Overview

overview

7

Static

static

3

2026-08-03...nj.exe

windows10-2004-x64

7

2026-08-03...nj.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/08/2026, 02:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_2eb604fdaebda468605d217057c4d4f4_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
  • Size 6.0MB
  • Sample260803-dctcqa1vd1
  • SHA256 85aefa7ed23adba83bfa766594bc5e7abebf3a3f4e4d92bcc330343a20807387
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryspywarestealertrojan

Malware Config

Signatures

  • Executes dropped EXE 23 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 41 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 40 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 47 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 16 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_2eb604fdaebda468605d217057c4d4f4_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_2eb604fdaebda468605d217057c4d4f4_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies trusted root certificate store through registry
    • Checks processor information in registry
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5672
    • C:\Users\Admin\AppData\Local\Temp\2026-08-03_2eb604fdaebda468605d217057c4d4f4_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
      C:\Users\Admin\AppData\Local\Temp\2026-08-03_2eb604fdaebda468605d217057c4d4f4_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
      2⤵
      • Loads dropped DLL
      • Checks SCSI registry key(s)
      • Checks processor information in registry
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:9592
      • C:\Users\Admin\AppData\Local\Temp\steamsysinfo.exe
        C:\Users\Admin\AppData\Local\Temp\steamsysinfo.exe -steamid 0 -buildid 1785187029 -logdir C:\Users\Admin\AppData\Local\Temp\logs -nocrashdialog -query 1 -out-file C:\Users\Admin\AppData\Local\Temp\3E52.tmp
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:12396
      • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
        C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe -nocrashdialog "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=9592" "-buildid=1785187029" "-steamid=0" "-logdir=C:\Users\Admin\AppData\Local\Temp\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Users\Admin\AppData\Local\Temp\clientui" "-steampath=C:\Users\Admin\AppData\Local\Temp\2026-08-03_2eb604fdaebda468605d217057c4d4f4_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling "--log-file=C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --disable-quick-menu --disable-component-update "--gaia-url=http://disabled.invalid" "--enable-features=PlatformHEVCDecoderSupport" "--disable-features=WinRetrieveSuggestionsOnlyOnDemand,SpareRendererForSitePerProcess,DcheckIsFatal,BlockPromptsIfIgnoredOften,WebUsbDeviceDetection,ValveFFmpegAllowLowDelayHEVC"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks processor information in registry
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:12776
        • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
          C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\dumps "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1785187029 --initial-client-data=0x318,0x31c,0x320,0x314,0x324,0x7fffa7f7aea0,0x7fffa7f7aeac,0x7fffa7f7aeb8
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:6048
        • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
          "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe" --type=gpu-process --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1785187029 --steamid=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1888,i,14771511563981513446,15025785844277712169,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=1892 --mojo-platform-channel-handle=1884 /prefetch:2
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:13468
        • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
          "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1785187029 --steamid=0 --field-trial-handle=2144,i,14771511563981513446,15025785844277712169,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2148 --mojo-platform-channel-handle=2136 /prefetch:11
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Time Discovery
          PID:14280
        • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
          "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1785187029 --steamid=0 --field-trial-handle=2236,i,14771511563981513446,15025785844277712169,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2252 --mojo-platform-channel-handle=2248 /prefetch:13
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:6220
        • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
          "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1785187029 --steamid=0 --gaia-url=http://disabled.invalid --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=4216,i,14771511563981513446,15025785844277712169,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4268 --mojo-platform-channel-handle=4264 /prefetch:1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:22312
        • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
          "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1785187029 --steamid=0 --field-trial-handle=5220,i,14771511563981513446,15025785844277712169,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5224 --mojo-platform-channel-handle=5196 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:24268
      • C:\Users\Admin\AppData\Local\Temp\bin\gldriverquery64.exe
        .\bin\gldriverquery64.exe
        3⤵
        • Executes dropped EXE
        PID:14028
      • C:\Users\Admin\AppData\Local\Temp\bin\gldriverquery.exe
        .\bin\gldriverquery.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:29684
      • C:\Users\Admin\AppData\Local\Temp\bin\vulkandriverquery64.exe
        .\bin\vulkandriverquery64.exe
        3⤵
        • Executes dropped EXE
        PID:20568
      • C:\Users\Admin\AppData\Local\Temp\bin\vulkandriverquery.exe
        .\bin\vulkandriverquery.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:19568
  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:5108
  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:2496
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    PID:4980
  • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    PID:3712
  • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    1⤵
    • Executes dropped EXE
    PID:5392
  • C:\Windows\SysWow64\perfhost.exe
    C:\Windows\SysWow64\perfhost.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:2020
  • C:\Windows\System32\ReFsDedupSvc.exe
    C:\Windows\System32\ReFsDedupSvc.exe
    1⤵
    • Executes dropped EXE
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    PID:3436
  • C:\Windows\System32\SensorDataService.exe
    C:\Windows\System32\SensorDataService.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Checks SCSI registry key(s)
    PID:1292
  • C:\Windows\System32\OpenSSH\ssh-agent.exe
    C:\Windows\System32\OpenSSH\ssh-agent.exe
    1⤵
    • Executes dropped EXE
    PID:1508
  • C:\Windows\system32\AgentService.exe
    C:\Windows\system32\AgentService.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:3644
  • C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\SearchIndexer.exe /Embedding
    1⤵
    • Executes dropped EXE
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4732
    • C:\Windows\System32\SearchProtocolHost.exe
      "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
      2⤵
        PID:4836
      • C:\Windows\System32\SearchProtocolHost.exe
        "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
        2⤵
        • Modifies data under HKEY_USERS
        PID:2892
      • C:\Windows\System32\SearchFilterHost.exe
        "C:\Windows\System32\SearchFilterHost.exe" 944 2968 2964 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
        2⤵
        • Modifies data under HKEY_USERS
        PID:3892
      • C:\Windows\System32\SearchFilterHost.exe
        "C:\Windows\System32\SearchFilterHost.exe" 944 2992 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
        2⤵
        • Modifies data under HKEY_USERS
        PID:3104
      • C:\Windows\System32\SearchProtocolHost.exe
        "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
        2⤵
        • Modifies data under HKEY_USERS
        PID:27224
      • C:\Windows\System32\SearchFilterHost.exe
        "C:\Windows\System32\SearchFilterHost.exe" 944 2968 2964 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
        2⤵
          PID:6752
        • C:\Windows\System32\SearchFilterHost.exe
          "C:\Windows\System32\SearchFilterHost.exe" 944 2992 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
          2⤵
            PID:5236
        • C:\Windows\system32\AUDIODG.EXE
          C:\Windows\system32\AUDIODG.EXE 0x0000000000000508 0x0000000000000510
          1⤵
            PID:13760
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
            1⤵
              PID:24672
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
              1⤵
              • Modifies data under HKEY_USERS
              PID:25000

