Overview

overview

9

Static

static

3

2026-07-30...nj.exe

windows10-2004-x64

9

2026-07-30...nj.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    31/07/2026, 00:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-30_ac2db665c7751cb70f02fec5b5c2c885_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
  • Size 6.0MB
  • Sample260731-arma6szgla
  • SHA256 1bd7186f2b346995e6f62f90e6754aac8da7fba855955d9e0f3a8cd915540beb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryspywarestealertrojan

Malware Config

Signatures

  • Executes dropped EXE 23 IoCs
  • Loads dropped DLL 63 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 41 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 40 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 1 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 47 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 16 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_ac2db665c7751cb70f02fec5b5c2c885_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-30_ac2db665c7751cb70f02fec5b5c2c885_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies trusted root certificate store through registry
    • Checks processor information in registry
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1312
    • C:\Users\Admin\AppData\Local\Temp\2026-07-30_ac2db665c7751cb70f02fec5b5c2c885_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
      C:\Users\Admin\AppData\Local\Temp\2026-07-30_ac2db665c7751cb70f02fec5b5c2c885_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
      2⤵
      • Loads dropped DLL
      • Checks SCSI registry key(s)
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:11668
      • C:\Users\Admin\AppData\Local\Temp\steamsysinfo.exe
        C:\Users\Admin\AppData\Local\Temp\steamsysinfo.exe -steamid 0 -buildid 1785187029 -logdir C:\Users\Admin\AppData\Local\Temp\logs -nocrashdialog -query 1 -out-file C:\Users\Admin\AppData\Local\Temp\4CBA.tmp
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3448
      • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
        C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe -nocrashdialog "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=11668" "-buildid=1785187029" "-steamid=0" "-logdir=C:\Users\Admin\AppData\Local\Temp\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Users\Admin\AppData\Local\Temp\clientui" "-steampath=C:\Users\Admin\AppData\Local\Temp\2026-07-30_ac2db665c7751cb70f02fec5b5c2c885_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling "--log-file=C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --disable-quick-menu --disable-component-update "--gaia-url=http://disabled.invalid" "--enable-features=PlatformHEVCDecoderSupport" "--disable-features=WinRetrieveSuggestionsOnlyOnDemand,SpareRendererForSitePerProcess,DcheckIsFatal,BlockPromptsIfIgnoredOften,WebUsbDeviceDetection,ValveFFmpegAllowLowDelayHEVC"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:13008
        • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
          C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\dumps "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1785187029 --initial-client-data=0x318,0x31c,0x320,0x314,0x324,0x7ff8900caea0,0x7ff8900caeac,0x7ff8900caeb8
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3180
        • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
          "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe" --type=gpu-process --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1785187029 --steamid=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1872,i,4686435275187032240,5867478100025298415,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=1880 --mojo-platform-channel-handle=1868 /prefetch:2
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:14624
        • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
          "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1785187029 --steamid=0 --field-trial-handle=2100,i,4686435275187032240,5867478100025298415,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2124 --mojo-platform-channel-handle=2120 /prefetch:11
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Time Discovery
          PID:6408
        • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
          "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1785187029 --steamid=0 --field-trial-handle=2216,i,4686435275187032240,5867478100025298415,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2232 --mojo-platform-channel-handle=2228 /prefetch:13
