Overview

overview

9

Static

static

3

2026-07-20...nj.exe

windows10-2004-x64

7

2026-07-20...nj.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    122s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/07/2026, 14:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-20_e58506a654c6b2aa4d94bd9363a39253_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
  • Size 6.0MB
  • Sample260720-rdt8asct8l
  • SHA256 09c6f6d31be6b14b5a40b70005a8fa839e15cf4483c003c9d72980ad9fc77148
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryransomwarespywarestealertrojan

Malware Config

Signatures

  • Renames multiple (6522) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 23 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 41 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 40 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 1 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 52 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-20_e58506a654c6b2aa4d94bd9363a39253_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-20_e58506a654c6b2aa4d94bd9363a39253_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies trusted root certificate store through registry
    • Checks processor information in registry
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4876
    • C:\Users\Admin\AppData\Local\Temp\2026-07-20_e58506a654c6b2aa4d94bd9363a39253_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
      C:\Users\Admin\AppData\Local\Temp\2026-07-20_e58506a654c6b2aa4d94bd9363a39253_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
      2⤵
      • Loads dropped DLL
      • Checks processor information in registry
      • Suspicious use of WriteProcessMemory
      PID:6560
      • C:\Users\Admin\AppData\Local\Temp\2026-07-20_e58506a654c6b2aa4d94bd9363a39253_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
        C:\Users\Admin\AppData\Local\Temp\2026-07-20_e58506a654c6b2aa4d94bd9363a39253_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
        3⤵
        • Loads dropped DLL
        • Checks SCSI registry key(s)
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:10016
        • C:\Users\Admin\AppData\Local\Temp\steamsysinfo.exe
          C:\Users\Admin\AppData\Local\Temp\steamsysinfo.exe -steamid 0 -buildid 1782866176 -logdir C:\Users\Admin\AppData\Local\Temp\logs -nocrashdialog -query 1 -out-file C:\Users\Admin\AppData\Local\Temp\50AD.tmp
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:10104
        • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
          C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe -nocrashdialog "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=10016" "-buildid=1782866176" "-steamid=0" "-logdir=C:\Users\Admin\AppData\Local\Temp\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Users\Admin\AppData\Local\Temp\clientui" "-steampath=C:\Users\Admin\AppData\Local\Temp\2026-07-20_e58506a654c6b2aa4d94bd9363a39253_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling "--log-file=C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --disable-quick-menu --disable-component-update "--gaia-url=http://disabled.invalid" "--enable-features=PlatformHEVCDecoderSupport" "--disable-features=WinRetrieveSuggestionsOnlyOnDemand,SpareRendererForSitePerProcess,DcheckIsFatal,BlockPromptsIfIgnoredOften,WebUsbDeviceDetection,ValveFFmpegAllowLowDelayHEVC"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks processor information in registry
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:10324
          • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
            C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\dumps "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1782866176 --initial-client-data=0x2b4,0x2b8,0x2bc,0x2b0,0x2c0,0x7fff991caea0,0x7fff991caeac,0x7fff991caeb8
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:10256
          • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
            "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe" --type=gpu-process --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1782866176 --steamid=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1840,i,17029343397639381684,6730409736531883391,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=1848 --mojo-platform-channel-handle=1836 /prefetch:2
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:10692
          • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
            "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1782866176 --steamid=0 --field-trial-handle=2124,i,17029343397639381684,6730409736531883391,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2168 --mojo-platform-channel-handle=2164 /prefetch:11
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Time Discovery
            PID:10744
          • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
