cdbad8079a664ab5d049e8aa8f9f42ab48be7e8557b72f2e49a76d280f3b826c

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 23:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
Size 2.7MB
Sample260722-3dptcsdd87
SHA256 cdbad8079a664ab5d049e8aa8f9f42ab48be7e8557b72f2e49a76d280f3b826c
MD5 b3c4ff50b2e3ec6ae964c3e9bd3babd0
SHA1 8b3a5e69d44ad5e0ea5f6a22f2e8465a688cf7ba
SHA512 5486dd34c18cd5ed88e31d291a9bb031c39ac546f25fb8f5c8a7ce6a1c7a72e554fbf47f0a62bc86f3f417e5cd4dfca0938596e58ffc950f5ebe860d593e8a04
SSDEEP 49152:j47PD0bQ3dMGRukYyejJQxhUpDmg27RnWGj:UbKQ3dMGLQjHD527BWG
TLSH
T151D56E40BADA8225F0F657F0AABF86D1823B7C116D70D19F7294115A0AB0B83DB76737
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1600	elevation_service.exe
4756	elevation_service.exe
688	maintenanceservice.exe
2504	OSE.EXE
4076	PerceptionSimulationService.exe
2872	perfhost.exe
3940	ReFsDedupSvc.exe
2800	SensorDataService.exe
5096	ssh-agent.exe
1804	AgentService.exe
4836	SearchIndexer.exe

Loads dropped DLL 31 IoCs

pid	Process
4860	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
4860	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
4860	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
4860	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
4860	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
4860	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
4860	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
4860	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
4860	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
4860	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
4860	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
4860	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
4860	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
4860	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
4860	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
4860	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
4860	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
4860	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
4860	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
4860	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
4860	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
4860	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
4860	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
4860	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
4860	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
4860	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
4860	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
4860	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
4860	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
4860	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
4860	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2c1ae29dc618523d.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5648	4860	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c8e2a33d311add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c721123d311add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000079f10f3e311add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008c13b47f311add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e6017b3d311add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000015c2373f311add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a03dbb7f311add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f0d9e77f311add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1600	elevation_service.exe
1600	elevation_service.exe
1600	elevation_service.exe
1600	elevation_service.exe
1600	elevation_service.exe
1600	elevation_service.exe
1600	elevation_service.exe
4756	elevation_service.exe
4756	elevation_service.exe
4756	elevation_service.exe
4756	elevation_service.exe
4756	elevation_service.exe
4756	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4860	2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeTakeOwnershipPrivilege	1600	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	1804	AgentService.exe
Token: 33	4836	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4836	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4836	SearchIndexer.exe
Token: SeBackupPrivilege	3940	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3940	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3940	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3940	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3940	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3940	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3940	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3940	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3940	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3940	ReFsDedupSvc.exe
Token: SeDebugPrivilege	1600	elevation_service.exe
Token: SeDebugPrivilege	4756	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 4292	4836	SearchIndexer.exe	104
PID 4836 wrote to memory of 1424	4836	SearchIndexer.exe	105
PID 4836 wrote to memory of 5056	4836	SearchIndexer.exe	106
PID 4836 wrote to memory of 1348	4836	SearchIndexer.exe	107
PID 4836 wrote to memory of 3160	4836	SearchIndexer.exe	111
PID 4836 wrote to memory of 3812	4836	SearchIndexer.exe	112
PID 4836 wrote to memory of 2804	4836	SearchIndexer.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_b3c4ff50b2e3ec6ae964c3e9bd3babd0_amadey_elex_luca-stealer_lynx_njrat.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4860
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 840
  2⤵
  - Program crash
  PID:5648