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:6492
        • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
          "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1785187029 --steamid=0 --gaia-url=http://disabled.invalid --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=4216,i,4686435275187032240,5867478100025298415,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4224 --mojo-platform-channel-handle=4220 /prefetch:1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:7548
        • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
          "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1785187029 --steamid=0 --field-trial-handle=5208,i,4686435275187032240,5867478100025298415,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5224 --mojo-platform-channel-handle=5220 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:8760
      • C:\Users\Admin\AppData\Local\Temp\bin\gldriverquery64.exe
        .\bin\gldriverquery64.exe
        3⤵
        • Executes dropped EXE
        PID:7436
      • C:\Users\Admin\AppData\Local\Temp\bin\gldriverquery.exe
        .\bin\gldriverquery.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:8044
      • C:\Users\Admin\AppData\Local\Temp\bin\vulkandriverquery64.exe
        .\bin\vulkandriverquery64.exe
        3⤵
        • Executes dropped EXE
        PID:8084
      • C:\Users\Admin\AppData\Local\Temp\bin\vulkandriverquery.exe
        .\bin\vulkandriverquery.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:8256
  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3216
  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:1420
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    PID:4512
  • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    PID:5848
  • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    1⤵
    • Executes dropped EXE
    PID:2068
  • C:\Windows\SysWow64\perfhost.exe
    C:\Windows\SysWow64\perfhost.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:5784
  • C:\Windows\System32\ReFsDedupSvc.exe
    C:\Windows\System32\ReFsDedupSvc.exe
    1⤵
    • Executes dropped EXE
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    PID:3328
  • C:\Windows\System32\SensorDataService.exe
    C:\Windows\System32\SensorDataService.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Checks SCSI registry key(s)
    PID:5608
  • C:\Windows\System32\OpenSSH\ssh-agent.exe
    C:\Windows\System32\OpenSSH\ssh-agent.exe
    1⤵
    • Executes dropped EXE
    PID:484
  • C:\Windows\system32\AgentService.exe
    C:\Windows\system32\AgentService.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:5356
  • C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\SearchIndexer.exe /Embedding
    1⤵
    • Executes dropped EXE
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3480
    • C:\Windows\System32\SearchProtocolHost.exe
      "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
      2⤵
        PID:1960
      • C:\Windows\System32\SearchProtocolHost.exe
        "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
        2⤵
        • Modifies data under HKEY_USERS
        PID:2592
      • C:\Windows\System32\SearchFilterHost.exe
        "C:\Windows\System32\SearchFilterHost.exe" 944 2652 2848 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
        2⤵
        • Modifies data under HKEY_USERS
        PID:1340
      • C:\Windows\System32\SearchFilterHost.exe
        "C:\Windows\System32\SearchFilterHost.exe" 944 2852 2880 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
        2⤵
        • Modifies data under HKEY_USERS
        PID:2368
      • C:\Windows\System32\SearchProtocolHost.exe
        "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
        2⤵
        • Modifies data under HKEY_USERS
        PID:9628
      • C:\Windows\System32\SearchFilterHost.exe
        "C:\Windows\System32\SearchFilterHost.exe" 944 2652 2848 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
        2⤵
          PID:9680
        • C:\Windows\System32\SearchFilterHost.exe
          "C:\Windows\System32\SearchFilterHost.exe" 944 2852 2880 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
          2⤵
            PID:9732
        • C:\Windows\system32\AUDIODG.EXE
          C:\Windows\system32\AUDIODG.EXE 0x00000000000004F4 0x00000000000004EC
          1⤵
            PID:7056
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
            1⤵
              PID:8980
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
              1⤵
              • Modifies data under HKEY_USERS
              PID:9096

