cdbad8079a664ab5d049e8aa8f9f42ab48be7e8557b72f2e49a76d280f3b826c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/07/2026, 23:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
Size 2.7MB
Sample260722-3dptcsdd87
SHA256 cdbad8079a664ab5d049e8aa8f9f42ab48be7e8557b72f2e49a76d280f3b826c
MD5 b3c4ff50b2e3ec6ae964c3e9bd3babd0
SHA1 8b3a5e69d44ad5e0ea5f6a22f2e8465a688cf7ba
SHA512 5486dd34c18cd5ed88e31d291a9bb031c39ac546f25fb8f5c8a7ce6a1c7a72e554fbf47f0a62bc86f3f417e5cd4dfca0938596e58ffc950f5ebe860d593e8a04
SSDEEP 49152:j47PD0bQ3dMGRukYyejJQxhUpDmg27RnWGj:UbKQ3dMGLQjHD527BWG
TLSH
T151D56E40BADA8225F0F657F0AABF86D1823B7C116D70D19F7294115A0AB0B83DB76737
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1036	alg.exe
1304	DiagnosticsHub.StandardCollector.Service.exe
436	fxssvc.exe
2504	elevation_service.exe
416	elevation_service.exe
3372	maintenanceservice.exe
1852	msdtc.exe
2312	OSE.EXE
4372	PerceptionSimulationService.exe
820	perfhost.exe
3392	locator.exe
2300	SensorDataService.exe
1260	snmptrap.exe
936	spectrum.exe
2740	ssh-agent.exe
1040	TieringEngineService.exe
1432	AgentService.exe
3252	vds.exe
4448	vssvc.exe
5040	wbengine.exe
920	WmiApSrv.exe
3056	SearchIndexer.exe

Loads dropped DLL 31 IoCs

pid	Process
3448	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
3448	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
3448	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
3448	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
3448	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
3448	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
3448	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
3448	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
3448	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
3448	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
3448	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
3448	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
3448	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
3448	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
3448	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
3448	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
3448	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
3448	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
3448	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
3448	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
3448	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
3448	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
3448	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
3448	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
3448	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
3448	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
3448	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
3448	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
3448	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
3448	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
3448	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 34 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4316d8e37c8d181e.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_78859\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3248	3448	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000091657470311add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001f7dd071311add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b3a6f36f311add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000db9f8e70311add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000043f23f70311add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008a23ba72311add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000706b9e71311add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000079071570311add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1304	DiagnosticsHub.StandardCollector.Service.exe
1304	DiagnosticsHub.StandardCollector.Service.exe
1304	DiagnosticsHub.StandardCollector.Service.exe
1304	DiagnosticsHub.StandardCollector.Service.exe
1304	DiagnosticsHub.StandardCollector.Service.exe
1304	DiagnosticsHub.StandardCollector.Service.exe
1304	DiagnosticsHub.StandardCollector.Service.exe
2504	elevation_service.exe
2504	elevation_service.exe
2504	elevation_service.exe
2504	elevation_service.exe
2504	elevation_service.exe
2504	elevation_service.exe
2504	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
640	Process not Found
640	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3448	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeAuditPrivilege	436	fxssvc.exe
Token: SeDebugPrivilege	1304	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	2504	elevation_service.exe
Token: SeRestorePrivilege	1040	TieringEngineService.exe
Token: SeManageVolumePrivilege	1040	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1432	AgentService.exe
Token: SeBackupPrivilege	4448	vssvc.exe
Token: SeRestorePrivilege	4448	vssvc.exe
Token: SeAuditPrivilege	4448	vssvc.exe
Token: SeBackupPrivilege	5040	wbengine.exe
Token: SeRestorePrivilege	5040	wbengine.exe
Token: SeSecurityPrivilege	5040	wbengine.exe
Token: 33	3056	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3056	SearchIndexer.exe
Token: SeDebugPrivilege	2504	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 4992	3056	SearchIndexer.exe	124
PID 3056 wrote to memory of 1716	3056	SearchIndexer.exe	125

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3448
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 832
  2⤵
  - Program crash
  PID:3248