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4860 -ip 4860
1⤵
PID:2056

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4756

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:688

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2504

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4076

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2872

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3940

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2800

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5096

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1804

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4292
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1424
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5056
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3004 3060 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1348
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3160
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3004 3060 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3812
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 cf11732d2f3fcb9b530bbbbdc50805673d95cce3f49c1afd2b81e45ee10332ef
MD5 7afe874afe043ff4fc27dc16939caac3
SHA1 fa63147f24d45adcf7bde946a46aa11d1f921207
SHA512 f9634b1aa6e00e0a39a335ea1fab0f0e46737833a85e126607eb37ab5143df649105ab5797a28559cb2c387055ca8284ffdf7f2b17071034302686a8f1067c6d
SSDEEP 49152:ib+632BuPkFKRrdE6ohmstBhuXjfS4LWxnrDmg27RnWGj:E3q6HjBAD527BWG
TLSH
T1FED59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 90a2f171d3064ee24b08617091e5f34f1551258b67e6a52cae916b32f206b7ba
MD5 9f67a2a2c34f9c869c2072f4d8c7d441
SHA1 8240e7a3a21f9f4fadef327364b8a11255a3cc15
SHA512 51bca00f0b10904d5c4e42d6bc857a6cb543f64b49ce2920669448a45c6d73de1da751c3cf760e2fb67e8fd6591e6aa66267643cc8698a42fbd63b35450f9ed9
SSDEEP 24576:sXYfDtczAYsqjnhMgeiCl7G0nehbGZpbD:LtcFDmg27RnWGj
TLSH
T17385F129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 78fbf652c1326116d243fd833696f5922481a34089fa5bc376cf8d1e4bacfd6a
MD5 c43ccc42641af8d630b94d5c2187e05a
SHA1 eedcdf14e14a9b9201893c41d234501208f8f7be
SHA512 806a64ae61515487aeed948e8266672e8b252710bb217ea359cc1399b2b16299fd127b4b7b7a86a5aa7b44ec575d0d8e2ef5a48c3536cf39b73760c728b80b9f
SSDEEP 24576:J0Le5ji0hmx3rMrsqjnhMgeiCl7G0nehbGZpbD:JPji0AZ6Dmg27RnWGj
TLSH
T1EAA59E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f6add2db683fa3e2f7f18ec254f3d5f3d9e86e4053c236b1da59c7c243509d3b
MD5 a4d9630ecde2316cedf1ea89b78893c3
SHA1 806f05267c019eb0b778d0d3f172dc396f008cb0
SHA512 97213de1304188628860580ac196d2646e8d8f1f87ad2698eeaa79a2c1a620a623dae214badadf7d165d094e652b5722e491b29ed49340fc3677769f83894ccf
SSDEEP 24576:ra7/ezSC6vUyD/aqgrvWE6q8wyuNsqjnhMgeiCl7G0nehbGZpbD:G/ezSC6vUzPvxHjymDmg27RnWGj
TLSH
T158755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ca634e7f2d53777d77a1dbdb7945c774050bbee2811d49577d135c2c5d248c0f
MD5 405b231557939ccc27c252703db5a698
SHA1 5604612655a91f7f0de238e41ef44fbdf5eeb255
SHA512 b3649eb22a28c5fd397c42dbba852b7df3c320261860e16ec01dd5c312de7640153109d4ae2166a8edbb8e43a069530d471bd8c20a956fe88a7dc2e3e4fcbf14
SSDEEP 24576:MVbqPb88hv/l+60sqjnhMgeiCl7G0nehbGZpbD:MVO88hXl+bDmg27RnWGj
TLSH
T12F559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 d7fd7595b96638ca94810831c282e207ad124b928133f768d49ce4999d331d15
MD5 23225529490680b806dfcbadd24a50e0
SHA1 f70accd85fba920d3dd642ad9b4126f110be9d31
SHA512 a3ad3603318c896ac240a62e6c89a3bd347bf651bbf4e52b3b0ad212c2c11904db80b6d8b6f7722ae72e6483ac216331b184523b95234290b867d4d539089520
SSDEEP 12288:tXPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tXPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15A6523BF864C50DAEB7608B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 d789c42194eec719426133889cc1114ea63b8f34c28d4fb716bd78944864cda7
MD5 6324f41f508f9c5976bb4d910bb8e5b0
SHA1 120c8f9e11ac19e127a30bfb31345cf7bb48ed8b
SHA512 451ccba3ace976c5215b7848c7d2c4cb9a568784df762a380f2a4e335468e2ac5bc8cf7ad6b248fab7f01c3541c88477e0685b6aaf4be5de13b3d511820c7c18
SSDEEP 12288:AeBNUbTVO86UMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:AJIUMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D585CF7BEE28FCD2C27A8DB85791C600E76278314F6193CBE165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 dd7a7e4b189831cf1beec507588736a90d41013c2ca264d01c1ef7858db97943
MD5 034494ccabd63a17e80b1dba11bd50d9
SHA1 b4bad47d28d2a1c1cf7739fa6f39f7f1cc198ba3
SHA512 c4c2ac471fe824a5996ed1fd117c397c3844099bee3324280c28e0cd5c5ff0cc55ceab4a58f7f23bc2a61de39b22ead6503d5c42bcbe5d6391d4e77f7c347538
SSDEEP 49152:FQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THz:FQvGAdlCEL8c/yRNw5CBD527BWG
TLSH
T149266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 c8625e4e1e7f5e52be535deab97601ea3afa652e23fa529d2a6684c660c5a94c
MD5 e63e2d9608c08ff835e3642290ab5e0b
SHA1 3f28daab0c6248a876ad105a3933cac6d78cec4c
SHA512 85dcd76ef2321f37a023c548bb3c3cbf7eea674368f3dd9aa05bf8792cd5552b1ef3a58628113c43a4ca362363e59ad3eab96d18f86acf793b5be2c49eff20a7
SSDEEP 12288:CAwSfxL/2Dc3RDLLmt0LDQewsAjGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:HUewsAjGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10095E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 47297fb7d03f5c8465a5aefc4f49966bc64c7f4f9491a555c897ae42fc0be5c2
MD5 ed863977eeffeec556907736ad4fdbcd
SHA1 615a05dca6930fec9094134aeff73e9076b73641
SHA512 142db056843c461d307a78bfb2b291209973a83dea01bd61cf8ddfb7f27642c821422bf62b44dbae84122cc8137f754cb5c8f2f8dccb6ac50d70481f31c356eb
SSDEEP 196608:2UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHiVQBWG:2UEtQevvqc2W1cpV2EI32VB
TLSH
T1D2474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c59f1fc3b3768fdb5962481cfc05de3c314eddd3fa968f9d1264d6b0af0dfe73
MD5 3ae23998bbc9367213e280fe6fd4379f
SHA1 76cf1dd5d509ac4b731cb57889d2643ffadc7304
SHA512 b22bd4c54e1ae463864fd47c15e8fa45f4f170950bbb015ea824f459fa561ea7b830b5a5285ab0e0fc168a156c9a6eb1f253f118494d0a2fdfa0c78ef0750467
SSDEEP 49152:TCbRquA/m2yL5zQfFiV+XenmE3/zqDmg27RnWGj:soqtVjnmdD527BWG
TLSH
T12DD58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 473de49da2da15b7bd7eb4a0e304fa1c8860aa5470d030c56921ecf237b9e3fb
MD5 22115ae0d3c3bf96c86afa43503af3c2
SHA1 a1cc0ad5ffb2c0fdda0759ef40133640ee0227e8
SHA512 3177e180430eea6d4f14cc1911e29105b7052c8d98f44046df218d306ab64acc383249eb4fba5c7ebc832c3ac65351ed55496a11c08b7d36c194d86a441f3a71
SSDEEP 24576:FAhGLJIFoiwtA5l7S535sqjnhMgeiCl7G0nehbGZpbD:FAMyFoiq5tDmg27RnWGj
TLSH
T105359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 6387f71ca6340ade5714c224f6af57fdd646cffdc542a7e9f80aaea695dfd467
MD5 fb078c375e12480ac564b89c41c2f1ec
SHA1 6f45fed6f6ef246a4b01bde445ec3830990ed70b
SHA512 4b458b2bdea14ce7863f1c89354d1db184f23f9943c81ae617d013793bf74a19c48849d1f6a353d65fd06f4746ce1f873cbf14a560b0e769b4279f42726902a3
SSDEEP 12288:Zmw5HEjsChNzBFgl0WDm+CBXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:0wuSOWysqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F985F15A72A80CF9E9674539C697D136F7B3BC122A20C71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 eb4c9315ace2b10b79b9536b7cf1ac36d012d9e7e46f5b0616c09a20167a66ae
MD5 bac596fb1b586a8da7ea0c82fde6aea9
SHA1 c25ef7ccb3bbd902d67b72b2f6f9ce715738f8f8
SHA512 14c171fe30dc9cf479709b659b6bc0f17b84cc6f22cc13a93be2fab3d27b47956906f4008a20f2a0e40a3063f974af82e020b2b882a98308f3771a7a8c31929b
SSDEEP 12288:3zZ1IyWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DZujsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1947512AE239820FAE163417CC5E5D609E7337C62673043CF166259AA6F739D44E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 10f0be36b8c06e4fe20811f914d641816d0b52d39a27474cf0ff87638b992ef7
MD5 748b9c7605dcc8d52bf7c6f72b36d78e
SHA1 c5a807ae4b94fe22d1b2caf520163321f17a62a3
SHA512 40abf7bccd56644d8faaf049b60b1a29c4a2c2196c364f6d62b0d7fdba9783a03c9345258a99e5a3256bc47cabbb9a5a5fc0a33c7e30e3328ce34658c0472b36
SSDEEP 49152:TB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glUDmg27RnWGj:lu6JmVxd2dUD527BWG
TLSH
T12AD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 8a1ea2672f590d9f5edda308d9fcf920f8f44fb58de8798e461a97f7dd656df5
MD5 31db76072d1d366a53280fa8b4fad091
SHA1 8d3ca5d102d1efc15e68ad2a3a680e8e903d6f59
SHA512 990766aa7fddbb4544c9354a07ef7f71207f3a35f8da5c8a4e194c0a7a3c4de7e46d67836ab784969b7c840de030814dfbcc3d869d701a0298338173503da91f
SSDEEP 24576:FfwvTk9RX6wkyAIvsqjnhMgeiCl7G0nehbGZpbD:YMnYITDmg27RnWGj
TLSH
T1DA95D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 b1868d5631f3e704f93cf0bd0afdff856d546a2f48b6c178518fa4c194e0b76d
MD5 f5edfbd80d78d1ee51a8ab1c423d8202
SHA1 c23a41bbb10dc68ec08cb9dc1145365b285a0b84
SHA512 a594b13060c6ef8e532a646a9eede69bb770877738b673691a9e6fe79ff0e5a38d735d5f7aba1db9990e0f3a5a8d8db7871e8a7d7dd715591ef01aa6ad0706ea
SSDEEP 49152:TYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0sDmg27RnWGj:XySzP0D527BWG
TLSH
T19E066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 37ba96745d2dd1cb9e5e1d8abc8501d395bb6329e069f1d0a6e488ab59b54609
MD5 52d64e1906d9557f0aae15988294d30c
SHA1 f03c83488996041c462a6a7ac6489a13dd44b2f1
SHA512 ed1157b21922514e6f351d8707d2db541f7d5f59ef526eb3e315fc8726b4c642c648c2179e8411dc05962badaac8614972d0b12046b43de9368040b5aa85969f
SSDEEP 24576:K47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY6sqjnhMgeiCl7G0nehbGZpbD:K47JUQj1irIhCnDHUPfF/8Dmg27RnWGj
TLSH
T19265AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF2270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntelGFX.log