            "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1782866176 --steamid=0 --field-trial-handle=2264,i,17029343397639381684,6730409736531883391,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2280 --mojo-platform-channel-handle=2276 /prefetch:13
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:10760
          • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
            "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1782866176 --steamid=0 --gaia-url=http://disabled.invalid --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=4128,i,17029343397639381684,6730409736531883391,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4220 --mojo-platform-channel-handle=4216 /prefetch:1
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:11460
          • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
            "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1782866176 --steamid=0 --field-trial-handle=5152,i,17029343397639381684,6730409736531883391,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5168 --mojo-platform-channel-handle=5164 /prefetch:14
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:12276
        • C:\Users\Admin\AppData\Local\Temp\bin\gldriverquery64.exe
          .\bin\gldriverquery64.exe
          4⤵
          • Executes dropped EXE
          PID:11312
        • C:\Users\Admin\AppData\Local\Temp\bin\gldriverquery.exe
          .\bin\gldriverquery.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:11668
        • C:\Users\Admin\AppData\Local\Temp\bin\vulkandriverquery64.exe
          .\bin\vulkandriverquery64.exe
          4⤵
          • Executes dropped EXE
          PID:11844
        • C:\Users\Admin\AppData\Local\Temp\bin\vulkandriverquery.exe
          .\bin\vulkandriverquery.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:11740
  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2028
  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:2672
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    PID:2304
  • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    PID:2388
  • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    1⤵
    • Executes dropped EXE
    PID:5716
  • C:\Windows\SysWow64\perfhost.exe
    C:\Windows\SysWow64\perfhost.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:1340
  • C:\Windows\System32\ReFsDedupSvc.exe
    C:\Windows\System32\ReFsDedupSvc.exe
    1⤵
    • Executes dropped EXE
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    PID:4808
  • C:\Windows\System32\SensorDataService.exe
    C:\Windows\System32\SensorDataService.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Checks SCSI registry key(s)
    PID:1480
  • C:\Windows\System32\OpenSSH\ssh-agent.exe
    C:\Windows\System32\OpenSSH\ssh-agent.exe
    1⤵
    • Executes dropped EXE
    PID:5988
  • C:\Windows\system32\AgentService.exe
    C:\Windows\system32\AgentService.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:1252
  • C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\SearchIndexer.exe /Embedding
    1⤵
    • Executes dropped EXE
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1528
    • C:\Windows\System32\SearchProtocolHost.exe
      "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
      2⤵
      • Modifies data under HKEY_USERS
      PID:808
    • C:\Windows\System32\SearchProtocolHost.exe
      "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
      2⤵
        PID:1336
      • C:\Windows\System32\SearchFilterHost.exe
        "C:\Windows\System32\SearchFilterHost.exe" 944 1716 1712 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
        2⤵
        • Modifies data under HKEY_USERS
        PID:2376
      • C:\Windows\System32\SearchFilterHost.exe
        "C:\Windows\System32\SearchFilterHost.exe" 944 1552 1540 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
        2⤵
        • Modifies data under HKEY_USERS
        PID:2096
      • C:\Windows\System32\SearchProtocolHost.exe
        "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
        2⤵
          PID:12532
        • C:\Windows\System32\SearchFilterHost.exe
          "C:\Windows\System32\SearchFilterHost.exe" 944 1716 1712 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
          2⤵
            PID:12668
          • C:\Windows\System32\SearchFilterHost.exe
            "C:\Windows\System32\SearchFilterHost.exe" 944 1552 1540 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
            2⤵
              PID:12596
          • C:\Windows\system32\AUDIODG.EXE
            C:\Windows\system32\AUDIODG.EXE 0x00000000000004F4 0x00000000000004F8
            1⤵
              PID:11208
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
              1⤵
                PID:12348
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                1⤵
                  PID:12304