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1036

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1304

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4428

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:436

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3448 -ip 3448
1⤵
PID:3496

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:416

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3372

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1852

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2312

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4372

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:820

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3392

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2300

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1260

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:936

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2544

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1040

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1432

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3252

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4448

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5040

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:920

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4992
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:1716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b89da0555463cb2bf711d7b29e337246c15807ce4a92a3b54207a641469bd8c7
MD5 911369f723cb3eea2bacdbe436689902
SHA1 2feb4ed587afabd67ef9f783c7f6cbb7b992cd81
SHA512 b2e522a9beacac272551673a8ba062a90a90ea281c7187c814b6416daf5289bbceee7e2ea04ec65670f0e6106632524a7d08a680e467a2171c23e1b2a667dcd5
SSDEEP 49152:4b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnTDmg27RnWGj:S3q6HjB0D527BWG
TLSH
T13FD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 18c12bf0bf5462e5ffa3b9b1b53827ff2e8796bdc01ca4c1dfcba96b1afa7adb
MD5 d768e48120716074a3080fd457e1dd2e
SHA1 6ec9bcd3c52668567e1a0ff0172d379ac4311d96
SHA512 32a4fdaa703384b089fbdf41bb4dd6fe23bdd9809eba37e856138e9f75029af8e6d18590a3364ebbdd9580de3e2985510f219573e1f417df1bdd0935dd7f1f69
SSDEEP 24576:SXYfDtczAssqjnhMgeiCl7G0nehbGZpbD:5tc1Dmg27RnWGj
TLSH
T127850129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 971cc21e4b56e4d5cf0ce194f69243b6eb889c8f49e7e8a4bb29ecff813357e0
MD5 17a77fc9ab55891f94d74dd6bd5de2d9
SHA1 88552adf7a3209038362ed638fe6e6207c6502ef
SHA512 51390a230cf3c5e9f25fd3e36f5d580bbb4ca616ed41c6904099c0ab816edd9b22f3a76c5bedf8bcebfd5d81ed0359b17aa94c9e75164de2bca4271411330ba6
SSDEEP 24576:I0Le5ji0hmx3rMAsqjnhMgeiCl7G0nehbGZpbD:IPji0AZdDmg27RnWGj
TLSH
T1C0A59E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9340580180108d9b449a21a395fe02d06e3096d7a7aaf3ba98fb2fb81a32767a
MD5 9324ce06edb71a2dc9eda68fcde2ca78
SHA1 196c9f010a9bd4c83182e4a7c4f45d4689e82250
SHA512 5e7d58160024f03d74139ba69913d46d90d75e7ab258c49649f4b3fc19418cb87a9a6839343bf7eec33b1f4ee7e2025751af2e3938fefd43d8eb3672079311da
SSDEEP 24576:Xa7/ezSC6vUyD/aqgrvWE6q8wyuesqjnhMgeiCl7G0nehbGZpbD:a/ezSC6vUzPvxHjypDmg27RnWGj
TLSH
T165755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8bb06b584f06e7f8077678fed49a2e959a311f8e8d42b967728abf77610eb8c5
MD5 eafda61b66569aa28bffb3337f8f01c9
SHA1 e7b14cb9a0e5cc9ef0186aa43bda464ce01b1e4a
SHA512 d8b5700dc87d7f6ca2a017b425e59cfd71ceff04a331a271cd76d0e5b2bc5a9446efc036e4342503342e45193b3e0f2f93a391eefa8bbb39493a2a155aa8e78b
SSDEEP 24576:HVbqPb88hv/l+6TsqjnhMgeiCl7G0nehbGZpbD:HVO88hXl+4Dmg27RnWGj
TLSH
T170559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 50ae2590c3c73c3e34d4686b537be4789a17246dca38775be26fbcea27bb1fc2
MD5 ca4073f7a38659d0ba2725ad5553ca86
SHA1 a3e8a40b9e984cc77e9e8882cfec35e20751b748
SHA512 3729e22fb1ff5375b2b13c3a4b4d7d29e27bcd5c6bf478cb9b9b3e1962f597ae1ab72f711a7ac1836a01476aa4418f7adb1cffbb704a0d7358613fb28d5269b1
SSDEEP 12288:rXUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:rXUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1636523BF865C50CAEB7609B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 b20974743b2120dc1dab6b13af610523b96bfa467ed7a0c00b70257179ec5399
MD5 43af6e8dffef04784f20d82747acf207
SHA1 d5e489e1c3e6ffdbde0bd85405aa892bc742ee6b
SHA512 dfa6a6b72d20b96df480df0adf7d70102af95c86092072b5fd517c251493b5596b8ffe10abd38d5eb1dfafb2620711ae53e6b78e97ef0d22557c817af2de2068
SSDEEP 12288:4eBNUbTVO86UrXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:4JIUrsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19D85CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9c814c5da91fbd2b6d982d5f242cf1d822c021034add545c47c6033c1a613b70
MD5 9587527fdbf8fdae6f0ef8879809a834
SHA1 0f726125b92168587e707f8123ee710d53f1448b
SHA512 739da7c1f56a870126ed67aa9a5746cf728fd6974143b511e8a12cd521cb0b07e985c0e7aa40f6e1eed1c4abda5c65f5e976f567eed409242ba6d26f39fa5e6a
SSDEEP 49152:2CbRquA/m2yL5zQfFiV+XenmE3/zNDmg27RnWGj:7oqtVjnmuD527BWG
TLSH
T165D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 c758b011f9ff580c8e71e74f53c2106f888cd522d573a219de7a4602e53ab7ce
MD5 67f871eef44f3e73737c40c67c13a33c
SHA1 44e422555b068e0f8ade25e8a54dfc943b8bf443
SHA512 fb7c95f1bc22f34417e1aa3b2333ad0fbc04d2478bc722dcc2ea2455ff7a984985a2b77ac9ec22736b87ddf936848c21c8587e4997a7d1aef6f6015028b1fec1
SSDEEP 12288:amw5HEjsChNzBFgl0WDm+CxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:zwuSOWusqjnhMgeiCl7G0nehbGZpbD
TLSH
T18A85F14A72A81CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 10bab07fa4f4141945a449bc2bf5909fef678dd38bb39ec04dc5b052d88f47d9
MD5 e184c2d2727eadc7b27b3a1571437788
SHA1 12967bb404a54460d433cde2ea031ef622234880
SHA512 555ec0d52dd255504d75f14b1f9220747b2b7882fe9e9fc229f18702c2133cd4ac6ebbdacfc6c9a8a5cc0e1f06577c750ecada28382db7d582c7c559db32ab9b
SSDEEP 49152:DB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gloDmg27RnWGj:1u6JmVxd2doD527BWG
TLSH
T1F6D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntelGFX.log

Path C:\ProgramData\Intel\Logs\IntelGFX.log
Size 832B
SHA256 69dbd0201b787c82809b41b464cb6ca300cf7ca0e34500fa1930b476beebd747
MD5 27f29a00d806efd4322bc113f54fdc46
SHA1 eb92da4c6590d10df1f8acc9ac2a948542c2e9c3
SHA512 cd86f7d57f191b67f2e82afd8498488745b498199cbfce235fb122bb2cccceccfdd765d33cc1b605962f105ed5ee935f222671172718aa3ae3043725c13b56ec
TLSH
T1FF01B91A57E91110F2B7BB1DA5F741616E767CE96C35A64C01C0560C0DE1910ED51767
MD5 SHA1 SHA512 TLSH

Submit Download

IntelGFX.log

Path C:\ProgramData\Intel\Logs\IntelGFX.log
Size 6KB
SHA256 8f45088df55c1dd9cbd7094d5a9be5bae6d7cc5d2b8d6123547b0f4c74448cc0
MD5 b629ae6da592fe99bf7174f55a72b49e
SHA1 8ac1db19f44a52a27c556d9b22e295094f5f207f
SHA512 8d12ad75710dce71483d5b9265f22ba7e9a7f8c2be0251345cb209efa36fc03f80221e7fb8d3c98b32a11b7941f88c88725c0849b8758c03dc85ad9e2115c3bf
SSDEEP 96:dBiRDki05A1L2NQpJw/LnvUUZzlbSTTbHjALkb3AqcYM9Trjef2DzsL/bR4DZroG:dgiiOSlnSn+nnnXe
TLSH
T1FCD15E917AEE524DF7FB3B8E26F24137A739FC329937550F0194526808A79148E20F76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\ar-SA\igxpin.exe.mui
Size 57KB
SHA256 6a15b7201fb7fd9de2084ac58716a4987d3cacf24bd0cb5dba610d8ef5d811d5
MD5 a51b2d26f4a22478fb702a00974fc5ba
SHA1 8b4edc19629bcad45eb15da76bfbb5a9cf7c9525
SHA512 cb2261cacafb5b8124638ded7e40859cfe49f5cd5dcf0f29b3e2ee8532fd3f5cf231fd7e94b9344921e3eb2388c3cce9da7cc85aba0a4f928305f52b0d098496
SSDEEP 384:tsKkHJJYN0atlRc4KLPiDr2zsKkHJJYN0atlRc4KLPiDr29:CBUZtDc4KriDr2YBUZtDc4KriDr29
TLSH
T11943EC50AD8CC139F0A3F2B4C7E7C793E315A09658C9123B5AB84A2746D4A709F2F5F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\bg-BG\igxpin.exe.mui
Size 68KB
SHA256 034b33f4ada1df6dd91143710bab082e4c1c4025bb8e3e7a73ec91251454fe93
MD5 6d0bcb144e34e9ee9aab3687b5fcb373
SHA1 c1c5d2bcc102d4d4a2d137e4fd214b76ea4f2118
SHA512 18767f4f30015cd2718712576b0912a96ce3b8cf0d657227c2b73aec3792e77053c8d08fbf78d096cdc3a2fd67a41668abad9063ae42a9a1f27eb1307ae39799
SSDEEP 384:C3sxkHJJYt0SbtJe5w5z8WorQnS3sxkHJJYt0SbtJe5w5z8WorQnX:isGUdnnor/sGUdnnorE
TLSH
T1FC63990FF9BD9124F5A4E2710FE282E772B6B750332046C7968F3D66A14CA317B29197
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\cs-CZ\igxpin.exe.mui
Size 64KB
SHA256 3abac0bf45c86666665dd607792f25368db8b1d967ddda7f2257e8ef39267224
MD5 0ee65da223db059ce66d142926e646b8
SHA1 ef6a7b56f3fde4331f4c3c45291012e7cb364d72
SHA512 e1fe2d79ae9e95d936193b1ea6d1f3c0158ccc76356d825f0c76ba07ef67d80bd756cb98d375e74c7da1146c08642c98444620f3952b8dc5408b8ed61f26c135
SSDEEP 384:9IbUkHJJYt0VonQJ6zSaWxqW8ymAaR1grNO6xIbUkHJJYt0VonQJ6zSaWxqW8ymg:GbfUa7EWAE5rwbfUa7EWAE5rB
TLSH
T1AE538701B6FD4165F0F77FB56AF142B38A7BBC922931C20F5684028A59A0E80EDB5773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\da-DK\igxpin.exe.mui
Size 65KB
SHA256 4ff2872d28e81801e49502bbe60105b2d35cf72f01af06bb46154c0c9debb284
MD5 9fc36b594bdaaeace8e0396b0e7109fa
SHA1 6b18485c584cba645ca69088901be343f55d1a25
SHA512 ff85f4220db98c3422769b85ea071e1d06068bd9b2b793c565a688f8a7062b05b5a98f24d04a9d53bb1d92b5c6cc64507a80c01eab108a9adab9a21e268c0fa9
SSDEEP 384:fTekHJJYt0wvnQBaPFFPEOys6r61O4TekHJJYt0wvnQBaPFFPEOys6r61Om:LdUH2oFwrOOQdUH2oFwrOOm
TLSH
T1B7539C50B7ED4129F0F37B70BEF642929A66BCD16938C61F2344109E49B1E88DAB4737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\de-DE\igxpin.exe.mui
Size 69KB
SHA256 7f262b0e5c14448c5bb846d0092d4e4cfd0685049b4c20e216842b03dc237f11
MD5 bb40f66292b001e9e22e23ab05b8fd03
SHA1 8681d9622dd41361323010901443f7b1e99d515b
SHA512 14b7fbf2b39041f46103ae20e82904686f2d1311aa66ec84dc7eb8ef49d118a9709cda432ce961ccedb29f72ba1b16a16b484991f6aeb9064acfe7f11a0d718e
SSDEEP 768:61rUU+I/BGuOWW1rnL/np41rUU+I/BGuOWW1rnL/npZ:6JUU//BGuOWWpLqJUU//BGuOWWpLX
TLSH
T1A0635510A7E98628F0F27BB46FF583969E72BCE16931DA1F2354109E58B0F04DA75732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license.txt

