219baf2b3d4884c7826883bd014447048b850663de5d7e45cf961b9d1eb5ea74

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/07/2026, 00:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
Size 2.7MB
Sample260723-are7vsed52
SHA256 219baf2b3d4884c7826883bd014447048b850663de5d7e45cf961b9d1eb5ea74
MD5 0d167cf294c43d78abaa0273efeec405
SHA1 763cb9aa8df3635d7221a6aeef534b7c0a90a62a
SHA512 143daed928fef1c2109322fdc6931abfca5529ded9631d5bd7ccb9ccc40a3fbac616ecae9d3a72cff9613db6df7da83d010143625cb10a0908469075dc4e3f75
SSDEEP 49152:R47PD0bQ3dMGRukYyejJQxhUhDmg27RnWGj:mbKQ3dMGLQjHD527BWG
TLSH
T1FBD56E40BADA8225F0F657F0AABF86D1823B7C116D70D19F7294115A0AB0B83DB76737
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1948	alg.exe
2088	DiagnosticsHub.StandardCollector.Service.exe
4544	elevation_service.exe
2136	elevation_service.exe
4772	maintenanceservice.exe
1684	OSE.EXE
4004	fxssvc.exe
2012	msdtc.exe
4568	PerceptionSimulationService.exe
3768	perfhost.exe
4324	locator.exe
2288	SensorDataService.exe
1812	snmptrap.exe
2732	spectrum.exe
3280	ssh-agent.exe
4092	TieringEngineService.exe
2100	AgentService.exe
2404	vds.exe
4052	vssvc.exe
4084	wbengine.exe
3704	WmiApSrv.exe
4212	SearchIndexer.exe

Loads dropped DLL 31 IoCs

pid	Process
4088	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
4088	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
4088	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
4088	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
4088	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
4088	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
4088	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
4088	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
4088	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
4088	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
4088	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
4088	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
4088	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
4088	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
4088	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
4088	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
4088	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
4088	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
4088	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
4088	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
4088	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
4088	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
4088	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
4088	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
4088	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
4088	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
4088	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
4088	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
4088	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
4088	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
4088	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2253dc73905883c7.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4368	4088	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c9c2d3433b1add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000040ebf9433b1add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000673e6d433b1add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007f0a154b3b1add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e485f7433b1add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001234de4a3b1add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000640272433b1add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000127203443b1add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c74dbe433b1add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dbad1d443b1add01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2088	DiagnosticsHub.StandardCollector.Service.exe
2088	DiagnosticsHub.StandardCollector.Service.exe
2088	DiagnosticsHub.StandardCollector.Service.exe
2088	DiagnosticsHub.StandardCollector.Service.exe
2088	DiagnosticsHub.StandardCollector.Service.exe
2088	DiagnosticsHub.StandardCollector.Service.exe
4544	elevation_service.exe
4544	elevation_service.exe
4544	elevation_service.exe
4544	elevation_service.exe
4544	elevation_service.exe
4544	elevation_service.exe
4544	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4088	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	2088	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	4544	elevation_service.exe
Token: SeAuditPrivilege	4004	fxssvc.exe
Token: SeRestorePrivilege	4092	TieringEngineService.exe
Token: SeManageVolumePrivilege	4092	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2100	AgentService.exe
Token: SeBackupPrivilege	4052	vssvc.exe
Token: SeRestorePrivilege	4052	vssvc.exe
Token: SeAuditPrivilege	4052	vssvc.exe
Token: SeBackupPrivilege	4084	wbengine.exe
Token: SeRestorePrivilege	4084	wbengine.exe
Token: SeSecurityPrivilege	4084	wbengine.exe
Token: 33	4212	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4212	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4212	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4212	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4212	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4212	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4212	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4212	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4212	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4212	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4212	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4212	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4212	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4212	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4212	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4212	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4212	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4212	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4212	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4212	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4212	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4212	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4212	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4212	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4212	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4212	SearchIndexer.exe
Token: SeDebugPrivilege	4544	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4212 wrote to memory of 4992	4212	SearchIndexer.exe	124
PID 4212 wrote to memory of 4988	4212	SearchIndexer.exe	125

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4088 -s 832
  2⤵
  - Program crash
  PID:4368

