Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
01/02/2024, 06:35
Static task
static1
Behavioral task
behavioral1
Sample
614a76bd6606b2f493d54cda015ea9372b07a08708c803cff98167e0062fa86b.exe
Resource
win7-20231215-en
General
-
Target
614a76bd6606b2f493d54cda015ea9372b07a08708c803cff98167e0062fa86b.exe
-
Size
1.8MB
-
MD5
99082dbf332838681ce39f9daf760ddc
-
SHA1
005846371ae83e62f42e1aadc6fd671ff0401eea
-
SHA256
614a76bd6606b2f493d54cda015ea9372b07a08708c803cff98167e0062fa86b
-
SHA512
5c69cd0cd7b82d05818c3dc15e3f46e6565c64a839f3e65ffc5240fe018e361483548ed599ee8846345867b96e68827cd9a768b5afe5dc214ce9c1d81743b4bb
-
SSDEEP
49152:Xx5SUW/cxUitIGLsF0nb+tJVYleAMz77+WApgDUYmvFur31yAipQCtXxc0H:XvbjVkjjCAzJ3U7dG1yfpVBlH
Malware Config
Signatures
-
Executes dropped EXE 14 IoCs
pid Process 528 alg.exe 3324 DiagnosticsHub.StandardCollector.Service.exe 1332 fxssvc.exe 4040 elevation_service.exe 1620 elevation_service.exe 1488 maintenanceservice.exe 2480 msdtc.exe 4652 OSE.EXE 2580 PerceptionSimulationService.exe 4928 perfhost.exe 1172 locator.exe 3228 SensorDataService.exe 3832 snmptrap.exe 3108 spectrum.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 30 IoCs
description ioc Process File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\SgrmBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\msdtc.exe 614a76bd6606b2f493d54cda015ea9372b07a08708c803cff98167e0062fa86b.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 614a76bd6606b2f493d54cda015ea9372b07a08708c803cff98167e0062fa86b.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe alg.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 614a76bd6606b2f493d54cda015ea9372b07a08708c803cff98167e0062fa86b.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 614a76bd6606b2f493d54cda015ea9372b07a08708c803cff98167e0062fa86b.exe File opened for modification C:\Windows\System32\snmptrap.exe 614a76bd6606b2f493d54cda015ea9372b07a08708c803cff98167e0062fa86b.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe 614a76bd6606b2f493d54cda015ea9372b07a08708c803cff98167e0062fa86b.exe File opened for modification C:\Windows\system32\locator.exe 614a76bd6606b2f493d54cda015ea9372b07a08708c803cff98167e0062fa86b.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 614a76bd6606b2f493d54cda015ea9372b07a08708c803cff98167e0062fa86b.exe File opened for modification C:\Windows\system32\dllhost.exe 614a76bd6606b2f493d54cda015ea9372b07a08708c803cff98167e0062fa86b.exe File opened for modification C:\Windows\System32\SensorDataService.exe 614a76bd6606b2f493d54cda015ea9372b07a08708c803cff98167e0062fa86b.exe File opened for modification C:\Windows\system32\SgrmBroker.exe alg.exe File opened for modification C:\Windows\system32\msiexec.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\SensorDataService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\msiexec.exe 614a76bd6606b2f493d54cda015ea9372b07a08708c803cff98167e0062fa86b.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 614a76bd6606b2f493d54cda015ea9372b07a08708c803cff98167e0062fa86b.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 614a76bd6606b2f493d54cda015ea9372b07a08708c803cff98167e0062fa86b.exe File opened for modification C:\Windows\system32\msiexec.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe 614a76bd6606b2f493d54cda015ea9372b07a08708c803cff98167e0062fa86b.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\a7c3bb40a5bf65ce.bin alg.