Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
17/02/2024, 13:53
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe
Resource
win7-20231215-en
General
-
Target
2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe
-
Size
24.3MB
-
MD5
fb31f9c8157f739b96fce508fff5a3f2
-
SHA1
fabf0b4e13362f468809abf220f47f0bacf1329c
-
SHA256
d58f68c68eead998a9f503c0d6b284855a534acc584e13be8af5f5e782d1122a
-
SHA512
165d16c4f66aea5e65385232311f4515b76233db42990c85b2c29ad9d4742051c090eb4906ab75f763c61d015203eb506420d987c06fa2639eb6e0fe662a9c20
-
SSDEEP
196608:tP0Hj6JigboXZDwqY8a/qVwsEXX1KOgCu3JK1OpUH2SAmGcWqnlv018vO:tPboGX8a/jWWu3cP2D/cWcls1j
Malware Config
Signatures
-
Executes dropped EXE 22 IoCs
pid Process 4912 alg.exe 812 DiagnosticsHub.StandardCollector.Service.exe 1176 fxssvc.exe 404 elevation_service.exe 4388 elevation_service.exe 3096 maintenanceservice.exe 5108 msdtc.exe 3724 OSE.EXE 1564 PerceptionSimulationService.exe 2216 perfhost.exe 4852 locator.exe 5064 SensorDataService.exe 3688 snmptrap.exe 4984 spectrum.exe 5044 ssh-agent.exe 2140 TieringEngineService.exe 1456 AgentService.exe 3236 vds.exe 2344 vssvc.exe 32 wbengine.exe 4908 WmiApSrv.exe 2376 SearchIndexer.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 31 IoCs
description ioc Process File opened for modification C:\Windows\system32\fxssvc.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe File opened for modification C:\Windows\system32\AgentService.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe File opened for modification C:\Windows\system32\AgentService.exe alg.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\d5c4db296319cddc.bin alg.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe File opened for modification C:\Windows\system32\spectrum.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe File opened for modification C:\Windows\System32\vds.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\System32\SensorDataService.exe alg.exe File opened for modification C:\Windows\System32\alg.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe File opened for modification C:\Windows\system32\msiexec.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\locator.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe File opened for modification C:\Windows\System32\snmptrap.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe File opened for modification C:\Windows\System32\msdtc.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe File opened for modification C:\Windows\system32\vssvc.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe File opened for modification C:\Windows\system32\wbengine.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe File opened for modification C:\Windows\system32\msiexec.exe alg.exe File opened for modification C:\Windows\system32\SgrmBroker.exe alg.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log maintenanceservice.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_103406\javaw.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000682591c1a861da01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e90e84c5a861da01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bd42dcc5a861da01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c5def8c5a861da01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005b332ebda861da01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000090e81fc5a861da01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003f316cbda861da01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c9241bc5a861da01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000083e46ec2a861da01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006dd3edbca861da01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000057f0ecbda861da01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe -
Suspicious behavior: EnumeratesProcesses 35 IoCs
pid Process 2668 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe 2668 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe 2668 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe 2668 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe 2668 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe 2668 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe 2668 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe 2668 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe 2668 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe 2668 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe 2668 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe 2668 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe 2668 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe 2668 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe 2668 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe 2668 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe 2668 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe 2668 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe 2668 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe 2668 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe 2668 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe 2668 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe 2668 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe 2668 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe 2668 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe 2668 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe 2668 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe 2668 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe 2668 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe 2668 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe 2668 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe 2668 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe 2668 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe 2668 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe 2668 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 668 Process not Found 668 Process not Found -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2668 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe Token: SeAuditPrivilege 1176 fxssvc.exe Token: SeRestorePrivilege 2140 TieringEngineService.exe Token: SeManageVolumePrivilege 2140 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 1456 AgentService.exe Token: SeBackupPrivilege 2344 vssvc.exe Token: SeRestorePrivilege 2344 vssvc.exe Token: SeAuditPrivilege 2344 vssvc.exe Token: SeBackupPrivilege 32 wbengine.exe Token: SeRestorePrivilege 32 wbengine.exe Token: SeSecurityPrivilege 32 wbengine.exe Token: 33 2376 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 2376 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2376 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2376 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2376 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2376 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2376 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2376 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2376 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2376 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2376 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2376 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2376 