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1948

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4088 -ip 4088
1⤵
PID:4884

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4544

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2136

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4772

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1684

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3824

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4004

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2012

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4568

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3768

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4324

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2288

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1812

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2732

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3280

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:824

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2100

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2404

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4052

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4084

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3704

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4212
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4992
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9e8cea9b8d9b82f71a129cf5f1c7e068b034e010b011e2edf797c0fe6c01aec3
MD5 ef97c6e180ab46966c35f2d09a1ffbc6
SHA1 f6714ccb3473608829bcc0e570876c505b2af866
SHA512 49eb4bf0210956fb06414269a96ef5d03f72bab9efe85090ac79e83b11e2f29fce12aadc292f749fb6bad0e114d5a26103b0e53224df3875f2eb851a8975ec29
SSDEEP 49152:Hb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnGDmg27RnWGj:13q6HjBdD527BWG
TLSH
T119D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 d2182625605202ad3c678326303bd0b5130bdad95d8976fbdad7b6158fd3b0dd
MD5 e0e41aae8f934e409b5518cfa0b0ee9d
SHA1 7a2ba59b95c91cd749047c9d78b9a0f2a93f9cd1
SHA512 7099f7e6c444a257b5a93e7e1a294a7f90a09db665700a0615a21c687a8807a8afba52af40f05f2487fc78b8fe0c762d5ce371f574b8cf07a83f9aef393f14f4
SSDEEP 24576:FXYfDtczA1sqjnhMgeiCl7G0nehbGZpbD:QtcADmg27RnWGj
TLSH
T1DE85F129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 191cad6fd4796e7feea448739b1acc3a4189b1e3d8ec8ad7f851a1d4263e9f17
MD5 b013eee142c8c8be530898c7313c6390
SHA1 e582c406bc082fb90de0ec40d346af7f9a988309
SHA512 c0646f16e60d3fa08221ec0e7675045c06d7c3d6f18a1b218647d0f1cbc44696a95b1baf72d98bd57bfee2f2a2991cc9f89e448686cef55ca9dabf76ac0210e9
SSDEEP 24576:70Le5ji0hmx3rMqsqjnhMgeiCl7G0nehbGZpbD:7Pji0AZHDmg27RnWGj
TLSH
T10CA59E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 aeae32b9b7dab938393ecdd7e0db74d4629f07145fed962ba8d8b58b1286235a
MD5 88c7759f9d35739cbfea627101595c56
SHA1 77ff4ae6b45ef3a07601b6f0ae616e64a3f17a51
SHA512 6947168231bd6f20c60eb7adf0a1894ee325310ab74d5dd2ea9f05d39c362c473db119e5e599b06d07d7fca82ce1b3885fb842c38c026ad611d26e53f94095cb
SSDEEP 24576:qa7/ezSC6vUyD/aqgrvWE6q8wyuUsqjnhMgeiCl7G0nehbGZpbD:d/ezSC6vUzPvxHjyTDmg27RnWGj
TLSH
T155755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 427b60a62b2ec7f1c146d4171c81b1f007f8252477d7b32b1cfea57b75758c24
MD5 18ea08c011e7acb35621a8180cf8d09e
SHA1 967e2b748bcfe0ea29a62b348c5977a09255d694
SHA512 1d39bd67085f11cf81ae70731cdd0cf6f798cfad4bc89736d4120f8133d31070bdeb42644e476edf0b1115d303c3be8dee82b0576898a381669a23459103e91a
SSDEEP 24576:ZVbqPb88hv/l+6JsqjnhMgeiCl7G0nehbGZpbD:ZVO88hXl+KDmg27RnWGj
TLSH
T106559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 56e95f0418b96de7bcfb4e713ea949edc122f79a0883a88153ffa08f15bc1fb6
MD5 701e24ead7faef1c8cd06322e708e580
SHA1 6f135cefd4c9c15b2a93de02b6c0a1dc8372c3a6
SHA512 76eee1a640a151982367fa2b243c4fc66367a8eafa783ceba6839ddfbe8414a267120a312874698a3a7fb71ef311d32c1bf5e722cc85811c26da685b772593fd
SSDEEP 12288:zX+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zX+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E26523BF965C50CAEB7608B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 eb3e7638fa95e771afc1307ccf55ffd391a1613fcd76db3b5dd8040d1122c0df
MD5 e182f270271d907948c44d69666a4de5
SHA1 c707fdbac741a6d1e045b1aa47cb0a15b1609afe
SHA512 d4f8cdf1d30b8e1413282875bf478cc571ac97f4e277abad7f4ab957a4bc4fce3fdab24d004de0289e5599da7d3f2eb20d1fe6d4f5a351cb4d0493f629d53c63
SSDEEP 12288:GeBNUbTVO86UxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:GJIUxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13F85CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 04bfcd3a9b3922d467beffafeb3eea57de6195e325061b164f532101cef42847
MD5 0045a046e9e731fe778e91298f8e7284
SHA1 4ac048f96bd61727724286d7db2268a6f5c36a8d
SHA512 f5f137dce309589bbcda46c3fa4707c6a4306718b515e254eba7758f879a03aaa2fe6a9db5c15a4fb1ce17e10bf7b791b46d98e992ca3e57d3a5a7ec35224bc7
SSDEEP 49152:JQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THg:JQvGAdlCEL8c/yRNw5CgD527BWG
TLSH
T109266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 9ba66c15826af2c172fb4df353421b58931c597a074f95f61b926ad36572f125
MD5 2ecb7786c6c342e24cb2bd67230eb12c
SHA1 eef5cde2476d6d2ad836f13796e5d9ecfb006e18
SHA512 6ab17e2f6fd774e834172887737e1858053a8fd014a3a94b07902ece7aad66510dfb2ca40a502b3104fd681042e77ad3967b6b38ef1c12e706f1c0983bca3a13
SSDEEP 12288:SAwSfxL/2Dc3RDLLmt0LDQewsAjzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:XUewsAjzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19B95E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6b9f57b5c663702893a22734a3e12ed489d8da579295ffcec8399d1ed5301863
MD5 20b9fcde7c2897ed06b1215108454fc4
SHA1 fea1d6fd7f4b25c4a7b66a5e5a01fafb39a30a9c
SHA512 7187d8f4017593d658e8ec4cbc424aa95f4052fa8aec00ac70447bd47617c654f5f0e8042d7c8388953417755c38edf61d4b9763f0bc4848bea07eb700de4911
SSDEEP 49152:5CbRquA/m2yL5zQfFiV+XenmE3/zXDmg27RnWGj:WoqtVjnmsD527BWG
TLSH
T157D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 0d524624461b72537d89b36b581b54f62cb54597550d59906a4b224365d9a94b
MD5 d007ca6db2550c44d99f65e642e666f0
SHA1 f1fb1e97f924ecb0fc5e7b3d8f9a3b8003cb269f
SHA512 17d72c713e4a963835f7f0e4e2b6bb144a0a77da53ae094c36fac1274591c76b0b153ad4f94cbe8487600b209f7de25efb4bf32050cb7725055465b030da22bb
SSDEEP 12288:Imw5HEjsChNzBFgl0WDm+C0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:lwuSOWPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12285F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 de9a025903330a60dd78a091681eb53efaba9c3e614021d976bc5f06405d8790
MD5 e9233bbb2ce9fa9d7a5bcd386d1a9182
SHA1 b72c180a28c151a9d3ced1263e45eee8934e807d
SHA512 536579a0f4b1ceae9663fa149f41dd2e1ca9623267f0a3e5c3b8101874115ac5776c726ed3e760f33f0ca76f13daf7eae7bfe7d42a4f24bf2668628b2cd0d869
SSDEEP 49152:vB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl5Dmg27RnWGj:Ru6JmVxd2d5D527BWG
TLSH
T17AD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntelGFX.log

Path C:\ProgramData\Intel\Logs\IntelGFX.log
Size 832B
SHA256 74868e32a0b09449ab41d599f41dc11af085dacfebf4ae742acd9f9dbed66445
MD5 856e30a299eb4bc6812b865fc4269144
SHA1 9b1ada24b7a5cb9af97189fc525918b435875ace
SHA512 d9de5b9fcaa8fa83b75266e12185f5ed86a987a6e3ce0e8915ce3f073b263ffa6937e24e09027e73430e06fd9a2a836e1a2a1be8482922f878e41819cd3e4a31
TLSH
T1ED01F51AA7F91101F2B7BB19A9F741212E75BCE95C35AA0C01C4620C0DE2D00EDA5767
MD5 SHA1 SHA512 TLSH