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\spectrum.exe 614a76bd6606b2f493d54cda015ea9372b07a08708c803cff98167e0062fa86b.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Google\Temp\GUM65EE.tmp\goopdateres_ko.dll 614a76bd6606b2f493d54cda015ea9372b07a08708c803cff98167e0062fa86b.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Google\Temp\GUM65EE.tmp\goopdateres_pt-PT.dll 614a76bd6606b2f493d54cda015ea9372b07a08708c803cff98167e0062fa86b.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 614a76bd6606b2f493d54cda015ea9372b07a08708c803cff98167e0062fa86b.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Google\Temp\GUM65EE.tmp\goopdateres_ms.dll 614a76bd6606b2f493d54cda015ea9372b07a08708c803cff98167e0062fa86b.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Google\Temp\GUM65EE.tmp\goopdateres_zh-CN.dll 614a76bd6606b2f493d54cda015ea9372b07a08708c803cff98167e0062fa86b.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Google\Temp\GUM65EE.tmp\goopdateres_zh-TW.dll 614a76bd6606b2f493d54cda015ea9372b07a08708c803cff98167e0062fa86b.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Google\Temp\GUM65EE.tmp\GoogleUpdateCore.exe 614a76bd6606b2f493d54cda015ea9372b07a08708c803cff98167e0062fa86b.exe File opened for modification C:\Program Files\dotnet\dotnet.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zG.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe alg.exe File created C:\Program Files (x86)\Google\Temp\GUM65EE.tmp\goopdateres_it.dll 614a76bd6606b2f493d54cda015ea9372b07a08708c803cff98167e0062fa86b.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files\dotnet\dotnet.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Google\Temp\GUM65EE.tmp\goopdateres_hi.dll 614a76bd6606b2f493d54cda015ea9372b07a08708c803cff98167e0062fa86b.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe alg.exe File created C:\Program Files (x86)\Google\Temp\GUM65EE.tmp\goopdateres_sw.dll 614a76bd6606b2f493d54cda015ea9372b07a08708c803cff98167e0062fa86b.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Google\Temp\GUM65EE.tmp\goopdateres_lt.dll 614a76bd6606b2f493d54cda015ea9372b07a08708c803cff98167e0062fa86b.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 614a76bd6606b2f493d54cda015ea9372b07a08708c803cff98167e0062fa86b.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe -
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3324 DiagnosticsHub.StandardCollector.Service.exe 3324 DiagnosticsHub.StandardCollector.Service.exe 3324 DiagnosticsHub.StandardCollector.Service.exe 3324 DiagnosticsHub.StandardCollector.Service.exe 3324 DiagnosticsHub.StandardCollector.Service.exe 3324 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 672 Process not Found 672 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4888 614a76bd6606b2f493d54cda015ea9372b07a08708c803cff98167e0062fa86b.exe Token: SeAuditPrivilege 1332 fxssvc.exe Token: SeDebugPrivilege 528 alg.exe Token: SeDebugPrivilege 528 alg.exe Token: SeDebugPrivilege 528 alg.exe Token: SeDebugPrivilege 3324 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\614a76bd6606b2f493d54cda015ea9372b07a08708c803cff98167e0062fa86b.exe"C:\Users\Admin\AppData\Local\Temp\614a76bd6606b2f493d54cda015ea9372b07a08708c803cff98167e0062fa86b.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4888
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:528
