219baf2b3d4884c7826883bd014447048b850663de5d7e45cf961b9d1eb5ea74

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 00:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
Size 2.7MB
Sample260723-are7vsed52
SHA256 219baf2b3d4884c7826883bd014447048b850663de5d7e45cf961b9d1eb5ea74
MD5 0d167cf294c43d78abaa0273efeec405
SHA1 763cb9aa8df3635d7221a6aeef534b7c0a90a62a
SHA512 143daed928fef1c2109322fdc6931abfca5529ded9631d5bd7ccb9ccc40a3fbac616ecae9d3a72cff9613db6df7da83d010143625cb10a0908469075dc4e3f75
SSDEEP 49152:R47PD0bQ3dMGRukYyejJQxhUhDmg27RnWGj:mbKQ3dMGLQjHD527BWG
TLSH
T1FBD56E40BADA8225F0F657F0AABF86D1823B7C116D70D19F7294115A0AB0B83DB76737
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5356	elevation_service.exe
804	elevation_service.exe
7052	maintenanceservice.exe
6812	OSE.EXE
4544	PerceptionSimulationService.exe
7064	perfhost.exe
2064	ReFsDedupSvc.exe
5088	SensorDataService.exe
3496	ssh-agent.exe
7084	AgentService.exe
800	SearchIndexer.exe

Loads dropped DLL 31 IoCs

pid	Process
6792	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
6792	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
6792	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
6792	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
6792	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
6792	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
6792	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
6792	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
6792	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
6792	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
6792	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
6792	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
6792	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
6792	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
6792	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
6792	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
6792	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
6792	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
6792	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
6792	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
6792	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
6792	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
6792	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
6792	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
6792	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
6792	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
6792	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
6792	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
6792	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
6792	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
6792	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Drops file in System32 directory 55 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c857d4cd957eebe4.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115171\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7116	6792	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009c86cf133b1add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000538ce4123b1add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fa3988543b1add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5356	elevation_service.exe
5356	elevation_service.exe
5356	elevation_service.exe
5356	elevation_service.exe
5356	elevation_service.exe
5356	elevation_service.exe
5356	elevation_service.exe
804	elevation_service.exe
804	elevation_service.exe
804	elevation_service.exe
804	elevation_service.exe
804	elevation_service.exe
804	elevation_service.exe
804	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6792	2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeAssignPrimaryTokenPrivilege	7084	AgentService.exe
Token: SeBackupPrivilege	2064	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2064	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2064	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2064	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2064	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2064	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2064	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2064	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2064	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2064	ReFsDedupSvc.exe
Token: SeTakeOwnershipPrivilege	5356	elevation_service.exe
Token: 33	800	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	800	SearchIndexer.exe
Token: SeDebugPrivilege	5356	elevation_service.exe
Token: SeDebugPrivilege	804	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 4348	800	SearchIndexer.exe	104
PID 800 wrote to memory of 2384	800	SearchIndexer.exe	105
PID 800 wrote to memory of 4328	800	SearchIndexer.exe	106
PID 800 wrote to memory of 6732	800	SearchIndexer.exe	107
PID 800 wrote to memory of 7020	800	SearchIndexer.exe	109
PID 800 wrote to memory of 7012	800	SearchIndexer.exe	110
PID 800 wrote to memory of 592	800	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_0d167cf294c43d78abaa0273efeec405_amadey_elex_luca-stealer_lynx_njrat.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:6792
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6792 -s 812
  2⤵
  - Program crash
  PID:7116