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\de-DE\license.txt
Size 276B
SHA256 be0c45b4c982bc6ef423248eb1e96db9e1f2749cabda7f30ca2d18807cc67b0c
MD5 5e4c8e5d23dbcfb3903e8693a7c92f77
SHA1 01789416dd92b97f9763a7de2c5ab87aa1c64672
SHA512 1f839320f378a9a54590dd62357beef4fbb2a7f039f8532919233ab036776b47d54efa8656213e099cf73b6c9bcb4ded74b4d0575db643959aeb0e08d22cc07d
TLSH
T1D6D0922152C94600F7F23BA13CB142C54DA67852FC72D25D5182000A4C61EA0CC60732
MD5 SHA1 SHA512 TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\el-GR\igxpin.exe.mui
Size 73KB
SHA256 9ee24d963d449dad9b54fd03b36d7218f80fc837cc6b4519ebd66cbe6526ced9
MD5 e0e0146676ef256d8f7a3b10901ea462
SHA1 a4c3e728a43c55a59c5be90956a58bd344e34242
SHA512 b4d4f075310681c9747737664cac1eead37c722c31d59b05d664acc2983a1a7193c144cfaf733e60d7948aef924101e4d17a017cd391ddf0a9eca32f164b3354
SSDEEP 384:ylkkkHJJYt0XkxlF/Ikwyb1aXpeyC2SXEz/rhjPlkkkHJJYt0XkxlF/Ikwyb1aXS:gqUrwmOS0z/rhj9qUrwmOS0z/rhjE
TLSH
T19A73578C59AF5221E9B5A9F256B3C1A78B6FF5C21020DE3B73F4304AD95CC158DC392A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\en-US\igxpin.exe.mui
Size 40KB
SHA256 4407d78ece9c7f840b5593401a3314d379e49dee9541a6d20bf7158c5fab4a8e
MD5 199921ec28eadbeefd1120da3138a842
SHA1 f87897e9879ae61dc34b0c90a46872f61ffe4c11
SHA512 3e375d5f39531038b27dfdf82cdeab007a11c3452321fac55057020119b0b6b21cd4f4cb8b93d9b98db52e7ce881858eea2f553b9efb3bfdb366279c85e6f36e
SSDEEP 384:O0n6kRCBRotVbQ7Li+R6zUXVUP8IKGAYvc6rv0n6kRCBRotVbQ7Li+R6zUXVUP89:d6rUIa+jF9G3rM6rUIa+jF9G3rQ
TLSH
T1F9031240B7FD8129F1F6BBB16BF582A68A3ABC91A834C71F1244005E96B1E44DE75733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\es-ES\igxpin.exe.mui
Size 70KB
SHA256 882a19d831527e3b988e8919882f5c18ad0f20c321d4e5d1cfa9931a43394451
MD5 87147e2cf3ade40d9e7f2ce90f4188ea
SHA1 9db79b70d472b2262eca8f9a8f405f1d97749d28
SHA512 59e1ddaa56ac401bf7119b72737a5124ad1b0911c74356c4e37bf5e1f482cab8da5e0a403d83c9cfb9996e809b7dae3cda75f14b9f5635014360983ec9d18b3f
SSDEEP 384:FwHAkHJJYt0MH2mlhRYRPTTJIrUPQwHAkHJJYt0MH2mlhRYRPTTJIrUP0:FMjUjDYPyrUPQMjUjDYPyrUP0
TLSH
T133631100ABFD5266F0F37F74AAF646A68E7ABC919834850F9358115E09B0E44DE74B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\fi-FI\igxpin.exe.mui
Size 62KB
SHA256 9d7310ec056244d2c1645383ab0a51abdc0cbc62aa5f97ee5fae23090c26ace1
MD5 be8fcf16bf3b9909c11644bf5d89552c
SHA1 cec1b5109b9a5ab4cfecab8f6ff2e5e2c9c71d62
SHA512 1cf2f49f13f5459d01e2acdbc5bc1d0d9f4e88e2aee4f0c9a1b07f5c061d269f5eb50abd6dab9472ec370265e374dad1eef422b799a51992a2afdf1d00babdf6
SSDEEP 768:ymU9ELFOy52vGfPrVtumU9ELFOy52vGfPrVtT:ymU9MkmU9Mh
TLSH
T105535984A6FDC124F1F7AF705BF582528A33BDD22CB5D61F1B48104E9AA0A80E975737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\fr-FR\igxpin.exe.mui
Size 73KB
SHA256 4da7821a89db874834ef4ec2b8adba85525656bc98911ec0437db91f17eaf458
MD5 fdb18982f1ee46c3f77aba3dc27e062b
SHA1 f77efe4f6c2501f108a7a3b5a3437325b7b9a798
SHA512 d466427ed83ddfa86c62d79b5735475b0484834306389e2bfc566b1cfd20c0fb0fc2af8ec6ce4c2a4ad8c6d12a5b7f3329d0ee7dd47e7cd2b72ae6bd16504f3b
SSDEEP 384:khlkHJJYt0dJHoLwvu4WNKq8HW+NL4isDDg6ZF70pDrWipVhlkHJJYt0dJHoLwvC:mSU6NaKX4TA7rTSU6NaKX4TA7rg
TLSH
T1F0732354A3E99221F2F37F70AAF941928E3BBC9A9C30C62E1254158E59B0F14DDB4733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\he-IL\igxpin.exe.mui
Size 54KB
SHA256 ef688d6b94819f18e4c06a634ac9a09e9843adb83b87f2787bd6760de196d644
MD5 2dcc6174a5d9211e70c9a2313d4dbb80
SHA1 4e16c609f27112671a15001d8728d825c03138c6
SHA512 08d1e03082f0757522c35de14f1996a486ddaaedaebc14375789fdf46637f43aaf50a77164b2753c5e94c30571bdcea7600ac750d5b75cc6728935995ebacc4b
SSDEEP 384:gQkykHJJYN0ulfz4eeDixrqTHYQkykHJJYN0ulfz4eeDixrqTH/:rwUplfU2xrezwUplfU2xre/
TLSH
T14A43FD806686C1F9E8B4FF7397AB8AAFC751F54410683717658C15926AECB80CB2D73C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\hr-HR\igxpin.exe.mui
Size 67KB
SHA256 90e2772aef21e8d72dc87f19b90bd0e58e2db8566982734a4307274ca50ad78e
MD5 da91d909d1ab4900e0413cde6055612d
SHA1 6957addda1e87fe340c73dda2a92048314915458
SHA512 5f181e6a387a023046ee9bd798f8f4cc842e45c24aa3284c3ad1ffad9d5a8fd3bdcf912d7a1baeed30a9916df5b890af38e056b76c581a18f0d1e7096f76f220
SSDEEP 384:5vkkHJJYt0pM1CrzfyjB/qh+kBBDrxkvkkHJJYt0pM1CrzfyjB/qh+kBBDrxI:NPUDF87rxYPUDF87rxI
TLSH
T1EB635C41B7F95269F4F37B756BF647A28A3BBCB17930821F1184118A4E70A80DAB5333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\hu-HU\igxpin.exe.mui
Size 67KB
SHA256 f9e9495e34ca2147cea5f80a679cc73a9939b2dd06f62ccbd77d36b6c4431551
MD5 bfb17cbf3a7d0671a3b5b9599b8d6c53
SHA1 bad1bdc568094da707a94a3cfedb15732e82f163
SHA512 b1d8ad318484d187467967acd4ef552c540ac748e2177d658f52bf88cc9d0ea522d104217c09da252b614f6b02098aa516110f7f3eed0d5f12dea4a7548936cd
SSDEEP 768:rSlUBMJUx5RUlk2oPj6Gu5nW39rPGn6lISlUBMJUx5RUlk2oPj6Gu5nW39rPGn6A:rgUWUuJxn66gUWUuJxn6A
TLSH
T17C637B00B2ED5119F0F39F723FF182D34A3AF8A1793DD21F9688528E59A1A44DD74726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\it-IT\igxpin.exe.mui
