Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29/03/2024, 17:23
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-29_e652df60ac2fc31adabcda5fdf4f19c1_ryuk.exe
Resource
win7-20240215-en
General
-
Target
2024-03-29_e652df60ac2fc31adabcda5fdf4f19c1_ryuk.exe
-
Size
940KB
-
MD5
e652df60ac2fc31adabcda5fdf4f19c1
-
SHA1
6db3a53692951cbe1d7286beb1eeee66cfd6b8cb
-
SHA256
f2443023f117626ab499b7451da15e21deac6f6a88112387f9764186687e056b
-
SHA512
39632d650e0052a190bd7bc39b8ec89a30a2d23d48a208174c531d678e11664249eac5fc834195ec673a279054de982612bcd6f634d7ebf647011d580b3da834
-
SSDEEP
12288:6ObfA4LWOsvAYFTaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:rbL3UTasqjnhMgeiCl7G0nehbGZpbD
Malware Config
Signatures
-
Executes dropped EXE 22 IoCs
pid Process 3996 alg.exe 3492 elevation_service.exe 748 elevation_service.exe 3332 maintenanceservice.exe 1040 OSE.EXE 4964 DiagnosticsHub.StandardCollector.Service.exe 4636 fxssvc.exe 2740 msdtc.exe 3640 PerceptionSimulationService.exe 2504 perfhost.exe 4280 locator.exe 4800 SensorDataService.exe 3644 snmptrap.exe 4552 spectrum.exe 3512 ssh-agent.exe 4476 TieringEngineService.exe 720 AgentService.exe 3368 vds.exe 1816 vssvc.exe 2964 wbengine.exe 4468 WmiApSrv.exe 4656 SearchIndexer.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 24 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\d206ba36205991d4.bin alg.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe elevation_service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe elevation_service.exe File opened for modification C:\Windows\system32\spectrum.exe elevation_service.exe File opened for modification C:\Windows\system32\SearchIndexer.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2024-03-29_e652df60ac2fc31adabcda5fdf4f19c1_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files\dotnet\dotnet.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe alg.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName SensorDataService.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000049d46713fe81da01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection" SearchIndexer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d19fd112fe81da01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fdb00313fe81da01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b502d412fe81da01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000673a0d13fe81da01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" SearchProtocolHost.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 3492 elevation_service.exe 3492 elevation_service.exe 3492 elevation_service.exe 3492 elevation_service.exe 3492 elevation_service.exe 3492 elevation_service.exe 3492 elevation_service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 652 Process not Found 652 Process not Found -
Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 912 2024-03-29_e652df60ac2fc31adabcda5fdf4f19c1_ryuk.exe Token: SeDebugPrivilege 3996 alg.exe Token: SeDebugPrivilege 3996 alg.exe Token: SeDebugPrivilege 3996 alg.exe Token: SeTakeOwnershipPrivilege 3492 elevation_service.exe Token: SeAuditPrivilege 4636 fxssvc.exe Token: SeRestorePrivilege 4476 TieringEngineService.exe Token: SeManageVolumePrivilege 4476 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 720 AgentService.exe Token: SeBackupPrivilege 1816 vssvc.exe Token: SeRestorePrivilege 1816 vssvc.exe Token: SeAuditPrivilege 1816 vssvc.exe Token: SeBackupPrivilege 2964 wbengine.exe Token: SeRestorePrivilege 2964 wbengine.exe Token: SeSecurityPrivilege 2964 wbengine.exe Token: 33 4656 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 4656 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4656 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4656 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4656 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4656 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4656 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4656 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4656 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4656 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4656 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4656 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4656 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4656 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4656 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4656 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4656 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4656 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4656 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4656 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4656 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4656 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4656 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4656 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4656 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4656 SearchIndexer.exe Token: SeDebugPrivilege 3492 elevation_service.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4656 wrote to memory of 3836 4656 SearchIndexer.exe 124 PID 4656 wrote to memory of 3836 4656 SearchIndexer.exe 124 PID 4656 wrote to memory of 4996 4656 SearchIndexer.exe 125 PID 4656 wrote to memory of 4996 4656 SearchIndexer.exe 125 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-29_e652df60ac2fc31adabcda5fdf4f19c1_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-29_e652df60ac2fc31adabcda5fdf4f19c1_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:912
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3996
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3492
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:748
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:3332
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1040
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
PID:4964
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:3972
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4636
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2740
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:3640
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:2504
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:4280
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4800
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:3644
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4552