                Network

                      MITRE ATT&CK Enterprise v16

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      elevation_service.exe
                      • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                      • Size 2.7MB
                      • SHA256 185f1dbdd09fe86ba0d8da5bae1b8ac090f17047775f872e069b0596de237e5d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      maintenanceservice.exe
                      • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                      • Size 1.5MB
                      • SHA256 948b05bc6a37a000e7ccdf9ea2210f086a325762c209be2b153ebc4dec98bf56
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      7z.exe
                      • Path C:\Program Files\7-Zip\7z.exe
                      • Size 1.8MB
                      • SHA256 15f310cccdb21a16bc5be1422c222b1a8409a1d464fe4a138887906b99c4afdd
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      7zFM.exe
                      • Path C:\Program Files\7-Zip\7zFM.exe
                      • Size 1.5MB
                      • SHA256 b4d97850b4501cb9575db4e7286ea776f3bd4799d0162806f98c16c50729817e
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      7zG.exe
                      • Path C:\Program Files\7-Zip\7zG.exe
                      • Size 1.2MB
                      • SHA256 9f21ecb060870cd541b7ff55cb92eba05b325c11bf64a9af91c62964d7154a0e
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Uninstall.exe
                      • Path C:\Program Files\7-Zip\Uninstall.exe
                      • Size 1.2MB
                      • SHA256 c8592c83eeb65826c4ee899b0aae538d1910ecd9315531e68e1f801cba17e386
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      AppVShNotify.exe
                      • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
                      • Size 1.5MB
                      • SHA256 23b2b78568bfc96686fc683554be9ba8fb2047864b333d69ccbff453c62418a7
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      IntegratedOffice.exe
                      • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
                      • Size 4.6MB
                      • SHA256 25bffa608d1390e029007d98969979d8a9d7b2e2c01b0874304012ccb6abddf4
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      MavInject32.exe
                      • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
                      • Size 1.6MB
                      • SHA256 3a797d5b89fd4591d01901f4a8d66f0df310097095529b89f90b85501d1c26db
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OfficeC2RClient.exe
                      • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
                      • Size 24.0MB
                      • SHA256 b5406a87e16b480207c04447a62c2a40ca5b7ab173ca7cd220ff663a13254434
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      appvcleaner.exe
                      • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
                      • Size 2.7MB
                      • SHA256 65262dcf30182e5ab81c24a3686a02414768764d55dc82bf4174726b8e357bbe
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      LICLUA.EXE
                      • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
                      • Size 1.1MB
                      • SHA256 f5ec92a9eb225af17d67b3d859450bca9958da0045d7e00e6617614d26a81022
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OSE.EXE
                      • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                      • Size 1.5MB
                      • SHA256 aff478ee74874ff9b325392af81c51e2183ef650a673acc2045cbef2fda78962
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      VSTOInstaller.exe
                      • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
                      • Size 1.3MB
                      • SHA256 793baeb853f0b4d060e04c92c200f70f90ac06382a63539ea0eef4943ea54f01
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      chrmstp.exe
                      • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
                      • Size 6.6MB
                      • SHA256 7d1ddac4d5ea85c2af313556287e0c3f25294510d49bf6aae47e3c4afe78a342
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      setup.exe
                      • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
                      • Size 6.6MB
                      • SHA256 d7bde696daf61d87a5fdb6ab8d8b53a1c9118ea223328de4f70c7ff7aed77304
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      chrome_pwa_launcher.exe
                      • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
                      • Size 2.3MB
                      • SHA256 3422bd274bbd030cf44470bcd3c541f5c6668711d9c331955c7f6a4c0ec0fe09
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      elevated_tracing_service.exe
                      • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
                      • Size 4.0MB
                      • SHA256 880166201b2f31d56be5c019a744155649a772134fc52e9d63ea9b6cb8d9a693
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      elevation_service.exe
                      • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                      • Size 2.8MB
                      • SHA256 22a332d9565562ac8c9aaced5b8779f586a1c09f4e2ac06d885b60e41505be57
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      notification_helper.exe
                      • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
                      • Size 2.2MB
                      • SHA256 ee320bcad3c42d7363c02bc6800b60716f193814f2825546b36e7ac38b7cddf6
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      os_update_handler.exe
                      • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
                      • Size 2.4MB
                      • SHA256 80e6a6552d29fda4d45eba5241ec5fe74619e270bbe0a96ad6320f91a69a9e9c
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      chrome_proxy.exe
                      • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
                      • Size 2.0MB
                      • SHA256 6ecceccd183644cb84ece6c981b5a02710ceb940909d52583908c071b68b8633
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      appletviewer.exe
                      • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
                      • Size 1.2MB
                      • SHA256 26e81175ad7655133a731fc9bc4aca48feed193239f7a728fd756535d35c7274
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      extcheck.exe
                      • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
                      • Size 1.2MB
                      • SHA256 b5a37a31db0911e3266fbc7d6e26648c537ffec3f02a6b44a1e792b80537989f
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      idlj.exe
                      • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
                      • Size 1.2MB
                      • SHA256 ecc20e5876a31a3952768bf6d6969a3b56f190be33f4cfe7860ceba00efa21ab
