Overview

overview

7

Static

static

3

2026-07-30...nj.exe

windows10-2004-x64

7

2026-07-30...nj.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    131s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/07/2026, 16:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-30_f9133808b0bdd5cbd757da94b220487c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
  • Size 6.0MB
  • Sample260730-t8fdqsscrd
  • SHA256 5bbbff562dc31f778c96317cf335bf8418e17796a2c672f9542367acb5a20d82
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryspywarestealertrojan

Malware Config

Signatures

  • Executes dropped EXE 23 IoCs
  • Loads dropped DLL 63 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 41 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 40 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 1 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 51 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_f9133808b0bdd5cbd757da94b220487c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-30_f9133808b0bdd5cbd757da94b220487c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies trusted root certificate store through registry
    • Checks processor information in registry
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:964
    • C:\Users\Admin\AppData\Local\Temp\2026-07-30_f9133808b0bdd5cbd757da94b220487c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
      C:\Users\Admin\AppData\Local\Temp\2026-07-30_f9133808b0bdd5cbd757da94b220487c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
      2⤵
      • Loads dropped DLL
      • Checks SCSI registry key(s)
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:9872
      • C:\Users\Admin\AppData\Local\Temp\steamsysinfo.exe
        C:\Users\Admin\AppData\Local\Temp\steamsysinfo.exe -steamid 0 -buildid 1785187029 -logdir C:\Users\Admin\AppData\Local\Temp\logs -nocrashdialog -query 1 -out-file C:\Users\Admin\AppData\Local\Temp\93E5.tmp
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:11740
      • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
        C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe -nocrashdialog "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=9872" "-buildid=1785187029" "-steamid=0" "-logdir=C:\Users\Admin\AppData\Local\Temp\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Users\Admin\AppData\Local\Temp\clientui" "-steampath=C:\Users\Admin\AppData\Local\Temp\2026-07-30_f9133808b0bdd5cbd757da94b220487c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling "--log-file=C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --disable-quick-menu --disable-component-update "--gaia-url=http://disabled.invalid" "--enable-features=PlatformHEVCDecoderSupport" "--disable-features=WinRetrieveSuggestionsOnlyOnDemand,SpareRendererForSitePerProcess,DcheckIsFatal,BlockPromptsIfIgnoredOften,WebUsbDeviceDetection,ValveFFmpegAllowLowDelayHEVC"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks processor information in registry
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:13764
        • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
          C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\dumps "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1785187029 --initial-client-data=0x318,0x31c,0x320,0x314,0x324,0x7ffeefe1aea0,0x7ffeefe1aeac,0x7ffeefe1aeb8
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:15112
        • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
          "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe" --type=gpu-process --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1785187029 --steamid=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1904,i,6552649279196099856,7514201389000543095,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=1908 --mojo-platform-channel-handle=1900 /prefetch:2
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:7576
        • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
          "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1785187029 --steamid=0 --field-trial-handle=2168,i,6552649279196099856,7514201389000543095,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2204 --mojo-platform-channel-handle=2200 /prefetch:11
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Time Discovery
          PID:16936
        • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
          "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1785187029 --steamid=0 --field-trial-handle=2272,i,6552649279196099856,7514201389000543095,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2296 --mojo-platform-channel-handle=2288 /prefetch:13
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:17160
        • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
          "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1785187029 --steamid=0 --gaia-url=http://disabled.invalid --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=4192,i,6552649279196099856,7514201389000543095,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4204 --mojo-platform-channel-handle=4200 /prefetch:1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:20264
        • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
          "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1785187029 --steamid=0 --field-trial-handle=4812,i,6552649279196099856,7514201389000543095,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5196 --mojo-platform-channel-handle=5192 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:23040
      • C:\Users\Admin\AppData\Local\Temp\bin\gldriverquery64.exe
        .\bin\gldriverquery64.exe
        3⤵
        • Executes dropped EXE
        PID:20220
      • C:\Users\Admin\AppData\Local\Temp\bin\gldriverquery.exe
        .\bin\gldriverquery.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:21080
      • C:\Users\Admin\AppData\Local\Temp\bin\vulkandriverquery64.exe
        .\bin\vulkandriverquery64.exe
        3⤵
        • Executes dropped EXE
        PID:21060
      • C:\Users\Admin\AppData\Local\Temp\bin\vulkandriverquery.exe
        .\bin\vulkandriverquery.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:21452
  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2332
  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:4844
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    PID:124
  • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    PID:1848
  • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    1⤵
    • Executes dropped EXE
    PID:5048
  • C:\Windows\SysWow64\perfhost.exe
    C:\Windows\SysWow64\perfhost.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:5900
  • C:\Windows\System32\ReFsDedupSvc.exe
    C:\Windows\System32\ReFsDedupSvc.exe
    1⤵
    • Executes dropped EXE
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    PID:1124
  • C:\Windows\System32\SensorDataService.exe
    C:\Windows\System32\SensorDataService.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Checks SCSI registry key(s)
    PID:948
  • C:\Windows\System32\OpenSSH\ssh-agent.exe
    C:\Windows\System32\OpenSSH\ssh-agent.exe
    1⤵
    • Executes dropped EXE
    PID:1344
  • C:\Windows\system32\AgentService.exe
    C:\Windows\system32\AgentService.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:988
  • C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\SearchIndexer.exe /Embedding
    1⤵
    • Executes dropped EXE
    • Enumerates connected drives
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3400
    • C:\Windows\System32\SearchProtocolHost.exe
      "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
      2⤵
        PID:1372
      • C:\Windows\System32\SearchProtocolHost.exe
        "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
        2⤵
        • Modifies data under HKEY_USERS
        PID:2144
      • C:\Windows\System32\SearchFilterHost.exe
        "C:\Windows\System32\SearchFilterHost.exe" 940 2888 2892 820 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
        2⤵
        • Modifies data under HKEY_USERS
        PID:3736
      • C:\Windows\System32\SearchFilterHost.exe
        "C:\Windows\System32\SearchFilterHost.exe" 940 2520 2584 820 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
        2⤵
        • Modifies data under HKEY_USERS
        PID:4568
      • C:\Windows\System32\SearchProtocolHost.exe
        "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
        2⤵
        • Modifies data under HKEY_USERS
        PID:19092
      • C:\Windows\System32\SearchFilterHost.exe
        "C:\Windows\System32\SearchFilterHost.exe" 940 2888 2892 820 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
        2⤵
          PID:19360
        • C:\Windows\System32\SearchFilterHost.exe
          "C:\Windows\System32\SearchFilterHost.exe" 940 2520 2584 820 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
          2⤵
            PID:19820
        • C:\Windows\system32\AUDIODG.EXE
          C:\Windows\system32\AUDIODG.EXE 0x00000000000004C4 0x00000000000004EC
          1⤵
            PID:19668
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
            1⤵
              PID:14648
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
              1⤵
              • Modifies data under HKEY_USERS
              PID:14956