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5356

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:804

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:7052

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6812

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4544

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:7064

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2064

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 6792 -ip 6792
1⤵
PID:4532

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3496

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:7084

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:800
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4348
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2384
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4328
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6732
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:7020
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:7012
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 925cb113ade87651f1dc40df5010b26c3676fc2da561d3c5f5bf2edc64a8f250
MD5 be430560dde9b395b3586f855b498657
SHA1 a20ddc112a0557b69d2c5aeb2f646cd80b523390
SHA512 f745b13fccc0947676e130be58e2153d912838e59718cc055e9535663f7be4fca02ee594ef1b9de8473e2f34913955c67cf3c700d4539dff27397e1c93a428f7
SSDEEP 49152:Cb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnSDmg27RnWGj:k3q6HjBhD527BWG
TLSH
T16CD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 29a7e52da17ccbbd4a6e73f1ec537fb3d2dd9f6e5cd08461aaaf929be500d9c4
MD5 1f557b2820c5612c59f8387e135b8c42
SHA1 90945aea97a1ff46c125b4ec19a1439980584161
SHA512 38d2326cb21cd0be2f320ebbf518ec32f30241beb679d81cdb82826603819befb874abce58e6704510988521954cd4d6491c1e24549ad3017c8c81563b134c5e
SSDEEP 24576:UXYfDtczAxsqjnhMgeiCl7G0nehbGZpbD:Ttc8Dmg27RnWGj
TLSH
T16485F129A3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 ad3b7d6cd2e1edfdc8c8e27943634f30961193ad5b204637b0dcff9287cc31de
MD5 ce28b1991571e95da0ce6e3b9ab872ed
SHA1 0406b015ae9d9898ba8abb0ddba6faa9a2b26ced
SHA512 5afa52216000f65bcea87effb959bb7a9ae760f2effaac59fa085e2311581361bf9d88fe2e019bad8a8ab904de5f82334d2957b8f8f3399b500377915d89d503
SSDEEP 24576:h0Le5ji0hmx3rMssqjnhMgeiCl7G0nehbGZpbD:hPji0AZ5Dmg27RnWGj
TLSH
T1F9A59E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 57972c5e09d5bdd61ee9b203bdf317ca5f00e4dfd15d87449f8fa25d9b053978
MD5 bd5133bc6233c59481685cb1fb679615
SHA1 3978359bdd3d21ceb17c998c054712c8f51a31d5
SHA512 fc5d18fd8955ec1633b0f95bed0f3efbe17404224bc9e2a5ec7a1021e787fa65e7c1dff04d0003af67f5935336cfccd965b076966a1368f5a0d7882b53ce4170
SSDEEP 24576:Ha7/ezSC6vUyD/aqgrvWE6q8wyuasqjnhMgeiCl7G0nehbGZpbD:K/ezSC6vUzPvxHjylDmg27RnWGj
TLSH
T104755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 64beceeb9469939c234be061db8756d31ab69765a815665fee075f15828e0908
MD5 19b553253aa8ec0b704751f6aff52dfc
SHA1 47e0fa5d9dfb908cfbf0d268f09eb5fcf8a2f610
SHA512 2a2c6ec2247681bb4b189a7afad0a9981dca98e4cee66d7a1bb523ccbedcbc0b7b0acd1b21990d7906ac2a9b39ec53988721b4b9b0a0c854cdee5692eacdedf4
SSDEEP 24576:LVbqPb88hv/l+6XsqjnhMgeiCl7G0nehbGZpbD:LVO88hXl+0Dmg27RnWGj
TLSH
T1EA559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 ce1c6c4d31b74770eff31d73a9eb2406d4bb6d45cec08211ffe6257b18b15009
MD5 1e619c60966af5f948eb0beb89588395
SHA1 e7d4f364c93b01acdc4f0a050c98f4b2c2f17f59
SHA512 362f6e839608da52c1ae39f788493e671f0b32671598587419d844e8f10d5ec34f56d38c25f4e76781d8c65eb0cac20892a5ecad54a35a5f28915ab53aefc706
SSDEEP 12288:FXAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FXAsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E16523BF865C50CAEB7608B5C3E9F51EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 af1ccb528cbfd1bc6b97ca91b25e76af3bc0bc944d25057b81a470f562b47a6c
MD5 ee465d8944f7ea641a7fe907ec686c26
SHA1 06280c07db3238590d4da8405c05ebe4d2d7febf
SHA512 fbf1377fbec4139d52e84fc61856ef5db15495a95ad53edce7768d49a0581155b05691b6254945af0dd016669a4e86ed36c2cbb22d13fd0edc19209329879f3b
SSDEEP 12288:SeBNUbTVO86U/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:SJIU/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T19E85CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d51cfd5c686510f5305344d43436ee85aa73d1afb5c6bb9ec9f5e5cb2571eb6c
MD5 00a4eae71945090e79c49664dc534884
SHA1 f869dfd6def4a13a67179bdb2b01995e1379c8d2
SHA512 1523578b439b8fa5c877b21b48be225a319298a9c0f48a26a2ff333a056e7862d54939699dcb23db5f3b82455e1144eaf9552c125ae62ac2f6c07e7f3e3f58ad
SSDEEP 49152:EQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THy:EQvGAdlCEL8c/yRNw5CeD527BWG
TLSH