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  elevation_service.exe
                  • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                  • Size 2.7MB
                  • SHA256 ebe60627aea023fe217651cdc1d83ac8778821a1399b733b157d86fc9cefd8d3
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  maintenanceservice.exe
                  • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                  • Size 1.7MB
                  • SHA256 8e02cc708027115712cdd9b6e50a9dcd2d4f08d271558ade6fa5708284351c53
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  7z.exe
                  • Path C:\Program Files\7-Zip\7z.exe
                  • Size 2.0MB
                  • SHA256 5740c67913651152a33e859e77bc0524e3c85c8b58998216d944dc667ed3c31c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  7zFM.exe
                  • Path C:\Program Files\7-Zip\7zFM.exe
                  • Size 1.5MB
                  • SHA256 e8c20a01e40719149ebd62e7471f3084766681198b95212de4946bac7cde7f1e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  7zG.exe
                  • Path C:\Program Files\7-Zip\7zG.exe
                  • Size 1.2MB
                  • SHA256 d83481d74594ad053f75ba3991d46a3ec3d73ba8ca2d3dd58ad0af91546ac059
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Uninstall.exe
                  • Path C:\Program Files\7-Zip\Uninstall.exe
                  • Size 1.5MB
                  • SHA256 c573ff253b749a3dd55e1e3a1323fed79a604f4a2ae4edcae30a5e6fc5349d5f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  AppVShNotify.exe
                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
                  • Size 1.7MB
                  • SHA256 1211fe5d093c4cac81801cff6a01d8e73e7be804b969ee34735f327feae50b02
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  IntegratedOffice.exe
                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
                  • Size 4.6MB
                  • SHA256 ca2352a984f346c9192a4993a1b388e1062204f113d77ebadca26264bd1c94d7
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MavInject32.exe
                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
                  • Size 1.8MB
                  • SHA256 4021829e0050cd178e748ae79d5d26225c9e4284bd0ae61b63dd4a11b5429ddf
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  OfficeC2RClient.exe
                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
                  • Size 24.0MB
                  • SHA256 92a2f6cc0e5093262607db5b7710e633426843be9acc426233935446a01f426a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  appvcleaner.exe
                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
                  • Size 2.7MB
                  • SHA256 8f78e7275b241beb78e8fc45d20e7a062f369f5b6df7a4bce0dfae240f87414d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  LICLUA.EXE
                  • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
                  • Size 1.1MB
                  • SHA256 e34b56c6e4084408f50a5887e2f7d44980f042d3c8a7cf1faa3732a4a072a36f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  OSE.EXE
                  • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                  • Size 1.7MB
                  • SHA256 3fbfcd5399bd40a2d15ff950bda513a73a102973620ce6aa78afbb72badb3448
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  VSTOInstaller.exe
                  • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
                  • Size 1.5MB
                  • SHA256 0a12ef66139a6203680d7bc74557311000774ef0bbd25c007239fa6fafe84f46
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  chrmstp.exe
                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
                  • Size 6.6MB
                  • SHA256 bac708fd1bdeafd4a843ef493aa1732f6132a6f57a77dc6f051c0d36970f9a27
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  setup.exe
                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
                  • Size 6.6MB
                  • SHA256 3eca775628f026109f084880b9c448c36eecf7c9501fd55d5be852e2d14a4dd8
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  chrome_pwa_launcher.exe
                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
                  • Size 2.3MB
                  • SHA256 5413331b8073781f7cc49ab5cb16e8a338019533c08c6b4c9fa3414debdd665a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  elevated_tracing_service.exe
                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
                  • Size 4.0MB
                  • SHA256 606de4e502cf3f1a8973b13f0dcc909278ae57dcdf3a45a2e54c107fed62d1b5
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  elevation_service.exe
                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                  • Size 2.8MB
                  • SHA256 21eaf27342fa9152dbce375f24b7e407a314cafae1846ad3282168275f5fa99d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  notification_helper.exe
                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
                  • Size 2.2MB
                  • SHA256 a1fea500d4911b502ee97f143cd1f1b03f568255631aecf2f736f38931018eb0
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  os_update_handler.exe
                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
                  • Size 2.4MB
                  • SHA256 00d9c2ed5c4479db236317776b587cfa95e4da7037cfe63dc603cf29fa126d5f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  chrome_proxy.exe
                  • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
                  • Size 2.0MB
                  • SHA256 2e4157343fa9135c5074d227a84a48823187d48170ee943e7223744e9c68092b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  appletviewer.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