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2376 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2376 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2376 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2376 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2376 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2376 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2376 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2376 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2376 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2376 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2376 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2376 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2376 SearchIndexer.exe Token: SeDebugPrivilege 2668 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe Token: SeDebugPrivilege 2668 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe Token: SeDebugPrivilege 2668 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe Token: SeDebugPrivilege 2668 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe Token: SeDebugPrivilege 2668 2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe Token: SeDebugPrivilege 4912 alg.exe Token: SeDebugPrivilege 4912 alg.exe Token: SeDebugPrivilege 4912 alg.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2376 wrote to memory of 312 2376 SearchIndexer.exe 113 PID 2376 wrote to memory of 312 2376 SearchIndexer.exe 113 PID 2376 wrote to memory of 4324 2376 SearchIndexer.exe 114 PID 2376 wrote to memory of 4324 2376 SearchIndexer.exe 114 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-17_fb31f9c8157f739b96fce508fff5a3f2_magniber_revil_zxxz.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2668
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4912
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
PID:812
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:836
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1176
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
PID:404
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4388
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3096
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5108
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3724
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:1564
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:2216
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:4852
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5064
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:3688
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4984
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:1084
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:5044
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2140
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1456
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:3236
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2344
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:32
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:4908
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:312
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
PID:4324
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5c234c46587a1de9d897b7e2c2b6caee1
SHA16049fa8b21ecb69d4348ece9ed3d0def18669786
SHA2563f24126dbafe60822c4a1dee9d1b1d55f14d4f3cd3385ce6aa41573282addbca
SHA51264797dc200821d6ea2930eb5dd28671c0134d0eaf9b333a549b6babe9841a01a75aa8d376877066105bda4ecb8e99d74fe284ea44b1ac731d38bfa640b5e9182
-
Filesize
1.6MB
MD5afec0b66adecced90d4ea320bc096c70