T1C0266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 623cc4f785e2cb8ed95ea4e8bbfd14521d037534b49b98fcd99901e4743d1690
MD5 82ce82b0f950e7b1a783b0a501aa01d2
SHA1 4177ff6ad9a61c435eefdf52c1721613677f0f15
SHA512 1993f745d2d6368c4a163628a203d8582c801441341b3e9db7b4d36f9f867cadaff2e55a5e980e5563824bce1991147939b091c80ea1c193426654d164a49b1e
SSDEEP 12288:8AwSfxL/2Dc3RDLLmt0LDQewsAj1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:hUewsAj1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T15495E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 9830f4d5c8666c3da7639c5550e8eaa67844bcf1275e3a29bd1b7685c801cbc6
MD5 f5a52f64f2188c052e76e0db30be757d
SHA1 3f996fb654d76f8cf91e4dd9a8c3a82a632a59b7
SHA512 2b678f8d2b7130412b0ac6681e7184d9bcf582b652e61b6795c04959c4668688a2a8c0c41e54a6d2d7876cd754f4a90998abb75898d7207f5d6443215b377823
SSDEEP 196608:KUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHxVQBWG:KUEtQevvqc2W1cpV2EI328B
TLSH
T1FE474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b6aaff04698abadb4c7640c9b6e57835e5917fe31181a5c6c92144126f11af76
MD5 81d483070f352105b31217edad6c155c
SHA1 ce2cff39939cb64e31962f2bca2bc9693cd69c4c
SHA512 440d15b9fb101549a7e99445e2af5df76f904b0e400aceee10b1cc5007408c3c54b4af88907ecf89f90a484983ec339042023f87496a920679820a14ff1e14fe
SSDEEP 49152:yCbRquA/m2yL5zQfFiV+XenmE3/zJDmg27RnWGj:XoqtVjnmKD527BWG
TLSH
T16BD58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 11fcc646e3f71346f5cc6113824c8c789a1822104954b78aaef6184bf364ba67
MD5 0d03c7ff1db33f4183582f40c833645b
SHA1 4ffab60567327f22b85b22b933189571d32d5042
SHA512 10683b704c0ef0435c402ecaf6a0a8bfebd71ead878527f4c7ffedb682d7d95a0329fc3dd92f8dad22b537ae51e49eaa64c01bc0f0e5eba87d8e0a64a97d10dd
SSDEEP 24576:RAhGLJIFoiwtA5l7S53msqjnhMgeiCl7G0nehbGZpbD:RAMyFoiq56Dmg27RnWGj
TLSH
T1E6359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 374fcee5cefce7d02d0a2a36e3e448b58241e72de3969d5a51de75aee1441236
MD5 12b87fb2eeb00aaedc3d90aedf55079b
SHA1 75ba87f7ad82fa11919df8b099e56860e90f5732
SHA512 75af0e9c2ca2fafca94fff6da001c8ac1fe3af966050e3d0e80008a8a383700e8a14f252248fe439b5a56fc18b8822e784cfbfbb5f9bba3b338a0530c418941b
SSDEEP 12288:xmw5HEjsChNzBFgl0WDm+CQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:swuSOWLsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15785F14A76A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 b6ec11bf499685e9de2593297d3f72b7ddc4644ce8ac8c07afbc75e8e25acca1
MD5 b831c25db5827feb9e58f3ebee7f4ce6
SHA1 d6e5cb00c55c36fd9c8c31bd023c712d068d6200
SHA512 8fb279b9d70f2aebbbe3b9a9295d9557d1d932530da8fedb71533e8690ff9d53e228ac27bc4a12a3b1c881c3a9d00c89408c9a40fe021ca9dbd1c033612e505e
SSDEEP 12288:izZ1IylXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:eZu0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T16B7512AA239820FAE163417CC5E5D609E7337C62673003CF16665AAA6F739D44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a4790f4d7efb7d080efb40940faee883ea9782debef5cb44f9011f1b95ff70fc
MD5 5324c25d4948cf98e49de36a8b58d62d
SHA1 0f2ab845110d727370446c087d40c62f0401effa
SHA512 69e59f2af4931103fca135aec80962d9160a16841252f76f219ef485e38cfce09fe4ee8aceb735d64a6474602b3bef7829d17b5297f12fc45ec70dae2f4382a3
SSDEEP 49152:/B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glVDmg27RnWGj:Bu6JmVxd2dVD527BWG
TLSH
T114D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 faeaeb1deb68a68fbf7082b88c60c152119facd1deecbd6404556b7a0dc5188a
MD5 b5226317d286334e2f9e351860612fc6
SHA1 2218e920ba3d5c1cd7d2a1bff0b36844caeb2209
SHA512 094a91fb527f85f0007a95973900736f7ef823f77b808305a87adca8c2d81efcaea8aaa2180f761c7c7364fc4860eb75a8f4964d77850da6c130c62eb81e28f7
SSDEEP 24576:XfwvTk9RX6wkyAIisqjnhMgeiCl7G0nehbGZpbD:iMnYImDmg27RnWGj
TLSH
T1DA95D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 1040b6c7dd56acc257e36458f6681d6c18b4fe4124c417d8a2d14059654d653a
MD5 e4956ca34c4759ff1ea7b28d74ef7639
SHA1 baebff934bf4d4f4408a1b8fae7003ab97129603
SHA512 7d2376e3b556fdad2ee335733a9fa1d8215ded6468cd9a39a8b538883377f431ba23cf88aafb87513ff61b4d43bcb75b954dd60d4ecb5c0cc44971884e8dc7bb
SSDEEP 49152:JYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK03Dmg27RnWGj:xySzPPD527BWG
TLSH
T155066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 25280e6dcde20a936f66aeb440b59e08de2de08ff4b283d99c99dafd644285c7
MD5 1f67039dfd971a17c64f355271389539
SHA1 3aaebc7ba17cebf82db981185f687d3bab12c4b1
SHA512 41849166f376713121e8b50d1fb08ca6eb40db4dd3a1ec57b31d66363a24c41317eaaf9314e426ede7ce919e3da0f7fc6a531a974bdfbe2d41ecf5e1f3240844
SSDEEP 24576:R47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYZsqjnhMgeiCl7G0nehbGZpbD:R47JUQj1irIhCnDHUPfF/nDmg27RnWGj
TLSH
T16665AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntelGFX.log