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3324
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:2896
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1332
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4040
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1620
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:1488
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2480
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4652
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:2580
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:4928
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:1172
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3228
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:3832
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3108
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:4944
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
294KB
MD5fb529565b42cb19686b67692801efb18
SHA14ac8c8892ad8545886faaf9895db2030919a5bf9
SHA2566c9f025db5ebe1e1b459e2c30a212fe91582385895dc32f7fc3596c7d1e97cf0
SHA512fa228eedc1257e38838e93d56854783b8a666e4f2ffa807f8d8f436fac58da95797e8ce4cf1e1340eab4310039a2874c92ac52158786cc06973e4cca357d79d1
-
Filesize
31KB
MD52d967ddfdce1bba5d77fd7e85ea6ab63
SHA1f2bb617a4412ba1bb1e3dad9184fa621fe066ed0
SHA256836a901e5cbce6223cd1df276407f61d218a2e70778d82b98d4933905f324a70
SHA512c3f05440bc1c74a77f4154ba8407ac41fb96ec846ac181d3448383a1f7472f6d0f41fcfeb88350ce77814836af17df95b34df57042a95d13121f3977075c192b
-
Filesize
145KB
MD5ba87d3e140063069ffbb4c0393387a4e
SHA16139c4a544a3a60b61d7a12d622cf11066aa4d45
SHA2568382acc7dbc67eb25168cd3429d696d5059b8ae997588b6cbe761050e63363b7
SHA512fcf93e56b5cfc01d01280bbc2d1172880261cf0e699b70319973255c72090d8d1d8c559a113428639a22c77bb5005195f0a5e33bf660542ab413694f485b22e0
-
Filesize
256KB
MD5febb0a53228f9ea2333adde1a8f3411e
SHA12c17f4a08a4ede0643c7bbfb9586cca6c9b5902a
SHA25637294d0a91f96c1a162d2a49a708cc276f9faa3845a398c30fe897012c386b76
SHA512334e840ed975dfce7f0021cdd57a50c92ea603440f32a2c277a3be6a6b79049c6d9a610e20b0a4709df38c1fa23ac8375d01bb81202f8f167e03345cc7a4c36a
-
Filesize
224KB
MD55f9120ee419da48235fe9c5545860dd6
SHA1e68e7ac6034964da86cbe69b214afdb7141edf94
SHA25676d70498583d1a52325af7dac856fb38bc2d8cde56dd8013e7113f8187d5b7ce
SHA512e413c6ff2c4a37a544f4451171c397ab2fff3661da927b3d8611c3f45cbe7c7968a44fda8a83ddd3202c8c5407d608a4eda4d31399444304a7183a7a798c95a6
-
Filesize
278KB
MD52ca57626f6f910d1403c46ef4d007249
SHA127728ea30696cd0861e2f86bc1aaf0edd19418d5
SHA2565068f4f7288b17798a48ed523b5df9cbdd475de8f05c9d7f10fe0662fb900613
SHA5124b6d13d81ca5a28e65aa4bd80a2cbcc488c255aa1e040ca1876ed100c7d77ae729c90a1047bb37b427e4b043485e21c6870a4396c1b4b82c4a5a5360ca70300c
-
Filesize
177KB
MD5357ba426e92022f178510958368bd3d1
SHA1c96b2091cdcb72dbb34624541785266c00bca627
SHA256a4d05bc6c3bf640370d62afe81229db3f41f3093612ee25556293698d6617d8d
SHA512be49ac9924b98a57db1c32797a935eb613367c086f877870559a92c8ea25b04b1a6e9961342b67d104ba134e8edb3a534128ebe2adc2391e689b20dd9ba46e17
-
Filesize
210KB
MD5486f6a5a27549ba05e23c818a0183fc6
SHA1047addefe56568d10329dbdda806374956c0a2dd
SHA25691587808f46b1ae5828703aaa124feac22049a2ca3e24dba87b96f8a97f9c4be
SHA51221976689af5d087b5d7dbb420d99a4e7ce3c3a415a543fc97b7fd734d15e3a7f878b89454ff5474310f40b4cea23aa914c772bf4b2e8118c0864275220db8f03
-
Filesize
264KB
MD5a5b9422897a10681a12fa874d91d83df
