Overview

overview

9

Static

static

3

2026-09-27...nj.exe

windows10-2004-x64

9

2026-09-27...nj.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    133s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    28/09/2026, 02:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
  • Size 6.8MB
  • Sample260928-c3a4dsvsbx
  • SHA256 3500ef5f7b6da58e80544f08cbb5174c92e5c41c8d2960989eced97243096530
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryransomwarespywarestealertrojanupx

Malware Config

Signatures

  • Renames multiple (6553) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 30 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 49 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 18 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 41 IoCs
  • Modifies system certificate store 2 TTPs 1 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 56 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 30 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies trusted root certificate store through registry
    • Reads the TCP/IP host and domain name from the registry
    • Checks processor information in registry
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2436
    • C:\Users\Admin\AppData\Local\Temp\2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
      2⤵
      • Loads dropped DLL
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Reads the TCP/IP host and domain name from the registry
      • Checks processor information in registry
      • Suspicious use of WriteProcessMemory
      PID:5512
      • C:\Users\Admin\AppData\Local\Temp\2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
        C:\Users\Admin\AppData\Local\Temp\2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
        3⤵
        • Loads dropped DLL
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Reads the TCP/IP host and domain name from the registry
        • Checks SCSI registry key(s)
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:7248
        • C:\Users\Admin\AppData\Local\Temp\steamsysinfo.exe
          C:\Users\Admin\AppData\Local\Temp\steamsysinfo.exe -steamid 0 -buildid 1788652215 -logdir C:\Users\Admin\AppData\Local\Temp\logs -nocrashdialog -query 1 -out-file C:\Users\Admin\AppData\Local\Temp\9859.tmp
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:7444
        • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
          C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe -nocrashdialog "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=7248" "-buildid=1788652215" "-steamid=0" "-logdir=C:\Users\Admin\AppData\Local\Temp\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Users\Admin\AppData\Local\Temp\clientui" "-steampath=C:\Users\Admin\AppData\Local\Temp\2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling "--log-file=C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --disable-quick-menu --disable-component-update "--gaia-url=http://disabled.invalid" "--enable-features=PlatformHEVCDecoderSupport" "--disable-features=WinRetrieveSuggestionsOnlyOnDemand,SpareRendererForSitePerProcess,DcheckIsFatal,BlockPromptsIfIgnoredOften,WebUsbDeviceDetection,ValveFFmpegAllowLowDelayHEVC"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          • Checks processor information in registry
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:7516
          • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
            "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe" --type=gpu-process --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1788652215 --steamid=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1912,i,1165988469599199620,7128799815785296936,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=1928 --mojo-platform-channel-handle=1908 /prefetch:2
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:7704
          • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
            "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1788652215 --steamid=0 --field-trial-handle=2228,i,1165988469599199620,7128799815785296936,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2252 --mojo-platform-channel-handle=2248 /prefetch:3
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Reads the TCP/IP host and domain name from the registry
            • System Time Discovery
            PID:7856
          • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
            "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1788652215 --steamid=0 --field-trial-handle=2316,i,1165988469599199620,7128799815785296936,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2336 --mojo-platform-channel-handle=2332 /prefetch:8
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:7888
          • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
            "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1788652215 --steamid=0 --gaia-url=http://disabled.invalid --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=4060,i,1165988469599199620,7128799815785296936,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4072 --mojo-platform-channel-handle=4068 /prefetch:1
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            PID:22656
          • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
            "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1788652215 --steamid=0 --field-trial-handle=5060,i,1165988469599199620,7128799815785296936,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5032 --mojo-platform-channel-handle=5012 /prefetch:8
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Reads the TCP/IP host and domain name from the registry
            PID:21640
        • C:\Users\Admin\AppData\Local\Temp\bin\gldriverquery64.exe
          .\bin\gldriverquery64.exe
          4⤵
          • Executes dropped EXE
          PID:22700
        • C:\Users\Admin\AppData\Local\Temp\bin\gldriverquery.exe
          .\bin\gldriverquery.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:22384
        • C:\Users\Admin\AppData\Local\Temp\bin\vulkandriverquery64.exe
          .\bin\vulkandriverquery64.exe
          4⤵
          • Executes dropped EXE
          PID:22356
        • C:\Users\Admin\AppData\Local\Temp\bin\vulkandriverquery.exe
          .\bin\vulkandriverquery.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:22256
  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3260
  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:212
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    PID:4860
  • C:\Windows\System32\msdtc.exe
    C:\Windows\System32\msdtc.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Windows directory
    PID:4160
  • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    PID:3500
  • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    1⤵
    • Executes dropped EXE
    PID:3880
  • C:\Windows\SysWow64\perfhost.exe
    C:\Windows\SysWow64\perfhost.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:408
  • C:\Windows\system32\locator.exe
    C:\Windows\system32\locator.exe
    1⤵
    • Executes dropped EXE
    PID:4744
  • C:\Windows\System32\SensorDataService.exe
    C:\Windows\System32\SensorDataService.exe
    1⤵
    • Executes dropped EXE
    • Checks SCSI registry key(s)
    PID:2356
  • C:\Windows\System32\snmptrap.exe
    C:\Windows\System32\snmptrap.exe
    1⤵
    • Executes dropped EXE
    • Reads the TCP/IP host and domain name from the registry
    PID:2196
  • C:\Windows\system32\spectrum.exe
    C:\Windows\system32\spectrum.exe
    1⤵
    • Executes dropped EXE
    • Checks SCSI registry key(s)
    PID:5088
  • C:\Windows\System32\OpenSSH\ssh-agent.exe
    C:\Windows\System32\OpenSSH\ssh-agent.exe
    1⤵
    • Executes dropped EXE
    PID:1716
  • C:\Windows\system32\TieringEngineService.exe
    C:\Windows\system32\TieringEngineService.exe
    1⤵
    • Executes dropped EXE
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    PID:560
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
    1⤵
      PID:4388
    • C:\Windows\system32\AgentService.exe
      C:\Windows\system32\AgentService.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:5076
    • C:\Windows\System32\vds.exe
      C:\Windows\System32\vds.exe
      1⤵
      • Executes dropped EXE
      PID:3780
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3152
    • C:\Windows\system32\wbengine.exe
      "C:\Windows\system32\wbengine.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3804
    • C:\Windows\system32\wbem\WmiApSrv.exe
      C:\Windows\system32\wbem\WmiApSrv.exe
      1⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      PID:4724
    • C:\Windows\system32\SearchIndexer.exe
      C:\Windows\system32\SearchIndexer.exe /Embedding
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:540
      • C:\Windows\system32\SearchProtocolHost.exe
        "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
        2⤵
        • Modifies data under HKEY_USERS
        PID:3404
      • C:\Windows\system32\SearchFilterHost.exe
        "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
        2⤵
        • Modifies data under HKEY_USERS
        PID:4624
      • C:\Windows\system32\SearchFilterHost.exe
        "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
        2⤵
          PID:20984
      • C:\Windows\system32\AUDIODG.EXE
        C:\Windows\system32\AUDIODG.EXE 0x480 0x40c
        1⤵
          PID:22792
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
          1⤵
            PID:21476