                  • Size 1.5MB
                  • SHA256 e8bbbdcb4530d920db4cd2254f564c4776c7a9ba4ff444bbb3d9b52463ab493d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  extcheck.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
                  • Size 1.5MB
                  • SHA256 aba14beb05db69113ae7d443b2860b5332e4bd1b4436625f485ef8043858dbb9
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  idlj.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
                  • Size 1.5MB
                  • SHA256 2d99c45ffbfe400224a05dd3b554f3953a16e6443161a7ea3a26b44635b959ce
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  jabswitch.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
                  • Size 1.5MB
                  • SHA256 2a252c7b8881fc09644d285407fa7ba3d4722745b745f2167b3cbea730161a8b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  jar.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
                  • Size 1.5MB
                  • SHA256 75a74d2c0a2cf3c63e26a30de89744070d304eb6c750826db3aaaaad7ea86919
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  jarsigner.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
                  • Size 1.5MB
                  • SHA256 2c4bbdbf8e42b3e2a4fde4be89f16cdefd043d37ba86f772329d30c38eb0b05d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  java-rmi.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
                  • Size 1.5MB
                  • SHA256 0158b9baae426396a7e88849d9351191b0cff7cb4855e0b87ca4585a576866c3
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  java.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
                  • Size 1.7MB
                  • SHA256 ceea04cfcdd22db67fdd94d9202d5d6d88122cea6fb47d03cdb15bbff6816636
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  javac.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
                  • Size 1.5MB
                  • SHA256 d6cf3a996697fe417ed65cfd66fa720f3f8eb90b98b85fd6ee55a1966a3c4a60
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  javadoc.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
                  • Size 1.5MB
                  • SHA256 1733eb905661687eabd5a816d3c7b1be6659d152e36c3d9781f9ab9d5014c30d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  javafxpackager.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
                  • Size 1.6MB
                  • SHA256 bf19b151d8939e171229db8a25c595964161ee3f9b1cd5f749135b896c635efa
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  javah.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
                  • Size 1.5MB
                  • SHA256 a3bceafe355744a978d2edcc87ac5d73d833ca9ac306e0de94f3d7c3fec19577
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  javap.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
                  • Size 1.5MB
                  • SHA256 8cf24276424a739cb97adfc11aa7d207f562638656643dc4b98cf96a8fc80674
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  javapackager.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
                  • Size 1.6MB
                  • SHA256 85762b61d6f0357e825cfffdc938d81c7f2cd8e6637e4f06aa3d80032abfe37a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  javaw.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
                  • Size 1.7MB
                  • SHA256 2d9a43fc1f8af531d8f4d4f304306a7f9b72534ec8fad90f06dd0a30791130e5
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MsSense.exe
                  • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
                  • Size 1.9MB
                  • SHA256 7f076347585a23e1dfde4ccd053966e2d01718476d5281c0be11df5033b32a39
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  NisSrv.exe
                  • Path C:\Program Files\Windows Defender\NisSrv.exe
                  • Size 3.5MB
                  • SHA256 670b26ed18c5cf351e5fc6c66567dd88252d992063cf9e8bab044fb6993c6c16
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  wmpnetwk.exe
                  • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
                  • Size 1.4MB
                  • SHA256 8eda9e680c8fb5b54bd28b3f11b1cabc8fdc0312a5755406fff38f973f7cd0ce
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  dotnet.exe
                  • Path C:\Program Files\dotnet\dotnet.exe
                  • Size 1.6MB
                  • SHA256 20d0d4a0748f270bb8e96b6ef19238e906af41831d8267ba90ceb5966ec721b4
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Windows.db
                  • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
                  • Size 1.2MB
                  • SHA256 a2ec2c2cbbde77326add063c992eea57a9e59876f9f4fa1452bc699648a3835d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Windows.db-wal
                  • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
                  • Size 1.5MB
                  • SHA256 69af56da2a16be81429b71108a702b1c8f0657dab86f81b663166c8110658737
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  the-real-index
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Code Cache\js\index-dir\the-real-index
                  • Size 384B
                  • SHA256 73f84071636a4de99de35fd5f8b2f70aeec0ff820070a033fc8cfcb111709327
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  the-real-index~RFe5acaf2.TMP
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Code Cache\js\index-dir\the-real-index~RFe5acaf2.TMP
                  • Size 48B
                  • SHA256 a05e254a75bf7140826344aa26af1569dc60b473df5ae6939ae3278cef76718b
                  • MD5 SHA1 SHA512
                  Submit Download