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  elevation_service.exe
                  • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                  • Size 2.7MB
                  • SHA256 c0ab775c085d81ce593d3fce1f6e7f8835622c3e84bd6895f2d2f80e9e86fb17
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  maintenanceservice.exe
                  • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                  • Size 1.6MB
                  • SHA256 cfd99f6e5fc38aaafebbbd69eda60642bbd9f7716e97079ec5850245d1336338
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  7z.exe
                  • Path C:\Program Files\7-Zip\7z.exe
                  • Size 1.9MB
                  • SHA256 9387f6ee9b5e45a10b8867fc86dfc295628e786bcbb0df12dbe10208b4238d9b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  7zFM.exe
                  • Path C:\Program Files\7-Zip\7zFM.exe
                  • Size 1.5MB
                  • SHA256 1afa6056931b4aa4f6241875fb53978478711f1915d57c4ff699226d85e7d2e2
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  7zG.exe
                  • Path C:\Program Files\7-Zip\7zG.exe
                  • Size 1.2MB
                  • SHA256 ac0c89bd2a3ca9bbec6073b9b1cb8f37c8620b5d143065f4cb4cd5ae1ad8a42d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Uninstall.exe
                  • Path C:\Program Files\7-Zip\Uninstall.exe
                  • Size 1.4MB
                  • SHA256 be4d7185a90109d99c5c84cfa1be17270db8196e3099b0d76e869a5c1c187eeb
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  AppVShNotify.exe
                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
                  • Size 1.6MB
                  • SHA256 c6eab7885ffc967001f3daab4aee544e8affa097fd3a93fbe379c5c346eaeb1c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  IntegratedOffice.exe
                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
                  • Size 4.6MB
                  • SHA256 a66d1a60ff7aa8e0d497fa56dfdbd12d82794061cb27a4b69b799557894a0794
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MavInject32.exe
                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
                  • Size 1.7MB
                  • SHA256 f0cc2d1d98be320969ee92a9379e58b4fd572caa80ccac415ac642c57a2d90af
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  OfficeC2RClient.exe
                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
                  • Size 24.0MB
                  • SHA256 8729bf8bd56707063774961d84e475871404b91fbba57201509214fce16523ed
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  appvcleaner.exe
                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
                  • Size 2.7MB
                  • SHA256 93cecabfdf9f8853fcafd489364f98ecb45f32e7ac2150aaa8595a1602fcf4e1
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  LICLUA.EXE
                  • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
                  • Size 1.1MB
                  • SHA256 d5e4de2e1777ae0073da7e8a8024fbb4fe7a096f55a2642796b9111f99911e6d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  OSE.EXE
                  • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                  • Size 1.6MB
                  • SHA256 c41a21aa8289b99e5813427b246a4cae17af3b0c8bbe950d98bd3b33a6cfd902
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  VSTOInstaller.exe
                  • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
                  • Size 1.5MB
                  • SHA256 b5371b99ae3f7341f629ff7381f60386970835f8ad60af50661bd9547475d0ac
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  chrmstp.exe
                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
                  • Size 6.6MB
                  • SHA256 d7ea2624ab55c39759a5e3d7455259e2eea0c1ea6e3a84461bca18fc05cbe85d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  setup.exe
                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
                  • Size 6.6MB
                  • SHA256 b45ab8642c5b225b8a0a9a7cc74642eccec967de49ab7241af6f5e5f9857d3ae
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  chrome_pwa_launcher.exe
                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
                  • Size 2.3MB
                  • SHA256 5f3853cb2c5100c15548c29d902c1cebb60d92878495de796f494ea24467b8ab
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  elevated_tracing_service.exe
                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
                  • Size 4.0MB
                  • SHA256 8c8821df1c2ba0dc2b4f2272daee6091c2a721494be52dff51f7365260b54348
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  elevation_service.exe
                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                  • Size 2.8MB
                  • SHA256 bfc466fee648509e0b10e04b9594e90f24ce59d0c0d60957d521a409883b5a4c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  notification_helper.exe
                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
                  • Size 2.2MB
                  • SHA256 8b6811cc6ee582250d03b4fe0f55b22c63b9f956e98c6bcaef6caa17506c4bf4
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  os_update_handler.exe
                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
                  • Size 2.4MB
                  • SHA256 a62c20222dee228f59524501bdd5c248955c5c2193717fa5617a14ce633bf44f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  chrome_proxy.exe
                  • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
                  • Size 2.0MB
                  • SHA256 f3ee4d7aeec608b25ac1786312c3e9b08c56f1bf6e0b0c6e592dabb5f2558900