Path C:\ProgramData\Intel\Logs\IntelGFX.log
Size 832B
SHA256 717c727d2408526585d30418a9774a308ff1f02124735cd2da1fe02888532e12
MD5 3379bd5e62a695392119e1e882e9708b
SHA1 25b11496c37933d149c13e1fcc8048c622df764d
SHA512 dcddd7c9dc70c9652370158212d4fbc9887a34dab4e723b30ac5f54cff922d3ba4b7845a46d4bfc6385cb53b667298bc427e6a6285600f413173c8bc4ee75e2b
TLSH
T19701F91A57FA1010F2B7BB1C65F342211E767CE96C35AA0C01C0520C0DE1A00ED51777
MD5 SHA1 SHA512 TLSH

Submit Download

IntelGFX.log

Path C:\ProgramData\Intel\Logs\IntelGFX.log
Size 6KB
SHA256 fe8cf97ff93cc4729259f2e070046c90db19214079b874d13b598eb9e336c9e6
MD5 b2a47460ef3b13ab73c2b574a7ab55b8
SHA1 b389915ba51870f89a3ca70aa296d946361f08fd
SHA512 ecbd8ecfd3bd92e7a1ed283921729c8365506e275c5d99e0f3f2c307bf0bf5f9605cf5dbabaee6a21fef6bbdfa6dcff4e82c01fba9dfea966c0377cc552aba8a
SSDEEP 96:dRiRDkic5A1L2NQpJw/LnvUUZzlbSTTbHjALkb3AqcYM9Trjef2DzsL/bR4DZroG:dwiimSlnSn+nnnXe
TLSH
T1E1D15E917AEE524DF7FB3B8E26F24137A739FC329937550F0294526808A79148E20F76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 956KB
SHA256 c72f43e05540b95067c2bd94de80dd27e03c8dbac7d0e250c80e0de91e7cbc9d
MD5 93a317edc1afe642b7aaa2bbb698a582
SHA1 ceaa49c1f451ffd6d5a3438932919441a28500d1
SHA512 4c25c443784e3c24b9f3a741a304d23b2600375a8c7dbeb607909ea28f1d15fce93b1e8fc70727d21418e8d0fae609f31b16beb5fb62ae8ba8b6362528ef32af
SSDEEP 12288:fA/vz2U3f3+nYAiCn8UiycbB+F48xP+Z5RDX5ZE:fA/vqUPbbBSTVeRDJZE
TLSH
T1B6250750762AC75FC6AD40321E32D1CCAB707D11FE05AB0772C8473FD576A69BAB2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 0a1d19f7fc7ac03aacb16f983ca41984de465c48e627f2c1778d11b0cc4f95cf
MD5 66c455a39f8f0122bbefdf81bc30f4f7
SHA1 b1f302a3d1282bb2ab96f400b7fd49271c43ce8d
SHA512 6bc874c409c9c2fbfc3287bf68788bce57c4aa7c5b7dc495948639b47b87e8079b57024f36b0a79d9c7bfc87a1df09a38d266daa63343253c29ddfdf1b42e613
SSDEEP 12288:Du2iPAiCn8UirAiCn8UiQAiin8UicAiCn82Aien8UiQAiCngAi7fn8UiiAi1fn8H:Du2iC1gGx
TLSH
T1B755D7416537E38FD1FB6032076A5B4DA764AC17B3056F26A3C8443ED82BB25A4BC3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\ar-SA\igxpin.exe.mui
Size 57KB
SHA256 6a15b7201fb7fd9de2084ac58716a4987d3cacf24bd0cb5dba610d8ef5d811d5
MD5 a51b2d26f4a22478fb702a00974fc5ba
SHA1 8b4edc19629bcad45eb15da76bfbb5a9cf7c9525
SHA512 cb2261cacafb5b8124638ded7e40859cfe49f5cd5dcf0f29b3e2ee8532fd3f5cf231fd7e94b9344921e3eb2388c3cce9da7cc85aba0a4f928305f52b0d098496
SSDEEP 384:tsKkHJJYN0atlRc4KLPiDr2zsKkHJJYN0atlRc4KLPiDr29:CBUZtDc4KriDr2YBUZtDc4KriDr29
TLSH
T11943EC50AD8CC139F0A3F2B4C7E7C793E315A09658C9123B5AB84A2746D4A709F2F5F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\bg-BG\igxpin.exe.mui
Size 68KB
SHA256 034b33f4ada1df6dd91143710bab082e4c1c4025bb8e3e7a73ec91251454fe93
MD5 6d0bcb144e34e9ee9aab3687b5fcb373
SHA1 c1c5d2bcc102d4d4a2d137e4fd214b76ea4f2118
SHA512 18767f4f30015cd2718712576b0912a96ce3b8cf0d657227c2b73aec3792e77053c8d08fbf78d096cdc3a2fd67a41668abad9063ae42a9a1f27eb1307ae39799
SSDEEP 384:C3sxkHJJYt0SbtJe5w5z8WorQnS3sxkHJJYt0SbtJe5w5z8WorQnX:isGUdnnor/sGUdnnorE
TLSH
T1FC63990FF9BD9124F5A4E2710FE282E772B6B750332046C7968F3D66A14CA317B29197
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\cs-CZ\igxpin.exe.mui
Size 64KB
SHA256 3abac0bf45c86666665dd607792f25368db8b1d967ddda7f2257e8ef39267224
MD5 0ee65da223db059ce66d142926e646b8
SHA1 ef6a7b56f3fde4331f4c3c45291012e7cb364d72
SHA512 e1fe2d79ae9e95d936193b1ea6d1f3c0158ccc76356d825f0c76ba07ef67d80bd756cb98d375e74c7da1146c08642c98444620f3952b8dc5408b8ed61f26c135
SSDEEP 384:9IbUkHJJYt0VonQJ6zSaWxqW8ymAaR1grNO6xIbUkHJJYt0VonQJ6zSaWxqW8ymg:GbfUa7EWAE5rwbfUa7EWAE5rB
TLSH
T1AE538701B6FD4165F0F77FB56AF142B38A7BBC922931C20F5684028A59A0E80EDB5773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\da-DK\igxpin.exe.mui
Size 65KB
SHA256 4ff2872d28e81801e49502bbe60105b2d35cf72f01af06bb46154c0c9debb284
MD5 9fc36b594bdaaeace8e0396b0e7109fa
SHA1 6b18485c584cba645ca69088901be343f55d1a25
SHA512 ff85f4220db98c3422769b85ea071e1d06068bd9b2b793c565a688f8a7062b05b5a98f24d04a9d53bb1d92b5c6cc64507a80c01eab108a9adab9a21e268c0fa9
SSDEEP 384:fTekHJJYt0wvnQBaPFFPEOys6r61O4TekHJJYt0wvnQBaPFFPEOys6r61Om:LdUH2oFwrOOQdUH2oFwrOOm
TLSH
T1B7539C50B7ED4129F0F37B70BEF642929A66BCD16938C61F2344109E49B1E88DAB4737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\de-DE\igxpin.exe.mui
Size 69KB
SHA256 7f262b0e5c14448c5bb846d0092d4e4cfd0685049b4c20e216842b03dc237f11
MD5 bb40f66292b001e9e22e23ab05b8fd03
SHA1 8681d9622dd41361323010901443f7b1e99d515b
SHA512 14b7fbf2b39041f46103ae20e82904686f2d1311aa66ec84dc7eb8ef49d118a9709cda432ce961ccedb29f72ba1b16a16b484991f6aeb9064acfe7f11a0d718e
SSDEEP 768:61rUU+I/BGuOWW1rnL/np41rUU+I/BGuOWW1rnL/npZ:6JUU//BGuOWWpLqJUU//BGuOWWpLX
TLSH
T1A0635510A7E98628F0F27BB46FF583969E72BCE16931DA1F2354109E58B0F04DA75732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license.txt