Submit Download

IntelGFX.log

Path C:\ProgramData\Intel\Logs\IntelGFX.log
Size 6KB
SHA256 054ed40fbfa423b6566a1df583bbaa4946b4485bd203512f1062f1bec331c27a
MD5 6a0abfc6f013ad943b67794f25f2c600
SHA1 812688efd48731ac8f159ccff948eda380f7810c
SHA512 b5d36645f4375a6bf79e94e57188d8993eb285bf4e577902f2d9e228b0b0755fcee19069221f5c57a988c067d0b03e696cffd83dc3d68dc6f8df5ead3e35a7a0
SSDEEP 96:dkiRDRjin5A1L2NQpJw/LnvUUZzlbSTTbHjALkb3AqcYM9Trjef2DzsL/bR4DZr9:dH1VitSlnSn+nnnXe
TLSH
T12ED14D917AEE524DF7FB3B8E26F64137A739FC329937950F0194526808A78148E20F76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\ar-SA\igxpin.exe.mui
Size 57KB
SHA256 6a15b7201fb7fd9de2084ac58716a4987d3cacf24bd0cb5dba610d8ef5d811d5
MD5 a51b2d26f4a22478fb702a00974fc5ba
SHA1 8b4edc19629bcad45eb15da76bfbb5a9cf7c9525
SHA512 cb2261cacafb5b8124638ded7e40859cfe49f5cd5dcf0f29b3e2ee8532fd3f5cf231fd7e94b9344921e3eb2388c3cce9da7cc85aba0a4f928305f52b0d098496
SSDEEP 384:tsKkHJJYN0atlRc4KLPiDr2zsKkHJJYN0atlRc4KLPiDr29:CBUZtDc4KriDr2YBUZtDc4KriDr29
TLSH
T11943EC50AD8CC139F0A3F2B4C7E7C793E315A09658C9123B5AB84A2746D4A709F2F5F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\bg-BG\igxpin.exe.mui
Size 68KB
SHA256 034b33f4ada1df6dd91143710bab082e4c1c4025bb8e3e7a73ec91251454fe93
MD5 6d0bcb144e34e9ee9aab3687b5fcb373
SHA1 c1c5d2bcc102d4d4a2d137e4fd214b76ea4f2118
SHA512 18767f4f30015cd2718712576b0912a96ce3b8cf0d657227c2b73aec3792e77053c8d08fbf78d096cdc3a2fd67a41668abad9063ae42a9a1f27eb1307ae39799
SSDEEP 384:C3sxkHJJYt0SbtJe5w5z8WorQnS3sxkHJJYt0SbtJe5w5z8WorQnX:isGUdnnor/sGUdnnorE
TLSH
T1FC63990FF9BD9124F5A4E2710FE282E772B6B750332046C7968F3D66A14CA317B29197
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\cs-CZ\igxpin.exe.mui
Size 64KB
SHA256 3abac0bf45c86666665dd607792f25368db8b1d967ddda7f2257e8ef39267224
MD5 0ee65da223db059ce66d142926e646b8
SHA1 ef6a7b56f3fde4331f4c3c45291012e7cb364d72
SHA512 e1fe2d79ae9e95d936193b1ea6d1f3c0158ccc76356d825f0c76ba07ef67d80bd756cb98d375e74c7da1146c08642c98444620f3952b8dc5408b8ed61f26c135
SSDEEP 384:9IbUkHJJYt0VonQJ6zSaWxqW8ymAaR1grNO6xIbUkHJJYt0VonQJ6zSaWxqW8ymg:GbfUa7EWAE5rwbfUa7EWAE5rB
TLSH
T1AE538701B6FD4165F0F77FB56AF142B38A7BBC922931C20F5684028A59A0E80EDB5773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\da-DK\igxpin.exe.mui
Size 65KB
SHA256 4ff2872d28e81801e49502bbe60105b2d35cf72f01af06bb46154c0c9debb284
MD5 9fc36b594bdaaeace8e0396b0e7109fa
SHA1 6b18485c584cba645ca69088901be343f55d1a25
SHA512 ff85f4220db98c3422769b85ea071e1d06068bd9b2b793c565a688f8a7062b05b5a98f24d04a9d53bb1d92b5c6cc64507a80c01eab108a9adab9a21e268c0fa9
SSDEEP 384:fTekHJJYt0wvnQBaPFFPEOys6r61O4TekHJJYt0wvnQBaPFFPEOys6r61Om:LdUH2oFwrOOQdUH2oFwrOOm
TLSH
T1B7539C50B7ED4129F0F37B70BEF642929A66BCD16938C61F2344109E49B1E88DAB4737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\de-DE\igxpin.exe.mui
Size 69KB
SHA256 7f262b0e5c14448c5bb846d0092d4e4cfd0685049b4c20e216842b03dc237f11
MD5 bb40f66292b001e9e22e23ab05b8fd03
SHA1 8681d9622dd41361323010901443f7b1e99d515b
SHA512 14b7fbf2b39041f46103ae20e82904686f2d1311aa66ec84dc7eb8ef49d118a9709cda432ce961ccedb29f72ba1b16a16b484991f6aeb9064acfe7f11a0d718e
SSDEEP 768:61rUU+I/BGuOWW1rnL/np41rUU+I/BGuOWW1rnL/npZ:6JUU//BGuOWWpLqJUU//BGuOWWpLX
TLSH
T1A0635510A7E98628F0F27BB46FF583969E72BCE16931DA1F2354109E58B0F04DA75732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license.txt