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:3512
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:1772
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4476
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:720
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:3368
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1816
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2964
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:4468
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:3836
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
PID:4996
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD53c1078c1aeca132051a6589de8f1f429
SHA1e3ea44bd865edab9e675c9b987100c474db4f42f
SHA256ce00e952971cdc560e2318cda3a7dd639f7f6fcb9fabbde0e1ad72c307559812
SHA512d7b7ddb0b956cf26e77c23fcf7f1ec25467f3952961fe3c608ec75055cc33285365c663128974d596b84f7de337ccde7362b0c43574f40fb1a3515c85d7a269d
-
Filesize
781KB
MD590a0752a937bbb004905026262c7f86a
SHA1d8f42ac3fd647f690600d7add21643af43bcd069
SHA2569217f608c07a1a465d6ea017a4215148173d9d73808eeacfb96aa73c9ac718f4
SHA51282bea7babc6bec188d7e3d7ad07c7642ca14075b796f25ab10623e9366aef327114bf1e7c8b1dcdf63fc37bc99b6ea103a9a1bb81d3f19376a46250af80273e2
-
Filesize
1.1MB
MD5524e940d2c424fd3e33c9ce6d2803328
SHA144c07bac2c39976ae1df86c55967d747f676d5a5
SHA256acc54c78d8e81dbabdc322ead902b8ee9993344b7d9711ea0ed6ed0b78f75dc9
SHA512854199d66115b3283a2fa11f307cbc0fcc8ddf584537ac84cbc1843eded1a543bfab1067481bdf43a487b14daf253740f229da223f05b160bc0e2a4a0aa30f08
-
Filesize
1.5MB
MD5e6a4f8d5da3e65f109ce92fa95815247
SHA18720a2b7f130d7466d9ce21740a4997359966025
SHA25613713d367214215c73a22ef02288955f6d92d7c0b9a5a6bdeae4e28f528951f3
SHA512e86de883bc31dd86ec1b4ec5e5fe4ed8ccaf8dea40fb50c66c3d888dd45f5ceb94b2329c38db0f74b652b21e63dc09a1f0ce5e9ec434ac4db362f60f096610ff
-
Filesize
1.2MB
MD5b6706b431953d63aa1cc19d7ede4e633
SHA19cb6fe34af8cb3f61863d4df1fe9758c661145ec
SHA256fc47a617ed790352a238a4b9ce44942d7618d4bd1e173420b4df69ff7efcd64b
SHA5129afe9f1e4bfc062d340d7c182a410c997f71751683d0bd20c6c333c9e5bf10b2ed595d5542b802a9b4729bd6906ea13147b99b303209ca4685b496b32246f106
-
Filesize
582KB
MD513c7b81e9541d48e00f390d65ff5c647
SHA198e986341b61c286c838d88c349f138ab8019afb
SHA2560e527455fd852754a38a831fc6ce1518e135b78461a4067724aa878e77547606
SHA512bc6244ecf3a698480a94fd1013b6bef26d721849ecb787c59efe35b7d09af6ade056aea330aa869c06138d0aa9027c5010798ca45c8df29229e4bbfa54a56913
-
Filesize
840KB
MD570c9265a9772512ed43dea902b42385f
SHA1f30c2b569fd3a04c7a22d19e11b0d66458bfffa5
SHA2560f4344d94bfba927720a9cfaae9d5cde5deb810d5b631ab3390d4176fe4e759c
SHA512de96cbe1b3cdc04ba5b17b141d123b1661ea7ef4a8fac446443cc0561330ae3ab095c37161c728f2808da8868dcbb7a5eff4ee62dc1b6a6f081ae6897a828469
-
Filesize
4.6MB
MD541b03e1127583c991337e542faf6f1f3
SHA1c5c0f9c94ad67c2fce2477dc8f65866248b00ff0
SHA2568ee774a6684cc5f1adf7b1b7ec6ee31b334f9a7e9229c0b4dcdb5f5aedb0def4
SHA51212bac40fa5e7f6b3c2d89ddaa57e20816cc0875a93bc8c054fedbf0be91f776fccaf714ee22728b1c74453c20185be03cd40185e2caf96a11ce3f1695287b81c
-
Filesize
910KB
MD51f77bde5c807e89f707636ae518d53e5
SHA1b20289696b0bbacda7fd4521ca0f9dc9c0db7500
SHA2561d356f34c013dcdf965a7f00213650baf2a2df705929c93816e55215fd7ed804