                  CURRENT
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Extension Rules\CURRENT
                  • Size 16B
                  • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                  • MD5 SHA1 SHA512
                  Submit Download

                  MANIFEST-000001
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Extension Scripts\MANIFEST-000001
                  • Size 41B
                  • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                  • MD5 SHA1 SHA512
                  Submit Download

                  data_0
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_0
                  • Size 8KB
                  • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  data_2
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_2
                  • Size 8KB
                  • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  data_3
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_3
                  • Size 8KB
                  • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  5182ef42-5111-43e7-9795-362ea3a4af54.tmp
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\5182ef42-5111-43e7-9795-362ea3a4af54.tmp
                  • Size 188B
                  • SHA256 0c4f0d29a3f9219ce471f002e122690027416b8e76b52bf162675a74f98e0376
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  SCT Auditing Pending Reports
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\SCT Auditing Pending Reports
                  • Size 2B
                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                  • MD5 SHA1 SHA512
                  Submit Download

                  TransportSecurity~RFe5b1ebf.TMP
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity~RFe5b1ebf.TMP
                  • Size 188B
                  • SHA256 4ef3df04ad16f8ed77fe67fcb841c3b992fac10397dd3d1929cfe2125ef2a4fa
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Preferences
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences
                  • Size 7KB
                  • SHA256 c60d115198d6a7df913d6cb1bbcb74bf0353c7754287de38e2b4b90ed3ca87d1
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Preferences~RFe5ab70d.TMP
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences~RFe5ab70d.TMP
                  • Size 7KB
                  • SHA256 a01503399fcd6bf2ee2c72cceaf0f51f2a6f7cde54a3a970c9577cd6e17d71c1
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Local State
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
                  • Size 1KB
                  • SHA256 3e2fdaad73cf93bb8337c3e0e37e7045cecd1764bb13d0aa7b2adaae5ebadd78
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Local State
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
                  • Size 2KB
                  • SHA256 71acf068ac81294233a9f33d535346909e2e78b5a69a8fc44bcebe73e1a09b4a
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Local State
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
                  • Size 890B
                  • SHA256 e2bb7853aad1a4deff1ee4e2930c3b03663cec70047118e0dee2cea0d2aef856
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Local State
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
                  • Size 2KB
                  • SHA256 2c7651e4c86a1c9b7cb4058433910be71859ee4f8935900622d0401ce5a340f8
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Local State
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
                  • Size 2KB
                  • SHA256 28226aa748cf198e17ce2a6c967f4aee5d22cf4ab5b1e8c78c08bfdde606c6e6
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  config.vdf
                  • Path C:\Users\Admin\AppData\Local\Temp\config\config.vdf
                  • Size 1KB
                  • SHA256 f3847b5e4a40d9cf76df35398bb555117dfe3626c00a91f2babdedb619d6ad53
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  config.vdf
                  • Path C:\Users\Admin\AppData\Local\Temp\config\config.vdf
                  • Size 11KB
                  • SHA256 3bf482ebffe9052a8750d9ed6165d63aa191e3ab8fee3595110c0fbbae3705d2
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  config.vdf
                  • Path C:\Users\Admin\AppData\Local\Temp\config\config.vdf
                  • Size 117B
                  • SHA256 a3d8a2cba6e356e02c0f33b50e3a9e61d2f9dfb6a26b5983e30e7786da95dba7
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  config.vdf
                  • Path C:\Users\Admin\AppData\Local\Temp\config\config.vdf
                  • Size 1KB
                  • SHA256 8f9f970835f133258a7f740126012439385bbaa5a1d6a9d0d967a390977441c3
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  crashhandler64.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\crashhandler64.dll
                  • Size 485KB
                  • SHA256 600785b8c5dacf926c8c768d398c4a1f00e97464b2d163af7e0a934f9b0d78e9
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  bootstrap_log.txt
                  • Path C:\Users\Admin\AppData\Local\Temp\logs\bootstrap_log.txt
                  • Size 13KB
                  • SHA256 aea3dfeb738b02e29b4383a2cd61ce8239fbb0f801d4e03733429dbbe0af5252
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  steam_client_metrics.bin
                  • Path C:\Users\Admin\AppData\Local\Temp\package\steam_client_metrics.bin
                  • Size 3KB
                  • SHA256 8079deb292c909b2687405432b2e68733e9779f7f89bd955abb07e546f2eb671
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  steam_client_win64.installed
                  • Path C:\Users\Admin\AppData\Local\Temp\package\steam_client_win64.installed
                  • Size 499KB
                  • SHA256 af7eb10f7913709007886bc1f8074f3ea8a97cdd21ccc68499dbb78aac2661fb
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  steam_client_win64.manifest
                  • Path C:\Users\Admin\AppData\Local\Temp\package\steam_client_win64.manifest
                  • Size 7KB
                  • SHA256 916759b96fbd5e75ad015335ba85cd80466a24f0a43d9a323fe2b60983bb6858
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  [email protected]_
                  • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\[email protected]_
                  • Size 15KB
                  • SHA256 983aa3928f15f5154266be7063a75e1fce87238bbe81a910219dea01d5376824
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  icon_button_news_mousedown.tga_
                  • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\icon_button_news_mousedown.tga_
                  • Size 20KB
                  • SHA256 cab3a68b64d8bf22c44080f12d7eab5b281102a8761f804224074ab1f6130fe2
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  filter_clean_bulgarian.txt.gz_
                  • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\resource\filter_clean_bulgarian.txt.gz_
                  • Size 23B
                  • SHA256 6feb83ca306745d634903cf09274b7baf0ac38e43c6b3fab1a608be344c3ef64
                  • MD5 SHA1 SHA512
                  Submit Download