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  elevation_service.exe
                  • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                  • Size 2.7MB
                  • SHA256 81b5c712ddbca2935b83381f8c0d288f718d47938adea6661f244e010d625ce5
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  maintenanceservice.exe
                  • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                  • Size 1.7MB
                  • SHA256 54035dd186909165d17c6470d41efeb2143c9bb67506683599ed82bfef530e11
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  7z.exe
                  • Path C:\Program Files\7-Zip\7z.exe
                  • Size 2.0MB
                  • SHA256 f64a36c0f9235b20388ccc4959ff968002a6bf660e43ed0ce7cf4f9c00b424b7
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  7zFM.exe
                  • Path C:\Program Files\7-Zip\7zFM.exe
                  • Size 1.5MB
                  • SHA256 c8ed132d269b2aefb4cab7bfb5e06ab9064674a2aeb64feac2c6501188dc5ae7
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  7zG.exe
                  • Path C:\Program Files\7-Zip\7zG.exe
                  • Size 1.2MB
                  • SHA256 e57e7334dca2ffdc0c832431ebf0b02e320885df1c38c8d374c876c0c0ef32c4
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Uninstall.exe
                  • Path C:\Program Files\7-Zip\Uninstall.exe
                  • Size 1.5MB
                  • SHA256 c26e573e0f1b8cc97e2e2cb13fb6d9fea9806e6419f05eb6ce0a515cf0fc91f0
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  AppVShNotify.exe
                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
                  • Size 1.7MB
                  • SHA256 34b8b7bd201ab393cfda1e621f72d2d54dea8bd1f3fa0eb77f6f542b8851c01b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  IntegratedOffice.exe
                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
                  • Size 4.6MB
                  • SHA256 b7914c45e8b3c45f254464ab4d12b269ea00282e727e7fe2965edd215b8064b7
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MavInject32.exe
                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
                  • Size 1.8MB
                  • SHA256 31fecd241f25f68168f2e58907d366531f5f0f45e59380909cbda9f188912efb
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  OfficeC2RClient.exe
                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
                  • Size 24.0MB
                  • SHA256 c46ee3da82c170cbdabe299af47e53ec0bf1644c1fd514f4d65213f17afa7664
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  appvcleaner.exe
                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
                  • Size 2.7MB
                  • SHA256 346b9ad61f1041ac35ce31de76c66e9d3328d9aeb0cf45642b7c7bd407dbd66b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  LICLUA.EXE
                  • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
                  • Size 1.1MB
                  • SHA256 65b1ac7c61205f8f5764f9c0ee9931df86c920b86c548fa89f382d531f65b12d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  OSE.EXE
                  • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                  • Size 1.7MB
                  • SHA256 b9e0c095933fc473ecb94ade4efb30f20c5d2fdeb2a9ce19686f58099aa2b18c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  VSTOInstaller.exe
                  • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
                  • Size 1.5MB
                  • SHA256 ce84f30611814e26cf7bc9c14e3fa5ac804bec1f495422d28dd22cb6fb480be3
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  chrmstp.exe
                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
                  • Size 6.6MB
                  • SHA256 80b0df16d96c01ce34bd7c8224654d567e0e4e9889f4186f69dda08136d16e8a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  setup.exe
                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
                  • Size 6.6MB
                  • SHA256 6bf79d3ca6300723fd3b2211cce5420ee5170d87f93081994eb628b58e6cac9e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  chrome_pwa_launcher.exe
                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
                  • Size 2.3MB
                  • SHA256 b383efa44851d57ac6dbeed896f3450c43821d9c84bab5f6f090403d028ae30f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  elevated_tracing_service.exe
                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
                  • Size 4.0MB
                  • SHA256 bac0576c9ec25bde85b1c57096e4ff5c119109d2215c398dbfbbdea3b146bb27
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  elevation_service.exe
                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                  • Size 2.8MB
                  • SHA256 fc57ff19ffe0840b06faadc21f290fc4ebb49cb90fdf7aae96d7be2c9e9ede3a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  notification_helper.exe
                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
                  • Size 2.2MB
                  • SHA256 153191fd73016b9016ceae230471bf3cb1f760f3bb2532bcf7bf4954f9a8a891
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  os_update_handler.exe
                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
                  • Size 2.4MB
                  • SHA256 b6b95563972f1ef335a2ffa7dea6e7534a4a425f526a91fc6ed0196a5637d162
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  chrome_proxy.exe
                  • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