Path C:\ProgramData\Intel\Logs\IntelGFX.log
Size 832B
SHA256 bb0cc0d3dda3ef8c54f38a168679588a4ce05164b5f5f64c23a0ab500bdfb3ba
MD5 5587b8ce4765b570b7f14134747d72a0
SHA1 b4ed883ec47a51c2874ddd04e8b7442cc198b81c
SHA512 79f732f0cacf3e9dd544bf84653fde8f30fdaf6f27c5cc8b77439f54d7cf5d46c96a2f2aa6eacaec178fb61b61da5fb9ec16c1a10d1719537cbc52517c460f91
TLSH
T15A01282A67FE1101F2B7BB1DA9F742216E757CE95C35A60C01C4520C0DF2D00EDA576B
MD5 SHA1 SHA512 TLSH

Submit Download

IntelGFX.log

Path C:\ProgramData\Intel\Logs\IntelGFX.log
Size 6KB
SHA256 c5062af05fd33b0bdef69fdc3d260d773f277c60a670acb03868fbdbe6be5f51
MD5 055610e9ce6cf771f79fd5beff660d61
SHA1 64f57d391a3f0a6e68a99354dc58bc9d369317c2
SHA512 ada30e38da451578eae53f65672fdb9f5022324b6729e4b4cc68a49020ad0fa537770599d919103fa682cc27705ccff2e02dd00e77513ffeddb89008661f72e8
SSDEEP 96:diiRDRjiO5A1L2NQpJw/LnvUUZzlbSTTbHjALkb3AqcYM9Trjef2DzsL/bR4DZr9:dR1Vi0SlnSn+nnnXe
TLSH
T1A7D15D917AEE524DF7FB3B8E26F64137A739FC329937950F0194526808A78148E20F76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 36257596dc26b70072f89091963fc32fb76bea98c1b0485f68dbfe7f46408de8
MD5 1b6bb83a9e51ebffa03d287dcabc2d1a
SHA1 c6aab6755e5f1f5c073bf6ff783b621ceacfcfc8
SHA512 e8d1bdf781679c566cd4a8db8818bddd5ed537ec688c6fbb8c6de19ac70b5386a05311fb0185a44fde7967b8cf09ceb4ecd35d2b23bc4e6b1d67bfc09e17631e
SSDEEP 12288:NbhBtPU3f8q4b+eKvE3gSjhd4TcFQ3+axtG5Fh:Nl7PUPNeU034TcFg+axCF
TLSH
T1DA352951766AD74FC5A940321E32C1CCAB707D41EE45AB0373C88B3FD576668BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 052e43c52136c86f281244dc12f36d0fe26a3318c6c088e5bd0a49de6b12a736
MD5 5d275811670a38f0ead5d2fec8183a44
SHA1 f8e71f40baebe7d10eb6bcd2d9e682bee6ee2020
SHA512 8d60df0a69464d9aac09c77bbbde5298aab00e1efe8d97c7672c14659815e0199bf569d8b8d13fb1eba1438bc401ef9fa7507d70f9201c324ec69063091fb21d
SSDEEP 6144:4Zg5o8ptdJ81vJx8Ycns/POI1OJDHwDPptMxOPptMx9nZhsa3BV1BKGwQHQ7OGHF:4a9XivXoJDw5GHOOE
TLSH
T11C75F981A537A38FD0FA6032072A5B4CAB64EC46B7056F2273C8453ED866725B4FD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\ar-SA\igxpin.exe.mui
Size 57KB
SHA256 6a15b7201fb7fd9de2084ac58716a4987d3cacf24bd0cb5dba610d8ef5d811d5
MD5 a51b2d26f4a22478fb702a00974fc5ba
SHA1 8b4edc19629bcad45eb15da76bfbb5a9cf7c9525
SHA512 cb2261cacafb5b8124638ded7e40859cfe49f5cd5dcf0f29b3e2ee8532fd3f5cf231fd7e94b9344921e3eb2388c3cce9da7cc85aba0a4f928305f52b0d098496
SSDEEP 384:tsKkHJJYN0atlRc4KLPiDr2zsKkHJJYN0atlRc4KLPiDr29:CBUZtDc4KriDr2YBUZtDc4KriDr29
TLSH
T11943EC50AD8CC139F0A3F2B4C7E7C793E315A09658C9123B5AB84A2746D4A709F2F5F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\bg-BG\igxpin.exe.mui
Size 68KB
SHA256 034b33f4ada1df6dd91143710bab082e4c1c4025bb8e3e7a73ec91251454fe93
MD5 6d0bcb144e34e9ee9aab3687b5fcb373
SHA1 c1c5d2bcc102d4d4a2d137e4fd214b76ea4f2118
SHA512 18767f4f30015cd2718712576b0912a96ce3b8cf0d657227c2b73aec3792e77053c8d08fbf78d096cdc3a2fd67a41668abad9063ae42a9a1f27eb1307ae39799
SSDEEP 384:C3sxkHJJYt0SbtJe5w5z8WorQnS3sxkHJJYt0SbtJe5w5z8WorQnX:isGUdnnor/sGUdnnorE
TLSH
T1FC63990FF9BD9124F5A4E2710FE282E772B6B750332046C7968F3D66A14CA317B29197
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\cs-CZ\igxpin.exe.mui
Size 64KB
SHA256 3abac0bf45c86666665dd607792f25368db8b1d967ddda7f2257e8ef39267224
MD5 0ee65da223db059ce66d142926e646b8
SHA1 ef6a7b56f3fde4331f4c3c45291012e7cb364d72
SHA512 e1fe2d79ae9e95d936193b1ea6d1f3c0158ccc76356d825f0c76ba07ef67d80bd756cb98d375e74c7da1146c08642c98444620f3952b8dc5408b8ed61f26c135
SSDEEP 384:9IbUkHJJYt0VonQJ6zSaWxqW8ymAaR1grNO6xIbUkHJJYt0VonQJ6zSaWxqW8ymg:GbfUa7EWAE5rwbfUa7EWAE5rB
TLSH
T1AE538701B6FD4165F0F77FB56AF142B38A7BBC922931C20F5684028A59A0E80EDB5773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\da-DK\igxpin.exe.mui
Size 65KB
SHA256 4ff2872d28e81801e49502bbe60105b2d35cf72f01af06bb46154c0c9debb284
MD5 9fc36b594bdaaeace8e0396b0e7109fa
SHA1 6b18485c584cba645ca69088901be343f55d1a25
SHA512 ff85f4220db98c3422769b85ea071e1d06068bd9b2b793c565a688f8a7062b05b5a98f24d04a9d53bb1d92b5c6cc64507a80c01eab108a9adab9a21e268c0fa9
SSDEEP 384:fTekHJJYt0wvnQBaPFFPEOys6r61O4TekHJJYt0wvnQBaPFFPEOys6r61Om:LdUH2oFwrOOQdUH2oFwrOOm
TLSH
T1B7539C50B7ED4129F0F37B70BEF642929A66BCD16938C61F2344109E49B1E88DAB4737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\de-DE\igxpin.exe.mui
Size 69KB
SHA256 7f262b0e5c14448c5bb846d0092d4e4cfd0685049b4c20e216842b03dc237f11
MD5 bb40f66292b001e9e22e23ab05b8fd03
SHA1 8681d9622dd41361323010901443f7b1e99d515b
SHA512 14b7fbf2b39041f46103ae20e82904686f2d1311aa66ec84dc7eb8ef49d118a9709cda432ce961ccedb29f72ba1b16a16b484991f6aeb9064acfe7f11a0d718e
SSDEEP 768:61rUU+I/BGuOWW1rnL/np41rUU+I/BGuOWW1rnL/npZ:6JUU//BGuOWWpLqJUU//BGuOWWpLX
TLSH
T1A0635510A7E98628F0F27BB46FF583969E72BCE16931DA1F2354109E58B0F04DA75732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license.txt