SHA512c1ee71e9faa76b19335b445463202f5ae58e11a8530673ce5ca4389c46e2e3f931ada286e151cf59c4f85f2065902c76c85fe20378080d8dd5bde6d04ecf605d
-
Filesize
24.0MB
MD5f294d2570cbd05af4127aebbc0fcc63a
SHA146976686dc1475812e6e43592a88e1035ab23574
SHA2568a7ac859f8da19854b1235c29640c3f0fc476c81bb58b8619760966772db1b15
SHA5127d0b6419820ca452e06a9eec0ed24b4fd7b5b6e440860f77f16494243f819d6f29fd3db3e568b669fe669952b550a3796ba152e8d16dc8f94b6d7d7fd0e6e88d
-
Filesize
2.7MB
MD57f4b2f845f3beaea9ce6ecc510b8f5a6
SHA17c739475b92017e03e31f9be9eb32c9a911e4fa9
SHA2569eac4e8e479c09084a35a71670322f8fdb8b48a22006dff27775688b37527730
SHA512e57a489a9ae8a82d069b1a7c696a57e656dfc0ea7ed54503ce8e109fbe934be0f485ec526e84bcaa23440dd6c686dd147aaee45cf36278f94e38eba9e8d57812
-
Filesize
1.1MB
MD521d591453a055f7bf858a7f3d931c549
SHA1ebd10770c68f591d2e55d0c683fe03ec5518f40c
SHA256c3a50ad48370a730ac9fb1281f965cd7627a391613315f10ef943e3afcb83d51
SHA512dfdc82bd1b87c6eabb8d45413ceb4d9e803e41657ed858714d03ae6d528f38f0a4f48a3d7043b7b9aa4078f7b7f7106cf839605bda7f3274e5537305b2021722
-
Filesize
805KB
MD5de250a6ad31db708aa591ee85012088b
SHA110c5be292e564d2a685b875730ac408a50cdccb7
SHA2560ccbcee2ffcbe295e8217bc04785a86ce6a0f01eff633326690c9a88890178a9
SHA5129f6dbe5f99e958844eac3bb0787fbf47a908dfc6a65287130e8e692796a16419e97b41cc48e50157f9a43b5d5db8a8250f9af7cd887de1cd99755dc8a874777c
-
Filesize
656KB
MD58c9e2d2a4d75acf1f7beb67dc97cace0
SHA139939a5f2a61acf1a3dd08e301bf51f5cf820ac3
SHA256cee8b377d41b1396e42e658f89dfbe6db024fe841367c945651066f2e417d2cd
SHA5126032f5110dd27f7a3b94ef1a6a24cd032f97b5f05d57251a272c528a3ad8b6b8336f7109636b3e70ea480180713b0e6086841e03271a9f4b3dcfddff7109ba7d
-
Filesize
4.8MB
MD5048e2c9d033d97296d6d3d76c04cfde1
SHA1402899c8180c7216c2850b087696b661b4207c4c
SHA256adb10f6dd75e4af61d970c4679099baf22a2bbe26fc039623820295593f9eb62
SHA512c6ed2617cf385f145fc0683c0761637d05974de8def61fc7a9fdc9df2855b1603107d7c72043e998ca20307bb14a703aad5b65382eda29e64da107d16911a06d
-
Filesize
4.8MB
MD5df055f347e165222f33658a9bf065180
SHA17d5461c7fe891e718d4420296fbedec8d64859b4
SHA256fadb667c55682e4a85772a29ee4712e0df0ee31d1a19fb00c588fb1fcaffe0b1
SHA512a306d0726107001e9b226f5ca45876482b58323e9b82bcb9e61b4701158d87bd345751279567a937b564ad145f2eeb14f987b7beb0f3945250b0ab2d9750d698
-
Filesize
2.2MB
MD5f2ed5551a7a1752f84f91d4bf7cf7f66
SHA198081aad1742ba75f2f376e006be87507a853163
SHA256369ad1b9c095187c4d9150a7f3840c8d6592fc4b14193c7bbafdba3e7ef4f9e0
SHA5124d4265a6f8914c615f4b7ba7a3c8a5f4ff0a32d3a54346ce89041a4f39a61be9802d7e89db48e2c5655426075575502d3b371bd92c4a9b3571f521e68c1bb38b
-
Filesize
2.1MB
MD5073495de939673fe1570e2b362ddf54d
SHA177cefae0476c5b6205389152ce1139f21c249f55
SHA256f0ece5350b6106307336bc625c0107fdaedb5392d8461a7bb9b90c1f83b2014d
SHA512edc99803a4c17f0d3192c8e70b4df72327936ed444cde4690faca24350d8d7efc89ccdba6f99e1f953240caaf4c592b54175d3567ccd3dedb0da5a1aff35b9fa
-
Filesize
1.8MB
MD5dfceaaf0214792552d05c0faa7403ad3
SHA1434d641ed885e73b261fbab21720f275b2b9a8e3
SHA256f61354754e43313e13969e5e60cb9f213ee4ca6cee140071c4476d5d19db42bd
SHA51207b1de587e1cd88321504402efc9974835e5d71a29bee88c5ad9abf79818de6daf32d5b9fd67af784f2a40158a46e172ece996933e383d5e8e5e980e8eab132f
-
Filesize
1.5MB
MD55f0c9b348788b84ed4fae2c7b412aa31
SHA1cff5f9bd0cb9953c535c5506d7eeba5391961d4e