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  appletviewer.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
                  • Size 1.4MB
                  • SHA256 0822ba61170cbc798d7de6d406dd92944971accb2ec840e4b12e7001a13e7f85
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  extcheck.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
                  • Size 1.4MB
                  • SHA256 2e3c9b1be32fc506d4d66d0609a2ab4a1b9822182367ae403408c64aa6e7555a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  idlj.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
                  • Size 1.4MB
                  • SHA256 df69ea135c3b96e19c1018a16ed4ec64d6d240f8bc1fe6a1a7ff25fe2b7b7a20
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  jabswitch.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
                  • Size 1.4MB
                  • SHA256 4ffdcb477985e9189be20c9900c0eaac3ccbef11bcb7e5c34e6eaa5a5ec63475
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  jar.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
                  • Size 1.4MB
                  • SHA256 65181b528772e810201b530c422ebaabbd292de985bd1d8ee32c112b51cd4f03
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  jarsigner.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
                  • Size 1.4MB
                  • SHA256 c5b9fb70538588d29fc93f62fd487dfe606c7958ddf80786d71f5f84bb8d35bb
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  java-rmi.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
                  • Size 1.4MB
                  • SHA256 27eb32d6e49dd73f539ac0bc7a64faedc37a766c63596e6d0d2e86ebe0bd24a1
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  java.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
                  • Size 1.6MB
                  • SHA256 92627cbe24736c2c97b7ca23768a85ad308e29f8c3b9e49f672161f3db315055
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  javac.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
                  • Size 1.4MB
                  • SHA256 0cb350f8392e0edbbceb0fe25504e168cc72dd3fde51acf2a761d7b27a90241b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  javadoc.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
                  • Size 1.4MB
                  • SHA256 313829fe2fb998c982f8ef1c98070259157c0db6707b02bfe2dea3767e40e4fe
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  javafxpackager.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
                  • Size 1.5MB
                  • SHA256 42f1fdec8a228979e3b25e7346e7e43214444e069f5c39c35455057af73ceaf0
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  javah.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
                  • Size 1.4MB
                  • SHA256 b6d5915a18172b6b7c9c354bebcde4cff21e7b1caac80b092764c3abc24d2e71
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  javap.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
                  • Size 1.4MB
                  • SHA256 ab1f2e989157296c7574a5d9806784a3ddedde9606088d0b1de18eedb5ee88d9
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  javapackager.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
                  • Size 1.5MB
                  • SHA256 682a851e279149be82e672212c8938ef9f1e5b32d78fa2d672fce0c6e7db2c56
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  javaw.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
                  • Size 1.6MB
                  • SHA256 e7ba010dff261d319694e1d6355c98822407db2b0078c98a8ef0412d9fe0a5bb
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MsSense.exe
                  • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
                  • Size 1.8MB
                  • SHA256 bba54934104b3b752326e2303f8234e7ec8c0e1f4f431e24fb708e906ce35c90
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  NisSrv.exe
                  • Path C:\Program Files\Windows Defender\NisSrv.exe
                  • Size 3.5MB
                  • SHA256 9e6d6e3e55311efb9c9f975c8c0553ff0985eb2e4b583eea7c9ed92e519fae16
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  wmpnetwk.exe
                  • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
                  • Size 1.4MB
                  • SHA256 f7c939338c83dd1f7482d2071364e2925a2a959225805faf459c6367d21330d7
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  dotnet.exe
                  • Path C:\Program Files\dotnet\dotnet.exe
                  • Size 1.5MB
                  • SHA256 e43f9c8953037b1825522854c27d535ebf8c2e43bbbcb3dc8eb584a8eceb12c6
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Windows.db
                  • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
                  • Size 996KB
                  • SHA256 59a6067d20b37cdd46eb2cc71cd83a215db6f74b085765e7cbe0e92a3e17cc55
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Windows.db-wal
                  • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
                  • Size 1.4MB
                  • SHA256 2434cfab1c0e32230f5a49384d4ca7c8c8a5af25958c6aff6fcfd0125cdb2b35
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  the-real-index
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Code Cache\js\index-dir\the-real-index
                  • Size 384B
                  • SHA256 210e957d0a52e899899fe24580c163202dc659c7c5867a099bc0df3365272a07
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  the-real-index~RFe5b0ae9.TMP
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Code Cache\js\index-dir\the-real-index~RFe5b0ae9.TMP
                  • Size 48B
                  • SHA256 1f714370fee9390225af56a3a3757449694d449906e17828e6c8f373158c63b3
                  • MD5 SHA1 SHA512
                  Submit Download