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\de-DE\license.txt
Size 276B
SHA256 be0c45b4c982bc6ef423248eb1e96db9e1f2749cabda7f30ca2d18807cc67b0c
MD5 5e4c8e5d23dbcfb3903e8693a7c92f77
SHA1 01789416dd92b97f9763a7de2c5ab87aa1c64672
SHA512 1f839320f378a9a54590dd62357beef4fbb2a7f039f8532919233ab036776b47d54efa8656213e099cf73b6c9bcb4ded74b4d0575db643959aeb0e08d22cc07d
TLSH
T1D6D0922152C94600F7F23BA13CB142C54DA67852FC72D25D5182000A4C61EA0CC60732
MD5 SHA1 SHA512 TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\el-GR\igxpin.exe.mui
Size 73KB
SHA256 9ee24d963d449dad9b54fd03b36d7218f80fc837cc6b4519ebd66cbe6526ced9
MD5 e0e0146676ef256d8f7a3b10901ea462
SHA1 a4c3e728a43c55a59c5be90956a58bd344e34242
SHA512 b4d4f075310681c9747737664cac1eead37c722c31d59b05d664acc2983a1a7193c144cfaf733e60d7948aef924101e4d17a017cd391ddf0a9eca32f164b3354
SSDEEP 384:ylkkkHJJYt0XkxlF/Ikwyb1aXpeyC2SXEz/rhjPlkkkHJJYt0XkxlF/Ikwyb1aXS:gqUrwmOS0z/rhj9qUrwmOS0z/rhjE
TLSH
T19A73578C59AF5221E9B5A9F256B3C1A78B6FF5C21020DE3B73F4304AD95CC158DC392A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\en-US\igxpin.exe.mui
Size 40KB
SHA256 4407d78ece9c7f840b5593401a3314d379e49dee9541a6d20bf7158c5fab4a8e
MD5 199921ec28eadbeefd1120da3138a842
SHA1 f87897e9879ae61dc34b0c90a46872f61ffe4c11
SHA512 3e375d5f39531038b27dfdf82cdeab007a11c3452321fac55057020119b0b6b21cd4f4cb8b93d9b98db52e7ce881858eea2f553b9efb3bfdb366279c85e6f36e
SSDEEP 384:O0n6kRCBRotVbQ7Li+R6zUXVUP8IKGAYvc6rv0n6kRCBRotVbQ7Li+R6zUXVUP89:d6rUIa+jF9G3rM6rUIa+jF9G3rQ
TLSH
T1F9031240B7FD8129F1F6BBB16BF582A68A3ABC91A834C71F1244005E96B1E44DE75733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\es-ES\igxpin.exe.mui
Size 70KB
SHA256 882a19d831527e3b988e8919882f5c18ad0f20c321d4e5d1cfa9931a43394451
MD5 87147e2cf3ade40d9e7f2ce90f4188ea
SHA1 9db79b70d472b2262eca8f9a8f405f1d97749d28
SHA512 59e1ddaa56ac401bf7119b72737a5124ad1b0911c74356c4e37bf5e1f482cab8da5e0a403d83c9cfb9996e809b7dae3cda75f14b9f5635014360983ec9d18b3f
SSDEEP 384:FwHAkHJJYt0MH2mlhRYRPTTJIrUPQwHAkHJJYt0MH2mlhRYRPTTJIrUP0:FMjUjDYPyrUPQMjUjDYPyrUP0
TLSH
T133631100ABFD5266F0F37F74AAF646A68E7ABC919834850F9358115E09B0E44DE74B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\fi-FI\igxpin.exe.mui
Size 62KB
SHA256 9d7310ec056244d2c1645383ab0a51abdc0cbc62aa5f97ee5fae23090c26ace1
MD5 be8fcf16bf3b9909c11644bf5d89552c
SHA1 cec1b5109b9a5ab4cfecab8f6ff2e5e2c9c71d62
SHA512 1cf2f49f13f5459d01e2acdbc5bc1d0d9f4e88e2aee4f0c9a1b07f5c061d269f5eb50abd6dab9472ec370265e374dad1eef422b799a51992a2afdf1d00babdf6
SSDEEP 768:ymU9ELFOy52vGfPrVtumU9ELFOy52vGfPrVtT:ymU9MkmU9Mh
TLSH
T105535984A6FDC124F1F7AF705BF582528A33BDD22CB5D61F1B48104E9AA0A80E975737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\fr-FR\igxpin.exe.mui
Size 73KB
SHA256 4da7821a89db874834ef4ec2b8adba85525656bc98911ec0437db91f17eaf458
MD5 fdb18982f1ee46c3f77aba3dc27e062b
SHA1 f77efe4f6c2501f108a7a3b5a3437325b7b9a798
SHA512 d466427ed83ddfa86c62d79b5735475b0484834306389e2bfc566b1cfd20c0fb0fc2af8ec6ce4c2a4ad8c6d12a5b7f3329d0ee7dd47e7cd2b72ae6bd16504f3b
SSDEEP 384:khlkHJJYt0dJHoLwvu4WNKq8HW+NL4isDDg6ZF70pDrWipVhlkHJJYt0dJHoLwvC:mSU6NaKX4TA7rTSU6NaKX4TA7rg
TLSH
T1F0732354A3E99221F2F37F70AAF941928E3BBC9A9C30C62E1254158E59B0F14DDB4733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\he-IL\igxpin.exe.mui
Size 54KB
SHA256 ef688d6b94819f18e4c06a634ac9a09e9843adb83b87f2787bd6760de196d644
MD5 2dcc6174a5d9211e70c9a2313d4dbb80
SHA1 4e16c609f27112671a15001d8728d825c03138c6
SHA512 08d1e03082f0757522c35de14f1996a486ddaaedaebc14375789fdf46637f43aaf50a77164b2753c5e94c30571bdcea7600ac750d5b75cc6728935995ebacc4b
SSDEEP 384:gQkykHJJYN0ulfz4eeDixrqTHYQkykHJJYN0ulfz4eeDixrqTH/:rwUplfU2xrezwUplfU2xre/
TLSH
T14A43FD806686C1F9E8B4FF7397AB8AAFC751F54410683717658C15926AECB80CB2D73C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\hr-HR\igxpin.exe.mui
Size 67KB
SHA256 90e2772aef21e8d72dc87f19b90bd0e58e2db8566982734a4307274ca50ad78e
MD5 da91d909d1ab4900e0413cde6055612d
SHA1 6957addda1e87fe340c73dda2a92048314915458
SHA512 5f181e6a387a023046ee9bd798f8f4cc842e45c24aa3284c3ad1ffad9d5a8fd3bdcf912d7a1baeed30a9916df5b890af38e056b76c581a18f0d1e7096f76f220
SSDEEP 384:5vkkHJJYt0pM1CrzfyjB/qh+kBBDrxkvkkHJJYt0pM1CrzfyjB/qh+kBBDrxI:NPUDF87rxYPUDF87rxI
TLSH
T1EB635C41B7F95269F4F37B756BF647A28A3BBCB17930821F1184118A4E70A80DAB5333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\hu-HU\igxpin.exe.mui
Size 67KB
SHA256 f9e9495e34ca2147cea5f80a679cc73a9939b2dd06f62ccbd77d36b6c4431551
MD5 bfb17cbf3a7d0671a3b5b9599b8d6c53
SHA1 bad1bdc568094da707a94a3cfedb15732e82f163