SHA1868c5142c7806e73431e61946bbd076c2d134830
SHA256aaac7e497df3e1ad0d0b0d7b532f1015805b8b22c17650e4d5a2f8086d6c78eb
SHA51208b3aea75a93dfd472fdd4e8c97f17be82d56215743014b380f38b6d83d0b33c7d8c858c1db99762a76b3c454261b4bf8d00ccfae921aebdf909305da2c34e01
-
Filesize
1.6MB
MD5635eb9f2331ee3972d13a614f0910a01
SHA13123136b48404bf8fb48001b95b1237091adc8a5
SHA2561f193990b13e4f2585639ee5a7ea4e793d7e8196e8774ae6d6b7374284f195d7
SHA512d42b393ad7133d91784cdd36214e9bcd9842e40f4634e79a2de5b9fc19b545497de5bd6933b46e27e09e35b36310a738c5ff68003b2772a321e6478db9fccabd
-
Filesize
2.0MB
MD5a6ee6836bc0f28f89919ef72b57dcff8
SHA12b409e7f52933f44b1194a99139dd9937e09c1ef
SHA2567e65fe034b7757eee42ce0c91b6df59a36c233101148602c111b51306b72f412
SHA5121bd2f4a83feb12c1913273d54d25e22db92a5ec45060fb32e2eee52c6d19f73b9039ea5305c0ea9e4daacb464295fb6d6d07b18bf018cbbdd0df730cc22f1a13
-
Filesize
1.5MB
MD59a91b2158b8306796c2679ccb3d3a536
SHA15e2fcf29675b5f012d39f8bf3e0e4e3b3ea932c2
SHA256ab3e7877e1425c8cd9eb68709158458e05c6b2e5420f4772393dfdab6815c9a0
SHA5122256a511f8c7915b443806c35d0ccda5a7f1a7913476293c776344cc53e259de1e5629409d2b16d85d9c84eb359fd0d15b953a41c71149a85eedf4797217c03b
-
Filesize
1.2MB
MD558d6c457ff39bc43be1e25a08313a8f2
SHA170aa4647a39934a291809e470ee76b001874deaf
SHA256ec01f9ea1fa0f00c8d6d09bc8b1fc7f2b5e12c79f0e66a103c47f78022d46bd8
SHA5122286362f5863bff9ad0e2662cdc39ac69412236dd0c4d64750810c4235163ddc33a49442c3f417c32a798a607c5b1dcdf68b2fe5e38c95df478e14324fcf8d8b
-
Filesize
1.4MB
MD513834244954c5532345bf3f08a5fe224
SHA1cecb85a70621b8bbafe4ad67fddf9ad9c7b63871
SHA256f6da4ce0f24ba3f9570d8e17cf240b9fbbdc0f3cfee47ee9ab13c938925d305a
SHA512abb26eb0b90361ae91ca50ad0cbb58908474cdcfe3e261d4633e91d253047a45ac18a7c6378ff53bcca46b9e3df8bfaea59c6ca13f2c31d2fdec4950a9defe0c
-
Filesize
1.7MB
MD561775a54078ee66f43839f40fef0330c
SHA169889837c6f08109ebeb9b9a58512c0ce26e6686
SHA256aab41756003b6397e75cf6497568cd41005e8afd28bb954ab575cb0d2ff0cf0c
SHA512147c1c41e48ebf8b556127599bf300e9936929f8a0d260de78637702906a53d704807445efd0d20d15a5fec9c176c53c294bdd5693c2cc6f2d6e8f1339d34d32
-
Filesize
3.7MB
MD5a154a1ad224bedc0f230ba3b71f26c50
SHA146dec451e4be7b350b11796fc7db45ea0e2cd790
SHA2564eaba5a2e7d0aa9db81789fb08b29f95b27f859426dd4418d79f3c7bbf3aae7f
SHA512186fd29ec2aca660053fd7290c3b68590de8541d4a6d20070bfd4b0496f8fa29b0b926adc83507e266160e9a8ca7fc97afd35b9583352260ca040b16c7e2a55f
-
Filesize
1.8MB
MD56b518c4c4ebca1d0c2e995056646596e
SHA1d54a69877c0f8cd28070d22ec7f338eb43508e37
SHA256163a548778bfd0691207e5f4c7a7831faf32492faf139dcdda447bbddcf84b47
SHA512906c62716edbdeeac3da23ea424a1637848a2a98183002dbdbd132492e0d5ac7afc75b2e8560d072f89e1487cab93ad26a69debf97389030da8c908444660e24
-
Filesize
3.0MB
MD5ee00ed5c99f029f5d2441174e3c39550
SHA1e75980793324b67a1a7c68c3863c0304fda2dc2f
SHA256bf7c5b0f0c1958e31472dbcdc166931d854496146d1763e87390671f056ab361
SHA5123b51d08424a7f775a6b48c43d3b433aef38cec654124f65c7354da5b20ca65864e9c201c6160b47d4bf14a17e23a2263c0bf2d04c01a5c12cd6e2e6e7caad3fa
-
Filesize
2.7MB
MD5107f3ec39182e391f3ba141d4793e219
SHA1f44303875a44a7dc0af2c622aa0f3052bb747c9e
SHA2560d2957c499ee03d1ffa86d41292809d0f18266c15e6481ddd7a24b4e4551faa1
SHA5128a4d910b3c83b329f1a306f7aac076f5af54774e22b659c5b51a058e62e78e117d3bcdbd201d7db517b5c090d9f68af6c575c4d0baa1b336cb5a363fd6c2918b
-
Filesize
1.1MB
MD58a699434da1d5daecfaa9883a5368826
SHA134a729936f7fe40948e2f9814bc2333c1de16a03
SHA256d20171cba92ca74551658aae769a6a1e4c44c0f6b54acd262c7a0f499a28ec49
SHA512e091777bd77f84bd4617bc90269bf2aba4fd3fad262461c756aabf0b7711ec415cae5a9fee26081b027c6f5874cadb8baacadc3eaeb5a0f5aa6bf52af623a09e
-
Filesize
1.7MB
MD5c750690de35cef112db208389eb664ed