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      jabswitch.exe
                      • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
                      • Size 1.3MB
                      • SHA256 89a010dfedc8e537e101341fbe6d018d22280836ed72b4dd4a964ed445341bf8
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      jar.exe
                      • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
                      • Size 1.2MB
                      • SHA256 d133db1b393b4d581049f4ca4e67ddf433e04bc095656241c244c93a532f902d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      jarsigner.exe
                      • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
                      • Size 1.2MB
                      • SHA256 1c1183723ab66583f98bfec6e8e7ed0f4fe50e58804dd2a1a45ab31121a27bb6
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      java-rmi.exe
                      • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
                      • Size 1.2MB
                      • SHA256 29ce61c8baf8f24fcead3a153fd289d5e56b9bfa9b3a5adf3861fd5c35508a45
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      java.exe
                      • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
                      • Size 1.5MB
                      • SHA256 7c18806627aa7452aa1697a16fe1f8b30210d343cc01888c47c6e85d11c6e659
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      javac.exe
                      • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
                      • Size 1.2MB
                      • SHA256 bbeaa7296d04c57befaffd29cf635a63a0fe962fa92e7e1f6522244b77b79f3a
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      javadoc.exe
                      • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
                      • Size 1.2MB
                      • SHA256 7730b32aef24daa4cd927b68f12dfcb8152a0acea1a6df1ba00429ebb67e357b
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      javafxpackager.exe
                      • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
                      • Size 1.4MB
                      • SHA256 0be30b1fdd3098281135f0bc9274dcf6da3ed190593898713ee0d2ea59ef7b40
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      javah.exe
                      • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
                      • Size 1.2MB
                      • SHA256 545fa5bde10010d064db4da0300825e73b3af14cdf37ede5ac56744ba3bf57d9
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      javap.exe
                      • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
                      • Size 1.2MB
                      • SHA256 995b0463f93af8c8e6eb0f29b7d1fa24e6b74f3fecd879833b7099f23452ef72
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      javapackager.exe
                      • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
                      • Size 1.4MB
                      • SHA256 a618e41c7a49bc4c5ad278aa7d5b6e38c57ec6da482466b366a4cdbda3ac8f7d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      javaw.exe
                      • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
                      • Size 1.5MB
                      • SHA256 38979d64f96be6a15d414f77360b9e5149137f31b55d090e92077580d005488e
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      javaws.exe
                      • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
                      • Size 1.7MB
                      • SHA256 e332e81ab908dfaafaae5d25847a09ba3d1f881a18eeb8335c3b3855368b9fb4
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      jcmd.exe
                      • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
                      • Size 1.2MB
                      • SHA256 ceb4fbf15063d3a0c844d6d71b238c8e9269295e90fade00fd127378a8024b9f
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      jconsole.exe
                      • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
                      • Size 1.2MB
                      • SHA256 fc6bf4adf4440aee07d05922d68052288b1df42d8482b458c3c77c515e1ed361
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      jdb.exe
                      • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
                      • Size 1.2MB
                      • SHA256 b340ba9a7f60f61534639751fbe3f3545c4c9af3a3c6b4087b7e3dde39749e3d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      jdeps.exe
                      • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
                      • Size 1.2MB
                      • SHA256 85c96e5da0e76539e65827978c3199464247fee893c122c023b4326eb4857028
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      MsSense.exe
                      • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
                      • Size 1.7MB
                      • SHA256 994b5b08ab32c789202e3d95cd1fb50f692c08e40b40648b22aa63881dd8df55
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      NisSrv.exe
                      • Path C:\Program Files\Windows Defender\NisSrv.exe
                      • Size 3.5MB
                      • SHA256 92517f7340b487a8bd9f8c79ef82d93c2847c605ce0d0a01bc8eeee205e91729
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      wmpnetwk.exe
                      • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
                      • Size 1.4MB
                      • SHA256 c4f380c3f6ea1dce1a525de679fe1f0ce2cd68f855a41fa145b818d92bbc9f1b
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      dotnet.exe
                      • Path C:\Program Files\dotnet\dotnet.exe
                      • Size 1.4MB
                      • SHA256 f7bb54036d23868e70969096e9f877e896d4d373b3e5b6eef6e1bb7aee5714d4
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Windows.db
                      • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
                      • Size 1.0MB
                      • SHA256 88fb93ee69a4ddc78b0964f14b58bb1904604b134d08c5affaa486a0921efa54
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Windows.db-wal
                      • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
                      • Size 1.3MB
                      • SHA256 2d65668f511c6da4d8f63d899e0d8c951113dd6cbf0531aeeaceef80b6c7a2d6
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      the-real-index
                      • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Code Cache\js\index-dir\the-real-index
                      • Size 360B
                      • SHA256 5aa535da4a6f174d32f7b5d4b089cd65300a1821ec8aa6c5fb188b41bfac0320
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      the-real-index~RFe5bc7c1.TMP
                      • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Code Cache\js\index-dir\the-real-index~RFe5bc7c1.TMP
                      • Size 48B
                      • SHA256 ed4c0b26afa868cfbce17ad6bdc33617d5701b064b119a7609adde1bc90aaef0
                      • MD5 SHA1 SHA512
                      Submit Download

