floxif | 52614b8e855f86a6e18c07d48c2ca857677b5fef5c5db728f5a688ae544a304e

Analysis

max time kernel
141s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-01-2025 02:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-01-04_ca2cd40054d5bbcd04a01cc3b0f44e7e_floxif_mafia.exe
Size

1.4MB
MD5

ca2cd40054d5bbcd04a01cc3b0f44e7e
SHA1

8886e5c8a72e76fa6959375f8517b25322e3e23b
SHA256

52614b8e855f86a6e18c07d48c2ca857677b5fef5c5db728f5a688ae544a304e
SHA512

399de63eba9f0ddc947eac5c52b5ac3dbe84734166ffb169a325a52cde8ec0be2e7ac5385391a30ead63724606f4687fbd7e96c7b8404ce86570bb06a083c12b
SSDEEP

24576:3Ucn7H6SyM8vFcmdn9A99JcNshDF3VNvAQ3lrEH7u:3Zn7wM8v2mhejJcNUDFDvH

Score

10^/10

floxif backdoor discovery persistence privilege_escalation trojan upx

Malware Config

Signatures

Floxif family
floxif
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral2/files/0x000d000000023b33-1.dat	floxif

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000d000000023b33-1.dat	acprotect

Executes dropped EXE 2 IoCs

pid	Process
4892	ICCProxy.exe
3556	ICCProxy.exe

Loads dropped DLL 7 IoCs

pid	Process
3444	2025-01-04_ca2cd40054d5bbcd04a01cc3b0f44e7e_floxif_mafia.exe
3444	2025-01-04_ca2cd40054d5bbcd04a01cc3b0f44e7e_floxif_mafia.exe
3444	2025-01-04_ca2cd40054d5bbcd04a01cc3b0f44e7e_floxif_mafia.exe
3444	2025-01-04_ca2cd40054d5bbcd04a01cc3b0f44e7e_floxif_mafia.exe
3444	2025-01-04_ca2cd40054d5bbcd04a01cc3b0f44e7e_floxif_mafia.exe
4892	ICCProxy.exe
3556	ICCProxy.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	2025-01-04_ca2cd40054d5bbcd04a01cc3b0f44e7e_floxif_mafia.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3444-4-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/files/0x000d000000023b33-1.dat	upx
behavioral2/memory/4892-133-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4892-134-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/3556-140-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/3444-162-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/3556-164-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe	2025-01-04_ca2cd40054d5bbcd04a01cc3b0f44e7e_floxif_mafia.exe
File created	C:\Program Files\Common Files\System\symsrv.dll	2025-01-04_ca2cd40054d5bbcd04a01cc3b0f44e7e_floxif_mafia.exe
File created	C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\uninstall\Setup.exe	2025-01-04_ca2cd40054d5bbcd04a01cc3b0f44e7e_floxif_mafia.exe
File opened for modification	C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\uninstall\Setup.exe	2025-01-04_ca2cd40054d5bbcd04a01cc3b0f44e7e_floxif_mafia.exe
File created	C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\uninstall\en-US\license.txt	2025-01-04_ca2cd40054d5bbcd04a01cc3b0f44e7e_floxif_mafia.exe
File created	C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\uninstall\en-US\setup.exe.dll	2025-01-04_ca2cd40054d5bbcd04a01cc3b0f44e7e_floxif_mafia.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ICCProxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ICCProxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-01-04_ca2cd40054d5bbcd04a01cc3b0f44e7e_floxif_mafia.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{46072945-A3E8-477D-B70F-8B66AA05C7FE}\1.0\0	ICCProxy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{46072945-A3E8-477D-B70F-8B66AA05C7FE}\1.0\HELPDIR	ICCProxy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1602C177-01DB-4C7F-963F-D01AD98CD287}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	ICCProxy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1602C177-01DB-4C7F-963F-D01AD98CD287}\TypeLib\ = "{46072945-A3E8-477D-B70F-8B66AA05C7FE}"	ICCProxy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{64609F30-9552-4FF9-B3B4-E928CA8038A2}	ICCProxy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ICCProxy.IccProxyClockManipulations\CurVer	ICCProxy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{46072945-A3E8-477D-B70F-8B66AA05C7FE}\1.0\0\win32\ = "C:\\Program Files (x86)\\Intel\\Intel(R) Integrated Clock Controller Service\\ICCProxy.exe"	ICCProxy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{71DDF0D4-8AA9-4F69-80D3-031879DA4D2C}\ProxyStubClsid32	ICCProxy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1602C177-01DB-4C7F-963F-D01AD98CD287}	ICCProxy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{64609F30-9552-4FF9-B3B4-E928CA8038A2}\ProxyStubClsid32	ICCProxy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{64609F30-9552-4FF9-B3B4-E928CA8038A2}\TypeLib	ICCProxy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{64609F30-9552-4FF9-B3B4-E928CA8038A2}\TypeLib\ = "{46072945-A3E8-477D-B70F-8B66AA05C7FE}"	ICCProxy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7B33B0B5-F719-4B0B-B48A-0B8F20CA08A5}\LocalServer32\ = "\"C:\\Program Files (x86)\\Intel\\Intel(R) Integrated Clock Controller Service\\ICCProxy.exe\""	ICCProxy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ICCProxy.IccProxyDebug.1\ = "IccProxyDebug Class"	ICCProxy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ICCProxy.IccProxyDebug\CLSID	ICCProxy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{33A86FA9-EBB6-449A-81A2-2BC3B2527A49}\TypeLib\ = "{46072945-A3E8-477D-B70F-8B66AA05C7FE}"	ICCProxy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7B33B0B5-F719-4B0B-B48A-0B8F20CA08A5}\AppID = "{3163A299-B985-4140-A820-57D8351EFCA1}"	ICCProxy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{46072945-A3E8-477D-B70F-8B66AA05C7FE}\1.0\FLAGS\ = "0"	ICCProxy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{64609F30-9552-4FF9-B3B4-E928CA8038A2}\ = "IIccProxyDebug"	ICCProxy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\ICCProxy.EXE	ICCProxy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ICCProxy.IccProxyClockManipulations\ = "IccProxyClockManipulations Class"	ICCProxy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7B33B0B5-F719-4B0B-B48A-0B8F20CA08A5}\ProgID\ = "ICCProxy.IccProxyClockManipulations.1"	ICCProxy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7B33B0B5-F719-4B0B-B48A-0B8F20CA08A5}\LocalServer32	ICCProxy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{46072945-A3E8-477D-B70F-8B66AA05C7FE}\1.0	ICCProxy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{71DDF0D4-8AA9-4F69-80D3-031879DA4D2C}\ProxyStubClsid32	ICCProxy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1602C177-01DB-4C7F-963F-D01AD98CD287}\TypeLib	ICCProxy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1602C177-01DB-4C7F-963F-D01AD98CD287}\ = "_IIccProxyClockManipulationsEvents"	ICCProxy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ICCProxy.IccProxyClockManipulations.1	ICCProxy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ICCProxy.IccProxyDebug.1\CLSID	ICCProxy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{33A86FA9-EBB6-449A-81A2-2BC3B2527A49}\ = "IccProxyDebug Class"	ICCProxy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{33A86FA9-EBB6-449A-81A2-2BC3B2527A49}\VersionIndependentProgID	ICCProxy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1602C177-01DB-4C7F-963F-D01AD98CD287}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	ICCProxy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1602C177-01DB-4C7F-963F-D01AD98CD287}\TypeLib	ICCProxy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1602C177-01DB-4C7F-963F-D01AD98CD287}\TypeLib\Version = "1.0"	ICCProxy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{64609F30-9552-4FF9-B3B4-E928CA8038A2}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	ICCProxy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1602C177-01DB-4C7F-963F-D01AD98CD287}\ = "_IIccProxyClockManipulationsEvents"	ICCProxy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{64609F30-9552-4FF9-B3B4-E928CA8038A2}\TypeLib	ICCProxy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{3163A299-B985-4140-A820-57D8351EFCA1}\ = "ICCProxy"	ICCProxy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ICCProxy.IccProxyDebug	ICCProxy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{71DDF0D4-8AA9-4F69-80D3-031879DA4D2C}\TypeLib\Version = "1.0"	ICCProxy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{71DDF0D4-8AA9-4F69-80D3-031879DA4D2C}\TypeLib	ICCProxy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{71DDF0D4-8AA9-4F69-80D3-031879DA4D2C}	ICCProxy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1602C177-01DB-4C7F-963F-D01AD98CD287}\TypeLib\Version = "1.0"	ICCProxy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{3163A299-B985-4140-A820-57D8351EFCA1}	ICCProxy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{33A86FA9-EBB6-449A-81A2-2BC3B2527A49}\ProgID\ = "ICCProxy.IccProxyDebug.1"	ICCProxy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{46072945-A3E8-477D-B70F-8B66AA05C7FE}\1.0\FLAGS	ICCProxy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{46072945-A3E8-477D-B70F-8B66AA05C7FE}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Intel\\Intel(R) Integrated Clock Controller Service"	ICCProxy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ICCProxy.IccProxyDebug\ = "IccProxyDebug Class"	ICCProxy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{71DDF0D4-8AA9-4F69-80D3-031879DA4D2C}\TypeLib\Version = "1.0"	ICCProxy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{64609F30-9552-4FF9-B3B4-E928CA8038A2}\TypeLib\Version = "1.0"	ICCProxy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{3163A299-B985-4140-A820-57D8351EFCA1}\LocalService = "ICCS"	ICCProxy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ICCProxy.IccProxyClockManipulations.1\CLSID	ICCProxy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ICCProxy.IccProxyClockManipulations\CLSID	ICCProxy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ICCProxy.IccProxyDebug.1	ICCProxy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{71DDF0D4-8AA9-4F69-80D3-031879DA4D2C}	ICCProxy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{71DDF0D4-8AA9-4F69-80D3-031879DA4D2C}\TypeLib\ = "{46072945-A3E8-477D-B70F-8B66AA05C7FE}"	ICCProxy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1602C177-01DB-4C7F-963F-D01AD98CD287}	ICCProxy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{64609F30-9552-4FF9-B3B4-E928CA8038A2}\ = "IIccProxyDebug"	ICCProxy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\ICCProxy.EXE\AppID = "{3163A299-B985-4140-A820-57D8351EFCA1}"	ICCProxy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ICCProxy.IccProxyClockManipulations\CLSID\ = "{7B33B0B5-F719-4B0B-B48A-0B8F20CA08A5}"	ICCProxy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7B33B0B5-F719-4B0B-B48A-0B8F20CA08A5}\VersionIndependentProgID\ = "ICCProxy.IccProxyClockManipulations"	ICCProxy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7B33B0B5-F719-4B0B-B48A-0B8F20CA08A5}\TypeLib\ = "{46072945-A3E8-477D-B70F-8B66AA05C7FE}"	ICCProxy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{64609F30-9552-4FF9-B3B4-E928CA8038A2}\ProxyStubClsid32	ICCProxy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{64609F30-9552-4FF9-B3B4-E928CA8038A2}\TypeLib\Version = "1.0"	ICCProxy.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3444	2025-01-04_ca2cd40054d5bbcd04a01cc3b0f44e7e_floxif_mafia.exe
3444	2025-01-04_ca2cd40054d5bbcd04a01cc3b0f44e7e_floxif_mafia.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3444	2025-01-04_ca2cd40054d5bbcd04a01cc3b0f44e7e_floxif_mafia.exe
Token: SeDebugPrivilege	4892	ICCProxy.exe
Token: SeDebugPrivilege	3556	ICCProxy.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 4892	3444	2025-01-04_ca2cd40054d5bbcd04a01cc3b0f44e7e_floxif_mafia.exe	84
PID 3444 wrote to memory of 4892	3444	2025-01-04_ca2cd40054d5bbcd04a01cc3b0f44e7e_floxif_mafia.exe	84
PID 3444 wrote to memory of 4892	3444	2025-01-04_ca2cd40054d5bbcd04a01cc3b0f44e7e_floxif_mafia.exe	84