                  • Size 2.0MB
                  • SHA256 79e2de23aacf6276e2d896c1e512fd8fc34e809f838ef362c940974c8c0938ae
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  appletviewer.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
                  • Size 1.5MB
                  • SHA256 b5168cf0ac2dc792982187fde2fb7c1e16e4231974b84b58039a7f192beeb7b6
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  extcheck.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
                  • Size 1.5MB
                  • SHA256 428760ef1cb05959933ae704110c86064fdc63a1ab7532912f7f7ff8a1a9356b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  idlj.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
                  • Size 1.5MB
                  • SHA256 77b99d114c21306e4aa8a051911fc744e45c73ac0cbb39fa2b8157d11959c2fc
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  jabswitch.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
                  • Size 1.5MB
                  • SHA256 436423d7b9988476063214ff36e11c06bd540ad58af7f6ca2b677391a65e340b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  jar.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
                  • Size 1.5MB
                  • SHA256 97356e273b1382ae2d865dc564c89fc670bfc58bdb5eaa47b11e6711c67b9573
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  jarsigner.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
                  • Size 1.5MB
                  • SHA256 8af872ab2d6458202a7ad3576dcee43129070e4d122f96630b41ed9a083dd619
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  java-rmi.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
                  • Size 1.5MB
                  • SHA256 4b224dfd8f112842a0dbd7ea8f21d6ad8ca36b68f5082163bc052db95f09a426
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  java.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
                  • Size 1.7MB
                  • SHA256 1ab497db874204d078c1d0c514e6517b579f9ab8b355d233c9ea636d1eb94e8f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  javac.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
                  • Size 1.5MB
                  • SHA256 0782af36165f05838771a67eb9b55d8da62bb9ab01b170d50b1134c499176060
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  javadoc.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
                  • Size 1.5MB
                  • SHA256 1144d97fa0669ef87650ef6dd33bc4aaeda3df55c8efab8a083bc35b8956af6f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  javafxpackager.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
                  • Size 1.6MB
                  • SHA256 32421537edace2b6d4a5815be75a05438e21972d1cd79132da7b6e453e87c930
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  javah.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
                  • Size 1.5MB
                  • SHA256 092f74329118c910fb96479f0fc48a897527d9e8306d0add068a3d10f1dd05e7
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  javap.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
                  • Size 1.5MB
                  • SHA256 241959f1a58bffcb3f963a71f7dd62a61591df87bc4528615b7c2c645ed4ad0f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  javapackager.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
                  • Size 1.6MB
                  • SHA256 f4d0fda23fe9403807956ed8ed4ece02926e43a1d07d651ba3bf1e0669996d37
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  javaw.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
                  • Size 1.7MB
                  • SHA256 fcc80140f709d362d1a0c2670135eff192bc9df4a5bec9c7ac86f93287abb746
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MsSense.exe
                  • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
                  • Size 1.9MB
                  • SHA256 b3257a31fcf56b8489f880e536c1b3b47f486247b638eb77ec4ca04e05990c11
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  NisSrv.exe
                  • Path C:\Program Files\Windows Defender\NisSrv.exe
                  • Size 3.5MB
                  • SHA256 724105a2e6477c2432417e8a955984ddbb9c24243ac8fbee19c0d01f0dc12852
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  wmpnetwk.exe
                  • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
                  • Size 1.4MB
                  • SHA256 68e2fad23f691f7cdeba6acd81a138215710023cc8ce6357f0c59f0062f65cb5
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  dotnet.exe
                  • Path C:\Program Files\dotnet\dotnet.exe
                  • Size 1.6MB
                  • SHA256 8df736cae126c4372d21abfbe5ce2d98785cd2f62ac653fe6a095a1884f8be23
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Windows.db
                  • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
                  • Size 1.1MB
                  • SHA256 1b8a0a45505711de3640cb730093477c4129f3b3ea2dadd157e2018ea39691b4
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Windows.db-wal
                  • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
                  • Size 1.4MB
                  • SHA256 a383124434c9a14a716680c2d211cf86fb104ef7a8194162f88b24a48c9411f3
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  the-real-index
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Code Cache\js\index-dir\the-real-index
                  • Size 48B
                  • SHA256 f125b8cb6368e4ae2f8d9c2d56bdfbdba1c51503954729231bc379c9e3588bb5
                  • MD5 SHA1 SHA512
                  Submit Download