                      MANIFEST-000001
                      • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Extension Rules\MANIFEST-000001
                      • Size 41B
                      • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                      • MD5 SHA1 SHA512
                      Submit Download

                      data_0
                      • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_0
                      • Size 8KB
                      • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      data_2
                      • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_2
                      • Size 8KB
                      • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      data_3
                      • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_3
                      • Size 8KB
                      • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      204fc117-617c-4d8e-b058-e3d6d8d90134.tmp
                      • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\204fc117-617c-4d8e-b058-e3d6d8d90134.tmp
                      • Size 2B
                      • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                      • MD5 SHA1 SHA512
                      Submit Download

                      Preferences
                      • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences
                      • Size 7KB
                      • SHA256 b8224bab35818b41c126e26d78f457aaa1409676577727fa8a1a0668cd9a84fc
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Preferences~RFe5bc446.TMP
                      • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences~RFe5bc446.TMP
                      • Size 7KB
                      • SHA256 f41d6878647c48a6f8d175b26b150345398c36b2dcd4d303da62cc38e7d14415
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      CURRENT
                      • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Site Characteristics Database\CURRENT
                      • Size 16B
                      • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                      • MD5 SHA1 SHA512
                      Submit Download

                      Local State
                      • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
                      • Size 2KB
                      • SHA256 ce78d43693e42106a603e33c6840ad4071b21adadab31930fd9492d39dde9e43
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      Local State
                      • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
                      • Size 1KB
                      • SHA256 2762a0e2e0cf770be3ff930939f1983bd0ed1bd3ca28208b6d2070d68ef1565d
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      Local State~RFe5b5ace.TMP
                      • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State~RFe5b5ace.TMP
                      • Size 890B
                      • SHA256 c6d8f059607cac12828ff6262226f71fcd9de07eba3011b9d4ab2cba5ccaf30c
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      config.vdf
                      • Path C:\Users\Admin\AppData\Local\Temp\config\config.vdf
                      • Size 1KB
                      • SHA256 f3847b5e4a40d9cf76df35398bb555117dfe3626c00a91f2babdedb619d6ad53
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      config.vdf
                      • Path C:\Users\Admin\AppData\Local\Temp\config\config.vdf
                      • Size 12KB
                      • SHA256 97821f847275b459add84224529ef086759c71fd257c9c90368937c4d22ba58a
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      config.vdf
                      • Path C:\Users\Admin\AppData\Local\Temp\config\config.vdf
                      • Size 1KB
                      • SHA256 8f9f970835f133258a7f740126012439385bbaa5a1d6a9d0d967a390977441c3
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      config.vdf~RFe5b6483.TMP
                      • Path C:\Users\Admin\AppData\Local\Temp\config\config.vdf~RFe5b6483.TMP
                      • Size 184B
                      • SHA256 661f122934bbc692266940a1fe2e5e51d4d460efb29d75695b8d5241c6e11da7
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      crashhandler64.dll
                      • Path C:\Users\Admin\AppData\Local\Temp\crashhandler64.dll
                      • Size 485KB
                      • SHA256 b0683d77581df5e1f0c95c4e040bea4a28a3b4d97fd3a7dc96da7c47e44f37c1
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      bootstrap_log.txt
                      • Path C:\Users\Admin\AppData\Local\Temp\logs\bootstrap_log.txt
                      • Size 14KB
                      • SHA256 80a1d2cbbaa17d6152d43a76d965679cdbf97479a999728e208d55abf4bb5d17
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      service_log.txt
                      • Path C:\Users\Admin\AppData\Local\Temp\logs\service_log.txt
                      • Size 685B
                      • SHA256 7568e367bdf433c8ecbf1a29b731bdd82cef4cd4031578b892c91466c670d5ed
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      service_log.txt
                      • Path C:\Users\Admin\AppData\Local\Temp\logs\service_log.txt
                      • Size 1KB
                      • SHA256 d1bb49027c89408523ef2ad62d22a21a62edc557213524bed44151772e05a741
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      steam_client_win64.manifest
                      • Path C:\Users\Admin\AppData\Local\Temp\package\steam_client_win64.manifest
                      • Size 7KB
                      • SHA256 6289a7228da67422d4b917fc7ecacf7fe654a865ce11cc78f9615c6701c8b204
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      btnOvrOffBottom.tga_
                      • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\btnOvrOffBottom.tga_
                      • Size 444B
                      • SHA256 ecd13153d9d438809a38de30f3abbb0f6f92837a7e3cacb442a9a9309bcd78d9
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      [email protected]_
                      • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\[email protected]_
                      • Size 6KB
                      • SHA256 5afc5816946e0d7b6d57a99a60be71d9e88670d9a63c18e249c9266d8e95cd2f
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      cloud_localfiles.tga_
                      • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\cloud_localfiles.tga_
                      • Size 14KB
                      • SHA256 c7a1b0021d1f943e497c592d83050ac85a3b93aff732f9b94cd26d9c41b37ca3
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      [email protected]_
                      • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\[email protected]_
                      • Size 15KB
                      • SHA256 983aa3928f15f5154266be7063a75e1fce87238bbe81a910219dea01d5376824
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      [email protected]_
                      • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\[email protected]_
                      • Size 92KB
                      • SHA256 e0ce36b93ae67846424364085ad79ee24fe5c036e5f6a78a4acbe1583f22daab
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      icon_button_news_mousedown.tga_
                      • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\icon_button_news_mousedown.tga_
                      • Size 20KB
                      • SHA256 cab3a68b64d8bf22c44080f12d7eab5b281102a8761f804224074ab1f6130fe2
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      tabStdBottom.tga_
                      • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\tabStdBottom.tga_
                      • Size 48B
                      • SHA256 5caa5fa3e79dcd8ec5ec20256ed7c77efaae77e0ae8d89e4a974c484cb177d84
                      • MD5 SHA1 SHA512
                      Submit Download