Size 69KB
SHA256 9264e4babc1af50b270c6cbd502c4696990bfdafe2a31c04b41a042bc83b5cb2
MD5 cad7efab3d9767ec92add388c2661c97
SHA1 e5cf1c174698b8459d55673a692313cd2da993ac
SHA512 22e99c8e9a37138d5974855bb3d5e0b2a4cf2639350ec117f50a6aa68b7a8180c1a8a2803f31b22ade4c82b887ca36478db347cd8086283cb873f974f0f95bf5
SSDEEP 384:NJD5XukHJJYt0blHA9A5Snrj+QaM2zeJrNJD5XukHJJYt0blHA9A5Snrj+QaM2z6:HD5dUclHbgGQZtrHD5dUclHbgGQZtrn
TLSH
T1EA632110A7FD5225F1F37B74BEB986968E3ABD926834C62F4284004E59B0E58DDB1733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\ja-JP\igxpin.exe.mui
Size 47KB
SHA256 2f04100c60a5a9d48940ee404e57332b7bc03db34828ea86501336ff2cb9b88d
MD5 f05d85bb31598913616880a1ade4f70b
SHA1 ea636c37c997d98505174e4f1cf885468d588144
SHA512 940051ddd778d3a455ef1dc923dda2c9e8735e6a7c9dc924bd1ddb2f7fd75000641943fa74269bafab44891cdfd6a8d31703e40d9d5c56e8d03fda337f7a5ad3
SSDEEP 384:7c6peVMox0L7IC3of4+3Goc6peVMox0L7IC3of4+3Ge:wRZw7LoA+3GfRZw7LoA+3Ge
TLSH
T197234548BAC6862BF0B4E1F447E2E2D3D715F464209209A76BC8154792D4E4E9F1F37E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\ko-KR\igxpin.exe.mui
Size 45KB
SHA256 4036a4bf81f1c3ddd3fd2bc05551b20157b329eef1e1213c2d3b3334209dc133
MD5 65bfcf2e236165bddc02334c13bdfd36
SHA1 f3c5d342fae24aa00d2da4a52ba95b26ec2a3aad
SHA512 44a720a34080915e2c0a14faf8e7da1131d7aa4735f6679d6df61caa02960283ae8fd2eaa63c6dc3a989c57b80ee8ebea527617b075db5e7c708fbf272dd50e6
SSDEEP 384:Qn7lWVNkx0bajcYrPQxbKITU6rrSn7lWVNkx0bajcYrPQxbKITU6rrx:804y3rW04y3rd
TLSH
T14E233118A9EED037E0A0F5BA47E3C3D7D72670926043061BF7886147A6D4F489F792B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\nb-NO\igxpin.exe.mui
Size 64KB
SHA256 c58f23795bf38641d1ffeadd3b212b85c371b38a9c8a7512442f164698b8d531
MD5 c1fa767f94bde7a32a43849f45e0d1f1
SHA1 3d03bb0829707aec52b99d96315806556fdeb61f
SHA512 54b6a59956843be44d54c712452ddc717a8d8d5262c31a6ae013e34749890058de591b6ddf1656adf24bcc3ff998d6d0300ebed1b856cb6e8de6dd80729f8edb
SSDEEP 384:n6hxBRhxBRhxm2yCSiyCSiyCSiyCSiHXn3HXn3HXn3WjkHJJYt0kArNZRh9vfrC1:JbMUDArNZ39frC+FbMUDArNZ39frC+L
TLSH
T1CF537B50A7EA8129F0F37F707FF982928A66BCE16D34C61F1344104E49B1A98DAB1737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\nl-NL\igxpin.exe.mui
Size 70KB
SHA256 5e9715be24d30c5279b4115809525312ad79855f18a6979c1b7a506ab2b3ced6
MD5 7149410345e0fd05aa2fd38c001a995b
SHA1 f329e592f93ae1f4557b023db1cbcba510f798e8
SHA512 8e8262538a82eb601304ba3866c479f1b38e4f04e5755403ef57763efe0f7495015e9d1ac1fdc834c6690ab756c1bd814218d76997bb70c330304e4c1684eb5f
SSDEEP 384:b2WWkHJJYt0tP7qYuxb0s9/CX6DPc2Jqr62WWkHJJYt0tP7qYuxb0s9/CX6DPc2f:qWlUCM91/CcOrbWlUCM91/CcOrg
TLSH
T107632301A7FD8128F0F36B742FF582A29F76BCD56971C62E1344169E49B0A80DAB5733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\pl-PL\igxpin.exe.mui
Size 68KB
SHA256 5f4ee06ec998aed810fc5bc96c53a5e181d329ba9f87c8af2969b8033dd60a1d
MD5 e1ec46583dd2db9e7933c192d4be236f
SHA1 326a4d5de247c77b0bde22fd968cbf92104e2eed
SHA512 9e2e8105ca064476858ae01587063d0c55c977b62c90ce69b9e10c7d98af45db4f3d7b94f4f7698c6451526027ac2b2ecf47b9fabd80267ff11ae75853d0d836
SSDEEP 768:EbmUWOxpr7PfoErLfKbmUWOxpr7PfoErLf9:ECUW0KCUW09
TLSH
T178638800B6F94165F0F3AFB46BF662D28F7BBC227930825F6684014A46A0E84ED75733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\pt-BR\igxpin.exe.mui
Size 67KB
SHA256 6db4955e8a7bfe8619771ce73f9b16f16c4df4ae61283491ebda49e712d75339
MD5 7eccd182eb1f0ad058f9b69d60faea79
SHA1 b7620c631f27b2a85f81917b5b52b49d9574d597
SHA512 bfda7a0ea08bcba6d75f02dc95e87aa285ea003d8768b82303fbe49f362374c812dac603f1872333e2993ac026e074cb6abd517e9a80f03404a50493b0404350
SSDEEP 384:PDCkHJJYt0LZj/FYVWyCClhtkRrtiDCkHJJYt0LZj/FYVWyCClhtkRrt8:LpU9178rwpU9178ru
TLSH
T19D634340A7FD4229F4F37F766AB556A2CA37BC926C38860E1254015A5EB0F40DE79733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\pt-PT\igxpin.exe.mui
Size 69KB
SHA256 f8f78750ffa05e18f3cce74c5d28c88819ea526e115582c62e4137d45e6d8aa2
MD5 ebf1ca17a35f8218a44f553c0f6c94bd
SHA1 86fd713fc727caab2f92688119771cecbb0ee7c8
SHA512 d51c5dfe2e330c0da13561721f007a285e174f98dd1ad1d131aabce6f6b16446d08e1588b34905b06a91badfde0a4414401de8d1b0e403b040f87db229f97d83
SSDEEP 384:unpkHJJYt0IhpTpEwqKMN2MpOSLRrAXConpkHJJYt0IhpTpEwqKMN2MpOSLRrAXC:uOUXTVcYsrlUOUXTVcYsrlh
TLSH
T18C635440A3FD5228F5F77F765AB95AA68E37BC919C39860E0254119A5DB4F80CE38333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\ro-RO\igxpin.exe.mui
Size 69KB
SHA256 a784b83f390aa8cc45371b308454c0abb43cf0f0505d01c80a9fe7280cf60093
MD5 4fb31bc00af82481c8d2012e803f9969
SHA1 a3d41214bd92bded63917f85ede6347eeb3a2bef
SHA512 01cd3ea09fe41730d333cd19b191181a266ad1ccfbeacabe59e75addc4cfd902bd9a60562f1054de96a2c0c09e77e30aa4cd60a0e1f272028b9f320445b6ac9c
SSDEEP 768:rteUGrTtZK9nLrr03teUGrTtZK9nLrr0j:rteUCLK9LMteUCLK9LC
TLSH
T150637650A3E90225F2F37B746FB546969E3BBE63A831C60F1648008E5BB1F849D65733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\ru-RU\igxpin.exe.mui
Size 63KB
SHA256 d0dd71ec2a342c0f94d15d10d78cc0be37e09bafda420274162155a7e4e6c2fa