                  the-real-index
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Code Cache\js\index-dir\the-real-index
                  • Size 384B
                  • SHA256 b4a7c465df418a4e83695b7c75ecced801373d2d864d8d4a77bbdd29441055f2
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  000001.dbtmp
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Extension Rules\000001.dbtmp
                  • Size 16B
                  • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                  • MD5 SHA1 SHA512
                  Submit Download

                  data_0
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_0
                  • Size 8KB
                  • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  data_1
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_1
                  • Size 264KB
                  • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  data_2
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_2
                  • Size 8KB
                  • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  data_3
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_3
                  • Size 8KB
                  • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  Network Persistent State
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\Network Persistent State
                  • Size 111B
                  • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Network Persistent State~RFe5b7d99.TMP
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\Network Persistent State~RFe5b7d99.TMP
                  • Size 59B
                  • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  SCT Auditing Pending Reports
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\SCT Auditing Pending Reports
                  • Size 2B
                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                  • MD5 SHA1 SHA512
                  Submit Download

                  TransportSecurity
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity
                  • Size 188B
                  • SHA256 4b19fc8295de368a0c0cb7945bec15f685dd419a31e9667a1123f54aaa004ebd
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  TransportSecurity~RFe5b14fb.TMP
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity~RFe5b14fb.TMP
                  • Size 188B
                  • SHA256 f4fbfd02c4d738ce225779cb7958835bbacb45eda80ff955ac1d4dcf2c97fa08
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Preferences
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences
                  • Size 7KB
                  • SHA256 52f4f092f33cb23fba4fdc42eb3b513e0fdcd3dcdebe3c4348d2eb32c7a855b5
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Preferences~RFe5aa8d4.TMP
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences~RFe5aa8d4.TMP
                  • Size 7KB
                  • SHA256 dffc8cd3ea4e35a1b9f625869f723044c4bf24285535ba2f002035a1907241d5
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MANIFEST-000001
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Site Characteristics Database\MANIFEST-000001
                  • Size 41B
                  • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                  • MD5 SHA1 SHA512
                  Submit Download