SHA12e8f688338cf397d6df1f7e5107ca53bd3c637f9
SHA2566d4a18dc21c998dc4a07c00559b9b9b6ad200d6ca5c9b1c3e1579488d9590493
SHA512ae7a44f667602e3bdc82ecd0a9e023f684409a6d829ceb5c1e5b99a07364ebda3d7f45a3f890f0483b89126bde4c8acb89020463df2b5012b5c75feb100a38d7
-
Filesize
204KB
MD513cb3a36dcba6c8d4a8f660950047533
SHA18fb265247c44fa4215456d99d794f4a300552d07
SHA25645b2d05187661d27589f35daff639d79c7e96c93586601ba3cb36f434354946e
SHA512b289031e7ed5094e50f5de75e1840335f16a9132be7db66aded7b9c2a8ac47682c2839ece7b885ca61c05500a5034bff80fb3fc5d9db0209710ed176c63008af
-
Filesize
289KB
MD5d824db4d3a859b80d617b8ba4b747488
SHA1c1737b83ab012fdd5bb6f6092376a715113fc638
SHA256360be18c373ed637a82ff1af31135240454d9e40343a34b6a0837fab4a7a1bf4
SHA512117afc6e03047f9103fac1e8d13ef3551f78a34f936462c83724fbd69fe94e338457ac98c8822a13c4926b64deb001ab40d4e84f2f9527b30a856fed86873081
-
Filesize
192KB
MD542258fa4de7865e67b3612dcbd8e3fe6
SHA19e9a6405565b59cfc9c0b0c1a50efe4666c84707
SHA256e18970b613a8b774bc0ba3e6bf58d68af865def5b2e1fc019f44f9c3ad8836cf
SHA512da986d0bdffa58548a5ebeaba3dfd3ba92c2d58200806a2d127b9b52af83e636a0e1a61bd6fa7d7533d3dbd027631ee80616837f0fd611a802638e606429f0fc
-
Filesize
241KB
MD566459d25e72a050d51656e27cb11af6b
SHA1ddc68d4cdc36045f93039e84e13ae7b1de856043
SHA256de5dbfcb8e3c7db0a3999d6771e3c9db9024413256f7d9defe88859f70a1de30
SHA512716c2d40262e2a42e76bdb1d06560537afc9ec3a306758417c90bc3d54a53d6054676565c6b57e03b2ffce3ba717a0189e96fa3f1c0f9e3660ecb2b3d5505640
-
Filesize
163KB
MD5ac5289bef3c50387f1fffa26ec0afad7
SHA1ddce274442eee39811298387b0d15cf26601ef19
SHA25692c135afafb822cf837e91fe5cecf9ac2133bd9b8418fb9fee699a972766487e
SHA5126e17cf464f916ec68b3e8904eb8747634752a184e7c8e91b152089ee755bdbd0aa93d926364e221a5d1764dea4237fdce6e717fa42ec064b6545e66cdc4e613c
-
Filesize
308KB
MD575b3c35262ccf1ee48a8a66931a01249
SHA11e55949b19de10b7a33a9b10096d08f07ef03cf7
SHA2569dbcd7d7a4a81319ecac7345a052771bbc87deb76a9b61cb373a81ea818af9ce
SHA51229a5f8a666c9e21d2bdc04d8cf0c06a51a0766b46f53fb8e37903139a849ee6b741d4222ce807a939315cf92b1c1fe4b0de3bc44bc51db04c0785284dbadcc3e
-
Filesize
189KB
MD55c9680e71abdff86541f87f8c76612c3
SHA12520c035cd6a387e4f1b73e66a0f0c48eea1c5fd
SHA25675fc6d9f8f3f318aed99ecc099776261184c17e0bbd3e3b9d371bce377ba56ab
SHA51275de060ed460775ff1db246983112f456406e015c4a761eeb027fcc60cf334cb4e54a383af7a368a9d6c71f266ade8e1b6238895e9e429dd0026cdfcd65bd1c8
-
Filesize
76KB
MD5bfc55f61d0f2c476a887d110188d239f
SHA1fcd01fecda739873d151607fafc5d6e765940375
SHA256a316615542363eb27b9ae670dd1fbfb31b217f4f6d5b647f8a0d8b659b2627c3
SHA512d9e1cfe9465228c5097be257235b08ea39862fd63205ea5c84793869932095f6dad1e1a44bb79ede87416a1eb18b46986a2964a9f01ed9175da3e010f7c34e35
-
Filesize
143KB
MD5685255c5983121d4c45dd545ffa21c59
SHA18131d3a62898c205043849714992d1171e4641f7
SHA25628cbe8a5e4f9017ea6bb8427d6d74c07985b27fe59cdf7651be8b69f28998443
SHA512956c447197ef5f37ace7a8fa99ac24f0846129b321670911b5a4e20974552a05999ac08ad5d1766e13c258493f215169550faf7ba399780efc221059e7fa946a
-
Filesize
340KB
MD5ccd4a0c05567fc994da37b9fb81ddc81
SHA15cb5d7273cf0a984f8326c64ec1973f9739a296c
SHA256ba3f6249023b695c73e91dd78ea797125f571f06a2afeb8a5953d7ae2cfbb1c8
SHA51259a07dbe5f40140052757f04d1b865068818e9719839d95f7f9ac8d5613a168a0b02a5561f1080572643767aaeaf62887e9386462c37ed91123a4dd0b30b0e75
-
Filesize
250KB
MD5394204f5a35e83e0b78f5baf1aacfbf2
SHA1ad1603b0adfd2f40ef480294b1192e8c6606bc7d