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\de-DE\license.txt
Size 276B
SHA256 be0c45b4c982bc6ef423248eb1e96db9e1f2749cabda7f30ca2d18807cc67b0c
MD5 5e4c8e5d23dbcfb3903e8693a7c92f77
SHA1 01789416dd92b97f9763a7de2c5ab87aa1c64672
SHA512 1f839320f378a9a54590dd62357beef4fbb2a7f039f8532919233ab036776b47d54efa8656213e099cf73b6c9bcb4ded74b4d0575db643959aeb0e08d22cc07d
TLSH
T1D6D0922152C94600F7F23BA13CB142C54DA67852FC72D25D5182000A4C61EA0CC60732
MD5 SHA1 SHA512 TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\el-GR\igxpin.exe.mui
Size 73KB
SHA256 9ee24d963d449dad9b54fd03b36d7218f80fc837cc6b4519ebd66cbe6526ced9
MD5 e0e0146676ef256d8f7a3b10901ea462
SHA1 a4c3e728a43c55a59c5be90956a58bd344e34242
SHA512 b4d4f075310681c9747737664cac1eead37c722c31d59b05d664acc2983a1a7193c144cfaf733e60d7948aef924101e4d17a017cd391ddf0a9eca32f164b3354
SSDEEP 384:ylkkkHJJYt0XkxlF/Ikwyb1aXpeyC2SXEz/rhjPlkkkHJJYt0XkxlF/Ikwyb1aXS:gqUrwmOS0z/rhj9qUrwmOS0z/rhjE
TLSH
T19A73578C59AF5221E9B5A9F256B3C1A78B6FF5C21020DE3B73F4304AD95CC158DC392A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\en-US\igxpin.exe.mui
Size 40KB
SHA256 4407d78ece9c7f840b5593401a3314d379e49dee9541a6d20bf7158c5fab4a8e
MD5 199921ec28eadbeefd1120da3138a842
SHA1 f87897e9879ae61dc34b0c90a46872f61ffe4c11
SHA512 3e375d5f39531038b27dfdf82cdeab007a11c3452321fac55057020119b0b6b21cd4f4cb8b93d9b98db52e7ce881858eea2f553b9efb3bfdb366279c85e6f36e
SSDEEP 384:O0n6kRCBRotVbQ7Li+R6zUXVUP8IKGAYvc6rv0n6kRCBRotVbQ7Li+R6zUXVUP89:d6rUIa+jF9G3rM6rUIa+jF9G3rQ
TLSH
T1F9031240B7FD8129F1F6BBB16BF582A68A3ABC91A834C71F1244005E96B1E44DE75733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\es-ES\igxpin.exe.mui
Size 70KB
SHA256 882a19d831527e3b988e8919882f5c18ad0f20c321d4e5d1cfa9931a43394451
MD5 87147e2cf3ade40d9e7f2ce90f4188ea
SHA1 9db79b70d472b2262eca8f9a8f405f1d97749d28
SHA512 59e1ddaa56ac401bf7119b72737a5124ad1b0911c74356c4e37bf5e1f482cab8da5e0a403d83c9cfb9996e809b7dae3cda75f14b9f5635014360983ec9d18b3f
SSDEEP 384:FwHAkHJJYt0MH2mlhRYRPTTJIrUPQwHAkHJJYt0MH2mlhRYRPTTJIrUP0:FMjUjDYPyrUPQMjUjDYPyrUP0
TLSH
T133631100ABFD5266F0F37F74AAF646A68E7ABC919834850F9358115E09B0E44DE74B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\fi-FI\igxpin.exe.mui
Size 62KB
SHA256 9d7310ec056244d2c1645383ab0a51abdc0cbc62aa5f97ee5fae23090c26ace1
MD5 be8fcf16bf3b9909c11644bf5d89552c
SHA1 cec1b5109b9a5ab4cfecab8f6ff2e5e2c9c71d62
SHA512 1cf2f49f13f5459d01e2acdbc5bc1d0d9f4e88e2aee4f0c9a1b07f5c061d269f5eb50abd6dab9472ec370265e374dad1eef422b799a51992a2afdf1d00babdf6
SSDEEP 768:ymU9ELFOy52vGfPrVtumU9ELFOy52vGfPrVtT:ymU9MkmU9Mh
TLSH
T105535984A6FDC124F1F7AF705BF582528A33BDD22CB5D61F1B48104E9AA0A80E975737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\fr-FR\igxpin.exe.mui
Size 73KB
SHA256 4da7821a89db874834ef4ec2b8adba85525656bc98911ec0437db91f17eaf458
MD5 fdb18982f1ee46c3f77aba3dc27e062b
SHA1 f77efe4f6c2501f108a7a3b5a3437325b7b9a798
SHA512 d466427ed83ddfa86c62d79b5735475b0484834306389e2bfc566b1cfd20c0fb0fc2af8ec6ce4c2a4ad8c6d12a5b7f3329d0ee7dd47e7cd2b72ae6bd16504f3b
SSDEEP 384:khlkHJJYt0dJHoLwvu4WNKq8HW+NL4isDDg6ZF70pDrWipVhlkHJJYt0dJHoLwvC:mSU6NaKX4TA7rTSU6NaKX4TA7rg
TLSH
T1F0732354A3E99221F2F37F70AAF941928E3BBC9A9C30C62E1254158E59B0F14DDB4733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\he-IL\igxpin.exe.mui
Size 54KB
SHA256 ef688d6b94819f18e4c06a634ac9a09e9843adb83b87f2787bd6760de196d644
MD5 2dcc6174a5d9211e70c9a2313d4dbb80
SHA1 4e16c609f27112671a15001d8728d825c03138c6
SHA512 08d1e03082f0757522c35de14f1996a486ddaaedaebc14375789fdf46637f43aaf50a77164b2753c5e94c30571bdcea7600ac750d5b75cc6728935995ebacc4b
SSDEEP 384:gQkykHJJYN0ulfz4eeDixrqTHYQkykHJJYN0ulfz4eeDixrqTH/:rwUplfU2xrezwUplfU2xre/
TLSH
T14A43FD806686C1F9E8B4FF7397AB8AAFC751F54410683717658C15926AECB80CB2D73C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\hr-HR\igxpin.exe.mui
Size 67KB
SHA256 90e2772aef21e8d72dc87f19b90bd0e58e2db8566982734a4307274ca50ad78e
MD5 da91d909d1ab4900e0413cde6055612d
SHA1 6957addda1e87fe340c73dda2a92048314915458
SHA512 5f181e6a387a023046ee9bd798f8f4cc842e45c24aa3284c3ad1ffad9d5a8fd3bdcf912d7a1baeed30a9916df5b890af38e056b76c581a18f0d1e7096f76f220
SSDEEP 384:5vkkHJJYt0pM1CrzfyjB/qh+kBBDrxkvkkHJJYt0pM1CrzfyjB/qh+kBBDrxI:NPUDF87rxYPUDF87rxI
TLSH
T1EB635C41B7F95269F4F37B756BF647A28A3BBCB17930821F1184118A4E70A80DAB5333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\hu-HU\igxpin.exe.mui
Size 67KB
SHA256 f9e9495e34ca2147cea5f80a679cc73a9939b2dd06f62ccbd77d36b6c4431551
MD5 bfb17cbf3a7d0671a3b5b9599b8d6c53
SHA1 bad1bdc568094da707a94a3cfedb15732e82f163
SHA512 b1d8ad318484d187467967acd4ef552c540ac748e2177d658f52bf88cc9d0ea522d104217c09da252b614f6b02098aa516110f7f3eed0d5f12dea4a7548936cd
SSDEEP 768:rSlUBMJUx5RUlk2oPj6Gu5nW39rPGn6lISlUBMJUx5RUlk2oPj6Gu5nW39rPGn6A:rgUWUuJxn66gUWUuJxn6A
TLSH
T17C637B00B2ED5119F0F39F723FF182D34A3AF8A1793DD21F9688528E59A1A44DD74726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\it-IT\igxpin.exe.mui
Size 69KB
SHA256 9264e4babc1af50b270c6cbd502c4696990bfdafe2a31c04b41a042bc83b5cb2
MD5 cad7efab3d9767ec92add388c2661c97
SHA1 e5cf1c174698b8459d55673a692313cd2da993ac
SHA512 22e99c8e9a37138d5974855bb3d5e0b2a4cf2639350ec117f50a6aa68b7a8180c1a8a2803f31b22ade4c82b887ca36478db347cd8086283cb873f974f0f95bf5
SSDEEP 384:NJD5XukHJJYt0blHA9A5Snrj+QaM2zeJrNJD5XukHJJYt0blHA9A5Snrj+QaM2z6:HD5dUclHbgGQZtrHD5dUclHbgGQZtrn
TLSH
T1EA632110A7FD5225F1F37B74BEB986968E3ABD926834C62F4284004E59B0E58DDB1733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\ja-JP\igxpin.exe.mui
Size 47KB
SHA256 2f04100c60a5a9d48940ee404e57332b7bc03db34828ea86501336ff2cb9b88d
MD5 f05d85bb31598913616880a1ade4f70b
SHA1 ea636c37c997d98505174e4f1cf885468d588144
SHA512 940051ddd778d3a455ef1dc923dda2c9e8735e6a7c9dc924bd1ddb2f7fd75000641943fa74269bafab44891cdfd6a8d31703e40d9d5c56e8d03fda337f7a5ad3
SSDEEP 384:7c6peVMox0L7IC3of4+3Goc6peVMox0L7IC3of4+3Ge:wRZw7LoA+3GfRZw7LoA+3Ge
TLSH
T197234548BAC6862BF0B4E1F447E2E2D3D715F464209209A76BC8154792D4E4E9F1F37E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\ko-KR\igxpin.exe.mui
Size 45KB
SHA256 4036a4bf81f1c3ddd3fd2bc05551b20157b329eef1e1213c2d3b3334209dc133