                  Local State
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
                  • Size 1KB
                  • SHA256 50801f2f289626444dc31eeb2ab46abf5966dd8e966257d99071b79c97c6567d
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Local State
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
                  • Size 2KB
                  • SHA256 65af467184b895f89313d348a449dbe4a0277f859035e293ee07c5e1da14e862
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Local State
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
                  • Size 2KB
                  • SHA256 db5f00b2f1f68e8950f5817f1366d46a0d6f778653fa18ae22aca37def9f80d8
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Local State
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
                  • Size 2KB
                  • SHA256 73854d87f66338fe41f637cfae5f09b4997903ec31d09a2e9e840da74b9b9851
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Local State~RFe5a510f.TMP
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State~RFe5a510f.TMP
                  • Size 890B
                  • SHA256 a9f3c62d422b2e4ad4b3d23b34033922bdf898c56cef0dbfbb8a24ec4fae1445
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  config.vdf
                  • Path C:\Users\Admin\AppData\Local\Temp\config\config.vdf
                  • Size 184B
                  • SHA256 661f122934bbc692266940a1fe2e5e51d4d460efb29d75695b8d5241c6e11da7
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  config.vdf
                  • Path C:\Users\Admin\AppData\Local\Temp\config\config.vdf
                  • Size 16KB
                  • SHA256 6fb111d45a5e89b9d1bc111e602d111706a746593e08468f7e11cb86ccba5650
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  config.vdf
                  • Path C:\Users\Admin\AppData\Local\Temp\config\config.vdf
                  • Size 117B
                  • SHA256 a3d8a2cba6e356e02c0f33b50e3a9e61d2f9dfb6a26b5983e30e7786da95dba7
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  config.vdf
                  • Path C:\Users\Admin\AppData\Local\Temp\config\config.vdf
                  • Size 1KB
                  • SHA256 f3847b5e4a40d9cf76df35398bb555117dfe3626c00a91f2babdedb619d6ad53
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  config.vdf
                  • Path C:\Users\Admin\AppData\Local\Temp\config\config.vdf
                  • Size 1KB
                  • SHA256 8f9f970835f133258a7f740126012439385bbaa5a1d6a9d0d967a390977441c3
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  crashhandler64.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\crashhandler64.dll
                  • Size 485KB
                  • SHA256 600785b8c5dacf926c8c768d398c4a1f00e97464b2d163af7e0a934f9b0d78e9
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  bootstrap_log.txt
                  • Path C:\Users\Admin\AppData\Local\Temp\logs\bootstrap_log.txt
                  • Size 12KB
                  • SHA256 e6f5ee3f214331070fb9d7403a5bab7fd43e7a71a7cfd7405df944e3a94845bb
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  steam_client_metrics.bin
                  • Path C:\Users\Admin\AppData\Local\Temp\package\steam_client_metrics.bin
                  • Size 3KB
                  • SHA256 dbea8130d7a8fbd04b208487d3ffb29f5164508985a72ecfe43ace639ce337d5
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  steam_client_win64.installed
                  • Path C:\Users\Admin\AppData\Local\Temp\package\steam_client_win64.installed
                  • Size 499KB
                  • SHA256 af7eb10f7913709007886bc1f8074f3ea8a97cdd21ccc68499dbb78aac2661fb
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  steam_client_win64.manifest
                  • Path C:\Users\Admin\AppData\Local\Temp\package\steam_client_win64.manifest
                  • Size 7KB
                  • SHA256 916759b96fbd5e75ad015335ba85cd80466a24f0a43d9a323fe2b60983bb6858
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  [email protected]_
                  • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\[email protected]_
                  • Size 15KB
                  • SHA256 983aa3928f15f5154266be7063a75e1fce87238bbe81a910219dea01d5376824
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  icon_button_news_mousedown.tga_
                  • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\icon_button_news_mousedown.tga_
                  • Size 20KB
                  • SHA256 cab3a68b64d8bf22c44080f12d7eab5b281102a8761f804224074ab1f6130fe2
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  filter_clean_bulgarian.txt.gz_
                  • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\resource\filter_clean_bulgarian.txt.gz_
                  • Size 23B
                  • SHA256 6feb83ca306745d634903cf09274b7baf0ac38e43c6b3fab1a608be344c3ef64
                  • MD5 SHA1 SHA512
                  Submit Download