C:\Users\Admin\AppData\Local\Temp\2025-01-04_ca2cd40054d5bbcd04a01cc3b0f44e7e_floxif_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2025-01-04_ca2cd40054d5bbcd04a01cc3b0f44e7e_floxif_mafia.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
  "C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe" /service
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:4892

C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
"C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Intel\Logs\IntelICCS.log

Filesize
4KB

MD5
7586248d1698fd04f62b116faa9314c9

SHA1
670521946caa47c28a334ecb6a70db298830de90

SHA256
9ff214027b3740c269c614201db0cf34224d26918d120d14970398d8ba8d9eee

SHA512
59b2b1ad84caa24921bcd94838b1cfc6b31a1c36a194b40d432ea2c215790bcdfee1eaad96eceeda8d4383cca155006b5298a397b18d639b3a44286c916036d7

Download Submit
C:\Intel\Logs\IntelICCS.log

Filesize
1KB

MD5
0a90f4c242e09440ef5dde6d3b52fede

SHA1
9cc383ea7137d394765eb03d5a6f63bd703be43e

SHA256
d3c2811a94efa857ac2737753afb7b6204deb2b9a8fe96b3e78731a75cb33813

SHA512
dd40eb00d7d0e240bccbbc3cd95c53820de2ffd36259f3aabddc9e1f6834ac7b4221591efef32c383d97f71eaa592e8b428c8f2ef96f86b825d8a7388c4c15d8

Download Submit
C:\Intel\Logs\IntelICCS.log

Filesize
2KB

MD5
3e3806f08f3acb23fb901cdf1c692754

SHA1
4857fc76f41b455adaca12caccb3957fd633b375

SHA256
dd5abf4bc40cccab4d58e4aec262c085eefd3e451c0cb2e65eefc4079aed216d

SHA512
ebd61d75f90e870724aabfd0aad8172627185562ffd93692a977f37f224c7937e67e2bbf368933580eeb5a2dadf91c162283b384b02037a38739b30f1ff82533