SHA2563db3c1faeb6d6a7bf3bd4763c5ad46fad0cb4cd99b6497ff72cb90022f5147ac
SHA512a41dc33d0610a1b73c5b4be68a3175af6b080f49c0a79846d58073a1a56d005c92ba1d1960365f32ef595bf9170479728d07747abd9635d7990d7a4ccbe5831d
-
Filesize
209KB
MD5331c6337dc5d6720a9a715e8967576e7
SHA130ca8422c5ab73e79e3e78796b80554edb0e2563
SHA256f514a8334b5df348d95fbefc6fa28659ea51b671966f735356fba8635f3a7874
SHA512e685b1dc91375cd88c388e40e9f84a977cb2383b28b08ad5c557e6c1596b71bf5382cbfb3d2e857813f9332b4bde6a558c9d4f4d97ba7528e3de35a0bab60901
-
Filesize
152KB
MD5edb0cb85c6bd15725577869bfe954538
SHA1dd1aeaa7402ed2c1533cf61ac54d2bda5b36b3aa
SHA256b1f9a72e53ab2e4d538b63ffd85abbc2f2bf9d9f7519edcd669a653287ca90f4
SHA51298a9c7cb9b47154a51f4bc88eb65d784494ea9f42c6f926f367b7176caa4a3d4cc5ebc6b94491ee2189bd2cecb03b2e04ccf61afc4afabbcdd8b002041e71b00
-
Filesize
180KB
MD528d3678392b49f518ab2a1a41d03f821
SHA1b98b007a769a0c3f362e888a0978aeade1ebfa57
SHA2564c774c28347586d60415d7724670dbcad1a180b6927da6f47671e4c6de4d2b21
SHA512b22ce43eb5e3aba8b23c4c7970511aa0aba9b2fe1b4f4cd6a5827f9d755b48bfdb8a133015f2b5918c59e6de5d918a59226a4ce97701d00dd5fedbe695a80262
-
Filesize
165KB
MD5f9a7f5bb3c2131c32dd6f87c68a55c83
SHA1820c5e16ec19d74da2d3a119ce1ad6125ae29025
SHA25670e6eb04b7388f727042ad45b4e3ef7d65ff8d0b1a646f11a2d24057691bc31f
SHA5124431ce8e53528647aa45d86e5d1de5a92e026571f8e545b4df93dcbf388e2ae241421386f7f41533c6d7b18b3fd71f79c8b4305eddd23b8333c448bf71acd797
-
Filesize
214KB
MD59ddf3c6956a7a492c5fcab65cd2702d7
SHA1a41c6d7af86b05597dc52313fb7c89e05f75ae5e
SHA256f9fbe51e0ed9b5e03b7484747c9db58282898ab3f9ecc3010ff70b888d670695
SHA512784e0c7edcedbf18b52ed035a033d1f4c9ced5bfbbf67ef075bd1c61c36fbe1323a877b7b7f49df741cc3803d3d5dae4c8309e8741fc3dc25900776efbd477bd
-
Filesize
147KB
MD58cad78519aaa64a99d9ab5df319d4c4f
SHA1b1f9b4225d83dd8b5213ced8d1fcf9d2c9278677
SHA2567ea1095d94fa52d5e93fe7607e16382a8cd18c965f7f970a6e7e3bb02d52887f
SHA51229a36c57e2bf2aa53a625dc2c3ce8ba2ab443848f0d49d6401677809fd9d9659470e9be6e6e6278798f305e0a02952fb2903b35b0b083733ef4cdc7ccb37d85b
-
Filesize
177KB
MD517a24f1f3bf202b076f50a8371970d55
SHA1ecadbe58b20338a9daa16a8c99cc0e476e5306a6
SHA256353811975b56c90d616e7d8c8296c39ffbd70c9de6a61dcee8530f5c2a9a3aab
SHA5129382ee38f98eb2edbb4b52a4594e3d04eef4ab4f44c609cd0083a374c5f871f0d7f49744084f605cfdffa6c2e161bde84164a73defd62f0af1d045ec245c0b74
-
Filesize
212KB
MD5bf695978c3378226084eb30cefdde88e
SHA1156f43607a565c0ad8d7c6f4eec2836396537200
SHA2567e9f5eff1a889ccccd4c69e3d1ff59d414e01a4741b88451ebb3c73ec05e5d88
SHA512c8cf6ab1296528d805ce585548c891846247b686ab1d8499b6beffbc5c1f6fdcd9a3381dc6be216ac4223f4dd4fef1ab9128191daaf2b8217845f0f1532e6278
-
Filesize
69KB
MD5d6d8051a44c844d271a101b2e0c3d083
SHA191c450bea4b195d82e108c0c3572d55995449d09
SHA256fc25cf7a036450feebe9f9873d86f8d31bfd37bdbdbc524b5a824925ab2908fb
SHA512374e61572ae518b40603210dca82633308bc36e3b1e602b96e0959341280542b31fcd6869fa0601817f0b11adb8940695a04f91f00059a00dad81f37e9ac5ebf
-
Filesize
144KB
MD554b14ab001e0e0d27f2151114a1e3ab9
SHA18f56b7226e4fed2a7a7c419fd634b398665bec90
SHA2562f19d8b302ab7fd0806f7633e552b2cae0bae69f1e6c77eb22eb6b043966933e
SHA5128d14590279cf2346a3e806328c4c117f9a8df9ff9c1e5739f03ad091782a6d9983e69beaac15563748e923d6db01c815938f1613ba8d6de4b348df01a4d80883
-
Filesize
76KB
MD5ed81b07465ad6cf208e43f9cc7a8d146
SHA17bc50b165763f294970eda02a7866aa7ef8524fd
SHA25635a4d95f74d639567d89a3e0834898b3ce105bb023ad90dac7dafe8c32940b16