MD5 bebcdc70c4725d4dfef27e0943c4e323
SHA1 a8d95589012f8fff1a8f95499c15776393db299f
SHA512 c0ace08c74ee7ac77bb430d855038d7c66fcd13f4943d8f74a712d69b4ed79500cb95ca9010dc61cc09d6e766f812ebbf0f6fdacd089e74b21b34225cec0582c
SSDEEP 384:JkO5WkHJJYt0k0mRVk9+Xy4Pqvu5drXWX8kO5WkHJJYt0k0mRVk9+Xy4Pqvu5drb:GO5lUjsOrKO5lUjsOrb
TLSH
T14E53CC4FF5BDC124F0A8E2B51FE389E35216F350231182C7A69F3D5AA198A34773919B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\sk-SK\igxpin.exe.mui
Size 66KB
SHA256 2dde3d941d45df92a2baf0c553ed6006d3aa272596a1b17423ff054deff2c4ec
MD5 54145dcf76b6c2f90158138664a0c316
SHA1 9355a03a7047ea005ed01340698397aae541886d
SHA512 2fdfd42e6ad275da40cbcc2fe5d33f7efaa05f325a326fc712b9f5b79bf342967fb2a62bee1afe9feed1c562a9e8800259416062f96bf563bcb848b629834dec
SSDEEP 384:v+9ndVkHJJYt0bC0g7qvy/+k7k0nRFgkfDYXhVAaLQUrOG3n/h+9ndVkHJJYt0bT:W9oU0dwYyOrXvE9oU0dwYyOrXvB
TLSH
T140638951A2FD4166F0F37FB56BF182A28B7BBC927931C20F5684024A49B0E84D9B5773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\sl-SL\igxpin.exe.mui
Size 65KB
SHA256 4af9ac0b53d9a9a06a067778dbbfa1847008e7fbac2707913cf39a27f112b6f6
MD5 33fabdfbb764c2b658461011d0674aa6
SHA1 be2a90d37c52a637a7fec560ba434e3c4636c593
SHA512 0f31480c920db5735d785b298af3303435562dfff737b53fbc5df2c8a54e8674dd4057914e32d36bc883fda9e9d0d7c88eacb532fe8f0bda045a595b2d9b21e1
SSDEEP 384:95mnkHJJYt0zgbd7KUUYdVuwa1Oi0wr3zqOXOF5mnkHJJYt0zgbd7KUUYdVuwa1a:HmIUsQOruvmIUsQOruv
TLSH
T1CB535745B2FD521AF0F77B7457F542A28B3BBCB27931C22F5244128E49A1A80DAB5373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\sv-SE\igxpin.exe.mui
Size 63KB
SHA256 77d63123fa73d837e9767564e700fe3347bee9b9e971334ee8744f44f9bdbf48
MD5 14342ed50d2987dc8cb6a53bb9224e80
SHA1 d5c86c916133605cf948fd2b107c41e8b3db9955
SHA512 6a8c1e5973dd6196dd3cdcaba4611f8b7a2d348e1c1607052fb97da81d2618175859be432c75cfbc9d386a51d8035d2b668989127a9393019301409203832a10
SSDEEP 384:vA0xkHJJYt0C65PHCVQmQHKCsWUZrENJA0xkHJJYt0C65PHCVQmQHKCsWUZrENp:YLUtfV/LtrENSLUtfV/LtrENp
TLSH
T14453CD40A7ED9128F0F3AB74BEF682A28A76BCD12934D62F1744159E4970E48D9F5333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\th-TH\igxpin.exe.mui
Size 62KB
SHA256 eee8df0d48be9d8fc6ab0acc55f8bcf161180a21990ed220cfaa41ce5d391caf
MD5 c00f9dcac9ed9e7cb74b124aafbe8fdf
SHA1 799af629f7839d26c956158171f71b7ce0771be4
SHA512 881e0bb46d7a41b71089b7571ce8e02e59b0f2295d802dbdb85ed4614f6941d068e19acab3a04fdcb7ede63e69d8101bca4ee81160aa630f5ea6bc322f753cf1
SSDEEP 384:jpHtIRkHJJYt05OuF/71AprRpHtIRkHJJYt05OuF/71Aprx:1NImUqZdCprDNImUqZdCprx
TLSH
T107530178A5B68202D096E1F0D3D28FF3BE1CB411D057825781AECE269690A756BF583D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\tr-TR\igxpin.exe.mui
Size 66KB
SHA256 3b0786f5f2f96ce0d88b8de69f4933e1c619eb0b5d2d82ff3b2415ffee9b698f
MD5 c929d496ced74c2be0e0f04bbd7afe0e
SHA1 cfa0728e853b55278b9c399fbb71a4f3e65e236a
SHA512 7f027a8f67caee1b24dd8f93977fe7b3f8fe24dd9b2ab4376e04d1edfa434292bd6755ef26f54932f1c13858a12778d333763a08e9714b6870a3de82b30b304a
SSDEEP 1536:7EUYgTIinGpgPOWymwep/0QhEUYgTIinGpgPOWymwep/0Qx:0gTIinGpgPOWymwep/0Q6gTIinGpgPOo
TLSH
T1E4637804A3DD8127F1F36B752FF591D287B7BCF23930831F6659115A49B0A848A29B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\zh-CN\igxpin.exe.mui
Size 38KB
SHA256 06530a1bc04da92b35685feb6543a79274af06652d22a6451a5fae1a1e7679f3
MD5 d38c33447b18da5e6d4ce190b32ad8fb
SHA1 5855086a1a99d05583abc1d1a658b7406f96c6be
SHA512 5f9e7756f6650155bf2fdd4119d2dda65081d16933a0e1393295adc6388a56c8304beedb782b5ae4b007c16cf30bb8f34ad516af0f2dddaa3162bfb6f9c6dfc6
SSDEEP 384:yNcRpy1dU50BQnyA+zLNcRpy1dU50BQnyA+zY:4TIqjA+zhTIqjA+zY
TLSH
T1BA035648B6CAC939F164B5B587E3C3D3D727B48620820F1FABCC624796C8E04DE6A535
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\zh-TW\igxpin.exe.mui
Size 39KB
SHA256 339579b3ead770a48a139a2c7d732bcbd1589a1eae4b3b2c80958d46c0f1e34e
MD5 dd5b173ee25fbf3a709381e4bec2ffb4
SHA1 554aea62d3b8dec62685f8507bde4d07ee146940
SHA512 1b722066e228217772f0a40fbaf089f15aa9fbacfc3c858a4ed0bedd7369bc0b47e3d45af9d69c94a1e265398bddc2915bf8420f8adda487ccd11256b14e8088
SSDEEP 384:nZ16C5VlIF0pRWaHJTQjwAog7v+InZ16C5VlIF0pRWaHJTQjwAog7v+In:ZfMMRWapTQjLH+ifMMRWapTQjLH+m
TLSH
T121033244B6CA8136F064B6B58BE382F7D737B4923141466FEE8C1547A3D0E099E6E235
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 b3e45693a55b8735ef9a93e781604c286f38c213bf7d7b6ea6c6b913cc4ba6dc
MD5 a01f5dc19e1cb8ef0aff82deb3a77aca
SHA1 204c77481af2ca373ac59594f90a854044e22363
SHA512 e721eaaad10a844f8ca6528d75667532c907afc4bcf955f229544d0146d86400aebe6367dff672fbaea59ceb7f900436d32ea99b897d4e24c40be864bd77e980
SSDEEP 12288:3jXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3jsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15465237FD35C918BE57659B082E5E12D681B3E669E204483BA433CFDF6B08948F38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 2f87256f74f0a1961e2dec733d1a82f9e46cc99cc99a10f3255d3040fcb6422e
MD5 a67c59d22424a3755129be1ceb47a604