                      steam_cloudsync.ico_
                      • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\public\steam_cloudsync.ico_
                      • Size 47KB
                      • SHA256 5aaca90948de8f7d11264ed608a2f96acba061e6463d337d658b00ed1c552449
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      steam_cloudsync_posix.tga_
                      • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\public\steam_cloudsync_posix.tga_
                      • Size 64KB
                      • SHA256 fd2abb8945c06a6b9c5444baf6ea523b52bf7a03a58b34ebe0a6a110630ed5f8
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      steam_tray.tga_
                      • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\public\steam_tray.tga_
                      • Size 1KB
                      • SHA256 f747d5fd27e74412be05bb376c0ff12fcebb7f39c158eaa89ab6a0a9d92ef3b6
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      filter_clean_bulgarian.txt.gz_
                      • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\resource\filter_clean_bulgarian.txt.gz_
                      • Size 23B
                      • SHA256 6feb83ca306745d634903cf09274b7baf0ac38e43c6b3fab1a608be344c3ef64
                      • MD5 SHA1 SHA512
                      Submit Download

                      filter_clean_schinese.txt.gz_
                      • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\resource\filter_clean_schinese.txt.gz_
                      • Size 33B
                      • SHA256 77f0055faba992867817c485930c5f60cf64e65c65b410128426dc35fd8d862b
                      • MD5 SHA1 SHA512
                      Submit Download

