Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
08/05/2024, 19:41
Static task
static1
Behavioral task
behavioral1
Sample
16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe
Resource
win7-20240220-en
General
-
Target
16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe
-
Size
625KB
-
MD5
cbebaf8931541edde6edbe6a130f7dbe
-
SHA1
43c3de702e7ebe6a9f47dd28f0221e67946c739c
-
SHA256
16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765
-
SHA512
e3d1acaf49ff3946379a2c79e801f1879065d2ec131a33690597f537a77237b660586a83f39d65e1edd55e514551899a44a9115d8e90442652bf81ca9244d7ea
-
SSDEEP
12288:g2XVqKNdQ8yRK6rkObwsToHOOWGgqvoEWH/lInNg4JYU5a0Cuxy:NXVqIi2lObXobHAEW9INFJY0au
Malware Config
Signatures
-
Executes dropped EXE 22 IoCs
pid Process 208 alg.exe 2664 DiagnosticsHub.StandardCollector.Service.exe 4576 fxssvc.exe 4992 elevation_service.exe 3228 elevation_service.exe 1072 maintenanceservice.exe 4884 msdtc.exe 2800 OSE.EXE 1396 PerceptionSimulationService.exe 388 perfhost.exe 4040 locator.exe 3832 SensorDataService.exe 3996 snmptrap.exe 3408 spectrum.exe 4312 ssh-agent.exe 4736 TieringEngineService.exe 3456 AgentService.exe 4396 vds.exe 232 vssvc.exe 4324 wbengine.exe 3720 WmiApSrv.exe 1964 SearchIndexer.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 37 IoCs
description ioc Process File opened for modification C:\Windows\system32\msiexec.exe 16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe File opened for modification C:\Windows\System32\alg.exe 16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe File opened for modification C:\Windows\system32\AppVClient.exe 16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe File opened for modification C:\Windows\system32\vssvc.exe 16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\106a6be0293b476c.bin DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe File opened for modification C:\Windows\System32\vds.exe 16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe File opened for modification C:\Windows\System32\SensorDataService.exe 16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe File opened for modification C:\Windows\system32\AgentService.exe 16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe 16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\fxssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe 16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe File opened for modification C:\Windows\system32\wbengine.exe 16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe 16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe File opened for modification C:\Windows\system32\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe 16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe File opened for modification C:\Windows\System32\snmptrap.exe 16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe File opened for modification C:\Windows\system32\spectrum.exe 16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe File opened for modification C:\Windows\system32\AgentService.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_102250\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe elevation_service.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe 16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe 16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe elevation_service.