                  steambootstrapper_english.txt
                  • Path C:\Users\Admin\AppData\Local\Temp\public\steambootstrapper_english.txt
                  • Size 4KB
                  • SHA256 fbc09c1b9a55d04b57be8fb2ad5ab58b38f76054ecd3d1b70440a2d08191b05b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  8a68e1d9238bf42.bin
                  • Path C:\Users\Admin\AppData\Roaming\8a68e1d9238bf42.bin
                  • Size 12KB
                  • SHA256 01010b3e323f9b9de606561bf70119dd402d06105da989b497df245312fc4139
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  perfhost.exe
                  • Path C:\Windows\SysWOW64\perfhost.exe
                  • Size 1.5MB
                  • SHA256 2fe5b8f7881b58f40adf0663d6d9b70045e2082bbcf9bdc685f09855a33a6c2e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  AgentService.exe
                  • Path C:\Windows\System32\AgentService.exe
                  • Size 1.4MB
                  • SHA256 e0e40e6b13afa7f23c492c81a2bf85c784bccfdd4eef3b56cddb6f2da30dbb64
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ssh-agent.exe
                  • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                  • Size 2.0MB
                  • SHA256 162ac86eb2357bc40fb3fcb9595d39e5f484529a2876ad9597e3fede99440402
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  PerceptionSimulationService.exe
                  • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
                  • Size 1.7MB
                  • SHA256 95ab4861e8bd37a98685dd932671c9f2f4339d8c247a4bb332bdef84ae65f402
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ReFsDedupSvc.exe
                  • Path C:\Windows\System32\ReFsDedupSvc.exe
                  • Size 2.6MB
                  • SHA256 7aeeb35e52724511bb99b0c1b0de8d326b6407b34893e590fff886c3da29bbee
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  SearchIndexer.exe
                  • Path C:\Windows\System32\SearchIndexer.exe
                  • Size 1.4MB
                  • SHA256 bbc54e80855bcd2b8e5fd440ebf52d23e85722ee7e47002d5545d0f86332c094
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  SensorDataService.exe
                  • Path C:\Windows\System32\SensorDataService.exe
                  • Size 1.7MB
                  • SHA256 d70e3cc74ca0508f11061b41d2af9e2edfee191f36efadf3a9de778d12ab02ee
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  AppVClient.exe
                  • Path C:\Windows\system32\AppVClient.exe
                  • Size 1.3MB
                  • SHA256 b1185b4b356905d5299e0907b7857c20be436f7f37fa59ea84a3e5eb69e5c34b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  SgrmBroker.exe
                  • Path C:\Windows\system32\Sgrm\SgrmBroker.exe
                  • Size 1.8MB
                  • SHA256 8a85d481772d7a5b0adb50350e60ca872c575c6ac9724d9c46a3c8abc09ddb75
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  memory/484-114-0x00000000007C0000-0x0000000000820000-memory.dmp
                  Download

                  memory/484-112-0x0000000140000000-0x0000000140221000-memory.dmp
                  Download

                  memory/484-120-0x00000000007C0000-0x0000000000820000-memory.dmp
                  Download

                  memory/484-321-0x0000000140000000-0x0000000140221000-memory.dmp
                  Download

                  memory/1312-6976-0x0000000001F80000-0x0000000001FE0000-memory.dmp
                  Download

                  memory/1312-6-0x0000000140000000-0x0000000140797000-memory.dmp
                  Download

                  memory/1312-8-0x0000000001F80000-0x0000000001FE0000-memory.dmp
                  Download

                  memory/1312-7-0x0000000001F80000-0x0000000001FE0000-memory.dmp
                  Download

                  memory/1312-76-0x0000000140000000-0x0000000140797000-memory.dmp
                  Download

                  memory/1312-0-0x0000000001F80000-0x0000000001FE0000-memory.dmp
                  Download

                  memory/1312-6987-0x0000000140000000-0x0000000140797000-memory.dmp
                  Download

                  memory/1420-35-0x00000000006E0000-0x0000000000740000-memory.dmp
                  Download

                  memory/1420-140-0x0000000140000000-0x00000001402D4000-memory.dmp
                  Download

                  memory/1420-26-0x0000000140000000-0x00000001402D4000-memory.dmp
                  Download

                  memory/1420-27-0x00000000006E0000-0x0000000000740000-memory.dmp
                  Download

                  memory/2068-66-0x0000000000C70000-0x0000000000CD0000-memory.dmp
                  Download

                  memory/2068-281-0x0000000140000000-0x00000001401AD000-memory.dmp
                  Download

                  memory/2068-64-0x0000000140000000-0x00000001401AD000-memory.dmp
                  Download

                  memory/2068-72-0x0000000000C70000-0x0000000000CD0000-memory.dmp
                  Download

                  memory/3180-7095-0x0000000140000000-0x00000001407D6000-memory.dmp
                  Download

                  memory/3180-7093-0x00000000010B0000-0x0000000001110000-memory.dmp
                  Download

                  memory/3180-7087-0x00000000010B0000-0x0000000001110000-memory.dmp
                  Download

                  memory/3180-7333-0x0000000140000000-0x00000001407D6000-memory.dmp
                  Download

                  memory/3216-14-0x0000000140000000-0x00000001402E9000-memory.dmp
                  Download