                  steambootstrapper_english.txt
                  • Path C:\Users\Admin\AppData\Local\Temp\public\steambootstrapper_english.txt
                  • Size 4KB
                  • SHA256 fbc09c1b9a55d04b57be8fb2ad5ab58b38f76054ecd3d1b70440a2d08191b05b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  4a197e4cd744edbe.bin
                  • Path C:\Users\Admin\AppData\Roaming\4a197e4cd744edbe.bin
                  • Size 12KB
                  • SHA256 109b5d27a56a7794fa4d0afd3b9f508ae495d5e4a76262a21fd035fbf9d3867d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  perfhost.exe
                  • Path C:\Windows\SysWOW64\perfhost.exe
                  • Size 1.5MB
                  • SHA256 e5a8fa55d7f02609b9500370361ec1a89736d0eb0a3296ac852c515977a0c002
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  AgentService.exe
                  • Path C:\Windows\System32\AgentService.exe
                  • Size 1.4MB
                  • SHA256 ddedf352ad4e9a6d2e51954fdce5f61753299133b41e1a5ef69520614fb5c9c4
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ssh-agent.exe
                  • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                  • Size 2.0MB
                  • SHA256 b6987481731b36ccc3b4c993f9c102c7600acd63cdd5b31086c4aa3070e05f4c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  PerceptionSimulationService.exe
                  • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
                  • Size 1.7MB
                  • SHA256 d367ed94ce8276431ea3f3d9d95af65d31afb9d4b41f2eaafd97be373e229a77
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ReFsDedupSvc.exe
                  • Path C:\Windows\System32\ReFsDedupSvc.exe
                  • Size 2.6MB
                  • SHA256 6918a9a56aa2142e17a02e5f610ead4bccf55515f772fea0838a0c43535ccfcc
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  SearchIndexer.exe
                  • Path C:\Windows\System32\SearchIndexer.exe
                  • Size 1.4MB
                  • SHA256 67a4882299d066f0438bd73ac93f9bf83fdc2529eee0ad820025237cd1224728
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  SensorDataService.exe
                  • Path C:\Windows\System32\SensorDataService.exe
                  • Size 1.7MB
                  • SHA256 b48b7beeaecbab5b287f7d95ff168abc7e78f0429dbae4dd5d5ed4285b499df9
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  AppVClient.exe
                  • Path C:\Windows\system32\AppVClient.exe
                  • Size 1.3MB
                  • SHA256 bbc497105920ec4be2521e3bdfd44ae65ca5eac6eccb6351bc44547983bef680
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  SgrmBroker.exe
                  • Path C:\Windows\system32\Sgrm\SgrmBroker.exe
                  • Size 1.8MB
                  • SHA256 36fe971a26d6706dfcdf0adf64c517f8e2cc6030779d5187a0174be4bd85c540
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  memory/1292-99-0x0000000140000000-0x00000001401BA000-memory.dmp
                  Download

                  memory/1292-329-0x0000000140000000-0x00000001401BA000-memory.dmp
                  Download

                  memory/1292-100-0x0000000000780000-0x00000000007E0000-memory.dmp
                  Download

                  memory/1292-106-0x0000000000780000-0x00000000007E0000-memory.dmp
                  Download

                  memory/1292-319-0x0000000140000000-0x00000001401BA000-memory.dmp
                  Download

                  memory/1292-327-0x0000000000780000-0x00000000007E0000-memory.dmp
                  Download

                  memory/1508-323-0x0000000140000000-0x0000000140221000-memory.dmp
                  Download

                  memory/1508-111-0x0000000140000000-0x0000000140221000-memory.dmp
                  Download

                  memory/1508-113-0x0000000000D20000-0x0000000000D80000-memory.dmp
                  Download

                  memory/1508-119-0x0000000000D20000-0x0000000000D80000-memory.dmp
                  Download

                  memory/2020-82-0x0000000000780000-0x00000000007E7000-memory.dmp
                  Download

                  memory/2020-77-0x0000000000780000-0x00000000007E7000-memory.dmp
                  Download

                  memory/2020-296-0x0000000000400000-0x000000000057A000-memory.dmp
                  Download

                  memory/2020-76-0x0000000000400000-0x000000000057A000-memory.dmp
                  Download

                  memory/2496-33-0x00000000006E0000-0x0000000000740000-memory.dmp
                  Download

                  memory/2496-26-0x00000000006E0000-0x0000000000740000-memory.dmp
                  Download

                  memory/2496-25-0x0000000140000000-0x00000001402D4000-memory.dmp
                  Download

                  memory/2496-123-0x0000000140000000-0x00000001402D4000-memory.dmp
                  Download

                  memory/2496-32-0x00000000006E0000-0x0000000000740000-memory.dmp
                  Download

                  memory/3104-342-0x000002319D5A0000-0x000002319D76A000-memory.dmp
                  Download

                  memory/3436-86-0x0000000140000000-0x00000001402C9000-memory.dmp
                  Download

                  memory/3436-93-0x0000000000750000-0x00000000007B0000-memory.dmp
                  Download

                  memory/3436-352-0x0000000000750000-0x00000000007B0000-memory.dmp
                  Download

                  memory/3436-87-0x0000000000750000-0x00000000007B0000-memory.dmp
                  Download

                  memory/3436-354-0x0000000140000000-0x00000001402C9000-memory.dmp
                  Download

                  memory/3436-317-0x0000000140000000-0x00000001402C9000-memory.dmp
                  Download

                  memory/3644-125-0x0000000000B80000-0x0000000000BE0000-memory.dmp
                  Download