Download Submit
C:\Program Files\Common Files\System\symsrv.dll

Filesize
67KB

MD5
7574cf2c64f35161ab1292e2f532aabf

SHA1
14ba3fa927a06224dfe587014299e834def4644f

SHA256
de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

SHA512
4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\IIFC8DF.tmp

Filesize
7KB

MD5
26e192bd9e2ee3641882e60297dc1853

SHA1
0b3e1c38785c32a97f1bc05da768f44683c23b09

SHA256
096d44324b556d7f253e1318b3ddfb20ce96a8563d3104a7d6317b0507a2628b

SHA512
e4cc5a1e1d54004553cd6727db5a3d57246281a4119a8309e87c1579334e33bfd1b06556e42bec129a9d45103be194a9398b9fb5f74020448b4cdb38138e4e5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IIFC8E1.tmp

Filesize
9KB

MD5
2077ce430146b94add67a10f1cf35431

SHA1
8a61dad90652df15f51db6c7ea19666fc0edbc46

SHA256
749ba8af45b0c8e3b2cd7e6eae5f5e41e9771df96ffbcce71c92e2f9be73828f

SHA512
6aedb87232ff722c344485451af8c7995c3843de8e7335bcedd2c1c5db894d91e56e5da653e93a55298ddac8b2699342c9df8b649d929a9aee4024e9b2d45239

Download Submit
C:\Users\Admin\AppData\Local\Temp\IIFC8E5.tmp

Filesize
1KB

MD5
cdd2f4f9c3b30af6003f32b742583a9e

SHA1
a77982d7e029616cd0b3934ac9a0755429533642

SHA256
d65ff4b61d3d376e3d8741d695b5d983229b09203f9198819a3a385ab72faab3

SHA512
0a2218c0f38d90a5e8eb9ada53fa44a17acc846958087d729adc6db793c93ee4f7302249f4f1ff3d9b8deb63ed76a28f0e5aabe19814c2846fbf0fbcb7c7a6e2

Download Submit
C:\Windows\Temp\IIFC217.tmp\ICC_PROXY\ICCProxy.exe

Filesize
212KB

MD5
e54bfab1679ccfbe2c28ad18be9d0e5f

SHA1
e27a500b69b3bd52d455b8a9418cc08e3cba1a93

SHA256
daffcfebdadee43fe657ffffcfada2f7ae62fcb29915540f620fdc0041a99cd1

SHA512
204f8abdde5ef4707a817984d0d942a8418b1bb0ca14d9a2d51a592a74b762dc27ed1681abded03a497c1fee95ce0b1642676e54fa885a0f05d7b68030f49dcc

Download Submit
C:\Windows\Temp\IIFC217.tmp\Lang\en-US\license.txt

Filesize
22KB

MD5
d6bf7496a982ba8d8743ef295aa46732

SHA1
dedceeef3224e6f2cd81d48b99aa9367dd5dc187

SHA256
90b020441fb3f2a8787408c8feccd5385188856cb132a645d65a4b3e0b0f22ba

SHA512
414d8bcc22a6fc7a842c4c42c5936b6a01ac696796510e8e76452c09535090359b9e456a589c2dae3e15449941eba61e441b112ac51044e21ee7ddce1100f2ea

Download Submit
C:\Windows\Temp\IIFC217.tmp\Lang\en-US\setup.exe.dll

Filesize
17KB

MD5
a3e690614d940cea53aa1084674d6f93

SHA1
4dfe95bdde87079025e031cbc5dac4e5fb85ef0c

SHA256
86f97668b5f2efe0c67c049a60f0e781c2a2d3de1e3c752816da9d24b30058b7

SHA512
1bf12df05765d22a137df0cde9da84a38206406a88dee00c289649025f4ef87781ca677dcb47d3db3fa019d21ab974b6456fda39d2aa92424a8a4727b0b934e5

Download Submit
C:\Windows\Temp\IIFC217.tmp\setup.exe

Filesize
880KB

MD5
13fc3c7896c34dd84d77a9a2829e4105

SHA1
f789a4a63eca0b0e92921c5463b314f808359172

SHA256
a990abc70dae46ab18bef3f732cf08c37eea92ee210029a62c8362b4456673cf

SHA512
816d49eee53e513cb41d49761192a8751c613d548de1560a589fa4ae05e2a1a763bbe3e6d3907a370d2dc5a2c75b1aee14eb62f7242e74b63bc56b20d17d6d20

Download Submit
memory/3444-4-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/3444-162-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/3444-160-0x00000000004A0000-0x00000000005F8000-memory.dmp

Filesize
1.3MB

Download
memory/3556-140-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/3556-164-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/4892-133-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/4892-134-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download