SHA1cfeeb66b918f36b7df5f278445b58aa638e58990
SHA2567e10754790f9f30459cbc6ae0bf3ada2bfd8813194abe0b2475a28e3a4e5e467
SHA512f36f0fceac4fea6741f6560fba416b60e7f5ed51d4c7ad53084fd0e650a8a4e4c70f3a5ac5855f74766d47073a6713a44547463727926a383053334de22a0150
-
Filesize
832KB
MD51ccecc221f078e11c3bff6dc340d9ac3
SHA115c8bab9ede4cd1faec6d8333376364a72e59389
SHA25636ce762604492e3ddf1371c0d7ca314bf70509b714082a6cebfe89852f79b463
SHA512ac47d3a87fd8de3bd22236feec12d9b6ac4ec1df9eff56b91500372b487613dcc10658fa86a1396cc26b117fdfc9a944d81e402ceb516178382977ee4e57638a
-
Filesize
4.8MB
MD57add6ce2f54565441642aa1a58cb38df
SHA1d36930bf5b471545f13088da462d66c8e3c8f5aa
SHA256a566fcfb707318c0d1d3a71341abd9bef920be5309bcb269019c2ce9e22fa4c6
SHA512efbf98b10a75514a3a639ff296adb32a22e8da11bf7e4263b687fd2df5983da3d48659200ab2f60cf7eba37801d29853c8ed0671760f8c2062289bad70f76008
-
Filesize
4.8MB
MD5926465ee6fa8dee974770406e821b1d9
SHA174047e973e486bf9ada9bf2a36739fd73736c0eb
SHA256dfe0367f9acc5f3cd6c42371e7ab6cba9066db7590ef5d1ea24fd4025072e0fd
SHA5126655feaad86173c334d4212baceb6fa174af656cf170e7ab9a3148832c7ff08c7c095bd858a7d992dfd49ee60b6649a5522b36ccecb7a2ca04b399d6ec46c55b
-
Filesize
2.2MB
MD523838d3c24fcb1dd05823cb0aab0245e
SHA1c57d7b70c88556b5c3f82783fcbf8432b6f6b0da
SHA25608828b47f0ac7668feb12223ceb132c2c4156af9f44306d6e9403ac36ee56ad5
SHA5122e97de562ded3982bad9fc3386934dd6e3f4cb6bcff1eb85e0076c1e85c3c8ea8e604b4612ca9e3db6278fc67d5110565f20a329699e44ea52a49b9ea4c3416c
-
Filesize
1.2MB
MD5ab7bff322d0ddb2ba3c9a0b71d8f3237
SHA1744bcaf720a723e3cb8cb10b43d40a389e119a7f
SHA256aa3ffa3be7ffd962787e11e3fd2839df8c706cae84fd7496db52e051870780cc
SHA512ca38e25fb0e00c43eaad6cfc91bf207fa91914dccb5fe0032b30dfa45f1f2e2c25464c25d2300d8aa730a8b7f73e252b91220bc16c88761bf538a9dc142b8ba9
-
Filesize
896KB
MD557de33049321f36aab15128e3237d01c
SHA19e2cfb4948bbc17e93f12092012416a134a99acb
SHA256e72cdeca098534075b14577e10547c70e810c11812582a43724103a9b264b6c7
SHA512b935702545e88fd002a66cdba3f45b2945a9a301d7527fa561f47f3f5bd54ec40e79adc6590d02b461c92e6f161b741e76743ad4f316034461772614b96fe90d
-
Filesize
832KB
MD5753eaa2f6b4d69e25c6485dc53ea0453
SHA1053abf973c295e7303a17b3f536df171b569902b
SHA256368b2f51804fbee67c21bc474dc5c6a3501d21026ee982207ac1482582e84c89
SHA512c829b19552df692dca4795d5d57d234d8f354602077493e679afcd77d8ef39766971fb635d768a30421201766e7d3dec9243f35bce2fa926a9b64f43e129958a
-
Filesize
832KB
MD596e4438518bf3de1fa610bda5e0aa246
SHA1bceb5a63c1db8d847a47101ff807926ef73ca770
SHA256c09d2c266a7e0439a92eef76f3fef6b7e42d577c183d66fe2f5c15edcd331fe5
SHA5128f56f3d8fcb72d2368ac2da49c5fcb81ba0d50c3c3f6bde5e134aee96ceeda1a5f4e19017d3510424668da3e1bed556138957e39790c31ffa0b07039f1072a4f
-
Filesize
832KB
MD52a12b97d89a43cfbbfc7ac1bda9c5662
SHA18be8db9d4b35852377c3c3ceff9061ba81227ca3
SHA2561f2aa2bca1fab8887fdaf334927bc33a174cad82b5bd59d62f71e76b0742aa79
SHA512b630d2d3cab5d48f48ee19d5ca2419d0d51708475ebf553479d3fa2a74e389f037bb65fd8341f33999cf9ed536a49e0eb26ce61071541b378017a7a21ab3e07d
-
Filesize
832KB
MD51e1c429340b780588236fbef0118b650
SHA1cc1b024016b63eb685a2a7b335dc6003d98ef60d
SHA2568983fb53c8ce80e9729c7034c54f7dee436067a566d745250ec99ccbc3833e0e
SHA512a64b178d375a0f4e75f3ba96792ddda8ac59b970377b22083e49c629c1cb7f67bc4b3b3875d342b723f1abd71e958b6b92d4680698539676c8b4383d26069cc0
-
Filesize
768KB
MD5b909a2cfb18ec11b0d24c0d08b0b32f8
SHA15fd3b22fb20fc9ae605e36a70c0a0b29286b0e49
SHA2564c96660d4cb088f555e4494b602df7ed0b37844024415d87bf6f64c13844d054
SHA5126940b3cbd6e80f38a58db99233bb9c310ca275d2fb496294bc6203a0fbdbf5786f8264bc185ea4eb71921c976f9ff24143a1dbb794e4a0c2f6701800291b588d
-
Filesize
768KB