SHA256149dd03719ca995f11211aac63f0299a2963faec699756b3d13bd8ee96a9e876
SHA512a95de27df46aacd58a38b60da324bf800027c3fdfda31be6cd814a3914480e5ed6643754782a5a78ae62893ffb735506c05bb4ab3a63bb99203d20a8a9e1dd93
-
Filesize
581KB
MD52a5f98043792626a4a2c2f2d6d3781fd
SHA17652834b9c2c95b7dfedf0f6f567dfda18c97387
SHA25638bb050135f53870038dd9cc03d101ac424f845cb69e18d761d18fbae446c156
SHA5120ae9399e4be6c51c10942aa2ac846a80aa6a782d1cc18bcd11d87a11fc0f71365718baa58cad1397aae24e39e55648c21ae1aeb93b9f5184d1218e8eca5cfbc3
-
Filesize
581KB
MD510bb26b33a581db88a0f20a20e31147b
SHA1f299e37ac8d9e57be2b267a5495ecf112e2968a0
SHA2562ec752eea15c9e994f1d957b94489dcc173019050344a6bbf6583afb96a37a01
SHA5128487873e49bf8daa807db7e9f642ae437795682a97acb4117d6a3aea1bdc9dda12aa6a22e47e0e74fe4b7a8a19422cf564035d0920b97bc8545ff7f45019113a
-
Filesize
581KB
MD552f03c3c695a11c2cc27cc65563cdf11
SHA1fe1a4eb1c298ee2282bc361940d9d6b856cb7f17
SHA256b5089a4b08a3b28e37ce39c70dd43f6f47fcb47b80b59ec5417a06087bca0c3c
SHA512bccc2b27860722d1b90df0256a513f96283c43714da6a0a451f9c635afea521a1457c7ad94e912ad86aa8d5e116df1ba2264b12efc5c79340f5e947d0f5f4109
-
Filesize
601KB
MD5fbf9621c05b827ce84c922771c9b1b3b
SHA12d839236adbf6a649131f6a536a14b35b9bde875
SHA25667c03557790d0850ae753f156eff5eb07f9dcf749ac5a8e6ecb2a4954cf60dea
SHA512fe170cd892620702eb3047448155e73be8dbd3b60dd3da1d7b77fc59ab46d1abee770f03f8ae35a050d09c8253245cbbd1196523bf79d883444dc21eabffd82f
-
Filesize
581KB
MD5019394d8cfa538a34ffc5f70e8cee4bc
SHA1bb3de21bafa8eee69e0cdf0637b6afa3840d0fca
SHA256d6589535c3431b4008e017a47589f4cdf7f4261f5f7898bb328cae2bd333e0a9
SHA5123c07b2db7ce4739dbb89607a84c78ffa3137141e481efa566da20777c62d8201b64ac1b8bdba2cf0fd3b37509a95f379f722632ed9be64c464979f78496157a1
-
Filesize
581KB
MD54585965726c53dbfde686865974d78d2
SHA13d4d4352da557508eac13812a5b0035383a30280
SHA2565fd89d61f78ce1f4f5778d3fab6bdd101a75b04ef8eb3c68590ee507fbb0a2e1
SHA512663eea94b6d22541df50b0e5842f31201fca4559ea92a7ed9709385b77763f4ab755c371e3010d75a17356c471ae4f892b14597b7bffd5f3aff7095d1e793ae6
-
Filesize
581KB
MD5a923e518f6065b0e5f6227c604d125f1
SHA11eabea3217c49503d9fb073e2e1065502b1c4344
SHA256adfb765b985f081a10f9f65904ede3bb72b1eb226c0d8465467744f01b4a0f0b
SHA512a2cb81c9e3852a56f6e5684e360fa31d40944c5e9074261953f5a53d0a043f777b361214ae91fb0209e468a09eafb94d44e0d26eaef693e0815fda1b999fe867
-
Filesize
841KB
MD584e067bedd93eaf5ceaa6d11ef562ace
SHA164ec4f3c3ef844aa81ecf832af9bbe549f5555ba
SHA256051651e94240fca192c4dcf472a2f7e33cf541e705b9e396a65d9644a34732ba
SHA5125dd33fe60099a9888ab60043b11c2e3848e01b58d12706649c70910a0d414e44accd7239e51d93d12f05b441f17a54d672038ce2223229590fc91556add81888
-
Filesize
581KB
MD5876261ca18d7e8c6b718ea2b0d6a1ca1
SHA192c9355aa106e1df4471da059ad08ae02326ba73
SHA256f169f9e0fd87671ff83cfdcb14dd0ec600174f73a4617d2111ea134ac359dd99
SHA5121eead65d410d74170536184a3fff882f66150cf0d5aa31007f87e7f93d8c965ed314af17ca6e1b301e777abfcdc170373d7c9f49f74cd02a6b475b5f84d45c18
-
Filesize
581KB
MD57a52ad0934ee2a74878300c31a1151bb
SHA16dc6944d3d5ddb6b44907233e318047a08eeaa52
SHA256608912940b2f99fd888fcd8e196bf5ab9610bb5cf84c27e23c8a602452d46d29
SHA5123fe5bb96d2baa2a2aaaffe18fa6cb3b2ce5b691afd34d89e58f441d2489ba57d5a030de380968e50df0b1fccb1d73426472a64c499dd3ee1381c962aa65a5075