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\de-DE\license.txt
Size 276B
SHA256 be0c45b4c982bc6ef423248eb1e96db9e1f2749cabda7f30ca2d18807cc67b0c
MD5 5e4c8e5d23dbcfb3903e8693a7c92f77
SHA1 01789416dd92b97f9763a7de2c5ab87aa1c64672
SHA512 1f839320f378a9a54590dd62357beef4fbb2a7f039f8532919233ab036776b47d54efa8656213e099cf73b6c9bcb4ded74b4d0575db643959aeb0e08d22cc07d
TLSH
T1D6D0922152C94600F7F23BA13CB142C54DA67852FC72D25D5182000A4C61EA0CC60732
MD5 SHA1 SHA512 TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\el-GR\igxpin.exe.mui
Size 73KB
SHA256 9ee24d963d449dad9b54fd03b36d7218f80fc837cc6b4519ebd66cbe6526ced9
MD5 e0e0146676ef256d8f7a3b10901ea462
SHA1 a4c3e728a43c55a59c5be90956a58bd344e34242
SHA512 b4d4f075310681c9747737664cac1eead37c722c31d59b05d664acc2983a1a7193c144cfaf733e60d7948aef924101e4d17a017cd391ddf0a9eca32f164b3354
SSDEEP 384:ylkkkHJJYt0XkxlF/Ikwyb1aXpeyC2SXEz/rhjPlkkkHJJYt0XkxlF/Ikwyb1aXS:gqUrwmOS0z/rhj9qUrwmOS0z/rhjE
TLSH
T19A73578C59AF5221E9B5A9F256B3C1A78B6FF5C21020DE3B73F4304AD95CC158DC392A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\en-US\igxpin.exe.mui
Size 40KB
SHA256 4407d78ece9c7f840b5593401a3314d379e49dee9541a6d20bf7158c5fab4a8e
MD5 199921ec28eadbeefd1120da3138a842
SHA1 f87897e9879ae61dc34b0c90a46872f61ffe4c11
SHA512 3e375d5f39531038b27dfdf82cdeab007a11c3452321fac55057020119b0b6b21cd4f4cb8b93d9b98db52e7ce881858eea2f553b9efb3bfdb366279c85e6f36e
SSDEEP 384:O0n6kRCBRotVbQ7Li+R6zUXVUP8IKGAYvc6rv0n6kRCBRotVbQ7Li+R6zUXVUP89:d6rUIa+jF9G3rM6rUIa+jF9G3rQ
TLSH
T1F9031240B7FD8129F1F6BBB16BF582A68A3ABC91A834C71F1244005E96B1E44DE75733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\es-ES\igxpin.exe.mui
Size 70KB
SHA256 882a19d831527e3b988e8919882f5c18ad0f20c321d4e5d1cfa9931a43394451
MD5 87147e2cf3ade40d9e7f2ce90f4188ea
SHA1 9db79b70d472b2262eca8f9a8f405f1d97749d28
SHA512 59e1ddaa56ac401bf7119b72737a5124ad1b0911c74356c4e37bf5e1f482cab8da5e0a403d83c9cfb9996e809b7dae3cda75f14b9f5635014360983ec9d18b3f
SSDEEP 384:FwHAkHJJYt0MH2mlhRYRPTTJIrUPQwHAkHJJYt0MH2mlhRYRPTTJIrUP0:FMjUjDYPyrUPQMjUjDYPyrUP0
TLSH
T133631100ABFD5266F0F37F74AAF646A68E7ABC919834850F9358115E09B0E44DE74B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\fi-FI\igxpin.exe.mui
Size 62KB
SHA256 9d7310ec056244d2c1645383ab0a51abdc0cbc62aa5f97ee5fae23090c26ace1
MD5 be8fcf16bf3b9909c11644bf5d89552c
SHA1 cec1b5109b9a5ab4cfecab8f6ff2e5e2c9c71d62
SHA512 1cf2f49f13f5459d01e2acdbc5bc1d0d9f4e88e2aee4f0c9a1b07f5c061d269f5eb50abd6dab9472ec370265e374dad1eef422b799a51992a2afdf1d00babdf6
SSDEEP 768:ymU9ELFOy52vGfPrVtumU9ELFOy52vGfPrVtT:ymU9MkmU9Mh
TLSH
T105535984A6FDC124F1F7AF705BF582528A33BDD22CB5D61F1B48104E9AA0A80E975737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\fr-FR\igxpin.exe.mui
Size 73KB
SHA256 4da7821a89db874834ef4ec2b8adba85525656bc98911ec0437db91f17eaf458
MD5 fdb18982f1ee46c3f77aba3dc27e062b
SHA1 f77efe4f6c2501f108a7a3b5a3437325b7b9a798
SHA512 d466427ed83ddfa86c62d79b5735475b0484834306389e2bfc566b1cfd20c0fb0fc2af8ec6ce4c2a4ad8c6d12a5b7f3329d0ee7dd47e7cd2b72ae6bd16504f3b
SSDEEP 384:khlkHJJYt0dJHoLwvu4WNKq8HW+NL4isDDg6ZF70pDrWipVhlkHJJYt0dJHoLwvC:mSU6NaKX4TA7rTSU6NaKX4TA7rg
TLSH
T1F0732354A3E99221F2F37F70AAF941928E3BBC9A9C30C62E1254158E59B0F14DDB4733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\he-IL\igxpin.exe.mui
Size 54KB
SHA256 ef688d6b94819f18e4c06a634ac9a09e9843adb83b87f2787bd6760de196d644
MD5 2dcc6174a5d9211e70c9a2313d4dbb80
SHA1 4e16c609f27112671a15001d8728d825c03138c6
SHA512 08d1e03082f0757522c35de14f1996a486ddaaedaebc14375789fdf46637f43aaf50a77164b2753c5e94c30571bdcea7600ac750d5b75cc6728935995ebacc4b
SSDEEP 384:gQkykHJJYN0ulfz4eeDixrqTHYQkykHJJYN0ulfz4eeDixrqTH/:rwUplfU2xrezwUplfU2xre/
TLSH
T14A43FD806686C1F9E8B4FF7397AB8AAFC751F54410683717658C15926AECB80CB2D73C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\hr-HR\igxpin.exe.mui
Size 67KB
SHA256 90e2772aef21e8d72dc87f19b90bd0e58e2db8566982734a4307274ca50ad78e
MD5 da91d909d1ab4900e0413cde6055612d
SHA1 6957addda1e87fe340c73dda2a92048314915458
SHA512 5f181e6a387a023046ee9bd798f8f4cc842e45c24aa3284c3ad1ffad9d5a8fd3bdcf912d7a1baeed30a9916df5b890af38e056b76c581a18f0d1e7096f76f220
SSDEEP 384:5vkkHJJYt0pM1CrzfyjB/qh+kBBDrxkvkkHJJYt0pM1CrzfyjB/qh+kBBDrxI:NPUDF87rxYPUDF87rxI
TLSH
T1EB635C41B7F95269F4F37B756BF647A28A3BBCB17930821F1184118A4E70A80DAB5333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\hu-HU\igxpin.exe.mui
Size 67KB
SHA256 f9e9495e34ca2147cea5f80a679cc73a9939b2dd06f62ccbd77d36b6c4431551
MD5 bfb17cbf3a7d0671a3b5b9599b8d6c53
SHA1 bad1bdc568094da707a94a3cfedb15732e82f163