MD589e689e5482a963faa79db3ddb49ee66
SHA12857e9c5132457a694c0198202dc089fc2ce3326
SHA2564cce025032100e932a87f8a6bcd0c327cf480714004aaf6da79d0093e1dc9813
SHA512325dffc8e496653e94b60a8c2b0a3423f23b210f5f215126699eef7e266a7becd9532e200583ce2b1b73af5aa7692ded99697d4b3b57ed09bf392cb440279365
-
Filesize
768KB
MD5d7f8576a08546bb89d0e55ce4d1b7ed7
SHA1f308028c8ec42ec2e09d5848cd213db55c87e0d8
SHA2562137aab3d764b0d7b9bccbb082673e11a4a6cce0f2fb8e6a77ac764e761678a0
SHA512fa278dc85902ec431ade493b6b0e949af73d64200e7497c2aa15ce34b2a8ad1304b9b687c85d80265526fced52bedd26d11f588cd80820c64589f813bcf484fb
-
Filesize
768KB
MD59af92ad5533ce18e5c81df66d23d1c07
SHA10de04223648cae0a493ef45fff99cbcd5987324a
SHA256f4ff806da6ce921c25ce230c5288393cac2765693da17953cc35749439d69869
SHA5128e0bb1d442e3a26248a4f339204629345de5b0d3f0feb80341fff98100849c0456ce65fb42077ce82521513184d09ac89df92e60cd2bb9508e782259d4beb1aa
-
Filesize
704KB
MD5bf78272b6559ab9103d5cdfcf50869c1
SHA132282dcfade5fba9786ddbf7885f9a81f431a23a
SHA256982cb1b99499ccf4831caa895fe9abeb7f4a7248fb5ee0fef5f73b7df044dbfd
SHA51212d6cbaf6ca5def0a73668a1c0089d4796c1928fd43655d266187f7131892235650dba0924ccd8992a772b30ad5eb3f8d106ae94e89081b8666b90a2902a80c5
-
Filesize
704KB
MD5a87ae8d3690ffdbbe26506ce71a0a8d6
SHA1fdbe3c79bf4c4f9b244dd8a1a428c7d538f938f4
SHA25671fe230fd765c793e0d3848059c9081434ceac16af54530e208aa7dcda287a1a
SHA512f50368fb605bd8153b5fe560e3f37fa3e252391d271fc3697fe2a918ef577ada4db96ed3e9f36e4923f988e865c0f21602077d46deeeb00efa90a7a5339791be
-
Filesize
704KB
MD5f0b75f0c13c44338bcc4b8883580fa09
SHA1c3cbbfb1525f3d8cbdb731acfd6f5a12c26a1db2
SHA2566cd81289bdbf272c4168cdc650dad7a192b9e34045a21baded0f43cb6798ce0e
SHA51224edd2e006861ff253adf4cf4ae5c38745767260fb91a129d1daa6481ccd851ba3efc89f5c5924fe15a0441af08c9f7960401e937fc0a3542f67366d6c3a7566
-
Filesize
704KB
MD5388611a6dba2adefb63578af478c6e88
SHA1be40f3619cae33d19b006dd038c54711fad6f74f
SHA2569b5b4dcac1bfad086617b6659cfd296a4383bdbed1b2aa4bf20c2b9b630e45f8
SHA512df29f8cf9e96bf7ceb8def4c873897c6dc3413fa10767e83c7798a2e2844b590555411d2c9261e1711ee6ae45bf50f298187f94317bf45ef2c09c3581c065fc2
-
Filesize
640KB
MD53fade7b34c9c6f07a9c305d6418ce865
SHA1074fa0e02fda390f5878ccd15a810932764e632f
SHA25643db3463f52402a26e3551d3fe99137931859f1dba24fe6d443c4f8d6754ad07
SHA51256641637e8e181a3448bc2c2c89ef65a45c0c8095a848578f68c9ce3f42e100b5c4b484f645af775a16cedb85b08685e044f6bfc1ad19b89a6c498b1122a7f3e
-
Filesize
640KB
MD5266d6265866b0cb5d92e138bcf270ce2
SHA14143c82635d04f849cff30df082c9a4cc193b7ab
SHA2561391063f82e49dfbb089c9d6d78666547922a3ed519323c6c1bf29d79435b04e
SHA51218d342deade13e067424a0c4e2f8e12d88aba6f590edc4c5409f2450e92d6aa4858e332ec83ca21c4a2e794e29e0f48dec098861177b5ba992fc2d7fe00aa598
-
Filesize
640KB
MD549db04ece456145105bb5adf0b88aab7
SHA104b62ab0c990c3f3d1321969e4c79e9c06eac05f
SHA256293cd4a8bce98efce37cdd62c080bc5858189d38c86f57c88c22c8246ca785e6
SHA51248ad5e9e2f2e5be591559115daa2a899787bd9fb0d80cb7afd4b8fac110db616012b0083bca5a800fca4756e58a3b53d9abcd2f0196d9be40cc53e248424de11
-
Filesize
1.5MB
MD592621a5c5a6401f862d63ac8696729b4
SHA184e6635513f9e44af909936de3fdc8c4841fbf2f
SHA256d26babffcd9f5429f9ab33212f4dcfceb05ef0c5680d7d5a0ac1f2c40667d691
SHA5122014f6e3c1eb18ae203728abb026b3b540698085386b215ef61af6281ba56bb53d2e195690815a77c64f111f99c61c3b076a989e19e8eecf4928b7f7a207a28c
-
Filesize
1.6MB
MD5894adfc0fea580f9dd29624d29133ac9
SHA1feb7f83c60f50a10eef6e0840807a272c73f4fea
SHA2567f9bdbf9ddb567d631943b0086ca45d91ccdf3aff71ef361b49656b1404c3e07
SHA5128a076c6b9ff0e75857354b721e627ddf2cc01449f870c9b191cdb3522f7289687e90652defd840175aa842131fec05a9cde9505152b668f714d1de7a12206673
-
Filesize
1.4MB