-
Filesize
717KB
MD5f6a67e5837160b1eab6172b82f6f9186
SHA1bf349d04a28287ebbe4b3f5cc7fa9ff7597bf589
SHA2564c1157fa6741fa93a74c24266c124a2dfc1a729ebf583658b1efc4f631e780f7
SHA5128f631ceb58172bea343e2731879c5ca6df3766c1a53265d3535935dd8ae63fc8a841f439eefb6a515bf45fecedef740b0161b7d003083f6ed7721312bbce6a4a
-
Filesize
581KB
MD5e65ed9c6325be8a7ecf843ed0a8e823e
SHA1f1a405d0f83166ff84d5852ba717c3aab83820ec
SHA2560d15bae6702ed3ae22d48e6f4144278a53194b3a47a56b27e429ba0ddd7abcbe
SHA5127b2ff699f3b5d6c85d42de91156e6f3bce8b977649250a74f7923adf93dcc18d33176611dd018f64b3442ea1fd97aab6bcf703ed740bc4a73daabadd89b85ea5
-
Filesize
581KB
MD55115aceb805d042b33e51d930b3c9832
SHA1cee7bacb8de33f1a3d427d8a23e4135118fb328d
SHA256182fecbe27c296814ab0d20207b0b46d29fdbca621efae7ccd2751751128a863
SHA5127de536cfad4eff9f60e8ce967d8714e621501ac7fd97ff1753a2004a625307425b50a754768f975ce440561c477250df598a69571d278d7e64ba6ddca97a0ab7
-
Filesize
717KB
MD5bb34514fa0e5834fa56bd090b3413c9d
SHA1542505213d3ef0ef045b79b6aeded892bacf9977
SHA2563a6f9b79ac7f30344c2eeaad5ca8537dff26609949c025911fc742a15359ad49
SHA5125528e9e3426b7c76c9c46a7dc3ad7b7920524d33493d8568161c2a8dba58bf293bfea1c96598f2eae55e2d470bfa98c94b8ae6d45bba74e25c81dc047f51e011
-
Filesize
841KB
MD5dd704214d90262dc4646ca130c2b47ed
SHA11a6bb51b1aff12b4cfd37432a1027bbbeeec9ef4
SHA25644146075a5417b5d2afbf50d09f89775fca3cd72748bb995d611223a2f3f61d3
SHA512871b86798d82808f2a5159ee04d477520e6b99d25d70219cdcf52197775b09857f31fc076dedd37c77195f72edf4bbddbf8fa915bd6fcda77b2bb243907470f1
-
Filesize
1020KB
MD5f88422e040b66a8d30fd2a17ecb6429d
SHA14fe1de8982344df61f4b8189f6c804919c857ac8
SHA25618da6479d93cf86ccbf496079bc2a023a66e55658afa13301b15622abc94d397
SHA5125ec015143b17f12611e60f8d0c86e5f799909d2cefbbd12655f9e286267199e48c28b5c62205ec8cfeb81d1853dd1c7ca3a271e08c52ca4d34119f17a16dd30a
-
Filesize
581KB
MD5103b264763e2424a89490aad19ff9611
SHA12345d9e399bd5d814c6e5a2454ac5042841962ba
SHA2561d3801961d74d7e6812d6abd1b4d0201af92303d587022ac708f7595513e2e06
SHA5121269814af333dbf26a1ea27687e271274d8181b47a6fdcf760f3c3102220e91128d193f67a55f463976f7df24c841731e822e8bb26b48334e4d80ff0290353f5
-
Filesize
581KB
MD565a5e5838db66e107aa9b9809b63ccc8
SHA154ffd7af246fd8fb703ef8a894716e9b8053b449
SHA256ae9d5e8d05518351e2f87ef3c62e387e45e64a9f98ee562b65e15d7c3c893060
SHA512c1a5896bc6546e2ba30f1e11ff6c41db023768175ef3d9e04dd7c8ab617a59630cca6cb5da2c3f00c309e4daf5c6819a7ac0c0dc6dd0e0d460a31f63aca87f4d
-
Filesize
581KB
MD53ef1e24b0d4054656e438aa4451e3123
SHA1f9a5ead137017d25992c81a79ccd7256c3660fb7
SHA25608d17cc555e5d12c193576a396a4b5e569343bc4d6721de1aa610257d8d175ca
SHA51277210da92c5aa1d0fee8efcfe1d8c7bd12f08f3c730430cebbed8633bf32eaec2f59ebfce561badcf8f883424f44a6474b4651383a8b74e9048a7ee381040f53
-
Filesize
581KB
MD594b68cf09d2b460cf3eee2db27c23fa9
SHA13e48212c00e6ffcb4e2e648f453a0464827dbcc7
SHA256d4a8711dfac35df9bb15eed1c4ff6106f679f11464affc23c26a553921895b1b
SHA51244da5b53861f89512f6038a77deddd73c07945c7f9f7b153c09150715b31fa5d29d271d60777249e188b198b13a77e696773a8d164ff0d8962896ffc78c70b8a
-
Filesize
581KB
MD501ab0fda0e6d3f65fefce25abac7f5f5
SHA1c38e1cf28a82be1c6cba28e12c8c2cfb3de2aefd
SHA25694ec201bbf2d005c864196ffc9602e24233f9c327a63872e5286b7928a31a804