MD5 65bfcf2e236165bddc02334c13bdfd36
SHA1 f3c5d342fae24aa00d2da4a52ba95b26ec2a3aad
SHA512 44a720a34080915e2c0a14faf8e7da1131d7aa4735f6679d6df61caa02960283ae8fd2eaa63c6dc3a989c57b80ee8ebea527617b075db5e7c708fbf272dd50e6
SSDEEP 384:Qn7lWVNkx0bajcYrPQxbKITU6rrSn7lWVNkx0bajcYrPQxbKITU6rrx:804y3rW04y3rd
TLSH
T14E233118A9EED037E0A0F5BA47E3C3D7D72670926043061BF7886147A6D4F489F792B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\nb-NO\igxpin.exe.mui
Size 64KB
SHA256 c58f23795bf38641d1ffeadd3b212b85c371b38a9c8a7512442f164698b8d531
MD5 c1fa767f94bde7a32a43849f45e0d1f1
SHA1 3d03bb0829707aec52b99d96315806556fdeb61f
SHA512 54b6a59956843be44d54c712452ddc717a8d8d5262c31a6ae013e34749890058de591b6ddf1656adf24bcc3ff998d6d0300ebed1b856cb6e8de6dd80729f8edb
SSDEEP 384:n6hxBRhxBRhxm2yCSiyCSiyCSiyCSiHXn3HXn3HXn3WjkHJJYt0kArNZRh9vfrC1:JbMUDArNZ39frC+FbMUDArNZ39frC+L
TLSH
T1CF537B50A7EA8129F0F37F707FF982928A66BCE16D34C61F1344104E49B1A98DAB1737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\nl-NL\igxpin.exe.mui
Size 70KB
SHA256 5e9715be24d30c5279b4115809525312ad79855f18a6979c1b7a506ab2b3ced6
MD5 7149410345e0fd05aa2fd38c001a995b
SHA1 f329e592f93ae1f4557b023db1cbcba510f798e8
SHA512 8e8262538a82eb601304ba3866c479f1b38e4f04e5755403ef57763efe0f7495015e9d1ac1fdc834c6690ab756c1bd814218d76997bb70c330304e4c1684eb5f
SSDEEP 384:b2WWkHJJYt0tP7qYuxb0s9/CX6DPc2Jqr62WWkHJJYt0tP7qYuxb0s9/CX6DPc2f:qWlUCM91/CcOrbWlUCM91/CcOrg
TLSH
T107632301A7FD8128F0F36B742FF582A29F76BCD56971C62E1344169E49B0A80DAB5733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\pl-PL\igxpin.exe.mui
Size 68KB
SHA256 5f4ee06ec998aed810fc5bc96c53a5e181d329ba9f87c8af2969b8033dd60a1d
MD5 e1ec46583dd2db9e7933c192d4be236f
SHA1 326a4d5de247c77b0bde22fd968cbf92104e2eed
SHA512 9e2e8105ca064476858ae01587063d0c55c977b62c90ce69b9e10c7d98af45db4f3d7b94f4f7698c6451526027ac2b2ecf47b9fabd80267ff11ae75853d0d836
SSDEEP 768:EbmUWOxpr7PfoErLfKbmUWOxpr7PfoErLf9:ECUW0KCUW09
TLSH
T178638800B6F94165F0F3AFB46BF662D28F7BBC227930825F6684014A46A0E84ED75733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\pt-BR\igxpin.exe.mui
Size 67KB
SHA256 6db4955e8a7bfe8619771ce73f9b16f16c4df4ae61283491ebda49e712d75339
MD5 7eccd182eb1f0ad058f9b69d60faea79
SHA1 b7620c631f27b2a85f81917b5b52b49d9574d597
SHA512 bfda7a0ea08bcba6d75f02dc95e87aa285ea003d8768b82303fbe49f362374c812dac603f1872333e2993ac026e074cb6abd517e9a80f03404a50493b0404350
SSDEEP 384:PDCkHJJYt0LZj/FYVWyCClhtkRrtiDCkHJJYt0LZj/FYVWyCClhtkRrt8:LpU9178rwpU9178ru
TLSH
T19D634340A7FD4229F4F37F766AB556A2CA37BC926C38860E1254015A5EB0F40DE79733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\pt-PT\igxpin.exe.mui
Size 69KB
SHA256 f8f78750ffa05e18f3cce74c5d28c88819ea526e115582c62e4137d45e6d8aa2
MD5 ebf1ca17a35f8218a44f553c0f6c94bd
SHA1 86fd713fc727caab2f92688119771cecbb0ee7c8
SHA512 d51c5dfe2e330c0da13561721f007a285e174f98dd1ad1d131aabce6f6b16446d08e1588b34905b06a91badfde0a4414401de8d1b0e403b040f87db229f97d83
SSDEEP 384:unpkHJJYt0IhpTpEwqKMN2MpOSLRrAXConpkHJJYt0IhpTpEwqKMN2MpOSLRrAXC:uOUXTVcYsrlUOUXTVcYsrlh
TLSH
T18C635440A3FD5228F5F77F765AB95AA68E37BC919C39860E0254119A5DB4F80CE38333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\ro-RO\igxpin.exe.mui
Size 69KB
SHA256 a784b83f390aa8cc45371b308454c0abb43cf0f0505d01c80a9fe7280cf60093
MD5 4fb31bc00af82481c8d2012e803f9969
SHA1 a3d41214bd92bded63917f85ede6347eeb3a2bef
SHA512 01cd3ea09fe41730d333cd19b191181a266ad1ccfbeacabe59e75addc4cfd902bd9a60562f1054de96a2c0c09e77e30aa4cd60a0e1f272028b9f320445b6ac9c
SSDEEP 768:rteUGrTtZK9nLrr03teUGrTtZK9nLrr0j:rteUCLK9LMteUCLK9LC
TLSH
T150637650A3E90225F2F37B746FB546969E3BBE63A831C60F1648008E5BB1F849D65733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\ru-RU\igxpin.exe.mui
Size 63KB
SHA256 d0dd71ec2a342c0f94d15d10d78cc0be37e09bafda420274162155a7e4e6c2fa
MD5 bebcdc70c4725d4dfef27e0943c4e323
SHA1 a8d95589012f8fff1a8f95499c15776393db299f
SHA512 c0ace08c74ee7ac77bb430d855038d7c66fcd13f4943d8f74a712d69b4ed79500cb95ca9010dc61cc09d6e766f812ebbf0f6fdacd089e74b21b34225cec0582c
SSDEEP 384:JkO5WkHJJYt0k0mRVk9+Xy4Pqvu5drXWX8kO5WkHJJYt0k0mRVk9+Xy4Pqvu5drb:GO5lUjsOrKO5lUjsOrb
TLSH
T14E53CC4FF5BDC124F0A8E2B51FE389E35216F350231182C7A69F3D5AA198A34773919B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\sk-SK\igxpin.exe.mui
Size 66KB
SHA256 2dde3d941d45df92a2baf0c553ed6006d3aa272596a1b17423ff054deff2c4ec
MD5 54145dcf76b6c2f90158138664a0c316
SHA1 9355a03a7047ea005ed01340698397aae541886d
SHA512 2fdfd42e6ad275da40cbcc2fe5d33f7efaa05f325a326fc712b9f5b79bf342967fb2a62bee1afe9feed1c562a9e8800259416062f96bf563bcb848b629834dec
SSDEEP 384:v+9ndVkHJJYt0bC0g7qvy/+k7k0nRFgkfDYXhVAaLQUrOG3n/h+9ndVkHJJYt0bT:W9oU0dwYyOrXvE9oU0dwYyOrXvB
TLSH
T140638951A2FD4166F0F37FB56BF182A28B7BBC927931C20F5684024A49B0E84D9B5773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\sl-SL\igxpin.exe.mui
Size 65KB
SHA256 4af9ac0b53d9a9a06a067778dbbfa1847008e7fbac2707913cf39a27f112b6f6
MD5 33fabdfbb764c2b658461011d0674aa6
SHA1 be2a90d37c52a637a7fec560ba434e3c4636c593
SHA512 0f31480c920db5735d785b298af3303435562dfff737b53fbc5df2c8a54e8674dd4057914e32d36bc883fda9e9d0d7c88eacb532fe8f0bda045a595b2d9b21e1
SSDEEP 384:95mnkHJJYt0zgbd7KUUYdVuwa1Oi0wr3zqOXOF5mnkHJJYt0zgbd7KUUYdVuwa1a:HmIUsQOruvmIUsQOruv
TLSH
T1CB535745B2FD521AF0F77B7457F542A28B3BBCB27931C22F5244128E49A1A80DAB5373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\sv-SE\igxpin.exe.mui
Size 63KB
SHA256 77d63123fa73d837e9767564e700fe3347bee9b9e971334ee8744f44f9bdbf48
MD5 14342ed50d2987dc8cb6a53bb9224e80
SHA1 d5c86c916133605cf948fd2b107c41e8b3db9955
SHA512 6a8c1e5973dd6196dd3cdcaba4611f8b7a2d348e1c1607052fb97da81d2618175859be432c75cfbc9d386a51d8035d2b668989127a9393019301409203832a10
SSDEEP 384:vA0xkHJJYt0C65PHCVQmQHKCsWUZrENJA0xkHJJYt0C65PHCVQmQHKCsWUZrENp:YLUtfV/LtrENSLUtfV/LtrENp
TLSH
T14453CD40A7ED9128F0F3AB74BEF682A28A76BCD12934D62F1744159E4970E48D9F5333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\th-TH\igxpin.exe.mui
Size 62KB
SHA256 eee8df0d48be9d8fc6ab0acc55f8bcf161180a21990ed220cfaa41ce5d391caf
MD5 c00f9dcac9ed9e7cb74b124aafbe8fdf
SHA1 799af629f7839d26c956158171f71b7ce0771be4