SHA512 b1d8ad318484d187467967acd4ef552c540ac748e2177d658f52bf88cc9d0ea522d104217c09da252b614f6b02098aa516110f7f3eed0d5f12dea4a7548936cd
SSDEEP 768:rSlUBMJUx5RUlk2oPj6Gu5nW39rPGn6lISlUBMJUx5RUlk2oPj6Gu5nW39rPGn6A:rgUWUuJxn66gUWUuJxn6A
TLSH
T17C637B00B2ED5119F0F39F723FF182D34A3AF8A1793DD21F9688528E59A1A44DD74726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\it-IT\igxpin.exe.mui
Size 69KB
SHA256 9264e4babc1af50b270c6cbd502c4696990bfdafe2a31c04b41a042bc83b5cb2
MD5 cad7efab3d9767ec92add388c2661c97
SHA1 e5cf1c174698b8459d55673a692313cd2da993ac
SHA512 22e99c8e9a37138d5974855bb3d5e0b2a4cf2639350ec117f50a6aa68b7a8180c1a8a2803f31b22ade4c82b887ca36478db347cd8086283cb873f974f0f95bf5
SSDEEP 384:NJD5XukHJJYt0blHA9A5Snrj+QaM2zeJrNJD5XukHJJYt0blHA9A5Snrj+QaM2z6:HD5dUclHbgGQZtrHD5dUclHbgGQZtrn
TLSH
T1EA632110A7FD5225F1F37B74BEB986968E3ABD926834C62F4284004E59B0E58DDB1733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\ja-JP\igxpin.exe.mui
Size 47KB
SHA256 2f04100c60a5a9d48940ee404e57332b7bc03db34828ea86501336ff2cb9b88d
MD5 f05d85bb31598913616880a1ade4f70b
SHA1 ea636c37c997d98505174e4f1cf885468d588144
SHA512 940051ddd778d3a455ef1dc923dda2c9e8735e6a7c9dc924bd1ddb2f7fd75000641943fa74269bafab44891cdfd6a8d31703e40d9d5c56e8d03fda337f7a5ad3
SSDEEP 384:7c6peVMox0L7IC3of4+3Goc6peVMox0L7IC3of4+3Ge:wRZw7LoA+3GfRZw7LoA+3Ge
TLSH
T197234548BAC6862BF0B4E1F447E2E2D3D715F464209209A76BC8154792D4E4E9F1F37E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\ko-KR\igxpin.exe.mui
Size 45KB
SHA256 4036a4bf81f1c3ddd3fd2bc05551b20157b329eef1e1213c2d3b3334209dc133
MD5 65bfcf2e236165bddc02334c13bdfd36
SHA1 f3c5d342fae24aa00d2da4a52ba95b26ec2a3aad
SHA512 44a720a34080915e2c0a14faf8e7da1131d7aa4735f6679d6df61caa02960283ae8fd2eaa63c6dc3a989c57b80ee8ebea527617b075db5e7c708fbf272dd50e6
SSDEEP 384:Qn7lWVNkx0bajcYrPQxbKITU6rrSn7lWVNkx0bajcYrPQxbKITU6rrx:804y3rW04y3rd
TLSH
T14E233118A9EED037E0A0F5BA47E3C3D7D72670926043061BF7886147A6D4F489F792B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\nb-NO\igxpin.exe.mui
Size 64KB
SHA256 c58f23795bf38641d1ffeadd3b212b85c371b38a9c8a7512442f164698b8d531
MD5 c1fa767f94bde7a32a43849f45e0d1f1
SHA1 3d03bb0829707aec52b99d96315806556fdeb61f
SHA512 54b6a59956843be44d54c712452ddc717a8d8d5262c31a6ae013e34749890058de591b6ddf1656adf24bcc3ff998d6d0300ebed1b856cb6e8de6dd80729f8edb
SSDEEP 384:n6hxBRhxBRhxm2yCSiyCSiyCSiyCSiHXn3HXn3HXn3WjkHJJYt0kArNZRh9vfrC1:JbMUDArNZ39frC+FbMUDArNZ39frC+L
TLSH
T1CF537B50A7EA8129F0F37F707FF982928A66BCE16D34C61F1344104E49B1A98DAB1737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\nl-NL\igxpin.exe.mui
Size 70KB
SHA256 5e9715be24d30c5279b4115809525312ad79855f18a6979c1b7a506ab2b3ced6
MD5 7149410345e0fd05aa2fd38c001a995b
SHA1 f329e592f93ae1f4557b023db1cbcba510f798e8
SHA512 8e8262538a82eb601304ba3866c479f1b38e4f04e5755403ef57763efe0f7495015e9d1ac1fdc834c6690ab756c1bd814218d76997bb70c330304e4c1684eb5f
SSDEEP 384:b2WWkHJJYt0tP7qYuxb0s9/CX6DPc2Jqr62WWkHJJYt0tP7qYuxb0s9/CX6DPc2f:qWlUCM91/CcOrbWlUCM91/CcOrg
TLSH
T107632301A7FD8128F0F36B742FF582A29F76BCD56971C62E1344169E49B0A80DAB5733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\pl-PL\igxpin.exe.mui
Size 68KB
SHA256 5f4ee06ec998aed810fc5bc96c53a5e181d329ba9f87c8af2969b8033dd60a1d
MD5 e1ec46583dd2db9e7933c192d4be236f
SHA1 326a4d5de247c77b0bde22fd968cbf92104e2eed
SHA512 9e2e8105ca064476858ae01587063d0c55c977b62c90ce69b9e10c7d98af45db4f3d7b94f4f7698c6451526027ac2b2ecf47b9fabd80267ff11ae75853d0d836
SSDEEP 768:EbmUWOxpr7PfoErLfKbmUWOxpr7PfoErLf9:ECUW0KCUW09
TLSH
T178638800B6F94165F0F3AFB46BF662D28F7BBC227930825F6684014A46A0E84ED75733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\pt-BR\igxpin.exe.mui
Size 67KB
SHA256 6db4955e8a7bfe8619771ce73f9b16f16c4df4ae61283491ebda49e712d75339
MD5 7eccd182eb1f0ad058f9b69d60faea79
SHA1 b7620c631f27b2a85f81917b5b52b49d9574d597
SHA512 bfda7a0ea08bcba6d75f02dc95e87aa285ea003d8768b82303fbe49f362374c812dac603f1872333e2993ac026e074cb6abd517e9a80f03404a50493b0404350
SSDEEP 384:PDCkHJJYt0LZj/FYVWyCClhtkRrtiDCkHJJYt0LZj/FYVWyCClhtkRrt8:LpU9178rwpU9178ru
TLSH
T19D634340A7FD4229F4F37F766AB556A2CA37BC926C38860E1254015A5EB0F40DE79733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\pt-PT\igxpin.exe.mui
Size 69KB
SHA256 f8f78750ffa05e18f3cce74c5d28c88819ea526e115582c62e4137d45e6d8aa2
MD5 ebf1ca17a35f8218a44f553c0f6c94bd
SHA1 86fd713fc727caab2f92688119771cecbb0ee7c8
SHA512 d51c5dfe2e330c0da13561721f007a285e174f98dd1ad1d131aabce6f6b16446d08e1588b34905b06a91badfde0a4414401de8d1b0e403b040f87db229f97d83
SSDEEP 384:unpkHJJYt0IhpTpEwqKMN2MpOSLRrAXConpkHJJYt0IhpTpEwqKMN2MpOSLRrAXC:uOUXTVcYsrlUOUXTVcYsrlh
TLSH
T18C635440A3FD5228F5F77F765AB95AA68E37BC919C39860E0254119A5DB4F80CE38333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\ro-RO\igxpin.exe.mui