SHA512 b1d8ad318484d187467967acd4ef552c540ac748e2177d658f52bf88cc9d0ea522d104217c09da252b614f6b02098aa516110f7f3eed0d5f12dea4a7548936cd
SSDEEP 768:rSlUBMJUx5RUlk2oPj6Gu5nW39rPGn6lISlUBMJUx5RUlk2oPj6Gu5nW39rPGn6A:rgUWUuJxn66gUWUuJxn6A
TLSH
T17C637B00B2ED5119F0F39F723FF182D34A3AF8A1793DD21F9688528E59A1A44DD74726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\it-IT\igxpin.exe.mui
Size 69KB
SHA256 9264e4babc1af50b270c6cbd502c4696990bfdafe2a31c04b41a042bc83b5cb2
MD5 cad7efab3d9767ec92add388c2661c97
SHA1 e5cf1c174698b8459d55673a692313cd2da993ac
SHA512 22e99c8e9a37138d5974855bb3d5e0b2a4cf2639350ec117f50a6aa68b7a8180c1a8a2803f31b22ade4c82b887ca36478db347cd8086283cb873f974f0f95bf5
SSDEEP 384:NJD5XukHJJYt0blHA9A5Snrj+QaM2zeJrNJD5XukHJJYt0blHA9A5Snrj+QaM2z6:HD5dUclHbgGQZtrHD5dUclHbgGQZtrn
TLSH
T1EA632110A7FD5225F1F37B74BEB986968E3ABD926834C62F4284004E59B0E58DDB1733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\ja-JP\igxpin.exe.mui
Size 47KB
SHA256 2f04100c60a5a9d48940ee404e57332b7bc03db34828ea86501336ff2cb9b88d
MD5 f05d85bb31598913616880a1ade4f70b
SHA1 ea636c37c997d98505174e4f1cf885468d588144
SHA512 940051ddd778d3a455ef1dc923dda2c9e8735e6a7c9dc924bd1ddb2f7fd75000641943fa74269bafab44891cdfd6a8d31703e40d9d5c56e8d03fda337f7a5ad3
SSDEEP 384:7c6peVMox0L7IC3of4+3Goc6peVMox0L7IC3of4+3Ge:wRZw7LoA+3GfRZw7LoA+3Ge
TLSH
T197234548BAC6862BF0B4E1F447E2E2D3D715F464209209A76BC8154792D4E4E9F1F37E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\ko-KR\igxpin.exe.mui
Size 45KB
SHA256 4036a4bf81f1c3ddd3fd2bc05551b20157b329eef1e1213c2d3b3334209dc133
MD5 65bfcf2e236165bddc02334c13bdfd36
SHA1 f3c5d342fae24aa00d2da4a52ba95b26ec2a3aad
SHA512 44a720a34080915e2c0a14faf8e7da1131d7aa4735f6679d6df61caa02960283ae8fd2eaa63c6dc3a989c57b80ee8ebea527617b075db5e7c708fbf272dd50e6
SSDEEP 384:Qn7lWVNkx0bajcYrPQxbKITU6rrSn7lWVNkx0bajcYrPQxbKITU6rrx:804y3rW04y3rd
TLSH
T14E233118A9EED037E0A0F5BA47E3C3D7D72670926043061BF7886147A6D4F489F792B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\nb-NO\igxpin.exe.mui
Size 64KB
SHA256 c58f23795bf38641d1ffeadd3b212b85c371b38a9c8a7512442f164698b8d531
MD5 c1fa767f94bde7a32a43849f45e0d1f1
SHA1 3d03bb0829707aec52b99d96315806556fdeb61f
SHA512 54b6a59956843be44d54c712452ddc717a8d8d5262c31a6ae013e34749890058de591b6ddf1656adf24bcc3ff998d6d0300ebed1b856cb6e8de6dd80729f8edb
SSDEEP 384:n6hxBRhxBRhxm2yCSiyCSiyCSiyCSiHXn3HXn3HXn3WjkHJJYt0kArNZRh9vfrC1:JbMUDArNZ39frC+FbMUDArNZ39frC+L
TLSH
T1CF537B50A7EA8129F0F37F707FF982928A66BCE16D34C61F1344104E49B1A98DAB1737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\nl-NL\igxpin.exe.mui
Size 70KB
SHA256 5e9715be24d30c5279b4115809525312ad79855f18a6979c1b7a506ab2b3ced6
MD5 7149410345e0fd05aa2fd38c001a995b
SHA1 f329e592f93ae1f4557b023db1cbcba510f798e8
SHA512 8e8262538a82eb601304ba3866c479f1b38e4f04e5755403ef57763efe0f7495015e9d1ac1fdc834c6690ab756c1bd814218d76997bb70c330304e4c1684eb5f
SSDEEP 384:b2WWkHJJYt0tP7qYuxb0s9/CX6DPc2Jqr62WWkHJJYt0tP7qYuxb0s9/CX6DPc2f:qWlUCM91/CcOrbWlUCM91/CcOrg
TLSH
T107632301A7FD8128F0F36B742FF582A29F76BCD56971C62E1344169E49B0A80DAB5733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\pl-PL\igxpin.exe.mui
Size 68KB
SHA256 5f4ee06ec998aed810fc5bc96c53a5e181d329ba9f87c8af2969b8033dd60a1d
MD5 e1ec46583dd2db9e7933c192d4be236f
SHA1 326a4d5de247c77b0bde22fd968cbf92104e2eed
SHA512 9e2e8105ca064476858ae01587063d0c55c977b62c90ce69b9e10c7d98af45db4f3d7b94f4f7698c6451526027ac2b2ecf47b9fabd80267ff11ae75853d0d836
SSDEEP 768:EbmUWOxpr7PfoErLfKbmUWOxpr7PfoErLf9:ECUW0KCUW09
TLSH
T178638800B6F94165F0F3AFB46BF662D28F7BBC227930825F6684014A46A0E84ED75733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\pt-BR\igxpin.exe.mui
Size 67KB
SHA256 6db4955e8a7bfe8619771ce73f9b16f16c4df4ae61283491ebda49e712d75339
MD5 7eccd182eb1f0ad058f9b69d60faea79
SHA1 b7620c631f27b2a85f81917b5b52b49d9574d597
SHA512 bfda7a0ea08bcba6d75f02dc95e87aa285ea003d8768b82303fbe49f362374c812dac603f1872333e2993ac026e074cb6abd517e9a80f03404a50493b0404350
SSDEEP 384:PDCkHJJYt0LZj/FYVWyCClhtkRrtiDCkHJJYt0LZj/FYVWyCClhtkRrt8:LpU9178rwpU9178ru
TLSH
T19D634340A7FD4229F4F37F766AB556A2CA37BC926C38860E1254015A5EB0F40DE79733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\pt-PT\igxpin.exe.mui
Size 69KB
SHA256 f8f78750ffa05e18f3cce74c5d28c88819ea526e115582c62e4137d45e6d8aa2
MD5 ebf1ca17a35f8218a44f553c0f6c94bd
SHA1 86fd713fc727caab2f92688119771cecbb0ee7c8
SHA512 d51c5dfe2e330c0da13561721f007a285e174f98dd1ad1d131aabce6f6b16446d08e1588b34905b06a91badfde0a4414401de8d1b0e403b040f87db229f97d83