SHA5129d8f38362175700870318e86a79cae5c20731cbe12d26bff996b823605cac7a6acd6898115bf92386728323da46bf74dbba2f0cbd7551a3ed78d5bc3a12bafdd
-
Filesize
125KB
MD5728a97ea81febc8833988702bcf99365
SHA11ec5d06be74fbc293ccc9723c5078183f76e5530
SHA256417578961be536dc4e862358c3733c14251ac002c086c545b4fa06fd838e0c0a
SHA512644111857d15c182f21f78720b59bcc30444fed49fcaf5d95c4edb5fe5ccd3278bd9e9dbea528901884a3644e713d17f1df1fbd6059982e44f51872e890206d8
-
Filesize
174KB
MD5fd005d4afc4d67ebd5307764c0909f88
SHA1d7ff0eff1a4ee4b58bcd6eb4e8cdcc50c880f62a
SHA2567bd434fe5d74cb01dbdcac754a872f18360af726c5d4f402bfd29cc3140c351c
SHA512aa3e64427805ebf03d4720daa868b0ad2ecb9390536fc494d5fa95194e1bfbdab768e39a8ad029f0b57b468b4d682758566a5fa6bfc142b489aa9d87e4273c15
-
Filesize
134KB
MD5722dc5c9775900ffd3dbd8e084949b9d
SHA18a0cb70e88d3aed2364e45c880095ad507035f17
SHA2566ee3bfb5b879df72e1ff9ebedf5f9b44265b3b0110387637145f8a4198b86fd0
SHA512af62768ce4bdba58c5a0279938defd23a06669920c7608e253759d2c57e4082af608dd7f82b63e89b29d4f6a70a0574646341e12c362fa9018ab2438952c1618
-
Filesize
202KB
MD55d54fb1a82c63b18a6563c94165a9f24
SHA1f95fafd07e39acf55fbb17c5991e7db57d4154a8
SHA25675deaa52e07e76032c9b058ee65082f74bbf47e39b4fd942cb506c3cc8cfd837
SHA512495144fc01cb24019df4e1f75b36b7af593bd2a1ff893646bd5043da7af72caa6ebb366f0c74496485cdc122d3b73ed2498a3d017edfccdd88bbdee2d7abdeeb
-
Filesize
339KB
MD549b98d82ca299c9fd8ad0589c03cb31f
SHA130db2ed59c53aa4a197bbc9946dcf7a0db7c24df
SHA2560be9e60af236db1f360326b394236bac3a8c20074fdb504bb8e499e6b8524b3f
SHA512bef0d1bc769c5ae5ccf7dfb4f61facf0ad0adbcda6776520804340dfb7040784e8125039b6ac07b70dd7790e8b25ec4f67d81dd04fe093f056c634a9fafaef05
-
Filesize
108KB
MD5f56aafe9374b899105198af8e1efc497
SHA1a91d01fa055e13b8ef669693e05d67be68adce92
SHA256dfe364c9ed4c96b990126d1a4ed1dfa000fe14319ba162d64763a734a326eb9d
SHA512754950a2c1fb4e29a6d51473288ebb6b8366d58bfce670bc353d66f6c0497baf26c3b66186d0a269ef0356aaadb2bf90168d4584839bc987b826202cf7680c46
-
Filesize
266KB
MD50d356d6be58acee8ae4cd905123900bf
SHA1b0909b74b88a4147cbedd09a10f3b9813b8cf89e
SHA256c48a5faffc8e0e0c0b3500d6b9e8fff1c124fee237d4d015840c3c6dbc82bdb8
SHA5126537027e253775775f7a99e13ae836e089079053d5b08e5147dd70ba9a40ed5f901bf696eb7bad3c454f43bff08cdb94019c9ce7a949842893c9aa669e14f48a
-
Filesize
256KB
MD5fcc386697ace8eec89bebae4188389f1
SHA1f7251b195bf27edb1c31f555f1ba89e954f50b5c
SHA256b295b490f93266e18b6cd20ab8308b89169faa0dc5ac8cea14d9d703f77590af
SHA512cf02951f151a96dfd1e7c11f476179640af79ca1b8aa8508b3bcf8697de4104b63d89fb51c23ac104bdf96b3a39f86cb2579263598e4e6cba48ff4b62d63af15
-
Filesize
274KB
MD588b153e879524a77290c671c451444cf
SHA17209e344ecc907d43a91ee33ebb9f4e0d854676c
SHA256523bd3231744a327238dc715095dd760886547a0dab68802df872abc4afe0180
SHA51260ae77484c2c6aa030aaa254fabab3017dd914a9124043db1cb640036c33399a41174fa0e54d3ee6d85929c7cc9678aadd288bdfbd99fad1ad9e00572f12805f
-
Filesize
306KB
MD5c90900c5e48fa48b7a163c20f598a95c
SHA1b217e556a8f8f04377dea2d2dc8f0f95b8109579
SHA256415a343a04687a3b72982a26f6524a1b867bd99d4037544906b5d655223ad4e1
SHA512a9b7fc95b2d10ba07ea1d85d7772ddf00f5b292600b890373348b96b0ca38d013b8ababee3f169590a5e7b227afb37c29b6e2b2eaa8f0132c4df80b224557d01
-
Filesize
176KB
MD5075bcc1ae9c1e299ceb63f802e9cb25b
SHA19de2e11db3263dcd441c8fcb1b23480efcb6c039
SHA256abfeaca803b825dda30a4afc5b502057e6670d02efa21d603aaeb0028995e899