Size 69KB
SHA256 a784b83f390aa8cc45371b308454c0abb43cf0f0505d01c80a9fe7280cf60093
MD5 4fb31bc00af82481c8d2012e803f9969
SHA1 a3d41214bd92bded63917f85ede6347eeb3a2bef
SHA512 01cd3ea09fe41730d333cd19b191181a266ad1ccfbeacabe59e75addc4cfd902bd9a60562f1054de96a2c0c09e77e30aa4cd60a0e1f272028b9f320445b6ac9c
SSDEEP 768:rteUGrTtZK9nLrr03teUGrTtZK9nLrr0j:rteUCLK9LMteUCLK9LC
TLSH
T150637650A3E90225F2F37B746FB546969E3BBE63A831C60F1648008E5BB1F849D65733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\ru-RU\igxpin.exe.mui
Size 63KB
SHA256 d0dd71ec2a342c0f94d15d10d78cc0be37e09bafda420274162155a7e4e6c2fa
MD5 bebcdc70c4725d4dfef27e0943c4e323
SHA1 a8d95589012f8fff1a8f95499c15776393db299f
SHA512 c0ace08c74ee7ac77bb430d855038d7c66fcd13f4943d8f74a712d69b4ed79500cb95ca9010dc61cc09d6e766f812ebbf0f6fdacd089e74b21b34225cec0582c
SSDEEP 384:JkO5WkHJJYt0k0mRVk9+Xy4Pqvu5drXWX8kO5WkHJJYt0k0mRVk9+Xy4Pqvu5drb:GO5lUjsOrKO5lUjsOrb
TLSH
T14E53CC4FF5BDC124F0A8E2B51FE389E35216F350231182C7A69F3D5AA198A34773919B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\sk-SK\igxpin.exe.mui
Size 66KB
SHA256 2dde3d941d45df92a2baf0c553ed6006d3aa272596a1b17423ff054deff2c4ec
MD5 54145dcf76b6c2f90158138664a0c316
SHA1 9355a03a7047ea005ed01340698397aae541886d
SHA512 2fdfd42e6ad275da40cbcc2fe5d33f7efaa05f325a326fc712b9f5b79bf342967fb2a62bee1afe9feed1c562a9e8800259416062f96bf563bcb848b629834dec
SSDEEP 384:v+9ndVkHJJYt0bC0g7qvy/+k7k0nRFgkfDYXhVAaLQUrOG3n/h+9ndVkHJJYt0bT:W9oU0dwYyOrXvE9oU0dwYyOrXvB
TLSH
T140638951A2FD4166F0F37FB56BF182A28B7BBC927931C20F5684024A49B0E84D9B5773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\sl-SL\igxpin.exe.mui
Size 65KB
SHA256 4af9ac0b53d9a9a06a067778dbbfa1847008e7fbac2707913cf39a27f112b6f6
MD5 33fabdfbb764c2b658461011d0674aa6
SHA1 be2a90d37c52a637a7fec560ba434e3c4636c593
SHA512 0f31480c920db5735d785b298af3303435562dfff737b53fbc5df2c8a54e8674dd4057914e32d36bc883fda9e9d0d7c88eacb532fe8f0bda045a595b2d9b21e1
SSDEEP 384:95mnkHJJYt0zgbd7KUUYdVuwa1Oi0wr3zqOXOF5mnkHJJYt0zgbd7KUUYdVuwa1a:HmIUsQOruvmIUsQOruv
TLSH
T1CB535745B2FD521AF0F77B7457F542A28B3BBCB27931C22F5244128E49A1A80DAB5373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\sv-SE\igxpin.exe.mui
Size 63KB
SHA256 77d63123fa73d837e9767564e700fe3347bee9b9e971334ee8744f44f9bdbf48
MD5 14342ed50d2987dc8cb6a53bb9224e80
SHA1 d5c86c916133605cf948fd2b107c41e8b3db9955
SHA512 6a8c1e5973dd6196dd3cdcaba4611f8b7a2d348e1c1607052fb97da81d2618175859be432c75cfbc9d386a51d8035d2b668989127a9393019301409203832a10
SSDEEP 384:vA0xkHJJYt0C65PHCVQmQHKCsWUZrENJA0xkHJJYt0C65PHCVQmQHKCsWUZrENp:YLUtfV/LtrENSLUtfV/LtrENp
TLSH
T14453CD40A7ED9128F0F3AB74BEF682A28A76BCD12934D62F1744159E4970E48D9F5333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\th-TH\igxpin.exe.mui
Size 62KB
SHA256 eee8df0d48be9d8fc6ab0acc55f8bcf161180a21990ed220cfaa41ce5d391caf
MD5 c00f9dcac9ed9e7cb74b124aafbe8fdf
SHA1 799af629f7839d26c956158171f71b7ce0771be4
SHA512 881e0bb46d7a41b71089b7571ce8e02e59b0f2295d802dbdb85ed4614f6941d068e19acab3a04fdcb7ede63e69d8101bca4ee81160aa630f5ea6bc322f753cf1
SSDEEP 384:jpHtIRkHJJYt05OuF/71AprRpHtIRkHJJYt05OuF/71Aprx:1NImUqZdCprDNImUqZdCprx
TLSH
T107530178A5B68202D096E1F0D3D28FF3BE1CB411D057825781AECE269690A756BF583D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\tr-TR\igxpin.exe.mui
Size 66KB
SHA256 3b0786f5f2f96ce0d88b8de69f4933e1c619eb0b5d2d82ff3b2415ffee9b698f
MD5 c929d496ced74c2be0e0f04bbd7afe0e
SHA1 cfa0728e853b55278b9c399fbb71a4f3e65e236a
SHA512 7f027a8f67caee1b24dd8f93977fe7b3f8fe24dd9b2ab4376e04d1edfa434292bd6755ef26f54932f1c13858a12778d333763a08e9714b6870a3de82b30b304a
SSDEEP 1536:7EUYgTIinGpgPOWymwep/0QhEUYgTIinGpgPOWymwep/0Qx:0gTIinGpgPOWymwep/0Q6gTIinGpgPOo
TLSH
T1E4637804A3DD8127F1F36B752FF591D287B7BCF23930831F6659115A49B0A848A29B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\zh-CN\igxpin.exe.mui
Size 38KB
SHA256 06530a1bc04da92b35685feb6543a79274af06652d22a6451a5fae1a1e7679f3
MD5 d38c33447b18da5e6d4ce190b32ad8fb
SHA1 5855086a1a99d05583abc1d1a658b7406f96c6be
SHA512 5f9e7756f6650155bf2fdd4119d2dda65081d16933a0e1393295adc6388a56c8304beedb782b5ae4b007c16cf30bb8f34ad516af0f2dddaa3162bfb6f9c6dfc6
SSDEEP 384:yNcRpy1dU50BQnyA+zLNcRpy1dU50BQnyA+zY:4TIqjA+zhTIqjA+zY
TLSH
T1BA035648B6CAC939F164B5B587E3C3D3D727B48620820F1FABCC624796C8E04DE6A535
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\zh-TW\igxpin.exe.mui
Size 39KB
SHA256 339579b3ead770a48a139a2c7d732bcbd1589a1eae4b3b2c80958d46c0f1e34e
MD5 dd5b173ee25fbf3a709381e4bec2ffb4
SHA1 554aea62d3b8dec62685f8507bde4d07ee146940