SHA5125a11580ec9d90b72be89d3fe5e0467470949199067544e4eb0f1ec3e7dd2b7e7cee2cac3b0a9b058c2d88d2c8991dddd1090e123aa6b388c425d7b839b9c0993
-
Filesize
581KB
MD5b3b8d0e849e6be2cf58029a7e41ce95f
SHA1aeced95c600d8a82fd877ee1a08e065fe04eaec4
SHA2561d199e4432de02a78689a4c0c430b3af09cc4bbc1c52c47c827986cc136f51fd
SHA512bfeedfb72a52acae11a9959ac320071aeefd6fb790c2720bdb888e1b8fc78693bce357da7f45902da9d788fb8b5c90f3f2e244d4f8ac9fc995d140f3436c362e
-
Filesize
696KB
MD578c62b7927f976758075ac171b4f7e55
SHA16319076940a9cc98d780927fe2996111fcdb8803
SHA2564400a66e3d362d941cefb4d32cd58eba8287291db2360cac81e0b7181dce276f
SHA5123b491192f2a7aa24afe356dab9a57f4579fa4fa27c56c389fb8f0a22454e8f2f0d1e72181262099f39111c5f23b78bededca72f5d24030c845df09ab065d3a52
-
Filesize
588KB
MD5ccd39011c94d7e58e9ca99978265daf7
SHA1f5acb94f71768d4eb0c875ed42d6e36455b97d6d
SHA2565f492d1a43f94ff40a08f752cc14d3c57e94431e287d3dfd4e290aba405c51e6
SHA5124608ba5158f6b7b728ef65fd0674ce2c8629211f64ae592513053e8eb6b45ea88acccc7000c67ee0bcd9a4ab16e708d08f1582e0ef0aacd5b0d04a61bca87c04
-
Filesize
1.7MB
MD52921759cbff2031c2c1d8da8f382a5b5
SHA15eb37fddf3ba327ba3c87a95d02f85cd2721d65f
SHA256b5e23d40ba75c50be5a4d88df07c80abec5a7747250a334cf0663747eaa5cb8c
SHA5125b8e2197b35501978c25faf59d8c677e0c4778308301d711b5715b748437db8b3724cb2b1df9170fa5357adb315f8a35618f426500bf7b7e3869ca5dca54da6b
-
Filesize
659KB
MD5e014c9242cdf21e813919b295f029ab5
SHA10d75f8163e8a9d12348b8bcde2ab52ceb3599bed
SHA256ac0c6447004f03f92c98412252518960a19f76346d54457303916d30c2bfed95
SHA512e1e8d6fc6660a71d01cce54f2320d41dca1f3994b6a21f2259f561e8de5fe24b8ef1ad69e91daae20df9169e7b3b411a101330e1fa45d24f85367f31ba724f1d
-
Filesize
1.2MB
MD564666eefefbffc12ec6c5c468d80409c
SHA111da3bc0597c582c7b4b7eaa808a4877bad5ce8b
SHA256f5a099c1d4a0000951286107e0c5aceee117713e2892d13fd22dd7b9fca6ee04
SHA512aedffabeab31de7beb2f7092cabd6b99f23c5b0bfd5eb3baa14ab0c3f221d24f891c5e5316b7a7c1d188039f3a8db84b79916fda4f0a72c0d39f244a6ac063eb
-
Filesize
578KB
MD5381c0db1f4896d039eceb8b8ebc3f99c
SHA14874d82cd6993535a51234b401b92a38e97fcd34
SHA256ee4ca094ac7866974d3f609c324fc4698fbd386a0c24a5f2ce4257cf88c6d0a9
SHA512a309e930bc6e47f7584af9abf6e3863307bf3d1f90dc9a65470fc8de167adf0523066bcf7c7d6178ed3215daa833762104cba53b8e47741f86823ce4ceaaea67
-
Filesize
940KB
MD58c9b9d281a6fd8117cdf7649788c53bb
SHA13ebd81a49229f490baf80235747d164089334087
SHA256d14959cc323009b41847555f676ac7f03cb5bf633048b1754781fc28f14ee04c
SHA51201c1a522a93a18da811f0917c739734984fecff69a208b8b24aea76383b915d71a3746d0d0dcfc4385c3cd7988a434c8f71f28e163525cf0cd28f4f4a697d38c
-
Filesize
671KB
MD5f9245ecdd7a846e282ab591002d19294
SHA1cbb0b68ce43ac39669696d1bce4f19a9ce1c5553
SHA256e10d00d9fc27399642ff8aaa6debae955f9b2f79e8c66670b86c989d7449054d
SHA512f5aecf6094ebaa1c3c10900ce72db23af34d7d93f1b2156123e2b32d4cef84dce53abc306826ef46d5b0856d010b7f622365252b0a0ab8a03eb437e09a0a94dd
-
Filesize
1.4MB
MD58d61ff3909de55f96eb4a2d22482041b
SHA104b4628a03a52316faed3366ea40357152bd3459
SHA256072014c7133cfeccb037c9e5194ffec17c401f63f38e5cfab73dde5ed7e96bca
SHA5128ce90fd8e6b78312586af9638c0d6c41ed89f8c96acb60e15d826b8ce8d67914c87c3f4012f674cb85d271900ba2a6a74407b7934a5116168117baac46df3a52
-
Filesize
1.8MB
MD50879996d4a99deb7d5e43ccef964f778
SHA152d61d92b160a0d705ab86cdaf18efa2bd5efd60