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007fe64fb17fa1da01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000026aa73b17fa1da01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000044bf48b17fa1da01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000055d46b17fa1da01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007c6bb6b17fa1da01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000060206ab17fa1da01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a9ffe6b07fa1da01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2664 DiagnosticsHub.StandardCollector.Service.exe 2664 DiagnosticsHub.StandardCollector.Service.exe 2664 DiagnosticsHub.StandardCollector.Service.exe 2664 DiagnosticsHub.StandardCollector.Service.exe 2664 DiagnosticsHub.StandardCollector.Service.exe 2664 DiagnosticsHub.StandardCollector.Service.exe 2664 DiagnosticsHub.StandardCollector.Service.exe 4992 elevation_service.exe 4992 elevation_service.exe 4992 elevation_service.exe 4992 elevation_service.exe 4992 elevation_service.exe 4992 elevation_service.exe 4992 elevation_service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 660 Process not Found 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 39 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2396 16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe Token: SeAuditPrivilege 4576 fxssvc.exe Token: SeRestorePrivilege 4736 TieringEngineService.exe Token: SeManageVolumePrivilege 4736 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 3456 AgentService.exe Token: SeBackupPrivilege 232 vssvc.exe Token: SeRestorePrivilege 232 vssvc.exe Token: SeAuditPrivilege 232 vssvc.exe Token: SeBackupPrivilege 4324 wbengine.exe Token: SeRestorePrivilege 4324 wbengine.exe Token: SeSecurityPrivilege 4324 wbengine.exe Token: 33 1964 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 1964 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1964 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1964 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1964 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1964 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1964 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1964 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1964 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1964 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1964 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1964 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1964 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1964 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1964 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1964 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1964 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1964 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1964 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1964 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1964 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1964 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1964 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1964 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1964 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1964 SearchIndexer.exe Token: SeDebugPrivilege 2664 DiagnosticsHub.StandardCollector.Service.exe Token: SeDebugPrivilege 4992 elevation_service.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1964 wrote to memory of 3556 1964 SearchIndexer.exe 110 PID 1964 wrote to memory of 3556 1964 SearchIndexer.exe 110 PID 1964 wrote to memory of 4572 1964 SearchIndexer.exe 111 PID 1964 wrote to memory of 4572 1964 SearchIndexer.exe 111 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe"C:\Users\Admin\AppData\Local\Temp\16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2396