                      game_details_header_green.tga_
                      • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\steam\cached\game_details_header_green.tga_
                      • Size 2.1MB
                      • SHA256 a24832de8b80e206143170a899ab91e76e85685aed74963fe2f490344bbf6427
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      perfhost.exe
                      • Path C:\Windows\SysWOW64\perfhost.exe
                      • Size 1.2MB
                      • SHA256 b5ec0b18dc4c1d937710a8385111f7657eeaec0ef585f6151db61aee8c73c9da
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      AgentService.exe
                      • Path C:\Windows\System32\AgentService.exe
                      • Size 1.4MB
                      • SHA256 9dd258f75c6013a4eacb95ef1e2c18bfe474f32356294a1dc3a21ad1048446b4
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ssh-agent.exe
                      • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                      • Size 1.8MB
                      • SHA256 e7922563922251fad74ea5b83138eaab33497248551ecc24694f75146507b718
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      PerceptionSimulationService.exe
                      • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
                      • Size 1.5MB
                      • SHA256 67170eb2645ad933a66e2b302ec5c570894694bd0728c21abd2f06cc72408b2f
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ReFsDedupSvc.exe
                      • Path C:\Windows\System32\ReFsDedupSvc.exe
                      • Size 2.6MB
                      • SHA256 575c42583d1aeec10fc26f5a333b3380114250d156dd731855acb22ed2093a06
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      SearchIndexer.exe
                      • Path C:\Windows\System32\SearchIndexer.exe
                      • Size 1.4MB
                      • SHA256 d3d8c2ba12d054c46b03794174e886d6cc71ab0ccee23610208ed770a0beef06
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      SensorDataService.exe
                      • Path C:\Windows\System32\SensorDataService.exe
                      • Size 1.7MB
                      • SHA256 56f26ca27a0c7df89baa3e868246bf89ddbd0f669f3d1f0064bb067a346ab2ad
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      AppVClient.exe
                      • Path C:\Windows\system32\AppVClient.exe
                      • Size 1.3MB
                      • SHA256 3dc44b56d294e150b505d9e930c4a718b3a6cde8b91086875ce679d4999c5770
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      SgrmBroker.exe
                      • Path C:\Windows\system32\Sgrm\SgrmBroker.exe
                      • Size 1.6MB
                      • SHA256 6ca6f019fe4f208886075d7c8bf6934d79678ea9b85c72904dff92e91d9e2adf
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      memory/1252-138-0x0000000000BB0000-0x0000000000C10000-memory.dmp
                      Download

                      memory/1252-144-0x0000000000BB0000-0x0000000000C10000-memory.dmp
                      Download

                      memory/1252-146-0x0000000140000000-0x0000000140168000-memory.dmp
                      Download

                      memory/1252-132-0x0000000000BB0000-0x0000000000C10000-memory.dmp
                      Download

                      memory/1252-131-0x0000000140000000-0x0000000140168000-memory.dmp
                      Download

                      memory/1340-90-0x0000000000930000-0x0000000000996000-memory.dmp
                      Download

                      memory/1340-84-0x0000000000400000-0x0000000000543000-memory.dmp
                      Download

                      memory/1340-85-0x0000000000930000-0x0000000000996000-memory.dmp
                      Download

                      memory/1340-320-0x0000000000400000-0x0000000000543000-memory.dmp
                      Download

                      memory/1480-113-0x00000000007C0000-0x0000000000820000-memory.dmp
                      Download

                      memory/1480-106-0x00000000007C0000-0x0000000000820000-memory.dmp
                      Download

                      memory/1480-112-0x0000000140000000-0x00000001401BA000-memory.dmp
                      Download

                      memory/1480-325-0x0000000140000000-0x00000001401BA000-memory.dmp
                      Download

                      memory/1480-328-0x00000000007C0000-0x0000000000820000-memory.dmp
                      Download

                      memory/1480-330-0x0000000140000000-0x00000001401BA000-memory.dmp
                      Download

                      memory/1528-156-0x0000000000620000-0x0000000000680000-memory.dmp
                      Download

                      memory/1528-149-0x0000000140000000-0x0000000140172000-memory.dmp
                      Download

                      memory/1528-150-0x0000000000620000-0x0000000000680000-memory.dmp
                      Download

                      memory/1528-332-0x0000000140000000-0x0000000140172000-memory.dmp
                      Download

                      memory/2028-119-0x0000000140000000-0x00000001402E9000-memory.dmp
                      Download

                      memory/2028-14-0x0000000140000000-0x00000001402E9000-memory.dmp
                      Download

                      memory/2028-15-0x0000000000DF0000-0x0000000000E50000-memory.dmp
                      Download

                      memory/2028-23-0x0000000000DF0000-0x0000000000E50000-memory.dmp
                      Download

                      memory/2028-21-0x0000000000DF0000-0x0000000000E50000-memory.dmp
                      Download

                      memory/2096-352-0x000001AA40600000-0x000001AA40848000-memory.dmp
                      Download

                      memory/2304-43-0x0000000000CE0000-0x0000000000D40000-memory.dmp
                      Download

                      memory/2304-49-0x0000000000CE0000-0x0000000000D40000-memory.dmp
                      Download

                      memory/2304-42-0x0000000140000000-0x0000000140181000-memory.dmp
                      Download

                      memory/2304-55-0x0000000140000000-0x0000000140181000-memory.dmp
                      Download