SSDEEP 384:unpkHJJYt0IhpTpEwqKMN2MpOSLRrAXConpkHJJYt0IhpTpEwqKMN2MpOSLRrAXC:uOUXTVcYsrlUOUXTVcYsrlh
TLSH
T18C635440A3FD5228F5F77F765AB95AA68E37BC919C39860E0254119A5DB4F80CE38333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\ro-RO\igxpin.exe.mui
Size 69KB
SHA256 a784b83f390aa8cc45371b308454c0abb43cf0f0505d01c80a9fe7280cf60093
MD5 4fb31bc00af82481c8d2012e803f9969
SHA1 a3d41214bd92bded63917f85ede6347eeb3a2bef
SHA512 01cd3ea09fe41730d333cd19b191181a266ad1ccfbeacabe59e75addc4cfd902bd9a60562f1054de96a2c0c09e77e30aa4cd60a0e1f272028b9f320445b6ac9c
SSDEEP 768:rteUGrTtZK9nLrr03teUGrTtZK9nLrr0j:rteUCLK9LMteUCLK9LC
TLSH
T150637650A3E90225F2F37B746FB546969E3BBE63A831C60F1648008E5BB1F849D65733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\ru-RU\igxpin.exe.mui
Size 63KB
SHA256 d0dd71ec2a342c0f94d15d10d78cc0be37e09bafda420274162155a7e4e6c2fa
MD5 bebcdc70c4725d4dfef27e0943c4e323
SHA1 a8d95589012f8fff1a8f95499c15776393db299f
SHA512 c0ace08c74ee7ac77bb430d855038d7c66fcd13f4943d8f74a712d69b4ed79500cb95ca9010dc61cc09d6e766f812ebbf0f6fdacd089e74b21b34225cec0582c
SSDEEP 384:JkO5WkHJJYt0k0mRVk9+Xy4Pqvu5drXWX8kO5WkHJJYt0k0mRVk9+Xy4Pqvu5drb:GO5lUjsOrKO5lUjsOrb
TLSH
T14E53CC4FF5BDC124F0A8E2B51FE389E35216F350231182C7A69F3D5AA198A34773919B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\sk-SK\igxpin.exe.mui
Size 66KB
SHA256 2dde3d941d45df92a2baf0c553ed6006d3aa272596a1b17423ff054deff2c4ec
MD5 54145dcf76b6c2f90158138664a0c316
SHA1 9355a03a7047ea005ed01340698397aae541886d
SHA512 2fdfd42e6ad275da40cbcc2fe5d33f7efaa05f325a326fc712b9f5b79bf342967fb2a62bee1afe9feed1c562a9e8800259416062f96bf563bcb848b629834dec
SSDEEP 384:v+9ndVkHJJYt0bC0g7qvy/+k7k0nRFgkfDYXhVAaLQUrOG3n/h+9ndVkHJJYt0bT:W9oU0dwYyOrXvE9oU0dwYyOrXvB
TLSH
T140638951A2FD4166F0F37FB56BF182A28B7BBC927931C20F5684024A49B0E84D9B5773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\sl-SL\igxpin.exe.mui
Size 65KB
SHA256 4af9ac0b53d9a9a06a067778dbbfa1847008e7fbac2707913cf39a27f112b6f6
MD5 33fabdfbb764c2b658461011d0674aa6
SHA1 be2a90d37c52a637a7fec560ba434e3c4636c593
SHA512 0f31480c920db5735d785b298af3303435562dfff737b53fbc5df2c8a54e8674dd4057914e32d36bc883fda9e9d0d7c88eacb532fe8f0bda045a595b2d9b21e1
SSDEEP 384:95mnkHJJYt0zgbd7KUUYdVuwa1Oi0wr3zqOXOF5mnkHJJYt0zgbd7KUUYdVuwa1a:HmIUsQOruvmIUsQOruv
TLSH
T1CB535745B2FD521AF0F77B7457F542A28B3BBCB27931C22F5244128E49A1A80DAB5373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\sv-SE\igxpin.exe.mui
Size 63KB
SHA256 77d63123fa73d837e9767564e700fe3347bee9b9e971334ee8744f44f9bdbf48
MD5 14342ed50d2987dc8cb6a53bb9224e80
SHA1 d5c86c916133605cf948fd2b107c41e8b3db9955
SHA512 6a8c1e5973dd6196dd3cdcaba4611f8b7a2d348e1c1607052fb97da81d2618175859be432c75cfbc9d386a51d8035d2b668989127a9393019301409203832a10
SSDEEP 384:vA0xkHJJYt0C65PHCVQmQHKCsWUZrENJA0xkHJJYt0C65PHCVQmQHKCsWUZrENp:YLUtfV/LtrENSLUtfV/LtrENp
TLSH
T14453CD40A7ED9128F0F3AB74BEF682A28A76BCD12934D62F1744159E4970E48D9F5333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\th-TH\igxpin.exe.mui
Size 62KB
SHA256 eee8df0d48be9d8fc6ab0acc55f8bcf161180a21990ed220cfaa41ce5d391caf
MD5 c00f9dcac9ed9e7cb74b124aafbe8fdf
SHA1 799af629f7839d26c956158171f71b7ce0771be4
SHA512 881e0bb46d7a41b71089b7571ce8e02e59b0f2295d802dbdb85ed4614f6941d068e19acab3a04fdcb7ede63e69d8101bca4ee81160aa630f5ea6bc322f753cf1
SSDEEP 384:jpHtIRkHJJYt05OuF/71AprRpHtIRkHJJYt05OuF/71Aprx:1NImUqZdCprDNImUqZdCprx
TLSH
T107530178A5B68202D096E1F0D3D28FF3BE1CB411D057825781AECE269690A756BF583D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\tr-TR\igxpin.exe.mui
Size 66KB
SHA256 3b0786f5f2f96ce0d88b8de69f4933e1c619eb0b5d2d82ff3b2415ffee9b698f
MD5 c929d496ced74c2be0e0f04bbd7afe0e
SHA1 cfa0728e853b55278b9c399fbb71a4f3e65e236a
SHA512 7f027a8f67caee1b24dd8f93977fe7b3f8fe24dd9b2ab4376e04d1edfa434292bd6755ef26f54932f1c13858a12778d333763a08e9714b6870a3de82b30b304a
SSDEEP 1536:7EUYgTIinGpgPOWymwep/0QhEUYgTIinGpgPOWymwep/0Qx:0gTIinGpgPOWymwep/0Q6gTIinGpgPOo
TLSH
T1E4637804A3DD8127F1F36B752FF591D287B7BCF23930831F6659115A49B0A848A29B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\zh-CN\igxpin.exe.mui
Size 38KB
SHA256 06530a1bc04da92b35685feb6543a79274af06652d22a6451a5fae1a1e7679f3
MD5 d38c33447b18da5e6d4ce190b32ad8fb
SHA1 5855086a1a99d05583abc1d1a658b7406f96c6be
SHA512 5f9e7756f6650155bf2fdd4119d2dda65081d16933a0e1393295adc6388a56c8304beedb782b5ae4b007c16cf30bb8f34ad516af0f2dddaa3162bfb6f9c6dfc6
SSDEEP 384:yNcRpy1dU50BQnyA+zLNcRpy1dU50BQnyA+zY:4TIqjA+zhTIqjA+zY
TLSH
T1BA035648B6CAC939F164B5B587E3C3D3D727B48620820F1FABCC624796C8E04DE6A535
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igxpin.exe.mui