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
PID:208
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2664
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:2696
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4576
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4992
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3228
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:1072
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4884
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2800
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:1396
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:388
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:4040
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3832
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:3996
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3408
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:4312
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:1916
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4736
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3456
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:4396
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:232
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4324
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:3720
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:3556
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 7842⤵
- Modifies data under HKEY_USERS
PID:4572
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5381f80b706be109386fd2a17509e3bec
SHA140a77e8c4b3cab5a10640fc262135ec04286dd63
SHA256f1e7ac643667cc319193d46338b50bbea70d9af4f5336397bafc3288255bf4db
SHA5124a3e1a435e86fc1508e848d761c2146f5432a1ad3f697ceb83ddec6dfe12d37492ba3cf54f9b9a25f913a9ba6b168a813560411423931993803ff22542b92a75
-
Filesize
797KB
MD55f4a7f56316bfba83b9c51f9b9887a01
SHA14955d79fc44aaf4b82ca5d113321ef11284bb4bf
SHA256cff46a65658318905c8cc27fe771bfeca1a476fd39f823b8d58935b174185dbd
SHA512f9ac13934a0b24771aaff17adb3841ae6c75850d2324b7b579b330a3960808963191d4d59f374d741b77f97442258015880f17429c894f3e8c2bc4b0f56a73bd
-
Filesize
1.1MB
MD5dae613418fc0f7a7fd0302135dcf4f9b
SHA1800e7d4c87834e59256623e371b1ff019046d048
SHA256e1f039d471e532186015b93db0ce2893fd98fbe52409d14e408a4a98ebe74ff5
SHA512e3582b7da2e23d664f0fddc399b591f312c8e9ba3fd707f676ee21d417ab4ab0441868fe444468b7442417ca73c25ac954c751e15c7e7f2bbd5600918620f848
-
Filesize
1.5MB
MD55ed05ef10a65a13a1d238af9670c4767
SHA12ffc96711114332b353c57ea32fe3c55c8f9cc39
SHA256195d724e77ea951333fd13d27f4c609392009b41eb782de65edf9c43f80dac28
SHA5129c8d70ec0a15e80c0f5b788d4d686828bd8c796f60520c6ef53d4d55f0f57048a6d7f4eaeef4423c7867d36968bc4c0635faba75afaac413cb808e23b897c3b5
-
Filesize
1.2MB
MD5925e541c1060400ea1905b0f72fc97c0
SHA1b82b04992fe682fce30b217d17d14e9c3bfb4608
SHA25695f1b8e2cfdb70026588ffd62fb4f5496dc3a652195a7882116b45a21d26f256
