

Download
memory/5528-3420-0x00000192C7D90000-0x00000192C7F24000-memory.dmp

Filesize
1.6MB

Download
memory/5680-3263-0x000002B7EE8B0000-0x000002B7EEEC8000-memory.dmp

Filesize
6.1MB

Download
memory/5680-3291-0x000002B7EEED0000-0x000002B7EF12E000-memory.dmp

Filesize
2.4MB

Download
memory/5680-3233-0x000002B7EBBC0000-0x000002B7EBC1C000-memory.dmp

Filesize
368KB

Download
memory/5680-3235-0x000002B7ED950000-0x000002B7ED9AA000-memory.dmp

Filesize
360KB

Download
memory/5680-3239-0x000002B7ED900000-0x000002B7ED928000-memory.dmp

Filesize
160KB

Download
memory/5680-3249-0x000002B7EBBC0000-0x000002B7EBC1C000-memory.dmp

Filesize
368KB

Download
memory/5680-3260-0x000002B7ED9B0000-0x000002B7ED9E2000-memory.dmp

Filesize
200KB

Download
memory/7004-3524-0x000002C41D4A0000-0x000002C41D4A8000-memory.dmp

Filesize
32KB

Download
memory/7004-4307-0x000002C41EF30000-0x000002C41EF38000-memory.dmp

Filesize
32KB

Download
memory/7004-3525-0x000002C41D4C0000-0x000002C41D4CA000-memory.dmp

Filesize
40KB

Download
memory/7004-3526-0x000002C41D5F0000-0x000002C41D640000-memory.dmp

Filesize
320KB

Download
memory/7004-3458-0x000002C41BB80000-0x000002C41BBAE000-memory.dmp

Filesize
184KB

Download
memory/7004-3527-0x000002C41D680000-0x000002C41D6A2000-memory.dmp

Filesize
136KB

Download
memory/7004-3457-0x000002C41C540000-0x000002C41C830000-memory.dmp

Filesize
2.9MB

Download
memory/7004-3459-0x000002C41BBF0000-0x000002C41BC28000-memory.dmp

Filesize
224KB

Download
memory/7004-3522-0x000002C41C260000-0x000002C41C26A000-memory.dmp

Filesize
40KB

Download
memory/7004-3521-0x000002C41C280000-0x000002C41C296000-memory.dmp

Filesize
88KB

Download
memory/7004-3519-0x000002C41C200000-0x000002C41C25E000-memory.dmp

Filesize
376KB

Download