                  memory/3644-136-0x0000000000B80000-0x0000000000BE0000-memory.dmp
                  Download

                  memory/3644-138-0x0000000140000000-0x0000000140168000-memory.dmp
                  Download

                  memory/3644-124-0x0000000140000000-0x0000000140168000-memory.dmp
                  Download

                  memory/3644-131-0x0000000000B80000-0x0000000000BE0000-memory.dmp
                  Download

                  memory/3712-220-0x0000000140000000-0x00000001401B2000-memory.dmp
                  Download

                  memory/3712-52-0x0000000000870000-0x00000000008D0000-memory.dmp
                  Download

                  memory/3712-51-0x0000000140000000-0x00000001401B2000-memory.dmp
                  Download

                  memory/3712-59-0x0000000000870000-0x00000000008D0000-memory.dmp
                  Download

                  memory/4732-147-0x0000000000620000-0x0000000000680000-memory.dmp
                  Download

                  memory/4732-141-0x0000000000620000-0x0000000000680000-memory.dmp
                  Download

                  memory/4732-140-0x0000000140000000-0x0000000140172000-memory.dmp
                  Download

                  memory/4732-330-0x0000000140000000-0x0000000140172000-memory.dmp
                  Download

                  memory/4980-38-0x0000000000C00000-0x0000000000C60000-memory.dmp
                  Download

                  memory/4980-49-0x0000000000C00000-0x0000000000C60000-memory.dmp
                  Download

                  memory/4980-58-0x0000000140000000-0x00000001401B8000-memory.dmp
                  Download

                  memory/4980-37-0x0000000140000000-0x00000001401B8000-memory.dmp
                  Download

                  memory/4980-44-0x0000000000C00000-0x0000000000C60000-memory.dmp
                  Download

                  memory/5108-98-0x0000000140000000-0x00000001402E9000-memory.dmp
                  Download

                  memory/5108-15-0x0000000000E60000-0x0000000000EC0000-memory.dmp
                  Download

                  memory/5108-20-0x0000000000E60000-0x0000000000EC0000-memory.dmp
                  Download

                  memory/5108-13-0x0000000140000000-0x00000001402E9000-memory.dmp
                  Download

                  memory/5392-276-0x0000000140000000-0x00000001401AD000-memory.dmp
                  Download

                  memory/5392-65-0x0000000140000000-0x00000001401AD000-memory.dmp
                  Download

                  memory/5392-72-0x00000000006E0000-0x0000000000740000-memory.dmp
                  Download

                  memory/5672-0-0x0000000001F90000-0x0000000001FF0000-memory.dmp
                  Download

                  memory/5672-6978-0x0000000140000000-0x0000000140798000-memory.dmp
                  Download

                  memory/5672-6976-0x0000000001F90000-0x0000000001FF0000-memory.dmp
                  Download

                  memory/5672-8-0x0000000140000000-0x0000000140798000-memory.dmp
                  Download

                  memory/5672-6-0x0000000001F90000-0x0000000001FF0000-memory.dmp
                  Download

                  memory/5672-64-0x0000000140000000-0x0000000140798000-memory.dmp
                  Download

                  memory/6048-7100-0x0000000001200000-0x0000000001260000-memory.dmp
                  Download

                  memory/6048-7334-0x0000000140000000-0x00000001407D6000-memory.dmp
                  Download

                  memory/6048-7108-0x0000000140000000-0x00000001407D6000-memory.dmp
                  Download

                  memory/6048-7106-0x0000000001200000-0x0000000001260000-memory.dmp
                  Download

                  memory/6048-7378-0x0000000004A00000-0x0000000004B59000-memory.dmp
                  Download

                  memory/6220-7186-0x000001AB1FBF0000-0x000001AB1FC50000-memory.dmp
                  Download

                  memory/6220-7184-0x00007FFFCEB80000-0x00007FFFCEB81000-memory.dmp
                  Download

                  memory/6220-7404-0x000001AB1FE80000-0x000001AB1FE8A000-memory.dmp
                  Download

                  memory/6220-7183-0x00007FFFCEB70000-0x00007FFFCEB71000-memory.dmp
                  Download

                  memory/6220-7187-0x000001AB1FBF0000-0x000001AB1FC50000-memory.dmp
                  Download

                  memory/6220-7211-0x0000000140000000-0x00000001407D6000-memory.dmp
                  Download

                  memory/9592-6986-0x0000000001F70000-0x0000000001FD0000-memory.dmp
                  Download

                  memory/9592-7185-0x0000000140000000-0x0000000140798000-memory.dmp
                  Download

                  memory/9592-6985-0x0000000140000000-0x0000000140798000-memory.dmp
                  Download