                  data_1
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\DawnGraphiteCache\data_1
                  • Size 264KB
                  • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  data_0
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_0
                  • Size 8KB
                  • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  data_2
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_2
                  • Size 8KB
                  • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  data_3
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_3
                  • Size 8KB
                  • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  Network Persistent State
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\Network Persistent State
                  • Size 111B
                  • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Network Persistent State~RFe5bc9e4.TMP
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\Network Persistent State~RFe5bc9e4.TMP
                  • Size 59B
                  • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  SCT Auditing Pending Reports
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\SCT Auditing Pending Reports
                  • Size 2B
                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                  • MD5 SHA1 SHA512
                  Submit Download

                  TransportSecurity
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity
                  • Size 188B
                  • SHA256 b85a31e3bb4ee09edd7ee142b16a3f0149ded7416b8fd8fb0390c680f137657e
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  TransportSecurity~RFe5b602d.TMP
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity~RFe5b602d.TMP
                  • Size 188B
                  • SHA256 8a7c70980ae005df391933a7d183d3bad900a45578ce81da23a3e7285a3066dc
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Preferences
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences
                  • Size 7KB
                  • SHA256 ee8d35a9a4857a05c1fe69f63f66abaf308b5ccf48717c35a13aeb98561bc8a3
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Preferences~RFe5b0915.TMP
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences~RFe5b0915.TMP
                  • Size 7KB
                  • SHA256 d08ac651ab84fb9d7772a1e1ea18827f2b38ba6a673ca568551041245f4ac41a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  CURRENT
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Site Characteristics Database\CURRENT
                  • Size 16B
                  • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                  • MD5 SHA1 SHA512
                  Submit Download

                  MANIFEST-000001
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Site Characteristics Database\MANIFEST-000001
                  • Size 41B
                  • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                  • MD5 SHA1 SHA512
                  Submit Download