SHA512 881e0bb46d7a41b71089b7571ce8e02e59b0f2295d802dbdb85ed4614f6941d068e19acab3a04fdcb7ede63e69d8101bca4ee81160aa630f5ea6bc322f753cf1
SSDEEP 384:jpHtIRkHJJYt05OuF/71AprRpHtIRkHJJYt05OuF/71Aprx:1NImUqZdCprDNImUqZdCprx
TLSH
T107530178A5B68202D096E1F0D3D28FF3BE1CB411D057825781AECE269690A756BF583D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\tr-TR\igxpin.exe.mui
Size 66KB
SHA256 3b0786f5f2f96ce0d88b8de69f4933e1c619eb0b5d2d82ff3b2415ffee9b698f
MD5 c929d496ced74c2be0e0f04bbd7afe0e
SHA1 cfa0728e853b55278b9c399fbb71a4f3e65e236a
SHA512 7f027a8f67caee1b24dd8f93977fe7b3f8fe24dd9b2ab4376e04d1edfa434292bd6755ef26f54932f1c13858a12778d333763a08e9714b6870a3de82b30b304a
SSDEEP 1536:7EUYgTIinGpgPOWymwep/0QhEUYgTIinGpgPOWymwep/0Qx:0gTIinGpgPOWymwep/0Q6gTIinGpgPOo
TLSH
T1E4637804A3DD8127F1F36B752FF591D287B7BCF23930831F6659115A49B0A848A29B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\zh-CN\igxpin.exe.mui
Size 38KB
SHA256 06530a1bc04da92b35685feb6543a79274af06652d22a6451a5fae1a1e7679f3
MD5 d38c33447b18da5e6d4ce190b32ad8fb
SHA1 5855086a1a99d05583abc1d1a658b7406f96c6be
SHA512 5f9e7756f6650155bf2fdd4119d2dda65081d16933a0e1393295adc6388a56c8304beedb782b5ae4b007c16cf30bb8f34ad516af0f2dddaa3162bfb6f9c6dfc6
SSDEEP 384:yNcRpy1dU50BQnyA+zLNcRpy1dU50BQnyA+zY:4TIqjA+zhTIqjA+zY
TLSH
T1BA035648B6CAC939F164B5B587E3C3D3D727B48620820F1FABCC624796C8E04DE6A535
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\zh-TW\igxpin.exe.mui
Size 39KB
SHA256 339579b3ead770a48a139a2c7d732bcbd1589a1eae4b3b2c80958d46c0f1e34e
MD5 dd5b173ee25fbf3a709381e4bec2ffb4
SHA1 554aea62d3b8dec62685f8507bde4d07ee146940
SHA512 1b722066e228217772f0a40fbaf089f15aa9fbacfc3c858a4ed0bedd7369bc0b47e3d45af9d69c94a1e265398bddc2915bf8420f8adda487ccd11256b14e8088
SSDEEP 384:nZ16C5VlIF0pRWaHJTQjwAog7v+InZ16C5VlIF0pRWaHJTQjwAog7v+In:ZfMMRWapTQjLH+ifMMRWapTQjLH+m
TLSH
T121033244B6CA8136F064B6B58BE382F7D737B4923141466FEE8C1547A3D0E099E6E235
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 c5bee500dbeff660f9e7cde67d014dc87ea701583f5ff79a406d2e569240fd9e
MD5 660d802b44fd530fad04fbedb7b0d77e
SHA1 7a76d53eafe2f328406c5d3f3890664ada0e912a
SHA512 1eb0f4db3266e275aef3361927a9c83deed761bb78b27aa0df88193d3edc5970c26df09f771ee658bab5ebbb5baa8e3b809503e92cda68d9ba25ebec3320fcae
SSDEEP 12288:fuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:fusqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BD65237FD34C518BE57659B082E9E02D781B3E669E204483BA4738FDF6B08948F38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 166bab023d7d3b661c563a76bd763a2459d5d5f77c5a7db1fb40f7acd8e95bb6
MD5 29d18e0a0a69aca30b25736b8dd8a795
SHA1 3d832382ddeb8a6aadde931f43e2835fdc89bfde
SHA512 ebc9f7635483198f571ba5c75cfa899d40ec16350f52f38dd016f1177b19b57b3211ab00d7aa706bec5c464378a70426aff3d56050f68f21c921bbcd9dbe99b9
SSDEEP 49152:sa0h2GEkuAe73q3pp46zwwQ8Dmg27RnWGj:sa0hNYG4JwTD527BWG
TLSH
T13685AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 a7c3eb76412f7ae3edfef21d24f08686de7e7812f78840c75ce48a403946e494
MD5 7b210fa7a5ebcd34abed29e5e7d286ee
SHA1 864ba1a1d25aab499a40445c4bf65cd75373a4a0
SHA512 7060fa0030c42fc181af50cd4cee2176e6a66974e45bb7a83ee7c3ca1a5dd1f9c174ff8179f0fba252858155f83cc8231f4000b98587394d9155f241302460d3
SSDEEP 12288:ihbHjfXSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ihbHjPSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C975127E12AC20C9E57291BD8296D10AD632BC26172053EF27D281BE5F37DE84D39F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 dc7e37960b49d69be50ae019f88d41b54717eb055499da941d32877a51f62514
MD5 1a71195f5a92d872a5e64e5efaa36385
SHA1 acd082455262119bfb85d815d682c51ba5b58d3e
SHA512 87990e18c3f4da089e925780742d3888dcc8280517624d8ce3a531fd11097fb9777784b9b30e0e1bd2d41570da67b67a5df7ebcca8df0b93e7518e45511d300f
SSDEEP 24576:C3YgnJcRTk4yti+R5dBR/rsqjnhMgeiCl7G0nehbGZpbD:CIgnaTk46pBR/fDmg27RnWGj
TLSH
T14B45BF2EF2B910B9D8A6D136850147B5FB71782D1F209AC70170C538AF1AEE85F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.5MB
SHA256 c01b2a2288a1a0bc97794ebe44542d34577f94f941a154818b5854232f659528
MD5 82e99255867524fa200da99221b1239f
SHA1 99ecb7879567a0fbb9f2a89776643750759dc906
SHA512 c97255c62762439d066af8b1928946a2ac0be22ef15a75310b4e6c9fce2d8af3345cfd6fc67e150e70332854264d751817654691c80510104268bd692e142738
SSDEEP 12288:2SXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2SsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16F6523BE924C51CAD93649F5C2E5E11DA8073E569B2004D379A77CFDE7B14E84B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 0b65dccc55a2b462ff2e7632af3b613de269a6ed34d8ab6c76efc42d831b90a5
MD5 a422c8a63957d092d8e747c07761e558
SHA1 4f0b0ba8b03fd96f58c5cdf308baf6048335826a
SHA512 bebe1961fc932747d1b486ebdfa9394ee6f02aafe3f5e53968842f162c3c4171378325981dd3dcb7b9b988cd3b6aae2ea53865809e96f0857536ce191d06ae18
SSDEEP 12288:wObcA4LWOsvAYFT9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:tcL3UT9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T152950159E79800F9E87B813CC5A2D616E672785D0720E7DF03A94AA91F637E04F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 8152a1665b7df2b8182a9828017624e127cce70c5ad62cf044b472fd5ea6068f
MD5 29020d7aa69c205a4587d62c24d7793c
SHA1 8b2ac9cea1fb832d5f49985173ea6d740a45161c
SHA512 76378c058e897563e27543b7d7e4c01ed4dd3fa7de15336f885cd582bdaf5c6fb2640f0b927afda0e72aa2559dd00f9da9f0fb328c2e02c008fdaec30ab9c164
SSDEEP 12288:ipFtvOhXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:iOhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13B75022E33EC10E9E536917C8692D20DD632BC66072117DF06D184BE5FA3EF85D39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 56d99b0b50aed92e065c21e93f580932b73da47ca543ce8b9b16934252f93e07
MD5 26b6e2af2f0d88c26a8a4bab5f1ec11a
SHA1 6fb77c50be251204d11c0545273a32f26d321275
SHA512 693b58c98f21165018abaf531136cbae748b9e8438cd810b382e97d293cbcfccc1368696d35487fc18ea59deb74b7870e5d20b7479bb4536d6b0b31a1b19d317
SSDEEP 24576:D7NM9YqZqmWMUkPjZM48Mv6bEhs+sqjnhMgeiCl7G0nehbGZpbD:D7cBWMpPjN8DbEh3Dmg27RnWGj
TLSH
T12D659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACB1162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 f3f86bd6a8bf9663590b2fa865c57e4586d5f32ffc26c3e1b3f4da2af36d941e