                  memory/3216-15-0x0000000000D20000-0x0000000000D80000-memory.dmp
                  Download

                  memory/3216-111-0x0000000140000000-0x00000001402E9000-memory.dmp
                  Download

                  memory/3216-21-0x0000000000D20000-0x0000000000D80000-memory.dmp
                  Download

                  memory/3328-88-0x0000000000740000-0x00000000007A0000-memory.dmp
                  Download

                  memory/3328-94-0x0000000000740000-0x00000000007A0000-memory.dmp
                  Download

                  memory/3328-310-0x0000000140000000-0x00000001402C9000-memory.dmp
                  Download

                  memory/3328-87-0x0000000140000000-0x00000001402C9000-memory.dmp
                  Download

                  memory/3328-353-0x0000000000740000-0x00000000007A0000-memory.dmp
                  Download

                  memory/3328-355-0x0000000140000000-0x00000001402C9000-memory.dmp
                  Download

                  memory/3448-7067-0x0000000001140000-0x00000000011A0000-memory.dmp
                  Download

                  memory/3448-7061-0x0000000001140000-0x00000000011A0000-memory.dmp
                  Download

                  memory/3448-7072-0x0000000140000000-0x00000001401D7000-memory.dmp
                  Download

                  memory/3448-7070-0x0000000001140000-0x00000000011A0000-memory.dmp
                  Download

                  memory/3448-7060-0x0000000140000000-0x00000001401D7000-memory.dmp
                  Download

                  memory/3480-142-0x0000000000620000-0x0000000000680000-memory.dmp
                  Download

                  memory/3480-141-0x0000000140000000-0x0000000140172000-memory.dmp
                  Download

                  memory/3480-148-0x0000000000620000-0x0000000000680000-memory.dmp
                  Download

                  memory/3480-329-0x0000000140000000-0x0000000140172000-memory.dmp
                  Download

                  memory/4512-45-0x0000000000C00000-0x0000000000C60000-memory.dmp
                  Download

                  memory/4512-49-0x0000000000C00000-0x0000000000C60000-memory.dmp
                  Download

                  memory/4512-51-0x0000000140000000-0x00000001401B8000-memory.dmp
                  Download

                  memory/4512-38-0x0000000140000000-0x00000001401B8000-memory.dmp
                  Download

                  memory/4512-39-0x0000000000C00000-0x0000000000C60000-memory.dmp
                  Download

                  memory/5356-138-0x0000000140000000-0x0000000140168000-memory.dmp
                  Download

                  memory/5356-136-0x0000000000C90000-0x0000000000CF0000-memory.dmp
                  Download

                  memory/5356-131-0x0000000000C90000-0x0000000000CF0000-memory.dmp
                  Download

                  memory/5356-125-0x0000000000C90000-0x0000000000CF0000-memory.dmp
                  Download

                  memory/5356-124-0x0000000140000000-0x0000000140168000-memory.dmp
                  Download

                  memory/5608-100-0x0000000000780000-0x00000000007E0000-memory.dmp
                  Download

                  memory/5608-106-0x0000000000780000-0x00000000007E0000-memory.dmp
                  Download

                  memory/5608-324-0x0000000140000000-0x00000001401BA000-memory.dmp
                  Download

                  memory/5608-322-0x0000000000780000-0x00000000007E0000-memory.dmp
                  Download

                  memory/5608-317-0x0000000140000000-0x00000001401BA000-memory.dmp
                  Download

                  memory/5608-99-0x0000000140000000-0x00000001401BA000-memory.dmp
                  Download

                  memory/5784-82-0x0000000000400000-0x000000000057A000-memory.dmp
                  Download

                  memory/5784-298-0x0000000000400000-0x000000000057A000-memory.dmp
                  Download

                  memory/5784-83-0x0000000000780000-0x00000000007E7000-memory.dmp
                  Download

                  memory/5784-77-0x0000000000780000-0x00000000007E7000-memory.dmp
                  Download

                  memory/5848-60-0x0000000000870000-0x00000000008D0000-memory.dmp
                  Download

                  memory/5848-54-0x0000000000870000-0x00000000008D0000-memory.dmp
                  Download

                  memory/5848-53-0x0000000140000000-0x00000001401B2000-memory.dmp
                  Download

                  memory/5848-243-0x0000000140000000-0x00000001401B2000-memory.dmp
                  Download

                  memory/6408-7365-0x0000000140000000-0x00000001407D6000-memory.dmp
                  Download

                  memory/6408-7163-0x0000000001400000-0x0000000001460000-memory.dmp
                  Download