                  Local State
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
                  • Size 1KB
                  • SHA256 54d666da4b2e0c86d67299b838102fd2ddca7f245bbc24dfada5eae1d9369af6
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Local State
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
                  • Size 2KB
                  • SHA256 afbebed925e256752e2e00ee094c2ed57b3793300eb0fa4aed4eae6490ca48a0
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Local State
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
                  • Size 2KB
                  • SHA256 bcb4817dc110a3aaa30923ebe1503d12fb233d9b730a7c9c45ee2af476a2e78f
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Local State~RFe5aa058.TMP
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State~RFe5aa058.TMP
                  • Size 890B
                  • SHA256 ec3cd65f38d20660d261d8ef3d9e829237627ccdb57d6cb314e55ea68636bcef
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  config.vdf
                  • Path C:\Users\Admin\AppData\Local\Temp\config\config.vdf
                  • Size 16KB
                  • SHA256 dbbf913cfd7cf7df185e65b6bd1d4cd971a9c146b189eb56ac9e80dd20dc091e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  config.vdf
                  • Path C:\Users\Admin\AppData\Local\Temp\config\config.vdf
                  • Size 16KB
                  • SHA256 0246c9b6684288db894d4614c3c7141634d21f1cbac7d02549e016cde2853c7b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  config.vdf
                  • Path C:\Users\Admin\AppData\Local\Temp\config\config.vdf
                  • Size 1KB
                  • SHA256 8f9f970835f133258a7f740126012439385bbaa5a1d6a9d0d967a390977441c3
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  config.vdf~RFe5ab5c4.TMP
                  • Path C:\Users\Admin\AppData\Local\Temp\config\config.vdf~RFe5ab5c4.TMP
                  • Size 1KB
                  • SHA256 f3847b5e4a40d9cf76df35398bb555117dfe3626c00a91f2babdedb619d6ad53
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  crashhandler64.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\crashhandler64.dll
                  • Size 485KB
                  • SHA256 600785b8c5dacf926c8c768d398c4a1f00e97464b2d163af7e0a934f9b0d78e9
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  bootstrap_log.txt
                  • Path C:\Users\Admin\AppData\Local\Temp\logs\bootstrap_log.txt
                  • Size 13KB
                  • SHA256 d7c75f63790e890f5ef3c9a0f5f262f6132c5d988ff50b3d603e735b912e2dff
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  steam_client_metrics.bin
                  • Path C:\Users\Admin\AppData\Local\Temp\package\steam_client_metrics.bin
                  • Size 3KB
                  • SHA256 a9f838e0f2662ecbb0bb95675bd4c006ee64ba3e30a1a08af4d316cdaa4c1ce2
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  steam_client_win64.installed
                  • Path C:\Users\Admin\AppData\Local\Temp\package\steam_client_win64.installed
                  • Size 499KB
                  • SHA256 af7eb10f7913709007886bc1f8074f3ea8a97cdd21ccc68499dbb78aac2661fb
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  steam_client_win64.manifest
                  • Path C:\Users\Admin\AppData\Local\Temp\package\steam_client_win64.manifest
                  • Size 7KB
                  • SHA256 916759b96fbd5e75ad015335ba85cd80466a24f0a43d9a323fe2b60983bb6858
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  [email protected]_
                  • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\[email protected]_
                  • Size 15KB
                  • SHA256 983aa3928f15f5154266be7063a75e1fce87238bbe81a910219dea01d5376824
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  icon_button_news_mousedown.tga_
                  • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\icon_button_news_mousedown.tga_
                  • Size 20KB
                  • SHA256 cab3a68b64d8bf22c44080f12d7eab5b281102a8761f804224074ab1f6130fe2
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  filter_clean_bulgarian.txt.gz_
                  • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\resource\filter_clean_bulgarian.txt.gz_
                  • Size 23B
                  • SHA256 6feb83ca306745d634903cf09274b7baf0ac38e43c6b3fab1a608be344c3ef64
                  • MD5 SHA1 SHA512
                  Submit Download