MD5 e0ceb9986409cfced20d407f21c19003
SHA1 7277fd4197f724fc3eef5229d50e343458b8ed88
SHA512 9fdb49bb73b14f5368b27f69887c8c846789f2f40f9679c82c393d3ce692fcb7997a48ef750e8ef525d189b89f3c50309e2831e8caac4aa6f251f1cba1ea6ee4
SSDEEP 24576:mW6BApg2YuyuNDYTabvcdvNYf8km1ssqjnhMgeiCl7G0nehbGZpbD:mF2YuHNETovAvNYf8kmyDmg27RnWGj
TLSH
T106857E6A27ED80A4E0BBD27D85B6D246F9B2B8511B3055CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 1eb2ee42823a907b83e6dc8c74932006f07efc2ca90cdff196d6c8b671c52a68
MD5 6f5c91bf828d4209b266a57ee49b1dc0
SHA1 10e22cf5e58d6448af6c10e8dff88941d9c30895
SHA512 78f04937bbde90503fed2b7274df742f763f4e99f50d6abf10e46c8bbcd258b59a0783d0c8aabb441488046f2e027cd5927bc6a5bf2529ec24f2c5845d6086ba
SSDEEP 24576:QAFs06+Omlf3NXEbTolsqjnhMgeiCl7G0nehbGZpbD:lFs060lVXucDmg27RnWGj
TLSH
T14965AF3F62AC00D5D07ED17D8A97C91AF6B1746307255ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.8MB
SHA256 d3f9e4252165a499f5cf551472ac2ac58c77e91e53456fbb790645f5b1d29119
MD5 a37b0f42fdc55ef9933bc7cfa6cb5116
SHA1 e2eae196b4724c224f5fa8cb1bf5d76b10c100f4
SHA512 8af066f14e7ac4d4bee64077cfe68fad481b1ade9593230ddeb916fdf378e0aaf6caaa54b9d1a85fac487e6a6d9cd50c1f2e53807ede895e651621d762a8558e
SSDEEP 24576:RJnJ5D3WegsqjnhMgeiCl7G0nehbGZpbD:RJnJ5DGecDmg27RnWGj
TLSH
T18B85E13DD2A810E8D4B7C2B4829A5746FE72383D2F2169C728B4D5357F12EE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 a18739f29efc72fc6222a0f63d45643003349ceee4db4b0317819f976d53fe29
MD5 f39cf5dc8de7d73e1cba1cfb0fa19e18
SHA1 01ad0e330499587399c3c439b1787f25b859a7ab
SHA512 150f6d4d346cf9f1461c19d5303c9a16dfe838439bca365cee6b80d94a6a4a6a32e4a69524147bee3e8371c68f490d5dae33422501747bd00d47180c5647de43
SSDEEP 24576:vEPghm6/7IIXdwcXrif7qQncjlP65i3VursqjnhMgeiCl7G0nehbGZpbD:Ig06DIKdwc+eQnSt65aVODmg27RnWGj
TLSH
T1BE955C16B7EA5294E8B3CAB1C962A1159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 b23e80114249da5b260c1adb2a538420e624ef5f216a593994fa77d425deac5e
MD5 f76a796e2c318ced21ad3206c108a647
SHA1 66335fb15dff78e95046bed048c59cb6574360a1
SHA512 ad5393191b661b9ab16af1affed1403e0597cd891ad2c94a2a8fd82d398a29294c522e850be5ee0269f8b8499a544d4de40501e6ba7d82a929ff3ff6718b5871
SSDEEP 12288:wEP3R2JXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:L2JsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16A75126E679C60DAD136907D8291C209D733F4716B2127EF26A2D57E8F739E80E3CA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 08eede074d20ea7a08f88e12ea89f65fb88479043e4a9654bd29883f8140c262
MD5 e0d4ae50d6ee1c47d7a1e085709f9885
SHA1 5fadcc49edd2b98f9eeb2bc704cbc06fdfa87e5d
SHA512 197ba89100b2e7e7249b1e5cd5c1429481b3f8c1de16eaa036ff01595f6ea345ec518992ad4f3f64ee5fcbeb6fba021fbaa807a114ac02e814241e6898a0a60e
SSDEEP 12288:wjkyDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wIyDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FE751219639C60C9E9760578C6B3D1589C36BC319F2042DF6591FA3EAF72BD48E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.5MB
SHA256 80ec1803e7b0caf5b2f36feab80afad203595d8e83e795a2cd723f9999c03f80
MD5 328c04e8d2f6afe7fed3c40967aab9ac
SHA1 e7107f5f080fe5b71ad54473bed29cec9586cf75
SHA512 7f25ddd80aafcd4f7f56cf664446661fa3f077af6d35496805dad462d96469d282bc0b73a6e6df5aada975d8e530f8d73509cebffc96bf21e7286584426074be
SSDEEP 12288:+ARXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dRsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15D65237E525C60CAE93645B4C3A5E11DA8133D36AB2014E739E3F8BDEBB24D44B39812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 daf73398b02bdbd8fab1894a4eeaf49c05ddc9ae1b70f7dd2cec93a44318de65
MD5 93b5474fc2449c423f59da4c9a4b7c3d
SHA1 64d9a575e6f596659b00748f50204da2e95c5f85
SHA512 ab60a1c5d25fb32eff23d549d5ccc7ee9651eb161804f0e0ec1e6eed32a2564ea58a1f467691cce29ce7b5965ab2df67f1573e9a5dd272f3364e9148e7201b44
SSDEEP 24576:uQ9MxZKdcz9dw3msqjnhMgeiCl7G0nehbGZpbD:uVKZqDmg27RnWGj
TLSH
T11C558C2DABE9058AE177D27595A250C3A633B4311B31D6CF2448D03D4D7BEE8AE78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.7MB
SHA256 56be826c90a5a64a0682d5fc99d6e7c70be13b8a7a4a0f7979705ce5b61ff05a
MD5 d83858d596956aceb73928a07549472f
SHA1 6ab51e236801b89af02e2818f703e177cca306c6
SHA512 d6b71f5ffe8a2f8afec08cdb36dc635342cd3de18c63ea5d3867cbf015a4f28f7ebcf810c1fcbcd01344c18d12e65336b0d4244ad129363a36bf38e77f787e02
SSDEEP 12288:2yoKo2YRple9pXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:2yoceApXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16685E01FB76D40E2E176813C8985C249E673B4305B6257CB6692C73D8F639E8BD38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 ba351b19b9f4aac127a104aeb24e2ae3366a95e433f5953b7e898734df0cafac
MD5 f969ad238fc8022802e4740091f0645c
SHA1 ba199e91cf97b0670d55028fa99254e4810781ec
SHA512 1ade645f5e74caf9ee91e16419c0ae77b4623eff51a1926b6f41a0cd7891731510baaf3d8b1535c435ad5a68295d3ac59ea878d766f70870c6cda534fef96389
SSDEEP 49152:vWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKrDmg27RnWGj:X0zuNIhD527BWG
TLSH
T129A57B3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 3da76146fc1d5326ffe70cc5d65467b66b20be3c6ee14e4acf82e7d5f881577f
MD5 1c4d6f4f45b6f57b242bcfe622d17b58
SHA1 5ef94efca45a236c244f834a2af69cc7cf715d94
SHA512 3cbd9ecfc734bb644e0e30e2afc9bafcb7bbabfec404a7b73c744bf4484cab96bfb2de9020637fda6f15d8350434f04087e31b7294fbbf6d2c0a53269d64dd61
SSDEEP 24576:q1QT7EcpfxR+N5AWAz3ooiYtjMqbJsqjnhMgeiCl7G0nehbGZpbD:XTDxR+N5YzTfjM0Dmg27RnWGj
TLSH
T14855B02EA7F815E9D17E85798B23C506FA727821033193CB42A0C17E1F6B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1684-278-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/1684-284-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/1684-440-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/1684-295-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/1812-583-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/1812-487-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/1948-423-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/1948-22-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/2012-540-0x0000000140000000-0x00000001401A0000-memory.dmp