SHA1 336acebccbe88da7d1ad34ac67a4e63b159d7ec4
SHA512 0fb7bb1db08391136ee6088bc5db4e8d256b9542430d7052042e817504490851c91da4cb1820b3ad35b55849e8f2ced2bb0f8c9749e45de9fdc4cb45add0be28
SSDEEP 49152:da0h2GEkuAe73q3pp46zwwQFDmg27RnWGj:da0hNYG4JwyD527BWG
TLSH
T15D85AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 f4d9ec49c817d81a18a512576f93e84b16e1f297255293c1bd8b56e51ab18984
MD5 018821ec7757704cfa4ef5341e8b68aa
SHA1 b83b28416b77e2b958b9cda10caff04ff9d71ec2
SHA512 7bf4bce1af6762ab5bab19743b7ed85302bfdeee87a235b1e2444ed6e2db0aec5718f8606981cdffcf3e11cd8d39125335be01bbe2a49d528346f6abbabd3d72
SSDEEP 12288:ThbHjfXGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ThbHjPGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D175127E12AC20D9E57291BD8296D10AD632BC26172053EF23D281BE5F37DE84D39F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 ab21ba082f4e3bd091b5dac45db9026c90e81f787e7582404c8c33c7d1061f1d
MD5 050593faab737c09a011a6067d025bf7
SHA1 24414a4479b4c33898540328b0708163e3fe410e
SHA512 fef26e3b0ee7cfbe5284468f66fb67542fdbb77b583737c9ec406ab776c593d25a3842ea99a2103bdecfcc56a050128872a7015544d98deca02dca84bbc12fae
SSDEEP 24576:93YgnJcRTk4yti+R5dBR/usqjnhMgeiCl7G0nehbGZpbD:9IgnaTk46pBR/CDmg27RnWGj
TLSH
T12945BF2EF2B910B9D8A6D136450147B5FB71782D1F209ACB0170C538AF1AEE85F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.5MB
SHA256 27e17cc54e096115d61dfb9ce225d7cbea67e191e5685ec382f52d6a1423f63d
MD5 69a278ae8d3a9ff9826e24f7cb250621
SHA1 93236ba88d30c3326f75fab22eaf26291f5d4bd7
SHA512 e31e408bd989f2f746ec66dda29084dce343b0829c955624a2a503eb650d89cbe8470baa19b746a99d6e5791f962ca010adce341b72a1544a69c2a224662c6b8
SSDEEP 12288:CPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12A6523BE924C51CAD53649B5C2E6E11DA8073E56AB2004D379A77CFEF7B18E84B38413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 ecdc5b1cd0980e073c4de712d90024d12e2399bb4f383e1a43e3f4b0a12fefb1
MD5 1e853d77cda9b5a4236fd8456f9ffdf1
SHA1 64b8e34807866a807fe2e1500c88c8137d870eed
SHA512 3b02eeea76046ae787b39330786fdeee15bdc87608dd63c95d7fc2eb930c8f100e8a695527b2e29eafcf031ee44d62a49bcba1b669314f7f08f9281d31812ad1
SSDEEP 12288:sObcA4LWOsvAYFTgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:RcL3UTgsqjnhMgeiCl7G0nehbGZpbD
TLSH
T101950159F79800F9E87B813CC5A2D616E672785D0720E7DF03A94AA91F637E04E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 5b2fa4f1298821ec3d8c041e39dccd0f4541a0916154beb189f681173f1a074f
MD5 070ac788cf3045785c08db545c62aca2
SHA1 f25a870a849978974c769107cee888c384744fc5
SHA512 87b5adf86045cf448c40a648736cbb488cf6365c4c28a577c8d5932adc948b5d21c4d118167cdd604bf0d00bc933af1d953ca41edc3906b566abc1a09d93e205
SSDEEP 12288:ApFtvOcXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QOcsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13375022E33EC10E9E536A17C8692D20DD6327C66172117DF06D184BE5FA3EF84D39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2b737af8591662b184a6bc090a2b8927b2c8aaa9b2832ade9b879e58b37b8b1f
MD5 03748a4bcb2ec7d462e347bdb7d25ae4
SHA1 ac23c42459384347e9f930bbd8d8ae6565fbe119
SHA512 327ca9cc819ef77bbd8198a420d79d3ac5a76e40565bd25d040fd5cd3d4b539d8ba86c1fef4375851b343c9fbf31d02c5172d89a20a4a59f8df7a4cd9bd115a5
SSDEEP 24576:o7NM9YqZqmWMUkPjZM48Mv6bEhszsqjnhMgeiCl7G0nehbGZpbD:o7cBWMpPjN8DbEhuDmg27RnWGj
TLSH
T16D659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACB1162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 1c603854377719ff2b9243675538050f3b28b6c08936c0b4e575007fe91dd0d4
MD5 f54d974e133fc7989721fe3651339ab0
SHA1 962df28e45b806dcc7bb0cc8ad725cafdc28e7bf
SHA512 d8c11600740f422c81bc76c244adf7162a7ec8a490f1db97172d6457ebed0ae4d34c571f488af69b231a4e8584b1c829e5e9272913c4ed12fcce54be11c2dc85
SSDEEP 24576:NW6BApg2YuyuNDYTabvcdvNYf8km1FsqjnhMgeiCl7G0nehbGZpbD:NF2YuHNETovAvNYf8kmXDmg27RnWGj
TLSH
T1EB857E6A27ED80A4E0BBD27D85B6D246F9B2B8511B3055CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 be06bdf18ecce19249872a08a75549f0eba0f1eddb35e911b35ebbd7e47dca1c
MD5 026b65990541b5bd529ba37e78b55cd1
SHA1 1b482afaa14660809da61ae1a44e8ad748d6f984
SHA512 ba1f16a9d80c96ded6c0536cd70bb3d493cc420f145a771b1145583a78d3076baad405951697f863e5e4541496dd43b0f1e0f30cd53396924036eaf7c895d438
SSDEEP 24576:bAFs06+Omlf3NXEbTo4sqjnhMgeiCl7G0nehbGZpbD:UFs060lVXulDmg27RnWGj
TLSH
T1BC65AF3F62AC00D5D07ED17D8A97C91AF6B1746307255ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.8MB
SHA256 651d49315af18bbfed44270fe6bc6de7369a33ba8b491763f68a4569bb995a60
MD5 b4cc25575cc8f2796ac888b109f73ca0
SHA1 30d6a088c5e8628f2fc9c9a23e2c0412595bca02
SHA512 ad199ebf0add86498914b9af85de52eceab65111fa688f028c82639ff94dbfa5cc5fb6bfc5477fcb5d1db26731b224ce81c0fac74c1e7d3bc87d7fa733a24a25
SSDEEP 24576:2JnJ5D3WeRsqjnhMgeiCl7G0nehbGZpbD:2JnJ5DGelDmg27RnWGj
TLSH
T15F85E13DD2A810E8D4B7C2B4829A5746FE72383D2F2169C728B4D5357F12EE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 d560001030d86b7d7701e23074974124e8290f4dfebe94a7a1809057f5a77eb4