SHA512912ee601d12469a247516e67620ebf20b19a6bb931f713fcc69204dc3ad56e4aefd43aa16e0da822dcdc93a9de42c35b4debd15912670ae2f322d77b99258a40
-
Filesize
582KB
MD51b092a2c0b425b0c52a58183a1b9d64b
SHA104eb03d1531934efd4d07aed9208989af45f5e97
SHA256bf8523c5bb9416ba17412efa8886f6e907c4cd9cbfade229f7bfd171ee639634
SHA5120da616a7661ea29fbb74755979a7e94053970e1ad85b1a9791f14b206eb95fea7f0da3a03538439f16584018d2f30e49a45bf92998cf151be2bb0628b57da2c4
-
Filesize
840KB
MD5934520afd4ca0485d35579c80db46bd8
SHA13bb4fe667e86d127888dad3bbcc0b93b38650b76
SHA25692502255fa1c0783a7819a27bf170a7993775b735fef5e297a7bbbe1c214128e
SHA51231c2955ae83a2fd716bae3ee40c5970132666c9641764f969bfa2121d6e07aad923e7e4f365614b8063c8052680d903080e08cf5e3ef2fcb233060be0f76b30a
-
Filesize
4.6MB
MD59b04726035f609a3518d121c1430b3ae
SHA1b530fcf469d3244c622ca7839425c4ad5f0fb2c3
SHA2563ba439c17cec76b89240900e16e9a4daf6194d59ffdb4b6319d4d16fcc75463f
SHA512a8c1792d44d17e97ec500458b8663b2ac01b5776a1d4f2c58ce7b5965827f468cc5ac48430d4d9d3bdcc9ff61a8a014a029f469ab817f4fde8adb8c1724d3edc
-
Filesize
910KB
MD58311c1cf33290a90e7ace7c09aedbcf5
SHA136087d1d6505eca6bfad4753077d284cf3bd71fd
SHA256db19c9c6197c35fccaf33bb4801deb99b2fd33fee8210729ba593fc8cb2d1510
SHA512b071c62f11edd29f4666d15962c786826eea9f534a81cf4c44f57fb46fe0372416e552ea271c827f927fb69e8f19d5358646a0ad867a15f8a6ceb0d4e5cb1a4f
-
Filesize
24.0MB
MD5ecbef913a5ca069de0672124a437e569
SHA1a38cbe1936dea0372ac437556c881eeebccc3ac7
SHA25696fbba6f9110fb1d193a2e24d4b48425a4109e7a44a8837c9c59d5ee7f5b50f1
SHA512ae87ffd9decd230aad78af513446ecf6ae50f83eb982162aa8c413c192f9ebfdc917db9ea50ee75add734f2e934f0015836097d04c863c14a29da0016bef654f
-
Filesize
2.7MB
MD581ddf49f15011350eda175752c05a1ef
SHA1cbe18553ae3dc13de10df17f78628dc12b180e67
SHA256dd9b5f8d5ec8a212e0fd31b9799526ed7f4d39c4c5c0a3857a4e788e66b92c43
SHA5129048fe34e298dc95400850eaf906b60b291783c235ed3dcf1ca74fd1b3dd3e0e5d210133e09b1417a7520a7cbc9c0ba7c999eaf51eec63868e6fcb5f7bc9a6ce
-
Filesize
1.1MB
MD5125ab095c652c117f9e881c238d6f18d
SHA12e258bb827feeb29f2d0fc9bf2964da81c20c192
SHA25616b2b31a46092a3d7e1c70b5991e4c45230e36bdb3fcf5e0b6ccec3516f056fd
SHA5124ca4a1dd9bae8346fb7911c5b148833c349b0f3efbaa602f31ec6506def8c7c387f489981a341cbc12a01c9b5b8a8a1d3a2555377889a0f229bb186e8e677b7b
-
Filesize
805KB
MD5708dcd9268939407295add605c700ca2
SHA1c4249b192c8002b0a20f847136a175ab618291a0
SHA2564ba6b4d11af99b0d37a83255769923a9ab5b51290ff8a93e42cb8570b7fb9cca
SHA5129e26399934df84214c6cf6485c94efaf8563e9fcb8c79572b920d1241ea1949cae6da6580c06326f979e3597eb640a28ad278f219fe4c6f94cdff9d0b51f9952
-
Filesize
656KB
MD5c28f09041b5fa3dca626b5b600910751
SHA179934e2f6da2bb477cf2ccaf8f5fb3f42364fc71
SHA25641472f8a31f557faa54d160d120a3675a93e16782e881cd1b0d9a9c88e5f3a49
SHA5121a60c800ccd11d1c95f3eede12525f2502842a4ce32bf730cc02154fb14a3c1c56ec8bffea1ee1901e52de46da575587c728874449e2b57f54f7203f0e4a6320
-
Filesize
5.4MB
MD5319c83274243399813517a57efcec71f
SHA1ce60aa8a73f347a558b24a94c5aa5928937d63e1
SHA2566488f729056bc2fc877f1c6e9a471ff13dfc7458007758187be3dd48376e65a1
SHA512cd3aa87d5ffedc54668cb4652ad0741bf5cc2babf0b670f8de1401f5276ce78c4720863fd1acc6bd166706b18cd5f7b053d1e6930a5d3fb87efd5283e528bf19
-
Filesize
5.4MB
MD58957645e97ec089c83bf8f673d1b54fc
SHA1ae0aed4ee0f00296d1b8d82203905461523091b5
SHA25664879ff0f4274708178e8b4eec06aab6f4baa352c98a4b9d6b631f948cb2a70d