Path C:\Users\Admin\AppData\Roaming\Intel\igxpin\Lang\zh-TW\igxpin.exe.mui
Size 39KB
SHA256 339579b3ead770a48a139a2c7d732bcbd1589a1eae4b3b2c80958d46c0f1e34e
MD5 dd5b173ee25fbf3a709381e4bec2ffb4
SHA1 554aea62d3b8dec62685f8507bde4d07ee146940
SHA512 1b722066e228217772f0a40fbaf089f15aa9fbacfc3c858a4ed0bedd7369bc0b47e3d45af9d69c94a1e265398bddc2915bf8420f8adda487ccd11256b14e8088
SSDEEP 384:nZ16C5VlIF0pRWaHJTQjwAog7v+InZ16C5VlIF0pRWaHJTQjwAog7v+In:ZfMMRWapTQjLH+ifMMRWapTQjLH+m
TLSH
T121033244B6CA8136F064B6B58BE382F7D737B4923141466FEE8C1547A3D0E099E6E235
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 9eff233705598c2f8863faae0ce5881009815e496a29c0729cdb0b1b93064ec1
MD5 43d2ee0bf32536ded05e5649cf30b953
SHA1 0d87cc59781a3e5c9b766ef42600ab2e23246782
SHA512 d64bccb72fced3ab30c18186977201dfc4d740b15c9b264f14371472d1d6a04999c930a107dbd0387dcb9ef229ef09ff38216b45771993d0e101fe2af7c0ab46
SSDEEP 12288:ZO72Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:M2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T18E65237B934C518AF83605B482EAE12D681B7E6A9F1044C3B91778FDF6B18D88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 cc8f235fd4f7bfae02cfbac1c414d61f6ede2eb97fd37364236c95c470bcd76b
MD5 c3aa9f9daa5482622cb3878e32bf1fc4
SHA1 06a583d881ba2284b010f21483dc53a9314415c7
SHA512 c9c1347385f246d25efba4b0e772c1654a0d6ea93cced272287b4e67326b2a26522935c72a675e4968ae5e6114ca0471797272f1c457afc7d21d65ea2f8c4cbf
SSDEEP 24576:gG88u8FpJqH1kzria7/mzsqjnhMgeiCl7G0nehbGZpbD:z7ZFPqVza7/kDmg27RnWGj
TLSH
T12EA5016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 dbaba69191e34fd979d7f9b3a5e85c46468bc8abe19cadee9f7501a675fbaa64
MD5 64cdea310b8836afd6d6d4c90ad4b2d5
SHA1 7495dda7eac7f03322a421985f2f1748085df856
SHA512 bce48afe4db9d09fd848b4d71e91b9caff32bedd436dd0011050c6964c689044ca5448d90f922b3d70891a463e0ee4ae448b46f65a23596afd3cc561b7e15320
SSDEEP 49152:pBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjjDmg27RnWGj:KG05lO43beD527BWG
TLSH
T17CD5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 9deecde605bda6d34592935d521a36d13850fb247908325783d9f510c1ba03e1
MD5 111dc27c6eada0292edee3197bb71f8f
SHA1 f701518ce3eee168f0d8e738abbdab9e716e77ce
SHA512 0a5ea0c60300bb73517152bee4d72739724fa6312b66f5739bea4ff4c34f75b0636fdc3ad67ce9e1b255ed955bae4f708a1b5c446bf0312d67999ab7fb60a28b
SSDEEP 24576:1fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnzsqjnhMgeiCl7G0nehbGZpbD:Va5POZ3+Jt2pasx2+m5Dmg27RnWGj
TLSH
T1E265BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 86ad0e5b62907c15038c276d0e7321dd7e2f3d85a4987e87b666bd1cf44bff17
MD5 da0d67f18dc2f86f212cd5e095aaf59b
SHA1 cd9547c23d9c3b8d7e95f48e3057420c11df2e7c
SHA512 a84fdc087667933ba3d28c97d8a33a81c6fda7bc260eba7750853a99173386cd79259615ec1a6a438af0f9c6d9d835da62f54535e1a99bcf3689ea4362a672e1
SSDEEP 24576:LNcwHdjbyQ4nLC18lb/EOjowL7FkrsqjnhMgeiCl7G0nehbGZpbD:LNc/zEOVHFEDmg27RnWGj
TLSH
T1E7857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 1.4MB
SHA256 ea944c15e7b33e7c4d537911dc051297fc061d432d733c7283954fb6a130dd50
MD5 a6f5cf9f7201b5af1b1251cf9321cfe9
SHA1 a7a0afb1d8e6bf5f072d9fabfebd54597b6a116c
SHA512 db1a6d8f989e5707ce2ce7f58fa9c2745e1ecd5d9224b961babfc8de0f51917348520a1cfa0da6c6067d3fd1e2e39cb7638190fbdeaf79a78ff17ca631cab300
SSDEEP 24576:fgb6bmBIi49WNNFpg1rSvFv7bYwsqjnhMgeiCl7G0nehbGZpbD:fgb4mBIBhGFnDmg27RnWGj
TLSH
T187659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 774c3ee7d578767b375bcafd21eccd01920fb36e78958c94cfe1a899a819d5ee
MD5 462be81f0532f7152f52c8f5b18b31c6
SHA1 fb0ffad4bd8b3545da81ece097ce5d86a532976d
SHA512 a025bd0e624d31cc07fed6b775cc9a068fb8bbfdc01521d82d816e264165caf6b0295f4a9e5a65d40a177bcc5226675eb9874eba4a626f688e0ac97a98815377
SSDEEP 24576:88kNvNnaFeYhJNtmZBm1sqjnhMgeiCl7G0nehbGZpbD:88MwBtOmpDmg27RnWGj
TLSH
T11F55AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 b7a8ab6b7d99f5f37177ea7dbddeec3af4f76da137311a4cd37d9eebfa0df524
MD5 80927ee4b25d440189ca0c4d93781efd
SHA1 4eaf310a0db12d028b21a75062fee73c47a011e6
SHA512 29ad856ff1cd67313c059a055b99ba592ec6cd1929c74287fcb65e4fb89e0777c041b922c6a6e8f0a667c788e7273299623c6b87ce3982b95105c0a8dfe07e93
SSDEEP 12288:0HvUrBFrEjwaQvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:0PUr+NQvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A185F12F22AC18E5E676A17DC582C70DF6727862171192CF02E1817E5F63DE8AD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 0024c9ad105e3b288999ef5f80874424ab573c46512455682ece7aa3ff0ec985
MD5 ce58e95fac046c4bac6f300d51c3ade5
SHA1 241a3e4b053509285c6f104ad7674fd2c9531911
SHA512 7d14a12b528d362c58e7304b061f6a8aaa4b03ede0d119595881340346a4aced4e24ef1322567b33700136c6ec83566902e8a3da60b985dad8aaea49402f11d1
SSDEEP 24576:uD3FHshBIYQgA6sqjnhMgeiCl7G0nehbGZpbD:uDVHeBIAAODmg27RnWGj
TLSH
T1DA95E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/800-366-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/800-359-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/800-531-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/800-360-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/804-152-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/804-322-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/804-144-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/804-151-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/804-150-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2064-544-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2064-525-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2064-249-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2064-243-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2064-242-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2064-543-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3496-330-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/3496-527-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3496-323-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3496-324-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/4544-200-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4544-481-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/4544-206-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4544-198-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/5088-315-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5088-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5088-530-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5088-528-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5088-526-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5356-241-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5356-90-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/5356-83-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5356-91-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/5356-84-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/6792-0-0x0000000000400000-0x00000000006B9000-memory.dmp

Download

memory/6792-354-0x0000000000400000-0x00000000006B9000-memory.dmp

Download

memory/6792-1-0x00000000024A0000-0x0000000002507000-memory.dmp

Download

memory/6792-214-0x0000000000400000-0x00000000006B9000-memory.dmp

Download

memory/6792-6-0x00000000024A0000-0x0000000002507000-memory.dmp

Download

memory/6812-179-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/6812-180-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/6812-407-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/6812-186-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/7052-164-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/7052-163-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/7052-319-0x0000000140000000-0x00000001401BC000-memory.dmp

Download

memory/7052-157-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/7052-172-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/7052-156-0x0000000140000000-0x00000001401BC000-memory.dmp

Download

memory/7064-215-0x0000000000400000-0x000000000057E000-memory.dmp

Download

memory/7064-216-0x00000000009A0000-0x0000000000A07000-memory.dmp

Download

memory/7064-221-0x00000000009A0000-0x0000000000A07000-memory.dmp

Download

memory/7064-511-0x0000000000400000-0x000000000057E000-memory.dmp

Download

memory/7084-342-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/7084-346-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/7084-344-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/7084-336-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/7084-335-0x0000000140000000-0x0000000140168000-memory.dmp

Download