                      memory/2304-53-0x0000000000CE0000-0x0000000000D40000-memory.dmp
                      Download

                      memory/2388-67-0x0000000000870000-0x00000000008D0000-memory.dmp
                      Download

                      memory/2388-61-0x0000000000870000-0x00000000008D0000-memory.dmp
                      Download

                      memory/2388-301-0x0000000140000000-0x000000014017B000-memory.dmp
                      Download

                      memory/2388-60-0x0000000140000000-0x000000014017B000-memory.dmp
                      Download

                      memory/2672-148-0x0000000140000000-0x00000001402D4000-memory.dmp
                      Download

                      memory/2672-27-0x0000000140000000-0x00000001402D4000-memory.dmp
                      Download

                      memory/2672-34-0x00000000007E0000-0x0000000000840000-memory.dmp
                      Download

                      memory/2672-36-0x00000000007E0000-0x0000000000840000-memory.dmp
                      Download

                      memory/2672-28-0x00000000007E0000-0x0000000000840000-memory.dmp
                      Download

                      memory/4808-353-0x00000000007E0000-0x0000000000840000-memory.dmp
                      Download

                      memory/4808-355-0x0000000140000000-0x00000001402C9000-memory.dmp
                      Download

                      memory/4808-94-0x0000000140000000-0x00000001402C9000-memory.dmp
                      Download

                      memory/4808-101-0x00000000007E0000-0x0000000000840000-memory.dmp
                      Download

                      memory/4808-323-0x0000000140000000-0x00000001402C9000-memory.dmp
                      Download

                      memory/4876-83-0x0000000140000000-0x0000000140797000-memory.dmp
                      Download

                      memory/4876-9-0x0000000002180000-0x00000000021E0000-memory.dmp
                      Download

                      memory/4876-6968-0x0000000140000000-0x0000000140797000-memory.dmp
                      Download

                      memory/4876-6946-0x0000000002180000-0x00000000021E0000-memory.dmp
                      Download

                      memory/4876-0-0x0000000002180000-0x00000000021E0000-memory.dmp
                      Download

                      memory/4876-6-0x0000000140000000-0x0000000140797000-memory.dmp
                      Download

                      memory/5716-318-0x0000000140000000-0x0000000140177000-memory.dmp
                      Download

                      memory/5716-79-0x0000000000CC0000-0x0000000000D20000-memory.dmp
                      Download

                      memory/5716-73-0x0000000000CC0000-0x0000000000D20000-memory.dmp
                      Download

                      memory/5716-71-0x0000000140000000-0x0000000140177000-memory.dmp
                      Download

                      memory/5988-127-0x0000000000E70000-0x0000000000ED0000-memory.dmp
                      Download

                      memory/5988-120-0x0000000140000000-0x00000001401EA000-memory.dmp
                      Download

                      memory/5988-121-0x0000000000E70000-0x0000000000ED0000-memory.dmp
                      Download

                      memory/5988-327-0x0000000140000000-0x00000001401EA000-memory.dmp
                      Download

                      memory/6560-9231-0x0000000140000000-0x0000000140797000-memory.dmp
                      Download

                      memory/6560-6949-0x0000000002050000-0x00000000020B0000-memory.dmp
                      Download

                      memory/6560-13571-0x0000000002050000-0x00000000020B0000-memory.dmp
                      Download

                      memory/6560-6955-0x0000000140000000-0x0000000140797000-memory.dmp
                      Download

                      memory/6560-13582-0x0000000140000000-0x0000000140797000-memory.dmp
                      Download

                      memory/6560-6956-0x0000000002050000-0x00000000020B0000-memory.dmp
                      Download

                      memory/10016-13580-0x0000000002050000-0x00000000020B0000-memory.dmp
                      Download

                      memory/10016-13579-0x0000000140000000-0x0000000140797000-memory.dmp
                      Download

                      memory/10016-13792-0x0000000140000000-0x0000000140797000-memory.dmp
                      Download

                      memory/10324-13833-0x0000024BB0800000-0x0000024BB0C85000-memory.dmp
                      Download

                      memory/10760-13642-0x00007FFFC19B0000-0x00007FFFC19B1000-memory.dmp
                      Download

                      memory/10760-13643-0x00007FFFC0090000-0x00007FFFC0091000-memory.dmp
                      Download

                      memory/11460-13881-0x00000150171B0000-0x0000015017635000-memory.dmp
                      Download