SHA512fb5e1eee0a1fdcee36ddb3aa55e35cd71bee56a37ca0d657ad3d0698b0f61e42e80dd41dbb89c40dd70df0728ed5da4d9ca1b2566d5a73730fd4e39d7a80e0c6
-
Filesize
2.0MB
MD5d8d294eae479bd35a22bea5f5d011a5e
SHA1ecb36a01aa536645b30d724ee7afc1d61d04698c
SHA256374d29c8f35ddfa514c95ff79da5978e0d1e3b6a68997d03c270d5e643003223
SHA512b07460fa86b3a5b91b94357452721bd47750c228f98886cd953adb12b776a862b10df29dce9b2b6b2b7e4566c0afeaabc4894c3da2dd3b393899a9f516041718
-
Filesize
2.2MB
MD508fefab72409093bbee3527b6d7b87ef
SHA1d1ea4a1c8861d79c8fc122eec6993c576bf34bcb
SHA256140a5398ba3d020113c34ef6b232461156cc9c28ceefaac29abc6be94f0de50c
SHA512ad0f0e4062e256871bac4ade153b06f00f6558df0cd959fd4c8c41357542c0a43e14bbdfe48ebe6a8a5d14effa0fee872510a30960bee47fbb46ccf9eb33b466
-
Filesize
1.8MB
MD5b5e2fa8b073b06d8af8686f92f95f722
SHA142b9b4ba3761ae22bf6b9fc7048964e9d2fd9063
SHA256309e767ef37c2fdb2a349d41cc89cc1bb96bb3c54dd8d7a5ced0a49fafbd03ac
SHA5129de10a88edee9fb9483e4c17dce1df23c23749bfc9f8822d5c98d6bd555b6a958ebaf5041bbc8f8416250bfb0e4d3bf354c5cb8ee597a393019b3404780aab14
-
Filesize
1.7MB
MD57138262826c2fdd999c84843bc8a2325
SHA19c35eeb2697d12d474a4c895e68664009478f20c
SHA25602fb9e80126fb9b53fd5c4fd9c84b835e87f2510a7307dd7d103863e54d39e45
SHA51280c8be1f48352c013fecf0a172d5811d82775e70b0bd661f7671da4a6efaeeae9a49b710c1f83319801ef1a832cefc3bd2be63a19a7db16cf76bc59c50398a63
-
Filesize
581KB
MD502637c43dc72510dbaf22d6f9d777883
SHA16c331801b012ca9c2bc8217e9e679c95f8c55f64
SHA256eda367dc6f35e5a0452aaffb32b5bb61c34fe824a742d6555594f5b404e55c02
SHA512fb3b7ba627e7b9ca84939f75c30660dd65bc52259564e5c434aa6be8436b7a6f73ac7926569a2573a066aa94535f7959dc25d98ebad5951269af63f54041dd9f
-
Filesize
581KB
MD51df72cde47e4f984af4f1c11534aadbc
SHA1fee47e8c1ccee5bb74e8d98e875655cf0c4e6e21
SHA2564959fb1277703db40fae974c33980391884d09df33703dbe18e44fe27171199d
SHA512dbbc8e18aabfff2cd3591101c393b63cc3557fa3de27990318b61af1e9b2171c0b0f6b8aff1827be771a72c0d298a2619f0132cabe5d2b2e7537a539b34aac3c
-
Filesize
581KB
MD52fe5b2ced773ecb31a88db4239ea4df5
SHA1e51d6867927b12d3ca31313fc72fac28d911c69d
SHA256fde45fe54f5df2a41135eab00a670d7f59c3549a668f5d1687f774a8872c2f5d
SHA512dca8f3997d878b045d3768415b146964495abb5388444de0a4b4b41da2328e3009a653cd5377d3046bcff337a62086368c63a0c9598560bf238f516c7eb252f7
-
Filesize
601KB
MD51224183c766590494d6e1f50d7560f59
SHA1762fae81d729450eea7013909d8251f12c7b9c50
SHA25653a68f0cdceec146525e2c69b72496e90f01a0c84d2c02f247cc1629ac6f9a55
SHA51241a2e0349fa64664257eb3af3112c0d15adc64f8f907cdb8a9b1ae6de48fdfa07be78936c54bf598049dbfdec9388aa48b15743544d9a1d4f6939ab8ce4e4362
-
Filesize
581KB
MD50e6720209d99fa9866e341dc49588fcf
SHA1cc29d32c43b65a8943e94489aa54329570d9ab8e
SHA2560aceb595fc3c9588a1ee70a311119ff4b26e3922365b10d75cc69fc51322f018
SHA512fe28acd4052effcaf564db5fb24bfd6608d0c78884fe709068f9be58552346025b8c1375ad83d6a7d2e88056c9556302415ee7e9cd13db6126ad6e163f32621b
-
Filesize
581KB
MD5228f5853879078875254341ecdbc4668
SHA13490ec3a2fd38c478e3b546b5bfb557206cb1ee9
SHA256d8c594e8b5123ca5a5deef9c627bcf77abd6527204820ee18ccf2c439892680f
SHA5129d4fba24af0b7767c8639709ee8d9b6602c726dadde4fefe8a1afe439abe0fd1392be6669650493e7f04d7d3ab2c5af47cec8af4e9b1ef14522a30ad96ecb1e6
-
Filesize
581KB
MD5f546b84da486a0f1b55959a1968bb13c
SHA12c3af53ed52940a0c3215d4ed440603f25421108
SHA25624f2852676b0b6bd3dd5b611daa781cf60f02e813d2887de055fe6d5ee4aa968