Download

memory/2012-452-0x0000000140000000-0x00000001401A0000-memory.dmp

Download

memory/2088-98-0x0000000140000000-0x0000000140190000-memory.dmp

Download

memory/2088-78-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2088-100-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2100-527-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2136-439-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2136-254-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2136-286-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2136-260-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2288-483-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2288-582-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2288-585-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2404-541-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2732-491-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2732-490-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2732-584-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2732-497-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3280-602-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3280-502-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3280-503-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/3280-509-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/3704-604-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3704-538-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3768-471-0x0000000000810000-0x0000000000877000-memory.dmp

Download

memory/3768-476-0x0000000000810000-0x0000000000877000-memory.dmp

Download

memory/3768-578-0x0000000000400000-0x000000000057E000-memory.dmp

Download

memory/3768-470-0x0000000000400000-0x000000000057E000-memory.dmp

Download

memory/4004-449-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4004-447-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4052-528-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4084-530-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4088-1-0x0000000002450000-0x00000000024B7000-memory.dmp

Download

memory/4088-8-0x0000000002450000-0x00000000024B7000-memory.dmp

Download

memory/4088-4-0x0000000000400000-0x00000000006B9000-memory.dmp

Download

memory/4088-239-0x0000000000400000-0x00000000006B9000-memory.dmp

Download

memory/4092-513-0x0000000140000000-0x00000001401C9000-memory.dmp

Download

memory/4092-603-0x0000000140000000-0x00000001401C9000-memory.dmp

Download

memory/4212-539-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4212-542-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/4212-574-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/4212-558-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/4212-605-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4212-579-0x000000000CDC0000-0x000000000CDC8000-memory.dmp

Download

memory/4324-480-0x0000000140000000-0x000000014017C000-memory.dmp

Download

memory/4324-581-0x0000000140000000-0x000000014017C000-memory.dmp

Download

memory/4544-438-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4544-242-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4544-251-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4544-250-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4568-460-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/4568-576-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/4568-456-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/4568-466-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/4772-270-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4772-276-0x0000000140000000-0x00000001401BC000-memory.dmp

Download

memory/4772-274-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4772-264-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4988-590-0x000001D0C8B20000-0x000001D0C8B30000-memory.dmp

Download

memory/4988-600-0x000001D0C8B20000-0x000001D0C8B30000-memory.dmp

Download

memory/4988-599-0x000001D0C8B20000-0x000001D0C8B30000-memory.dmp

Download

memory/4988-598-0x000001D0C8B20000-0x000001D0C8B30000-memory.dmp

Download

memory/4988-597-0x000001D0C8B20000-0x000001D0C8B30000-memory.dmp

Download

memory/4988-596-0x000001D0C8B20000-0x000001D0C8B30000-memory.dmp

Download

memory/4988-595-0x000001D0C8B20000-0x000001D0C8B30000-memory.dmp

Download

memory/4988-594-0x000001D0C8B20000-0x000001D0C8B30000-memory.dmp

Download

memory/4988-593-0x000001D0C8B20000-0x000001D0C8B30000-memory.dmp

Download

memory/4988-592-0x000001D0C8B20000-0x000001D0C8B30000-memory.dmp

Download

memory/4988-589-0x000001D0C8B20000-0x000001D0C8B30000-memory.dmp

Download

memory/4988-586-0x000001D0C8B20000-0x000001D0C8B30000-memory.dmp

Download

memory/4988-601-0x000001D0C8B20000-0x000001D0C8B30000-memory.dmp

Download

memory/4988-591-0x000001D0C8B20000-0x000001D0C8B30000-memory.dmp

Download

memory/4988-588-0x000001D0C8B20000-0x000001D0C8B30000-memory.dmp

Download

memory/4988-587-0x000001D0C8B20000-0x000001D0C8B30000-memory.dmp

Download

memory/4988-609-0x000001D0C8B20000-0x000001D0C8B30000-memory.dmp

Download

memory/4988-608-0x000001D0C8B20000-0x000001D0C8B30000-memory.dmp

Download

memory/4988-623-0x000001D0C8B20000-0x000001D0C8B30000-memory.dmp

Download

memory/4988-622-0x000001D0C8B20000-0x000001D0C8B30000-memory.dmp

Download

memory/4988-621-0x000001D0C8B20000-0x000001D0C8B30000-memory.dmp

Download

memory/4988-620-0x000001D0C8B20000-0x000001D0C8B30000-memory.dmp

Download

memory/4988-619-0x000001D0C8B20000-0x000001D0C8B30000-memory.dmp

Download

memory/4988-618-0x000001D0C8B20000-0x000001D0C8B30000-memory.dmp

Download

memory/4988-617-0x000001D0C8B20000-0x000001D0C8B30000-memory.dmp

Download

memory/4988-616-0x000001D0C8B20000-0x000001D0C8B30000-memory.dmp

Download

memory/4988-615-0x000001D0C8B20000-0x000001D0C8B30000-memory.dmp

Download

memory/4988-614-0x000001D0C8B20000-0x000001D0C8B30000-memory.dmp

Download

memory/4988-613-0x000001D0C8B20000-0x000001D0C8B30000-memory.dmp

Download

memory/4988-612-0x000001D0C8B20000-0x000001D0C8B30000-memory.dmp

Download

memory/4988-611-0x000001D0C8B20000-0x000001D0C8B30000-memory.dmp

Download

memory/4988-610-0x000001D0C8B20000-0x000001D0C8B30000-memory.dmp

Download

memory/4988-624-0x000001D0C8B20000-0x000001D0C8B30000-memory.dmp

Download

memory/4988-625-0x000001D0C8B20000-0x000001D0C8B30000-memory.dmp

Download

memory/4988-626-0x000001D0C8B20000-0x000001D0C8B30000-memory.dmp

Download

memory/4988-629-0x000001D0C8B20000-0x000001D0C8B30000-memory.dmp

Download

memory/4988-628-0x000001D0C8B20000-0x000001D0C8B30000-memory.dmp

Download

memory/4988-627-0x000001D0C8B20000-0x000001D0C8B30000-memory.dmp

Download

memory/4988-632-0x000001D0C8B20000-0x000001D0C8B30000-memory.dmp

Download

memory/4988-633-0x000001D0C8B20000-0x000001D0C8B30000-memory.dmp

Download

memory/4988-631-0x000001D0C8B20000-0x000001D0C8B30000-memory.dmp

Download

memory/4988-630-0x000001D0C8B20000-0x000001D0C8B30000-memory.dmp

Download