                  memory/9592-6979-0x0000000001F70000-0x0000000001FD0000-memory.dmp
                  Download

                  memory/12396-7063-0x0000000000980000-0x00000000009E0000-memory.dmp
                  Download

                  memory/12396-7074-0x0000000140000000-0x00000001401D7000-memory.dmp
                  Download

                  memory/12396-7072-0x0000000000980000-0x00000000009E0000-memory.dmp
                  Download

                  memory/12396-7069-0x0000000000980000-0x00000000009E0000-memory.dmp
                  Download

                  memory/12396-7062-0x0000000140000000-0x00000001401D7000-memory.dmp
                  Download

                  memory/12776-7076-0x0000000140000000-0x00000001407D6000-memory.dmp
                  Download

                  memory/12776-7092-0x00000000012C0000-0x0000000001320000-memory.dmp
                  Download

                  memory/12776-7098-0x00000000012C0000-0x0000000001320000-memory.dmp
                  Download

                  memory/12776-7445-0x0000000006A00000-0x0000000006B59000-memory.dmp
                  Download

                  memory/12776-7333-0x0000000006A00000-0x0000000006B59000-memory.dmp
                  Download

                  memory/12776-7282-0x0000000140000000-0x00000001407D6000-memory.dmp
                  Download

                  memory/13468-7127-0x0000000140000000-0x00000001407D6000-memory.dmp
                  Download

                  memory/13468-7129-0x0000018D852E0000-0x0000018D85340000-memory.dmp
                  Download

                  memory/13468-7128-0x0000018D852E0000-0x0000018D85340000-memory.dmp
                  Download

                  memory/13468-7356-0x0000000140000000-0x00000001407D6000-memory.dmp
                  Download

                  memory/13468-7393-0x0000018D88E00000-0x0000018D88F59000-memory.dmp
                  Download

                  memory/14028-7252-0x0000000140000000-0x000000014017F000-memory.dmp
                  Download

                  memory/14028-7241-0x0000000002150000-0x00000000021B0000-memory.dmp
                  Download

                  memory/14028-7225-0x0000000140000000-0x000000014017F000-memory.dmp
                  Download

                  memory/14028-7248-0x0000000002150000-0x00000000021B0000-memory.dmp
                  Download

                  memory/14028-7230-0x0000000002150000-0x00000000021B0000-memory.dmp
                  Download

                  memory/14280-7174-0x00000000014E0000-0x0000000001540000-memory.dmp
                  Download

                  memory/14280-7377-0x0000000140000000-0x00000001407D6000-memory.dmp
                  Download

                  memory/14280-7189-0x0000000140000000-0x00000001407D6000-memory.dmp
                  Download

                  memory/14280-7180-0x00000000014E0000-0x0000000001540000-memory.dmp
                  Download

                  memory/19568-7341-0x00000000009B0000-0x0000000000A17000-memory.dmp
                  Download

                  memory/19568-7345-0x0000000000400000-0x000000000059B000-memory.dmp
                  Download

                  memory/19568-7336-0x00000000009B0000-0x0000000000A17000-memory.dmp
                  Download

                  memory/19568-7335-0x0000000000400000-0x000000000059B000-memory.dmp
                  Download

                  memory/20568-7331-0x0000000140000000-0x00000001401A8000-memory.dmp
                  Download

                  memory/20568-7329-0x0000000000560000-0x00000000005C0000-memory.dmp
                  Download

                  memory/20568-7321-0x0000000000560000-0x00000000005C0000-memory.dmp
                  Download

                  memory/20568-7327-0x0000000000560000-0x00000000005C0000-memory.dmp
                  Download

                  memory/20568-7320-0x0000000140000000-0x00000001401A8000-memory.dmp
                  Download

                  memory/22312-7302-0x0000000140000000-0x00000001407D6000-memory.dmp
                  Download

                  memory/22312-7432-0x0000021A20770000-0x0000021A2077A000-memory.dmp
                  Download

                  memory/22312-7427-0x0000000140000000-0x00000001407D6000-memory.dmp
                  Download

                  memory/22312-7293-0x0000021A20390000-0x0000021A203F0000-memory.dmp
                  Download

                  memory/22312-7294-0x0000021A20390000-0x0000021A203F0000-memory.dmp
                  Download

                  memory/24268-7423-0x00000000014E0000-0x0000000001540000-memory.dmp
                  Download

                  memory/24268-7412-0x00000000014E0000-0x0000000001540000-memory.dmp
                  Download

                  memory/29684-7283-0x0000000000400000-0x000000000057F000-memory.dmp
                  Download