MD5 83db246e18c68f0da2fd07ebbf992fd6
SHA1 d28fcd95cba710b65345c528c653ed4fbfa5ddac
SHA512 80927a7c29e6fe7e0d8d921d253e3c36d5d69fb4409ef3753b9e34c3341cb2e51fd9c0a01fea7ae007edf94d4d2574a3111349a279a305b5501d0390da174ed4
SSDEEP 24576:XEPghm6/7IIXdwcXrif7qQncjlP65i3VuCsqjnhMgeiCl7G0nehbGZpbD:Qg06DIKdwc+eQnSt65aVbDmg27RnWGj
TLSH
T17E955C16B7EA5294E8B3CAB1C962A1159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 4d2107dee6621239dde76145081809b0f779456157f8a913a10651b930abe84a
MD5 4e3584ddb1952e444aaef904a9b1175e
SHA1 9fa0a8ec45fd4808212f0fbe4689de629c99f1c2
SHA512 d3c0cb4bc975917ba0cfd402bbe932d10b7a32ca04741af6f6284566675e372827b90deb788fb700fafc96dba3a41587934e6b617d418ab3be5e19dbc5d8fd31
SSDEEP 12288:nEP3R2xXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:s2xsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CE75126E679C60DAD136907D8291C209D733F4716B2127EF26A2D57E8F739E80E3CA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 26b0b19eaeeb475859ae776f6c542701b348590e5d115664bacfe97adbdb6d2e
MD5 03af37dbb102e9bd4745dcba185caab5
SHA1 58885bc353c8d440bd88fd9eef3126c475966db5
SHA512 b21948e8995d037ff355ad4c11190c4dd228a96440167e46c901fac2918c5ebf861df98c6017eb1e34125b4038e68bdb763eddf2fde6fa137d81e551251d0a4e
SSDEEP 12288:pjky2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pIy2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C5752219639C60C9EA760578C6B3D1589C32BC319F2046DF6591FA3EAF72BD48E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.5MB
SHA256 5e325399f61886787648dd3f18d7f77056f1be33a8576ff6d15285821dcf254d
MD5 c420c30d7fa4562cbb47b92b28646d37
SHA1 6c6d0b5c000e75e2a38b3d5671e5bf6c542db354
SHA512 935cfa24f4c34ba8ec9b34725051155f15b23c664a35e4b138b2c92fcf563e51059f68173c4cb0494574f9bdb5a58db7e9a863b3a60cc4c67f0b2380df88a9c2
SSDEEP 12288:hAMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C565237E525C60CAE93245B8C3A5E50D98133D76AB2014E739E7FCB9EBB24D44B39812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 ed89d68c81b72a51307dca1fc55ca0d28919067c092ac3c9e5a3794399095c6d
MD5 1fab37bd92a5392c0d23f80ed2766c38
SHA1 006e7c5052ead6d7b4722c19d250f7e9c08d0a05
SHA512 9fbb2557486fb7e822031dee2629dad13bba48aeae761485119e200476ce1ffb85a3f791f297e555ecebc3099fd35d605baaf5a4e76c45aeb605219eedcfafc8
SSDEEP 24576:hQ9MxZKdcz9dw3rsqjnhMgeiCl7G0nehbGZpbD:hVKZfDmg27RnWGj
TLSH
T1BC558C2DABE9058AE177D27595A250C3A633B4311B31D6CF2448D03D4D7BEE8AE78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.7MB
SHA256 b9a668391e532720f95a24203f6a7224e77e51fd594743c8ef8caac6ba718131
MD5 9abc11ba724378627491f7ca6a74b5ce
SHA1 4dc6b0b1e2bec8f0f531e2a2551b56596f584892
SHA512 d5135e49081dbf5ac7147a2bccf8d09d4009f4211e85de71f6731c126343159fd008798ef0b1bad7cc3602b4d80a66af83b48766d0acc3063c82de0ea8b2fd11
SSDEEP 12288:eyoKo2YRple9p2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:eyoceAp2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T12B85E01FB76D40E2E176813C8985C249E673B4305B6157CB6692C73D8F639E8BE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 29f26ef48fc693aa4e973efec7da091c09c1534ab99d989b145f354e718896f5
MD5 1fe4c743250e2a1700a585df119deefc
SHA1 ed032f1be0b144b7ae16a2e45425c468d3de3b1e
SHA512 cc6075ba880d1868527a0bd6b6e65b56578fff0b395906700dc320abba31810a07fd014a32f82b145bb5fe477c076057b79886b5a3e0ee73b25338772e6883be
SSDEEP 49152:6WcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IK6Dmg27RnWGj:80zuNIcD527BWG
TLSH
T1C6A57B3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 dee13505f92a0817be56cf3059a2dda503cc7c2b9083944ca9477f76c510a4ba
MD5 7a12b390fd3f7fee852e58a7eebc3db1
SHA1 230be758da5c203e229b6f1b1579159a1a8b2f0f
SHA512 717a9f08c469e8550fbdbd935161392dc504be5862f25db3f02bb0b4f72558c439dd7db0f1772694075afe44743e8801c9d6757fce40666711974766de322dfe
SSDEEP 24576:F1QT7EcpfxR+N5AWAz3ooiYtjMqbxsqjnhMgeiCl7G0nehbGZpbD:gTDxR+N5YzTfjMMDmg27RnWGj
TLSH
T12A55B02EA7F815E9D17E85798B23C506FA727821033193CB42A0C17E1F6B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.5MB
SHA256 9e5f548a8afbf2900f342191870c4f2598dd7dfc5389b3007cb35f4aefdd92cf
MD5 9cbdda5d0a97b082d35248082a2e6165
SHA1 c8d1831358e26b1fc572be34ee23c1f1ee7bba5d
SHA512 66193ba615da4dbe8f8fc6c931833537745bb7b532a493af980931422c2e3d154e3ef25b4b4f7062a3bbe635b8b3fc8012af2681610d38776c37ee7fef10c212
SSDEEP 12288:b4vsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CssqjnhMgeiCl7G0nehbGZpbD
TLSH
T18675126E63EC30D9E4325574C6B6D10994327C36272015FF39E1D9BE9F729D48A38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/416-453-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/416-252-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/416-258-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/416-259-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/436-184-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/436-277-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/820-480-0x0000000000630000-0x0000000000697000-memory.dmp