SHA512acc81242b79a335562655b6117a90e01c9ee0533400e2674adedf7b4e4817358549c4a9e319e8a213f63fbc71467dbfbf16a608acb4cb1db96235273e743868f
-
Filesize
841KB
MD519d27431896e336b30e81a0f7530db87
SHA14a4424b79704c60597409f22f34a5d5dad5deb85
SHA256f0cb795ba4e7031a375be70e458432f976839f9daac8ee5114e0cefb6cf55a54
SHA512f67632ab125a8d9e84103fae059033f21d2c3692aa7f16fc51dc829aaad99918cbff280ba0fcddd885eff40b5f51f1c16886baf71dca530fce972d0e76e17ef1
-
Filesize
581KB
MD5a20f2c5a01e87a58d6d8823dd1ccff94
SHA15f5a75d0864a274effe88c37450fd430be755dab
SHA256af54a91be225a14afa86a894ce959f7007f8a53665d4607a78f91592ac259e20
SHA512a1c29e616a021b51ef531686d9ba9c464257990f8e2157c47ec6058970a1706cfa8ea6765e9286f1feaad59611653948519b056f2b758520c142da825a76defb
-
Filesize
581KB
MD533581d2ab50ca1150ac3eb6bf545b448
SHA122a39245c4deb55939c2268cf6fe63d34d1f67e8
SHA2561e542863ecd3246b40ad4b67b51051fc4102fea1a0ebf76bf0de0c56868e8dcc
SHA512895b5b7488e3ae8bc069ffbc532a8419ccc948992a491d83958f1b411e2ce8ed13ba51ea1f17623b27f7b2a262ac712bf753befedf787ee8a98e686a29d9a6ad
-
Filesize
717KB
MD5a3f24a0ab9fff0f9c7a26e3676edbfeb
SHA1f99b60c6a3d28e85a1dae78feb0c0281bf6a8ac4
SHA25688b1748cbfc3fd6b3bb89ab5712073b6c2ab63d02774b9c1322a61b9ccf928b8
SHA51269a83790db21d62006c500910ec72ee4c3c1323ba1e7d9c845f998d2e8f870cf8ea94073ff49ada5ddfdab807fccf33d5ef4ef1d3576f61ea0cecc6e19fea6d6
-
Filesize
581KB
MD51b02fcac3d9e4f7fa9cb1cee4e01159b
SHA154ccbca422dc7ef1860d1ecf5b0db48e68eafa03
SHA256b8ad2814974b06a664418ec859167abd269675d4eee5e6780435d20a7a8a4bfe
SHA51230bc216a75fc736da8470b773202cde6a623f4b0661fc227f2e05eecee293d0a81f7cd13cbdfc45a1eef250c3c07ec5f00278aff16c5e3361da62d7bcbc2ff05
-
Filesize
581KB
MD57c10ebf70693e42f612e1b56fc80683e
SHA13f514dd57a2e4bd5a9e178e53043a8048667f390
SHA256a81e4c05ab43caa72f417b0c063c90f4026ab2e46eda8ff354d93ba6b284baf0
SHA5123e50e367e7a335bd2ce7ac69100e87cd842eb7c3b6503f841c3cc8f77d1297120832e410f8cdde96bf70c8605b16db2380449005159b3dbabfbf0b6d5fa69fae
-
Filesize
717KB
MD53bff6ca4637fc9c50f3abc48404ea15b
SHA1f54aa42352d5d3b988ad37b3e53e7a34a336fbd4
SHA256e30684457c92d6db7f968385dfe1eec9999559b22f3c747a3b20b99e1d192605
SHA5126fd7d0cca616852095d9ff924cdc186ac4635eb66be9ea821748188534f1445cef515ca71ef804c00b36af2df930ad1b91bdcacb5b7a55c10f613dd1f444a3a9
-
Filesize
841KB
MD57c2c1b46fee327d58efac8d514a2afca
SHA1aed7ce308bf3a8acf8de932b43c5ef56b86cade1
SHA25603e92477fd27aa34926ad66c52d2206f53aca9f8c0b32d71d4137050dffbf28a
SHA512ec8162e86cc742190baf5b56d6ad41768f99f1375e3b9b5ec81a173b10ec7fc129659b42e446d7bbe2a0a05cd872a093728cdee22f9a6f4dac16e1d4c10541f8
-
Filesize
1020KB
MD5c0d97fec1f1a4518402907e99078d6f7
SHA12d0a26aac6f74a24a5fd43f4d3845b94a4d4366b
SHA2563edc1c41f817bbbfc4c08143660f4d36937af6c2a5a97b41f6c9761745911192
SHA512e4199fbd2076962fd7b7bcf568ccc4616b5defba83939ed85673a16d03fd47b309b5808824e4c5395b383702e11800d5d06898a43928af245a0a75e9ce454c8c
-
Filesize
581KB
MD5903a0c19ce971593f596b294a6bccfd0
SHA105f63c20a27f8fbfe6ace3c0f584796fdb5873d8
SHA2560e391665e77c00243cd47c2c8b78d5e587bdbe2977160d30db4c52aa6e9b2935
SHA51276349e2e49f814271f910a238b651bda0d99662b12bc98c0bb47c512d9d39f9ff5e5e30831eaca77ac85bde39dc03a710494b448d1df9f304e84f35fa5daad38
-
Filesize
1.5MB
MD5fb6638803b071c2d2424ff8ff1dad105
SHA18b1110cb6b53206ab3f60b365aae620baf8df364
SHA256ac0c9d3be6df79b53b45f8898c8e618964ede4fb33099ab99f8cc0be84afe01a
SHA51261e6c882cb85d6152de3c4e2f50f1b8c5cbea23080d9ec16430d744deb6628f9ab552c79e4d0826142b2a620645fe1f1a4171385a9f82d5ccee6ae24600775dc