SHA512009dbc2c0fb4255e55a25cb79e7dc118400262df7e053e246948f00a17b3835639f556cefb8ace20e37c01ed842f85e727fa949086afa05f30ec246d0123a68d
-
Filesize
177KB
MD598530a7f0d6d52c066a6765f7dea787f
SHA1265e3371012b3a4161b18ba509cd8d99e2e86c8a
SHA256e3476fccb803a65fd78214bc89bac585d634913b53425b59c674add24d1b5028
SHA5121c541fdb1692a9e8a24e26e41025515088404819af8eb7a4357e98e68c2392e035c2fd512d5e67ee73fe29d96ff5e72db1b9e6428df3ad0781d9f27c82810891
-
Filesize
205KB
MD504fdba0de7475f0a45fa933900be45e2
SHA1fecb728b773d3cc6292f80444c9b6c0737c638ef
SHA25636d7956da63f5918ac24e46ad2ec43e231004413733f0e77696845e0e1a82268
SHA512a979cb2b3a4143afe1a9a93e38a616c047cff158b5e90d0ad8f08a8be45b269dab3b880b467abec929a71b31baaf9029064b6a7ca342eeef64938f4c95cd0461
-
Filesize
121KB
MD5be583f828928b0982ca223ec22858360
SHA146fcea9214e60c38fae8ec64ef1a7414d809989e
SHA256b13f9fb12d0cbe8d4a05dc5ed5a7cbc14f9f4fe22690bb3e9501182c0f8274f3
SHA512c6fe71258634e793910d5bb730ab20fcab782e1b7ea0394e28f290abdf57ae24a4d3081afe92e916fe033dc9faaaa96b25b8d7704e41286d993b086b01314657
-
Filesize
158KB
MD5b7466ee1ccf352aa44695d14dacbad77
SHA11bab6a1b5a0335229fa71deb00e824c8d20306a4
SHA256e6c802247788727fac84a9411c2f7bbcd1ab0707cd475d9486f604929ccc16b0
SHA512c3645769fb5a96dba5257d5c19481345f559edbc7edc79da8a8f57944a8fca942d8f5406ea5598d80216c979cec0ea12335fad5c0af621d512e6955dcd0ab837
-
Filesize
286KB
MD59b6450470b64b926b6302aa867ee71e1
SHA136b46e9c9a5868dd11a4bdad004b3cc1a39ab49b
SHA256d4002c1846ba873cd2c9363935f97e9834fd5f03d7a0164cb90a4f0c47573354
SHA5127e3a5ed766bcbf496d22e9621ca0c9fa6c4352492981491a8a8b53ec011202e0be574594d076864c32a06071696b5826e3cb183992405e3131b7e41df146d33e
-
Filesize
96KB
MD510fe8390d1a4436318d8e58d458f4d2a
SHA137eb002e34181dddc0eaa5bb9a2582cbb379a294
SHA256bb7fa0d70cff35f58e48f2bb0e98549bf11052ae3bdfd8fdbcade63c83a67289
SHA512d2dcb7cdc5e28a73d938b6c25c7c6b4b2138aae3c7d094ee9fde5ef189fe706b0724edd480b2a60e3ac6b572f2b236fd6eddd9f541570e5495225a97285b608b
-
Filesize
836KB
MD51e632cbe60da3a45243864a9e0ac0595
SHA1d691dacc2bc07de23b5ea5f83f2c41fafa771448
SHA256bd908fc9525647fb2b74aa5b8268ad34ae3e93916289cdc4ec7de728373f9b7c
SHA51237170acf7f4dd5744339699c0069bb7ba6f20e0275e66d7f763794ebaf7c690b731c1dea57ed4987151cc93525a98a1a5a67437137009b17dd503a7d36b2e62e
-
Filesize
433KB
MD5e7eb9c17151f28c04e50111547baef1b
SHA110b606425ce03438a4cf3e0b17b33b1ffaabe861
SHA256c8ba4d42e6713c2cb4224fe02ae5f49e76e94514abc887ac1ff5956f4fcaf5a9
SHA512673b2c5c3fac31043eb4bfa1849ec11471e9327dc9069f4bc1646439edfafe5025210d32ec87c3ed0a578031a19fc5ed0a82d49514088c61abd27a9715ce6961
-
Filesize
138KB
MD51665065547dd80b5f15003c4c7b78877
SHA1e1ec8eb6247b1ccc92a678a8fb7292f6d47dbc6a
SHA256d5ce6297871222dd586b237cf2cc4e315576fb644d859c2b2671337635e28b54
SHA512e617b71afe141d8d7401d7255f58d7c1b5709908425e1eb6bc8adce35324e874fe17975704ec50bdc19facd38d0713e0ae15b2aa1e5c685bbe3f4c14b8740b06
-
Filesize
82KB
MD5aedc3a81a498670dc5fb60e26b0fb412
SHA16e04fcb14841885479fbd01896ad3ed1b5004593
SHA256d47e2221ad7606d0eb3991efe0ef6d0f1a6c98c43d96ab23c176c3b1045ecaf6
SHA5124856bd6eb16e1e0031b5518590abb9d81a8971bb4b90482c70c2a8af3ad0fa2ceada14347368d259a878a61f1e7bb5e5c656ece427a2562e58fc726961921aef
-
Filesize
93KB
MD581b28e12e5b58700e2ee674323a6f546
SHA1b9919457e02b480f4808d4c37f84410c55439405
SHA256629954dbcf735778d83e74126b4ee0fbe26afed13a45deb663d47388e64343cb
SHA512d6aaacf46d91405a089c1e936406d587ac1c77e36a9cfc54e346a2407d1a11e7429c4e2c85e7dfa6d8d3dc303ab037378ceab4333db08c70dabde28284c23e83