Download

memory/820-475-0x0000000000630000-0x0000000000697000-memory.dmp

Download

memory/820-531-0x0000000000400000-0x000000000057E000-memory.dmp

Download

memory/820-474-0x0000000000400000-0x000000000057E000-memory.dmp

Download

memory/920-545-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/936-494-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/936-501-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/936-587-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/936-495-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/1036-416-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/1036-22-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/1040-589-0x0000000140000000-0x00000001401C9000-memory.dmp

Download

memory/1040-518-0x0000000140000000-0x00000001401C9000-memory.dmp

Download

memory/1260-582-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/1260-491-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/1304-87-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1304-82-0x0000000140000000-0x0000000140190000-memory.dmp

Download

memory/1304-417-0x0000000140000000-0x0000000140190000-memory.dmp

Download

memory/1304-62-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1432-522-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1432-520-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1716-604-0x0000015F6D700000-0x0000015F6D710000-memory.dmp

Download

memory/1716-597-0x0000015F6D700000-0x0000015F6D710000-memory.dmp

Download

memory/1716-625-0x0000015F6D700000-0x0000015F6D710000-memory.dmp

Download

memory/1716-613-0x0000015F6D700000-0x0000015F6D710000-memory.dmp

Download

memory/1716-605-0x0000015F6D700000-0x0000015F6D710000-memory.dmp

Download

memory/1716-602-0x0000015F6D700000-0x0000015F6D710000-memory.dmp

Download

memory/1716-601-0x0000015F6D700000-0x0000015F6D710000-memory.dmp

Download

memory/1716-614-0x0000015F6D700000-0x0000015F6D710000-memory.dmp

Download

memory/1716-623-0x0000015F6D700000-0x0000015F6D710000-memory.dmp

Download

memory/1716-600-0x0000015F6D700000-0x0000015F6D710000-memory.dmp

Download

memory/1716-598-0x0000015F6D700000-0x0000015F6D710000-memory.dmp

Download

memory/1716-622-0x0000015F6D700000-0x0000015F6D710000-memory.dmp

Download

memory/1716-603-0x0000015F6D700000-0x0000015F6D710000-memory.dmp

Download

memory/1716-599-0x0000015F6D700000-0x0000015F6D710000-memory.dmp

Download

memory/1716-596-0x0000015F6D700000-0x0000015F6D710000-memory.dmp

Download

memory/1716-620-0x0000015F6D700000-0x0000015F6D710000-memory.dmp

Download

memory/1716-593-0x0000015F6D700000-0x0000015F6D710000-memory.dmp

Download

memory/1716-624-0x0000015F6D700000-0x0000015F6D710000-memory.dmp

Download

memory/1716-619-0x0000015F6D700000-0x0000015F6D710000-memory.dmp

Download

memory/1716-618-0x0000015F6D700000-0x0000015F6D710000-memory.dmp

Download

memory/1716-610-0x0000015F6D700000-0x0000015F6D710000-memory.dmp

Download

memory/1716-621-0x0000015F6D700000-0x0000015F6D710000-memory.dmp

Download

memory/1716-617-0x0000015F6D700000-0x0000015F6D710000-memory.dmp

Download

memory/1716-594-0x0000015F6D700000-0x0000015F6D710000-memory.dmp

Download

memory/1716-595-0x0000015F6D700000-0x0000015F6D710000-memory.dmp

Download

memory/1716-611-0x0000015F6D700000-0x0000015F6D710000-memory.dmp

Download

memory/1716-615-0x0000015F6D700000-0x0000015F6D710000-memory.dmp

Download

memory/1716-612-0x0000015F6D700000-0x0000015F6D710000-memory.dmp

Download

memory/1716-592-0x0000015F6D700000-0x0000015F6D710000-memory.dmp

Download

memory/1716-591-0x0000015F6D700000-0x0000015F6D710000-memory.dmp

Download

memory/1716-590-0x0000015F6D700000-0x0000015F6D710000-memory.dmp

Download

memory/1716-616-0x0000015F6D700000-0x0000015F6D710000-memory.dmp

Download

memory/1716-632-0x0000015F6DDD0000-0x0000015F6FCA7000-memory.dmp

Download

memory/1852-454-0x0000000140000000-0x00000001401A0000-memory.dmp

Download

memory/1852-279-0x0000000140000000-0x00000001401A0000-memory.dmp

Download

memory/2300-487-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2300-547-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2300-607-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2312-455-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/2312-286-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2312-292-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2312-296-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/2504-241-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/2504-248-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/2504-452-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2504-247-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2740-588-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2740-507-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2740-513-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2740-506-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3056-546-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3056-626-0x000000000DCB0000-0x000000000DCB8000-memory.dmp

Download

memory/3056-585-0x000000000C330000-0x000000000C338000-memory.dmp

Download

memory/3056-628-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3056-629-0x000000000DD80000-0x000000000DD88000-memory.dmp

Download

memory/3056-630-0x000000000DD70000-0x000000000DD71000-memory.dmp

Download

memory/3056-564-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/3056-580-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/3056-548-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/3252-524-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3252-606-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3372-271-0x0000000140000000-0x00000001401BC000-memory.dmp

Download

memory/3372-263-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/3372-269-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/3372-276-0x0000000140000000-0x00000001401BC000-memory.dmp

Download

memory/3372-274-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/3392-544-0x0000000140000000-0x000000014017C000-memory.dmp

Download

memory/3392-484-0x0000000140000000-0x000000014017C000-memory.dmp

Download

memory/3448-8-0x0000000002540000-0x00000000025A7000-memory.dmp

Download

memory/3448-295-0x0000000000400000-0x00000000006B9000-memory.dmp

Download

memory/3448-0-0x0000000000400000-0x00000000006B9000-memory.dmp

Download

memory/3448-1-0x0000000002540000-0x00000000025A7000-memory.dmp

Download

memory/4372-470-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/4372-464-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/4372-463-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/4372-527-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/4448-608-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4448-528-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5040-532-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5040-609-0x0000000140000000-0x0000000140216000-memory.dmp

Download