SHA512 1b722066e228217772f0a40fbaf089f15aa9fbacfc3c858a4ed0bedd7369bc0b47e3d45af9d69c94a1e265398bddc2915bf8420f8adda487ccd11256b14e8088
SSDEEP 384:nZ16C5VlIF0pRWaHJTQjwAog7v+InZ16C5VlIF0pRWaHJTQjwAog7v+In:ZfMMRWapTQjLH+ifMMRWapTQjLH+m
TLSH
T121033244B6CA8136F064B6B58BE382F7D737B4923141466FEE8C1547A3D0E099E6E235
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 01849cd4eb6625d7440eb07a117d983119b2bdb351d761baf6aa60a914dc760f
MD5 4470fe7b41a8a1c664ffd0492ae7481b
SHA1 d4974e60559ee79ce5bad9c895a0548a7f148388
SHA512 59a262dc0badc04a09f2fa975107891e900adacec732166c50fa4bfb918f3ed65593261c23516b0519c2a92ead212464dba3b9e250b482c1274f84a8f802b118
SSDEEP 12288:MO7LXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bLsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19765237B934C518AE83609B482EAE12D681B7E669F1044C3B91778FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1ee947b354b9d7b12a8cb8cc0d2b461d35b59ead86f4f725631f0bff5bd928be
MD5 7dcd345a3a8ce3409af92aaef57b01d2
SHA1 ac58d25969db1bb21e34f54d1dad5acc6eab3140
SHA512 b91bf4c0cf8b014d57a1843c94a2c135d63968c8de92bf12fe8884e7d5d520a1309ba503ae87964f502fb871df585703d5c6208f7d58653d41804f785c78d6d2
SSDEEP 24576:Mgb6bmBIi49WNNFpg1rSvFv7bYNsqjnhMgeiCl7G0nehbGZpbD:Mgb4mBIBhGFODmg27RnWGj
TLSH
T17F659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 9cd9bdc683f6c79d2e1631430715ff8c57e8a5c825f06fe7f24fc940e781867c
MD5 2abbf4be54742fabdda23ee1f8081d34
SHA1 96d1448050efe4087ae84ff1568557efeb85c7f3
SHA512 f0188fddc192c8909541f42d622ab97e7bcbe8b57c0072648824871200b347491c5079d4f8b0905abd3f939ebc1f45517b1b303db639fa205728d79be9f9471b
SSDEEP 24576:KG88u8FpJqH1kzria7/mqsqjnhMgeiCl7G0nehbGZpbD:x7ZFPqVza7/JDmg27RnWGj
TLSH
T146A5016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 2ead3b4c06db15527b62b2a87501825569722d8007d0057a42b5cdd6b96d8379
MD5 1a420554652fb0fa327f8faef57a6732
SHA1 999107244d988bcbc350031f3158d1e33f5cab74
SHA512 a3671dd6334f87b12acaac3f7a2cd3736599647a5da0456a610941d528ae966408ab088f30df71869626c769ce74223899aa0495c22e9a604cb2ff0582dad290
SSDEEP 49152:DBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjyDmg27RnWGj:sG05lO43brD527BWG
TLSH
T1FFD5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4f323d1720e8b18ef48e93adb03e84e36f789f47abb2e61b915aa7f71c4c67e5
MD5 e0f03b8da9548acb6a47dce64108824b
SHA1 1bee9a22bf5a9e45a37a3d7ada9ec2eaaed757a1
SHA512 2ad711f6cf8ff4e49fc6ef81272c77b11006f144f2e239494d40fb6ff0ed2eecb8b4e82dd48ce24f331512067ae5ae9588363ba2902a32187b99dacad2039dc5
SSDEEP 24576:jfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnwsqjnhMgeiCl7G0nehbGZpbD:ba5POZ3+Jt2pasx2+m6Dmg27RnWGj
TLSH
T1CF65BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 9364f9ded5efc4f02b19589401dd2b1763ffad77dc781c47a6f483a91ead0564
MD5 92c34d13b525d606c834d90541dedd04
SHA1 31fa67a5b171edc453479357ddb438f8815679cc
SHA512 9d4c1c9146fbc8cb042167ae0d5169efea03b359b21d39c4562137bab91de0114176b7ed677b45e67a8966459dbf97149818ffe1f6e5375a0cb30c782691c128
SSDEEP 24576:3NcwHdjbyQ4nLC18lb/EOjowL7FkisqjnhMgeiCl7G0nehbGZpbD:3Nc/zEOVHFpDmg27RnWGj
TLSH
T1BF857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 1252cae694ca32432f1150a2d0fae17da585da4e8fcf384b81ce21bacbb390b1
MD5 896e8f965407ecee1e6661cc029dc8db
SHA1 9ae0943d7bfddbf88bcd5dd043ccf3c7cee4b7ff
SHA512 7ffc04ff2dc1c982291efd81920418dd631f5daea1bda37f5c6b0930f54b7de4cdf8b0ccd7b3441a0687729747a3e17d76ff53f90d954234c5a5c82e161d132c
SSDEEP 24576:a8kNvNnaFeYhJNtmZBmMsqjnhMgeiCl7G0nehbGZpbD:a8MwBtOm4Dmg27RnWGj
TLSH
T19855AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F4E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 7faf7b96775ded068d286b67d4c8f7f5bbabd548625781122a8956962904021e
MD5 67ebd23942213db967c0c77e61268671
SHA1 f21d350706b8627fdc2323927f1df246e75291db
SHA512 56560799a393f705879c24e8dbf0dc15de024ec847253cd4fa03f9273286583402c53fe5c88b79e10687edcfae2c86f0feca51c80daa6376448801e8031168df
SSDEEP 12288:ZHvUrBFrEjwaQuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:ZPUr+NQusqjnhMgeiCl7G0nehbGZpbD
TLSH
T13385F12F22AC18E5E676A17DC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 5694737707a688a60a71acee02a7e223b70c73aed4ebd042f2a762dec030e9d6
MD5 61678b740d61f4f4acc7dfab8220b6b3
SHA1 22e25a13ea862067d334cff06318c63d0689729d
SHA512 5eb078bab5d53792b5017a12997d0c4cf8d86447b5e1a4de60ec71fdc630ab1a311d24e278000864f914352d43d243bec74bdc9205a5d3c0783b44d441e89ea6
SSDEEP 24576:RD3FHshBIYQgAnsqjnhMgeiCl7G0nehbGZpbD:RDVHeBIAA7Dmg27RnWGj
TLSH
T1FA95E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/688-258-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/688-260-0x0000000140000000-0x00000001401BC000-memory.dmp