                  memory/6408-7168-0x0000000001400000-0x0000000001460000-memory.dmp
                  Download

                  memory/6408-7181-0x0000000140000000-0x00000001407D6000-memory.dmp
                  Download

                  memory/6492-7179-0x0000018F9C000000-0x0000018F9C060000-memory.dmp
                  Download

                  memory/6492-7366-0x0000000140000000-0x00000001407D6000-memory.dmp
                  Download

                  memory/6492-7178-0x0000018F9C000000-0x0000018F9C060000-memory.dmp
                  Download

                  memory/6492-7176-0x00007FF8B7A30000-0x00007FF8B7A31000-memory.dmp
                  Download

                  memory/6492-7182-0x0000000140000000-0x00000001407D6000-memory.dmp
                  Download

                  memory/6492-7177-0x00007FF8B7480000-0x00007FF8B7481000-memory.dmp
                  Download

                  memory/6492-7385-0x0000018F9C590000-0x0000018F9CC86000-memory.dmp
                  Download

                  memory/7436-7251-0x0000000002140000-0x00000000021A0000-memory.dmp
                  Download

                  memory/7436-7257-0x0000000002140000-0x00000000021A0000-memory.dmp
                  Download

                  memory/7436-7250-0x0000000140000000-0x000000014017F000-memory.dmp
                  Download

                  memory/7436-7261-0x0000000140000000-0x000000014017F000-memory.dmp
                  Download

                  memory/7436-7259-0x0000000002140000-0x00000000021A0000-memory.dmp
                  Download

                  memory/7548-7433-0x000002908DE70000-0x000002908E566000-memory.dmp
                  Download

                  memory/7548-7278-0x0000000140000000-0x00000001407D6000-memory.dmp
                  Download

                  memory/7548-7272-0x000002908D8C0000-0x000002908D920000-memory.dmp
                  Download

                  memory/7548-7270-0x000002908D8C0000-0x000002908D920000-memory.dmp
                  Download

                  memory/7548-7434-0x0000000140000000-0x00000001407D6000-memory.dmp
                  Download

                  memory/8044-7307-0x0000000000400000-0x000000000057F000-memory.dmp
                  Download

                  memory/8084-7309-0x0000000140000000-0x00000001401A8000-memory.dmp
                  Download

                  memory/8084-7320-0x0000000140000000-0x00000001401A8000-memory.dmp
                  Download

                  memory/8084-7316-0x0000000000740000-0x00000000007A0000-memory.dmp
                  Download

                  memory/8084-7318-0x0000000000740000-0x00000000007A0000-memory.dmp
                  Download

                  memory/8256-7345-0x0000000000400000-0x000000000059B000-memory.dmp
                  Download

                  memory/8256-7341-0x00000000009D0000-0x0000000000A37000-memory.dmp
                  Download

                  memory/8256-7336-0x00000000009D0000-0x0000000000A37000-memory.dmp
                  Download

                  memory/8256-7334-0x0000000000400000-0x000000000059B000-memory.dmp
                  Download

                  memory/8760-7410-0x0000000001400000-0x0000000001460000-memory.dmp
                  Download

                  memory/8760-7430-0x0000000001400000-0x0000000001460000-memory.dmp
                  Download

                  memory/11668-7195-0x0000000140000000-0x0000000140797000-memory.dmp
                  Download

                  memory/11668-6985-0x0000000002060000-0x00000000020C0000-memory.dmp
                  Download

                  memory/11668-6978-0x0000000002060000-0x00000000020C0000-memory.dmp
                  Download

                  memory/11668-6984-0x0000000140000000-0x0000000140797000-memory.dmp
                  Download

                  memory/13008-7306-0x0000000140000000-0x00000001407D6000-memory.dmp
                  Download

                  memory/13008-7085-0x00000000012C0000-0x0000000001320000-memory.dmp
                  Download

                  memory/13008-7079-0x00000000012C0000-0x0000000001320000-memory.dmp
                  Download

                  memory/13008-7074-0x0000000140000000-0x00000001407D6000-memory.dmp
                  Download

                  memory/14624-7347-0x0000000140000000-0x00000001407D6000-memory.dmp
                  Download

                  memory/14624-7123-0x0000000140000000-0x00000001407D6000-memory.dmp
                  Download

                  memory/14624-7121-0x000001DCD3740000-0x000001DCD37A0000-memory.dmp
                  Download

                  memory/14624-7120-0x000001DCD3740000-0x000001DCD37A0000-memory.dmp
                  Download