-
Filesize
701KB
MD5f9694f7f318e7f429a0652edd52d1942
SHA1c26cd3678a2a1d69a98ba1acad16a37d2196ef09
SHA256c1b0c14bfff2e7e9a5e1a85b0d28aad30906f2ea837c0cf1e5bdacabc78dc591
SHA51209ed1dc730758ebf48faed26ce386310215a7a9af7768248b273f9decb89a35c058e55071e5c8643ad3569cbd62392564792d7312bc1bf3f4e4b45dc2940844e
-
Filesize
588KB
MD5b11259f762319adfbf6aa7a9200bd6a4
SHA1e195bdb85a24c5dffb770f0034e17457b5be6dff
SHA2560cd431ec9a6237bdc11bf5fcfd25fc088a30063c82bda34e5bac51311cf06b4d
SHA51227dbdd45531bdd31ea4441b3784a02f1bb5d95a658d3e38e59c6122bf6bc5d2c79c633a4ea4facdaf2a97fc7e127aa39699dbe4acb1a01ff190b032f391c1470
-
Filesize
1.7MB
MD593293b7b1e1863617ff17e33330d0a28
SHA14d3d4b542aacd3b189488c626b9a4cfb133c5927
SHA256973f355a627c36584d19743938ecd124346411d85f9fd46f65db32c623aac831
SHA5126e62481eb761ea16eff014359a15764b7b844938a1252c9897f851f25ee3be695ed1fff2e83b4bf089b0062a44f3ca97023cbade68e72a3846e18817bc76a214
-
Filesize
659KB
MD5b24e4ee307f20fa33127e87b56feab19
SHA19f208bcc83f806ecbc2c23215ba87dabc2c7d12f
SHA25651a4f0e2e72083c5d81dfe74b304552211425c72189ca1d312aae13187be6b21
SHA51277665a9805b1a86b11f3ef50c67c3631f7963c3e4ed9dc26746d2f9a320eb62592c9102ba3ebda1d0a09670df3c0ab02e7228a3411395df42eac96056c29e077
-
Filesize
1.2MB
MD5a496a91934745a8554695ed03e26b8fb
SHA1fa3bedfd2eeb2b06c4b16d7a885c4670816746eb
SHA2567079e3329b2d231e19c0417fba1e6850c20fef4992e5ca1d6a4ac0f39791b712
SHA512ad0dd1a07bb285ff18617af367181720bf98e0a86dce0e51664852e142d76521f29dec951c852ce08303735a4d42564fe7a2d886b319da1175c8c10b5912a48d
-
Filesize
578KB
MD510dea12de1308f96faf144233575fd78
SHA18541df65824108250cf5ffdfb3d766c7f417a280
SHA256da667a1c6f23455ff7f5d3bb762f4d6004638b2173bc2bf449f7b8f778d4ebcd
SHA512f1928bfd3f7269f4fba86dd181e7f33b9ee658de8db00b9582e13d914a82f4e177b7fa7a72414d5c12b05755f733c78b816206e00b0e4bae3709a97967077a94
-
Filesize
940KB
MD517f51fa9c55e13143e5ebfbc9aa77230
SHA1c897f68d8e7468596c1ed4bfd6829f5ab161b7b4
SHA256c5d7d7acb02d09cb293de37a47225ed54d071bcf8d89cbb9e4f8c69178059910
SHA51263dfdfe7d17967f914d4177b8c0b1c146639204a61d1b14338ea58bede2c4f8ba8f4545a2897c60c33ecf6b33e689207a5e8274b636df2404a0c459a87005cc5
-
Filesize
671KB
MD56ac1881d309259a15c9ae88d5c3c303d
SHA17cd2b61cb4fcab4ebb212b1f34328e594f69e382
SHA2564a7fff065ae9c9ce2ff31b72d452cadf8dcbd500a7094c81c162610a673cf45d
SHA5125ffd251c0d0102d2cfb7e3bcbd87615bc1dda1b93e392d8dcfb07a15d719f0c65b4563628c6fe5fa02146070e1873be4e8e7ee347d1a7c86a10418ef587cf8a7
-
Filesize
1.4MB
MD5c8816bfb3ec536fc3918304392239850
SHA12c3622dba99d6d435124dbb41842104d16313123
SHA25669533bb5982c757fd18cb010db73e6ee1df8801fcb988bba6e2cf45f5550877e
SHA5121f7f93c1ad42e30141161b9fbdc39627d3eef5f9fa91206c3c3a627f3483c7c508c066139ce209fc8e6206211f2b27f969d76f08538c595f05aa2681995b2134
-
Filesize
1.8MB
MD5fd67ff6f5889a4a0ed7af1151941bf85
SHA19e351f4cb7291c58b4dc0d661b9ef8c228660055
SHA2561a2cea4206429ab479c1fa3280be3ddabc691c92be5c11ccb33a8c28c22cebc0
SHA512b96eb36b731df5ccfde25b74491e6a6fac2c5563957d73e430493e9aa81ecdbf4caa415ed5544fe2d3bb7cd52a6a29ad9030130abd37af3265d798ed5bae8a53
-
Filesize
1.4MB
MD58a6936d9b9a4633ed7eb336940ec9909
SHA1f0a78a40603f68907665bb1d9288c2d48b33f835
SHA2564c1e27d6ae920c46527e185dad9e1b992e9857d87dbb5dccd46b515e0d26e5ed
SHA5126348a22750ed73aedb4e6fce1570d6191bd6593f49b39737bfddbf706cdd005ac2c69b65af751001280858179eb7d99d9de0aaef4a854ccfea8b10075a88d6a2