                  steambootstrapper_english.txt
                  • Path C:\Users\Admin\AppData\Local\Temp\public\steambootstrapper_english.txt
                  • Size 4KB
                  • SHA256 fbc09c1b9a55d04b57be8fb2ad5ab58b38f76054ecd3d1b70440a2d08191b05b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  f038293dc618523d.bin
                  • Path C:\Users\Admin\AppData\Roaming\f038293dc618523d.bin
                  • Size 12KB
                  • SHA256 810f8acbe8bd0e6c16bd99c40b580bf971c5010ec7e11a80ee16be6187f5dc73
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  perfhost.exe
                  • Path C:\Windows\SysWOW64\perfhost.exe
                  • Size 1.4MB
                  • SHA256 b73d1ead600e404e2860bd4f6bfeb7d77d5949d1d9b8c1143626f2a27cc35bee
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  AgentService.exe
                  • Path C:\Windows\System32\AgentService.exe
                  • Size 1.4MB
                  • SHA256 cc556a3147d35f0184b7211708a746dd3f6a574fe067078c9cbeb6f845609bbe
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ssh-agent.exe
                  • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                  • Size 1.9MB
                  • SHA256 bbe298fec8a935963be2d0ccf3ab547e6b785cf7889c0287646fc6a6f18baebd
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  PerceptionSimulationService.exe
                  • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
                  • Size 1.6MB
                  • SHA256 61b4e51a89cf27c5bbd4c47486a37d3184d7dca20ca503534ec21d8390fe77e2
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ReFsDedupSvc.exe
                  • Path C:\Windows\System32\ReFsDedupSvc.exe
                  • Size 2.6MB
                  • SHA256 770d0ae99fcbc0c2382bc9ee631f270f684182ce4d91d53526948ff9724a8f97
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  SearchIndexer.exe
                  • Path C:\Windows\System32\SearchIndexer.exe
                  • Size 1.4MB
                  • SHA256 893b9dd26a2291f43c45393cc82aac0c828499181f5b06a5409797925f0d34dd
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  SensorDataService.exe
                  • Path C:\Windows\System32\SensorDataService.exe
                  • Size 1.7MB
                  • SHA256 eadf9676cea191fe1f02855ea0e7094e1655f75330083c29dbc4397ebcf1cb30
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  AppVClient.exe
                  • Path C:\Windows\system32\AppVClient.exe
                  • Size 1.3MB
                  • SHA256 17da686607a522ce3bfafa6f054c2335a606704580931cb6fbf01a24fc9b52aa
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  SgrmBroker.exe
                  • Path C:\Windows\system32\Sgrm\SgrmBroker.exe
                  • Size 1.8MB
                  • SHA256 e3461c846b5acdfe22060bd7cab4158d91f3fb5af9470260a76d5f2dcaca7d53
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  memory/124-51-0x0000000140000000-0x00000001401A8000-memory.dmp
                  Download

                  memory/124-38-0x0000000140000000-0x00000001401A8000-memory.dmp
                  Download

                  memory/124-45-0x0000000001B00000-0x0000000001B60000-memory.dmp
                  Download

                  memory/124-39-0x0000000001B00000-0x0000000001B60000-memory.dmp
                  Download

                  memory/124-49-0x0000000001B00000-0x0000000001B60000-memory.dmp
                  Download

                  memory/948-106-0x0000000000730000-0x0000000000790000-memory.dmp
                  Download

                  memory/948-328-0x0000000000730000-0x0000000000790000-memory.dmp
                  Download

                  memory/948-319-0x0000000140000000-0x00000001401BA000-memory.dmp
                  Download

                  memory/948-99-0x0000000140000000-0x00000001401BA000-memory.dmp
                  Download

                  memory/948-330-0x0000000140000000-0x00000001401BA000-memory.dmp
                  Download

                  memory/964-6-0x0000000002030000-0x0000000002090000-memory.dmp
                  Download

                  memory/964-6977-0x0000000002030000-0x0000000002090000-memory.dmp
                  Download

                  memory/964-6991-0x0000000140000000-0x0000000140798000-memory.dmp
                  Download

                  memory/964-81-0x0000000140000000-0x0000000140798000-memory.dmp
                  Download

                  memory/964-0-0x0000000002030000-0x0000000002090000-memory.dmp
                  Download

                  memory/964-9-0x0000000140000000-0x0000000140798000-memory.dmp
                  Download

                  memory/988-124-0x0000000140000000-0x0000000140168000-memory.dmp
                  Download

                  memory/988-125-0x0000000000CE0000-0x0000000000D40000-memory.dmp
                  Download

                  memory/988-139-0x0000000140000000-0x0000000140168000-memory.dmp
                  Download

                  memory/988-134-0x0000000000CE0000-0x0000000000D40000-memory.dmp
                  Download

                  memory/988-131-0x0000000000CE0000-0x0000000000D40000-memory.dmp
                  Download

                  memory/1124-315-0x0000000140000000-0x00000001402C9000-memory.dmp
                  Download

                  memory/1124-94-0x0000000000730000-0x0000000000790000-memory.dmp
                  Download