-
Filesize
74KB
MD53d3852a702dbb0fdc7b9f102eec5c656
SHA128b9798e065624cf603ecadba3f1e4ed7f26f4f6
SHA25619006707dcc9138d4efa042ffe724e5fc67adb3745b3a0d0e10fbedfa8bbf97d
SHA5120b1c99f6e88191cf799497cbfc217dcf30841251084d900cff57bd1f4dc0b55ad230dd09a99c98268de3a813ea1a3db236088e07021cc28b6f57c7696c9cdb2c
-
Filesize
271KB
MD55fc1a9fc353b22b2b73daaed660b3ee6
SHA1b29d9fba9b044c6dda03b99faf72c2310384e6ab
SHA2560ff838642a2e69dc9258ac3f0b789d21cc805e0cad289b6e7baf87d947560cf6
SHA5122e3050304419288cc93a8c17f28e212734d052a9db7bd4de3111c3c559bfadfe2f9642ebd7ce6aab9416d4f15c8ebeeb43cfdf3c070a7f5f470d7838dc2acaa7
-
Filesize
22KB
MD5914bbd5a355c4d347f44325f72304da5
SHA18fb4146e00bf80a94a86c42f141a3fc94a020c7b
SHA256d6c1f23a65f6671f2caf5cdaa3fd3f9e7e816f3524d18e904b60267865c5c062
SHA512eeeb14c75a428d927fb5366987eaa093d8fbdb48b378379a49ef4c761b4a7177e2c4c3b40f44aa31dab97b46a271dd70719d06bf7167955ec5c7701d758359ca
-
Filesize
1.2MB
MD551a27a3f98693450911e9a28c869a2c4
SHA123e8dfdbbd9e175e1677f430bb25ba10acba106e
SHA256f5e757715a620babf43f8f0c4ab0eba0a0c32541100942c470509fa21f8f92de
SHA51224a304e468ea80591d47f287b15adb452a7bf0dc1b9a071351f21e60883248440fafed2acf6c36e2a60ed297e3410a96d37dbc85e5931256b75abc3a798387f9
-
Filesize
85KB
MD543b3cea1dd19cae6d6fefbb0b1acd1ce
SHA1c669abf62e1a72acf581eae16258196011e67d51
SHA256971861390ad4a23b12e62382700a5b14dadca4de39bc0e9157fe7813e4dad52d
SHA51230459188d406a7931ed34fb752a83ff007ba8725b8a2c08217c59426f69571a224b24e9fbd97dceb7a11f1d1aa3908af8b563378870028ec68a7aab476962c5b
-
Filesize
54KB
MD5a652be74d584198e0715125a7282ce51
SHA1ef7b44a816901a11b2b75a1094cd0c848d215f5c
SHA2562aeb6c50d75fa832fb4af42d0eaaacb0df71ece72fa57e9ad1393c608d834590
SHA512ad2899d13b964be02a289eb91eb6c4cf0d946938d4342252ca61b50692c4f0285da142cab54b5d07aea128197f84dd0f3814f339bef0003c2608fa258019a11a
-
Filesize
153KB
MD56da93fd4942738fba626db7bd999aae5
SHA1a7d4a157913304c556968e93b0fd74d92696f9da
SHA2562b3b0443e36c80932aae9697831221f136e54f7f9d5c8d5df3f8852c4a75bf80
SHA5127482e63cbce745364531bb81eb28469fb63f951810f4061aa69458b4b6b25be698c09fecc5b634b7728ca0d6d3eca7cb15a85f8edb0e673be91cc57619cd8620
-
Filesize
191KB
MD52410d93a71c8a5de5abbb20f4eb0b378
SHA1635c1cea242414d20ea097288154db019b0c9fa3
SHA2565ab5bd3bb9fd98eb5edfb6ba54361b6f229386c367f1d86c87166ee48c252e87
SHA512073e7855d325118d3f7f00ac7399a8f0f180f1d9cd63f4e3265c835cbd8c9069454b8f6129f1d4a7d72bf203d9cedc84f7bf7ab59ce4bc8cbb99e801b2d46daf
-
Filesize
68KB
MD5b0e3a63545ccfe46bae0e7d39e89d6d7
SHA10338d2e5633833dc0e1c1bb6aecfa197b850d659
SHA256a91596c264b952da20db8b327976e4310defbe27cc42b69adda667c36c28d7f4
SHA5129eb9c3462ec3f89f9ebd70744fd7795b2bedac104da9770e4409c14e6b4c3e60152d4901257049f753793b4fff566db6f2fbfefb86b86fea30db49a3e8ea4aaa
-
Filesize
64KB
MD5c6a2333196f4829a7498686ef7bb5ce1
SHA17b1b47a59a686c915cc98bcdb71755d84945921a
SHA256ec818710f84153c09cf66986d207706d83c8a268c4af007efe398be61d00f4b9
SHA5120b480cbbc0dbec8d74191518fa69653126c2ed7fdd80cb2dc727e4e4a2bcfdb287f18dd638bfacfda55ffca3e9b9af5a2edc5090cb235fd980c7ea82960c3226
-
Filesize
265KB
MD52786cc305ae47a2478f9e0b2673dedf2
SHA1452b062d8b9a5a00f0fc69e7417044f8010dba3e
SHA256ffd688ab28aaac2f56ea0a106ecdfb09d6aac6b0550ed30136c4b79db8ba58ff
SHA5129f29b02db3f77be48737058d0fd2bfa48bb1e87f05e7bf50578f8b4f3c36183c3a0e01884ce014a3fecf210d2597ba71b31880d0a9721e0612b773beadf40637