MD52157cce74f02225dad1a228075a58fa9
SHA13e01f5bffea7fe84d3bb9c84517f7779ebdcd5cf
SHA256a7e8b6ab8b62d9bbec498d16ac82056eb7e5f4bf4815219515ae8b85353bfcd4
SHA51285ed9cf9770ac4b75f8d4d89a73b8fe5a55f5cd553acb2c5a653184001a95db655d2991354e545886ebc1f4635767f253c38fdcb19e5a8633de10a560d15659c
-
Filesize
1.7MB
MD5d1e74a4145d5304449d838c5baf6454c
SHA16191d22c6d9d22afb4e536192667a950d9332acf
SHA25619fec68cda3d853ce53d1aa86d06366429556bd47b7bdcb20fb6297e675656b7
SHA512940a5f7297a72cc51221a1d4b601742acb6722328480a08e5ef82965294aa1f184797b5c37bca894d0e4ed972217623de05ba415945fbd6f787364e27a500090
-
Filesize
1.5MB
MD521dc8f57abf1b8b39648306481134637
SHA178556a0f1fbef81d6e6568b4a05466a4c6f9eb17
SHA256d2f6b2d38e3af23f8dedfc079b87f0ce348fbb117e2fce78f2340e5ae1613495
SHA512059e6f22aadb94f2a250a0238d2bb6d10b629a1d1de057e143f8b330d2944d3332c2bebc7204cce30336b683b15f2ffad79255dd8fc1b7a4836ff04d7bf5df6f
-
Filesize
1.2MB
MD54cf740f8259a1fd43c7cde5174a96d39
SHA1bb78c91bd02dbd00f1bd771dbbfd2aaf718d3c30
SHA256514e19894b307931d1e0b5ca9fd13fa2c3046429f6e3392e9e1182837c3d1866
SHA5124f31695ce92d81e111a2192679842075b41a8e78f0593e763ba5adb46c61d00742f87b0e6545e020e4801fb0dc799147a08137baadca0f0189cf26e89ddfdd13
-
Filesize
1.4MB
MD554265d9b9e59d7567870bc1d65ad481c
SHA17d64bf0c1eeb5b469530c9be8c4094fc7e38e833
SHA2561bcea31b8b7439e45b39105ab6d9804e679db8c1a61a0a49cbfd817fae73b1ea
SHA512b9b0fc4cb0c10aa50bdc4633ec5d1c93a21c64ea5ad5a14ad0ce16b496f1a80a1537e5378917a66ad8be23a920833c50a8168193b43f0e111876576bea80c878
-
Filesize
640KB
MD56fe58a3cede64180b15ddaabacc19a54
SHA1a4a64735a2d81d37ebfc04bbe0490189f391aa11
SHA2560c6f38b685201f40f381c47e2159a877554ff7a81d2314a693d4d04e84815e78
SHA512bca3a48aae01aa011332cfd7af6c8791d329bcecd981dbce819fb69c430ca4165a10264863b178d40cbc598854c9525f2c1c70454876b0ee4e80ddd9fa6af488
-
Filesize
384KB
MD5f469049e447c2ef2c718f0fedaa5c507
SHA1d0696aa6e51bcfc4a59d92c5e8d0b5765329b13f
SHA256a7e8c3c71f0fcfe458a235550c4342e8435e99c1c905f44fc4525031e7bf33cd
SHA5122b872c8a3009dbc1d7e5b73cbb309238597f26b1e4ab8e5f676ea58a37c4ead807208eebb047e73610791f2eb83e3f45b0de1b6d06351c063d96a7fedf82e585
-
Filesize
1.5MB
MD579d5970b47abc811b80ee3cc50bd0674
SHA1a01761adfb54b53318a3ca317eb1799a4aa91d0e
SHA256da654dcd023e7ee9726fb0137baab7717ab55e8da8fe4fca309385be0ceed5e9
SHA512d7208254f75f45317108a96afc9b871c7bf308dc5a3edec7da5f6ba14692c5deb1e78cf54dea2d75b56f489c903d99d052c4633f68df6ba8026ea900877e2fb2
-
Filesize
1.4MB
MD57ed60b2faee240ac229da9d0dc92082f
SHA14a87f8f54be959972c0daca7cf222c5b2763d091
SHA2565fe674e16f0f8c25dbaf067ba8b6c8b1fb68848d4911532953745b97aafa7408
SHA5123633649eff528eb5f5f86e0a509a766315a9a853e8e07c2be600198f2db8fa3e7f906bc4ba98344294fb5730de52f8a463f17d32afbf68e55550673c787b77f7
-
Filesize
384KB
MD50b356b6a476881ccc4869af4af56b1bb
SHA1fe036aa4a4513463477e84f1cbbe789d03ba9a31
SHA2564ee17bad0e1bbac1590d11cf38544f48b0c8d9720c91685a236d1ba204a1ed2e
SHA51285cbc7b839f7906c0836e9c38f8d8d389c7c09e1b7ad10746b22ce53211ee6bb754a73d4f8ad544a7609e3b22d14814b58ebd64eec21e92e0bb08faa4030a2b7
-
Filesize
1.8MB
MD585a30f1c37f21b802bf6b06277e6c988
SHA108b6816b0be7877b27d82169b11f2c3218fb0767
SHA256443d3d0e68e289a2d2c27a851738779e34c90d4190b5a0ee636805d916dd3923
SHA512880b90e808fa6de60ea11f67dc9698af09d75f7ac8c4b79c7a8280190d9758070705413049f25d8182209c0efaa2b4d7f1f1a918c98b18c3e04b3000ccacea7a
-
Filesize
1.4MB
MD568ccb9fc1f15652ead4075c5eb16aff6
SHA1e600430325c935c1d3df8fbf7f18d1c2f9f37f14
SHA256be59eeb53d83d36870a5ae33c5296a54006a6c862237478a7b0e57cc96c4cdc8
SHA51269b238343a92617bfc9046b7b005d8bb8ff1da379201cff19f2af7fb00ce228ac5c2df6099f09f4a956a0e9bfaf0a399476369fde2137bf116a754b8b3978b7d
-
Filesize