-
Filesize
885KB
MD5e3b57d4f547675230cc96be166410532
SHA1896d3212ba9f19ff589ba25867a45e98e9343468
SHA256a78df20710d4f9d9b03d14ed65057363f462e861880cbd0428da4529bbb3b628
SHA512ea090c989eb1d466dd883cddfb7ea5a57230db7db6681416b181de4c4e70eac767441dd70473701be9fa9900b3039be32278e5d7228d28777663365c35921cd6
-
Filesize
2.0MB
MD5ddab879ff417a1b9bbeadb1436d05053
SHA1b425bcd51868827b355c9c6e845ae472b088ba74
SHA256094371bffe695bd5a66ad231d6174d19251bf45f36ad293be1297c38b9507e73
SHA51201587ac447036c383823f976cdcae00684e68d0adc01b265d224df8ad02bd3bc975f5c33893a9086ecdb434e131d39ca3541f89ebf682046c36785b126be886c
-
Filesize
661KB
MD5d300168df06b0bba95612fc9cef84271
SHA108a68027de1f4e20c17c44878026b460d84c94c6
SHA2560b7293820712be1a33dc1cd08bb73d5ab868d513b1ae30ac1d1120b6a21a0dea
SHA5129df3b0c4cdb74dfa0e00a2a6f9d1cb5b7e0c30d21120361adc6a613e316890c8a9dba9dbd072b69829d8600563fb04078bf0b68cdee934cc61ff1c31f1e64fc9
-
Filesize
712KB
MD55db93e9b706ab343236a2409aa8d4e8a
SHA15d163624eb7c6a73960414c6eeebf06bee5287b0
SHA2568b8c3b30534d3ab336d6a3939e15ff14d785b0027bac0a594331cc91570f9c12
SHA512d95b27c0689b6243d9d23aeb688143109b68f4ede5da55b6c9e3d90648294421924c87a48071d3c6a709e4eccfa7da5456eebf22cd410158f90ebda534c05dac
-
Filesize
584KB
MD50f9031bd4d710cef4dd2cebc1a3dc276
SHA1acab6b21258e4eb451f2fd916cda8cd0b473cb36
SHA256005d939d0e3d4335d440d3057742ea785539eac68a6ed557bae87421c329be17
SHA512a72827551d653cf34d8d1a97d2a50775b64d50f89c08aba1d1526ff17050891008e153f8e6f577150e76ce9bf2d04b53bc617adc6a6f6f38c880778fb4034db0
-
Filesize
1.3MB
MD5396ff5d3269976452268509ba43ff158
SHA106ff79559241e415273299b1b7d7ab808cbfd586
SHA256ae6b135ab8c3b079b9f384081e1fee0be5f237a3432e3db8518f3646f9f2f298
SHA51258a9896da1192fe68fb97d387dd2cdca4c695fef58d572e7258c40cf69a9c962d8de5ca4ad5a0b9e618a4ef2aa8cc7138bb1352458fa61a8feb5f8f993195db2
-
Filesize
772KB
MD5a528999ced2de66d44ebe9beb5a8b733
SHA14380ff44a5d7372005d2b4e1994fde31a3a1d90d
SHA256c1034ebfe89c640f04ea27e2acec9ab24360502d967e0a901a6e1a68b6739f22
SHA51220c1d8c286a5ce2590c78759108245d331501b13a7e2d0994bfaab83780f2335518cadd85ccb2f25fd46bdeec2486fc0f845c8df8da0944f4275f08869a2e4c7
-
Filesize
2.1MB
MD5f676bffec330dff6938a5395ae8b2133
SHA1ab0861bcdd521b459da54cd9bdaf50bca67c639a
SHA256826c91b2ff6e19618660303a4a9170ceee02fa8a8b9a4b65a028fc08de21e7c3
SHA512911bae579693248eed678e0a2a3ea37611171970bc2d791cf0d6d53cfe74273e33251824bee74989bea8a80430a15696f04cd3f56ed2e42fd603b6c1f8fc593e
-
Filesize
1.3MB
MD534f9565db82b042d03f5723daf9c2e78
SHA1ea35ba76c939fce32d037f39027579f1ce7a928c
SHA256147432bc4ccdff7ec48878575f4b87b09737372cc511a75cb945bbd5fbaefc93
SHA5125d6d6d8c923fc0aeb924a987dee4b4feb906cece64bf109e4bfede3794b04dc60aa68de3a69a0a5add0e58505d1953fa1d4017d7ccf71dead63c946145e0ef80
-
Filesize
877KB
MD55a92a16999d6ced5da2fa792e74e70b7
SHA1ccc7ebc8b48908d294c244d8f00262425408a19f
SHA2561b1587cf385e7592061bb6052c3defbc4f57107c052595c8a8bb41dffeebca11
SHA51275a74337dc2c2badba72b993f532726251c6d82a698660a545180c239ae16670bea58acd0874c773a1ac7ddd0eedf675f8c892f6a7855a9e089c7bff4852a24e
-
Filesize
635KB
MD5a3c32c3c3d0cfdaf9b3948487d82efe1
SHA1ffd15e558bcc44529303ce7faceeb6e60947e250
SHA2562fd55ad7c8a90d3815a547deabe984231e6d06f5a7f4d247c818cb70b622fbf9
SHA512bca50a86727f98565ac2a4a7e08c29097285d4a3c9f2afa6655759e3ddba9a4487547ccbf8ca68c4a39101af981f011652bfc1305180c3865c5ae607506bb0ab