                  memory/1124-87-0x0000000140000000-0x00000001402C9000-memory.dmp
                  Download

                  memory/1124-88-0x0000000000730000-0x0000000000790000-memory.dmp
                  Download

                  memory/1124-355-0x0000000000730000-0x0000000000790000-memory.dmp
                  Download

                  memory/1124-356-0x0000000140000000-0x00000001402C9000-memory.dmp
                  Download

                  memory/1344-120-0x0000000000DF0000-0x0000000000E50000-memory.dmp
                  Download

                  memory/1344-322-0x0000000140000000-0x0000000140211000-memory.dmp
                  Download

                  memory/1344-113-0x0000000000DF0000-0x0000000000E50000-memory.dmp
                  Download

                  memory/1344-119-0x0000000140000000-0x0000000140211000-memory.dmp
                  Download

                  memory/1848-60-0x0000000000960000-0x00000000009C0000-memory.dmp
                  Download

                  memory/1848-54-0x0000000000960000-0x00000000009C0000-memory.dmp
                  Download

                  memory/1848-53-0x0000000140000000-0x00000001401A2000-memory.dmp
                  Download

                  memory/1848-283-0x0000000140000000-0x00000001401A2000-memory.dmp
                  Download

                  memory/2332-13-0x0000000140000000-0x00000001402E9000-memory.dmp
                  Download

                  memory/2332-14-0x0000000000D50000-0x0000000000DB0000-memory.dmp
                  Download

                  memory/2332-22-0x0000000000D50000-0x0000000000DB0000-memory.dmp
                  Download

                  memory/2332-111-0x0000000140000000-0x00000001402E9000-memory.dmp
                  Download

                  memory/3400-143-0x00000000006A0000-0x0000000000700000-memory.dmp
                  Download

                  memory/3400-142-0x0000000140000000-0x0000000140172000-memory.dmp
                  Download

                  memory/3400-149-0x00000000006A0000-0x0000000000700000-memory.dmp
                  Download

                  memory/3400-331-0x0000000140000000-0x0000000140172000-memory.dmp
                  Download

                  memory/4844-35-0x00000000006E0000-0x0000000000740000-memory.dmp
                  Download

                  memory/4844-26-0x0000000140000000-0x00000001402D4000-memory.dmp
                  Download

                  memory/4844-141-0x0000000140000000-0x00000001402D4000-memory.dmp
                  Download

                  memory/4844-27-0x00000000006E0000-0x0000000000740000-memory.dmp
                  Download

                  memory/5048-306-0x0000000140000000-0x000000014019E000-memory.dmp
                  Download

                  memory/5048-72-0x0000000000CC0000-0x0000000000D20000-memory.dmp
                  Download

                  memory/5048-64-0x0000000140000000-0x000000014019E000-memory.dmp
                  Download

                  memory/5048-66-0x0000000000CC0000-0x0000000000D20000-memory.dmp
                  Download

                  memory/5900-308-0x0000000000400000-0x000000000056A000-memory.dmp
                  Download

                  memory/5900-76-0x00000000009A0000-0x0000000000A07000-memory.dmp
                  Download

                  memory/5900-82-0x00000000009A0000-0x0000000000A07000-memory.dmp
                  Download

                  memory/5900-84-0x0000000000400000-0x000000000056A000-memory.dmp
                  Download

                  memory/7576-7379-0x0000000140000000-0x00000001407D6000-memory.dmp
                  Download

                  memory/7576-7124-0x0000000140000000-0x00000001407D6000-memory.dmp
                  Download

                  memory/7576-7122-0x000002FE872C0000-0x000002FE87320000-memory.dmp
                  Download

                  memory/7576-7121-0x000002FE872C0000-0x000002FE87320000-memory.dmp
                  Download

                  memory/9872-6986-0x00000000020D0000-0x0000000002130000-memory.dmp
                  Download

                  memory/9872-6979-0x0000000140000000-0x0000000140798000-memory.dmp
                  Download

                  memory/9872-7269-0x0000000140000000-0x0000000140798000-memory.dmp
                  Download

                  memory/9872-6980-0x00000000020D0000-0x0000000002130000-memory.dmp
                  Download

                  memory/11740-7062-0x0000000001140000-0x00000000011A0000-memory.dmp
                  Download

                  memory/11740-7068-0x0000000001140000-0x00000000011A0000-memory.dmp
                  Download

                  memory/11740-7061-0x0000000140000000-0x00000001401D7000-memory.dmp
                  Download