1.7MB
MD598586c682547530f6c4a11f4a5cabe6f
SHA1c539531e101c34c9b8d6f66043c0ed7d23482d3c
SHA256b9124fc4d46640e6dec5248ff79dcdd68283e9838fcd46af6a507b6e8c7b9615
SHA512bd96aa48b2d9c3006ea7a2ba58de9bfefea6ca5f210da07c4c9a7ade37f12c90a24adbb0562fbde786f272ea4911f72f47774c8709a548095fab39849be9d0aa
-
Filesize
2.0MB
MD577205a97ee7564dda02c29b3a1c3ad65
SHA15319046633f75462b27850f7c2887db5746b7bfb
SHA256065ec8c203e4843c40b99a3bacd8a36de9202d01e976667f6dbb4d582391857d
SHA512cd378658778c57108df19e9669aea9d8c21d86ce173c51d5a003f3c84fe41755e367cea42a363ec097ca5bf0b9c3983a7e1d45cb2793bfdf8f1f98ef377d3922
-
Filesize
1.5MB
MD5e1086f30a7e625e44ae042c9b4774006
SHA1220df86f9057fc9ff8cdf2ec692a6ff8342f8476
SHA25690e686b0d3e6a0f7d12e8f7dc17e74f131c06007fe91d614c9f23f8337294ac7
SHA51277e840442b3b0e48ec9d266a279920bd9c0aff16d2bc178dcbaa6585410af77cd1b31f6e40421e375c26783cd53f8177690f69514a8508400023ed9e7d2747ee
-
Filesize
1.6MB
MD5784eede8fe0b15f54a30f15a8f34608c
SHA1e32dac63f5017234ad838b47502ad6b029144a03
SHA256f1f402a86485b4d69040143ff6019af05bc8472e23f038f87c304529fb6aa5d5
SHA5125f6e96a791a0522104154f1989862c3db371d59376d47eb4c8a825a7851d2becd15679be06a651b9b11d123205105b4e0df32365a5e46609d2e6e895b50636bc
-
Filesize
1.4MB
MD501d10d3e86a2ac0a22df746959bfc98f
SHA1412afefbf9b4b5288039229b2b7cd425357fbcb4
SHA256f6f9c288a11fec2f249c62a0b69cab65635e2a6ea0b1e4da924a101e159889ef
SHA512ccdb58ad8ea68e7241b94ec1f2a275b47818c77110ba153528b5ee02a999a4f55853857f2395a6ef4d5bc8f2667b9722716b845801a63774d4d649101b7a2334
-
Filesize
1.3MB
MD540b2d7104bdb2f12be7a021c3d1338bb
SHA10e84501a3235172752944874b5f77565c9dd1735
SHA2565a8282ece2a0d30a3923d533a13b3fc82d216c32fc78238ecee4ea46a473a0cb
SHA512d44e620d59bb7edb9a0821c09a845cf30db5142f67a03b225973c800da6f0eea0efc5a7b128edfb9aefb49a9f5abcdae45f9aebf06d41a4d91069ab46088f170
-
Filesize
320KB
MD5fd1100b344f285057dde563e01dba6a5
SHA15f84d5045284c08a19f7c33025e6c81c90cc296f
SHA25603b7e8fbcf18dedc7dbe010557da1e4e150c5643f4a6e4253cf657b98519fa5c
SHA512db1742f3b77bdd1eea67e4598174eab4edd38ee0f0b36162ac5d93502cd178830caa855bb60e1a406cc1383fe5b151bc27b7d496552980d24212b274f2a50b8e
-
Filesize
2.1MB
MD5882fbb1de679de7c0f72ca1c302be482
SHA183c6c236016ccd767b923ee5c116aaa7ae87ea35
SHA2560df6e18001dc669037693597c5df84b41e2e30fec1629614cca22bf4b953492f
SHA5125e1717717fbd08c51b540120fd860ba376f08358ae07f02a3ea90079d4e7ac41b3530b9bc77d8cfd2e9924e2320c2babd01a0cf0bae9ac61306d384df477ecb9
-
Filesize
1.3MB
MD53a571fd5a821efc339bf66c8b745b612
SHA1cf19f35df89f0dd10f23a2261542dd764635f8dd
SHA25654b06cd7423894822c52a4316888aa3bb0987c05c3af2ddcce4933b281dfa750
SHA512f7800df318d54015172a9699633639311fe2d199b17285b65927b7a46cecab6b03f76cb343e36a109eb61c8e30fe744498249f308c29a271b5c849608937ee83
-
Filesize
1.7MB
MD5bb9e852f4532e25cef9af9cc075e26e5
SHA1711eebced1b65d1bccb732088a03b7e3895f39a3
SHA2566064cbc4f60e7f57fc2e17abe8e5e362caaa190afd0b408764e94de58ae9084c
SHA512d093d2534979fc89b0f1f1ce22cf1859368938b0d6fd92fb5391915feb269d690bfebf5956b205247bbb4203cf539e028d41607939be1ea499a09c591b3961fc
-
Filesize
1.5MB
MD56126917df60eb1ac5b84e27a3c7c43e0
SHA10e4b918c93386c9f6a1ebb4a955272890f180cf1
SHA25682233e3e85721ae9b3f01b63cd0ffe0bafe1e78365a862c94fa601bdbcb74c8b
SHA51291834dcab83b7305164e29c3123a5678b24e26c2135bba6add55ede5a1ab9dad9e780ca0aa3587d75ddc48aa1a025acc7c04aa07b8938b0ef04209185f46d1ca
-
Filesize
3.2MB
MD5cf88094e3b11f220cd1c04d43411ef15
SHA1fca03a93e9c667de12fb1aab7388e4aeda5ab981
SHA2561cf6d81aa2077e1cfdc4fa5e342beed87ca8c4b47848767b71866fa5d8d17a47
SHA5123e8df35fb9e6f9371b5e3afe541b61f6b44eae46dcc4877eb0a909e81bdea721bcf9f4aa583691a6c79d767d4f40cfde716c987cce84197427f7ce29da52ca78