Download

memory/688-248-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/688-254-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/688-247-0x0000000140000000-0x00000001401BC000-memory.dmp

Download

memory/1600-68-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/1600-59-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1600-67-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/1600-51-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/1600-300-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1804-340-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1804-350-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1804-339-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1804-348-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1804-346-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/2504-265-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/2504-275-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2504-267-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2504-480-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/2800-522-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2800-320-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2800-314-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2800-526-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2800-524-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2800-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2872-517-0x0000000000400000-0x000000000057E000-memory.dmp

Download

memory/2872-291-0x00000000009D0000-0x0000000000A37000-memory.dmp

Download

memory/2872-296-0x00000000009D0000-0x0000000000A37000-memory.dmp

Download

memory/2872-290-0x0000000000400000-0x000000000057E000-memory.dmp

Download

memory/3940-539-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3940-308-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3940-541-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3940-521-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3940-302-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3940-301-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4076-280-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/4076-278-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/4076-506-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/4076-286-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/4756-243-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4756-235-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4756-237-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4756-242-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4756-338-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4836-355-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4836-362-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4836-356-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4836-527-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4860-0-0x0000000000400000-0x00000000006B9000-memory.dmp

Download

memory/4860-273-0x0000000000400000-0x00000000006B9000-memory.dmp

Download

memory/4860-7-0x0000000002560000-0x00000000025C7000-memory.dmp

Download

memory/4860-6-0x0000000002560000-0x00000000025C7000-memory.dmp

Download

memory/4860-1-0x0000000002560000-0x00000000025C7000-memory.dmp

Download

memory/5096-334-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5096-326-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5096-523-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5096-328-0x0000000000890000-0x00000000008F0000-memory.dmp

Download