SHA25654e08556b48fb002fae35ce740bb0d6055b003ae1bb1e8e3fe16f5a759b72f70
SHA512e497611e481459575caa5b1fe81e40b6b638a313c24e0c12468fce2a350e287790f303c03cdb03ff662d1d43266a0ba69f21d6fb9256b4d5793af20bf128e885
-
Filesize
1.4MB
MD5741cdfd243de18403789b4da637a1a40
SHA1d1bb83059100118ea74578c97b78ba6f04a26b7b
SHA256f8f0c104579a1e0e4d797465ba21f3fe62d3a6639c3358f32c767b40159e6b74
SHA5125b6e3551042a25dc45b772932f30475f68520490f667ffc414a75d396d8baaa04c0f3785b21471a6032f601b7b6026028ee110c3a8d700719e60ccffde8114f4
-
Filesize
885KB
MD5cf75aca1e6799bb8330ba14dd2ce6ecd
SHA1022c715f31b02b1c218d0bad7404ef2521a41f86
SHA2568aa5ab3f07c1ddcd94d142bc4a0a8619383e627e577c8bf8fae91ac4d2bb81f9
SHA512c8418330254459b95d1b687a323edbcee637b5e4c8d7dc64c45d398b159a7b1eea2b4e5c9674831825a46c584a520c1eff1d0cd2f1e3cb78ee8b33dc23e0bead
-
Filesize
2.0MB
MD53fd4b689787efb3c3f49dc3436f42a0e
SHA1834ac94988cf52f041b23d5856472fdabd32821c
SHA2562db69d3c09b98e205a4e482bdc32b634cf5e87e0056c08d68c48d155a9fe38af
SHA5126dc4526b38044350e086b567906b202d828517382e9018c5a28711c1daca5b34a427a9f363c9de71a83127a0d35ecf7ad2b279ac5041652dfe2a98f63fda36d2
-
Filesize
661KB
MD5fcd22af0998ac972d684eadeb9a7b478
SHA1620bd2d9d8c054e4fef206fc89f0e0257e0c373f
SHA25652333ed39a2c93155e4efb33e210f88b4c7bfee4c574b631da030c0f3700387d
SHA51206c766e37c38b893da37f0f6a692cab7d62d6920caeefd430318922a8dbee9b719d37df2fa912bddd2522c5a3d8079ee6caf402089f0cc1fbd252fac457001d5
-
Filesize
712KB
MD5ff1d19047b1d4ea38ace981af1d41809
SHA1db330383fc934d368084c6ca8b870c7b6fc468af
SHA25659ab7139ce2a196a4bc0b06641b8738b71e92825331e0e1a65d9814fc22497a1
SHA512d70a43dcde004f61b79c68a4318541a2ac7011bf169199bfb4b125d9982a91cc287d73365d7d8a4d2ffd037e11c4a8f8d3e1a1bf9febdc1f96b19bf305ea3a20
-
Filesize
584KB
MD5e28d98a7f351a4bd05490d3af3e9e7f0
SHA18d5aeff248fd02dccffda23cb460f9f39c453be9
SHA2568e82651efcff7072850980ca45102c4c4501367b2ce0e07d11db538519b9881d
SHA5122b283f0b2e141384ed64b641dca6f78584218002764e9b3de7b1808bafab788d31ab4ce4683a598fb63d3d21455142eab8b89df039b7b2dde5c271c7b51a2f74
-
Filesize
1.3MB
MD5567c8d72786e8cd70e963b5996575d34
SHA1ce7e0f46ccccc20b410b64acaac796c2b6f8c5e1
SHA256e776ef5f5d01e3172498730841634f2062481dc3c6ef696f9cc3ba8944a7f6d1
SHA5127717a71513afd7f8b2b91f4c38dee55b576b42cfc39530743dc372f312a494771230b2b21aebdebd7e32b983cc214a0b85105cdbf189fb84938e6f8dea0153e0
-
Filesize
772KB
MD5842b2d176d4ce36c8a37e8e48d2a79ee
SHA115e6740d1331d550e9e454e5303ff65164ad0877
SHA256ffa3befd9f4687bcc43fc89e39476230c66946b009db85b434962e34eb7614e1
SHA51245d89dbfe89208270c84bb945957da758eeb3ac3af5c239b68c3da0b045524b5e7def7249ab1576c1db46f6f5e3d8c5d966d961addb47793e8bede33295dbf27
-
Filesize
2.1MB
MD5d33ef9a3cb98dc72447e205355bfcd7a
SHA17ffb7b85b008f193587448fa838aa0cd0e7d4282
SHA25669a4b113b74baa240e3a2f63caefe06382f48dce066896ca885233b139ce71f5
SHA5125e2cc6c9edf1c03a3203c52af64ff6e3dfe029288ec7858149a6962ab777ea2de791037940f90f30e071e7e9e3f0c079a2e36238289e48614f5950a2afbf74a7
-
Filesize
5.6MB
MD59078d9615d9c2b247373e9923a7820b2
SHA1d0999876e866c1d081e84dc7448e41c962217493
SHA256716019db5965ff4e07faf07aeaf0f61f0669db3c9826f22f208ac2feb673ee83
SHA512fd1ac6fe9e49b903b24a4cbc251ec91bc83de17667a4ec8a289cd8c846e376114fe1cab08195aa66c4a6b41e4035c53e0dcd63d08fb54984af2f019247938144