                  memory/11740-7071-0x0000000001140000-0x00000000011A0000-memory.dmp
                  Download

                  memory/11740-7073-0x0000000140000000-0x00000001401D7000-memory.dmp
                  Download

                  memory/13764-7075-0x0000000140000000-0x00000001407D6000-memory.dmp
                  Download

                  memory/13764-7387-0x0000000003C00000-0x0000000004085000-memory.dmp
                  Download

                  memory/13764-7311-0x0000000140000000-0x00000001407D6000-memory.dmp
                  Download

                  memory/13764-7092-0x00000000012C0000-0x0000000001320000-memory.dmp
                  Download

                  memory/13764-7086-0x00000000012C0000-0x0000000001320000-memory.dmp
                  Download

                  memory/15112-7102-0x0000000140000000-0x00000001407D6000-memory.dmp
                  Download

                  memory/15112-7347-0x0000000140000000-0x00000001407D6000-memory.dmp
                  Download

                  memory/15112-7100-0x00000000010C0000-0x0000000001120000-memory.dmp
                  Download

                  memory/15112-7094-0x00000000010C0000-0x0000000001120000-memory.dmp
                  Download

                  memory/16936-7174-0x00000000013E0000-0x0000000001440000-memory.dmp
                  Download

                  memory/16936-7398-0x0000000140000000-0x00000001407D6000-memory.dmp
                  Download

                  memory/16936-7182-0x0000000140000000-0x00000001407D6000-memory.dmp
                  Download

                  memory/16936-7168-0x00000000013E0000-0x0000000001440000-memory.dmp
                  Download

                  memory/17160-7177-0x00007FFF176C0000-0x00007FFF176C1000-memory.dmp
                  Download

                  memory/17160-7178-0x00007FFF18350000-0x00007FFF18351000-memory.dmp
                  Download

                  memory/17160-7179-0x0000022981A00000-0x0000022981A60000-memory.dmp
                  Download

                  memory/17160-7202-0x0000000140000000-0x00000001407D6000-memory.dmp
                  Download

                  memory/17160-7181-0x0000022981A00000-0x0000022981A60000-memory.dmp
                  Download

                  memory/17160-7399-0x0000000140000000-0x00000001407D6000-memory.dmp
                  Download

                  memory/20220-7246-0x0000000140000000-0x000000014017F000-memory.dmp
                  Download

                  memory/20220-7247-0x0000000140000000-0x000000014017F000-memory.dmp
                  Download

                  memory/20264-7271-0x000002647D7A0000-0x000002647D800000-memory.dmp
                  Download

                  memory/20264-7270-0x000002647D7A0000-0x000002647D800000-memory.dmp
                  Download

                  memory/20264-7451-0x000002647E480000-0x000002647E905000-memory.dmp
                  Download

                  memory/20264-7450-0x0000000140000000-0x00000001407D6000-memory.dmp
                  Download

                  memory/20264-7279-0x0000000140000000-0x00000001407D6000-memory.dmp
                  Download

                  memory/21060-7290-0x0000000000480000-0x00000000004E0000-memory.dmp
                  Download

                  memory/21060-7289-0x0000000140000000-0x0000000140198000-memory.dmp
                  Download

                  memory/21060-7300-0x0000000140000000-0x0000000140198000-memory.dmp
                  Download

                  memory/21060-7298-0x0000000000480000-0x00000000004E0000-memory.dmp
                  Download

                  memory/21060-7296-0x0000000000480000-0x00000000004E0000-memory.dmp
                  Download

                  memory/21080-7287-0x0000000000400000-0x000000000056F000-memory.dmp
                  Download

                  memory/21452-7314-0x00000000006E0000-0x0000000000747000-memory.dmp
                  Download

                  memory/21452-7323-0x0000000000400000-0x000000000058B000-memory.dmp
                  Download

                  memory/21452-7319-0x00000000006E0000-0x0000000000747000-memory.dmp
                  Download

                  memory/21452-7312-0x0000000000400000-0x000000000058B000-memory.dmp
                  Download

                  memory/23040-7388-0x00000000014E0000-0x0000000001540000-memory.dmp
                  Download

                  memory/23040-7403-0x0000000140000000-0x00000001407D6000-memory.dmp
                  Download

                  memory/23040-7424-0x0000000140000000-0x00000001407D6000-memory.dmp
                  Download

                  memory/23040-7395-0x00000000014E0000-0x0000000001540000-memory.dmp
                  Download

                  memory/23040-7420-0x00000000014E0000-0x0000000001540000-memory.dmp
                  Download