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                ADelRCP.exe
                • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe
                • Size 1.6MB
                • SHA256 33e566bffc5508b7211a9a4dfbe2396de39c3000a784157cc8bb1e495bcfe444
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AcroBroker.exe
                • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe
                • Size 1.7MB
                • SHA256 436a41820a4b8912a39d24170da460a5cf2bf3927f849a6f73e0239d5743e09c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                RdrCEF.exe
                • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                • Size 9.9MB
                • SHA256 5de3f1592332eba5ab4d72999e9979423750dce2529c18601634b3142c947e72
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                RdrServicesUpdater.exe
                • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe
                • Size 25.4MB
                • SHA256 1bf81c7a74ecebd301f039ce2f3801ada0c0bcd004d33620104f6d77337ea0a2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AcroRd32.exe
                • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
                • Size 3.0MB
                • SHA256 1b3e45831ac87a47791dc61229c6de448a97734fc16c26c3585836795572b2b8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AcroRd32Info.exe
                • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
                • Size 1.5MB
                • SHA256 8e8cc22a5357e8fd1c38aab69471e0059550457cf9c6b3343b319f1aa1a6969b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AcroTextExtractor.exe
                • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
                • Size 1.5MB
                • SHA256 105e479d3f82a70c366c6bdcfcef4e8c01bda0d12cbb825c01f42bfa06eea4f6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AdobeCollabSync.exe
                • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
                • Size 6.2MB
                • SHA256 d9044096b7b924a2a24993e081bfe5d1117c711b42a59528ff044594f260307b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                WCChromeNativeMessagingHost.exe
                • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe
                • Size 1.6MB
                • SHA256 3e8fc6f982ba230640aa5c3d5e9e6d3e8a57c2f05d75e95c9a21712e60f18cf3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Eula.exe
                • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe
                • Size 1.5MB
                • SHA256 b3be174f880d0fcbc9d6bd30120d6324b767eb4dd4b774bd9315db8349efda47
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                FullTrustNotifier.exe
                • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe
                • Size 1.6MB
                • SHA256 497ad0f89562c843537a37ad71ed5a87942c126b3495d8d76c608f1a3b32ef96
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                LogTransport2.exe
                • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe
                • Size 1.8MB
                • SHA256 23bafd757433d761a30b6eafbed10fabfcc4775ec9665f5411515f67e4736d4d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                arh.exe
                • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe
                • Size 1.5MB
                • SHA256 9c839d68c091c325ac51e5a664ecdd9167656e19ae01f00b5f8979ac1747d7ec
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                32BitMAPIBroker.exe
                • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe
                • Size 1.5MB
                • SHA256 202ab3622de1291014c0ec3cf0e2ee415e9465aeb2aab0baec637053a438c667
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                64BitMAPIBroker.exe
                • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe
                • Size 1.7MB
                • SHA256 ac8a9eb1f38f4b119747986d5629983a36a3ef5e4d4955d95f00ae696ebe55a5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                reader_sl.exe
                • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
                • Size 1.5MB
                • SHA256 cfacac4d85c56c18f3960886a279b91b127c4982aea6015939e0ff393144426f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                wow_helper.exe
                • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe
                • Size 1.5MB
                • SHA256 6da624ff69add33e15a49cee7c735405f8fdaefaefed3e9c7eda8cf68f4aa380
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AdobeARM.exe
                • Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
                • Size 1.7MB
                • SHA256 df10423a9706aeff237c88bc356e676d64e91dfa881c57abdb66d2e32e347803
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AdobeARMHelper.exe
                • Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
                • Size 1.8MB
                • SHA256 0e4333c5c191b45169735f55846412e93e90c5a179be02c604a72eb5ab681075
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jaureg.exe
                • Path C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe
                • Size 1.9MB
                • SHA256 e77d1cf03231522986bb6312bf7d7a293076575b57d68dfa7cd33e4a5ee62fd2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                java.exe
                • Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
                • Size 1.7MB
                • SHA256 342e89c4c552054a74ba6c28c2e23bfa66cdb14b289277381dfc2a9737aef92a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javaw.exe
                • Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe
                • Size 1.7MB
                • SHA256 dd97953ce4a648dc2f0bb94b09b2ab153bf9f41aa4b5a8d40d5ed2ecab3d2ec4
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javaws.exe
                • Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe
                • Size 1.9MB
                • SHA256 069a582290447186b64b1077ab6d7e302eccd52de73303ab3e7173180777ad6a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                elevation_service.exe
                • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                • Size 2.7MB
                • SHA256 e69dc0a5c174231887074a08c29874c00d53dc74d704ae9e1b73c5775fac51a5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                maintenanceservice.exe
                • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                • Size 1.7MB
                • SHA256 63fc7e5144431f34ce914cdca63aeb325e2243c73cc20c079fe44d4f4f3bb1bc
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                maintenanceservice.exe
                • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                • Size 2.4MB
                • SHA256 bbd0ca5bea9654cb1a3e8a613d2d68b99b91d83d7f0ec995bad0d2a2640f27e3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                OSE.EXE
                • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                • Size 1.7MB
                • SHA256 f99c5fb9cace8cbf12d0586796772c8b22cdce614cd4214b96a1fb6866cd0825
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                elevation_service.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                • Size 2.8MB
                • SHA256 9d15df2611c5763dea1dac55521d83781a7999974350cce07220a8fffa55a904
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                tnameserv.exe
                • Path C:\Program Files\Java\jre-1.8\bin\tnameserv.exe
                • Size 1.5MB
                • SHA256 a9b6ceafa6de8b9cfd52b5658b50113b0530a5ef0cea6bd9571bcd71a1636e8e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                unpack200.exe
                • Path C:\Program Files\Java\jre-1.8\bin\unpack200.exe
                • Size 1.6MB
                • SHA256 51d64049fbf0e57748b2f2d5d03f8c1ed3d07fda0693de49727bfef568cb9cf9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                crashreporter.exe
                • Path C:\Program Files\Mozilla Firefox\crashreporter.exe
                • Size 3.9MB
                • SHA256 a99695b6f383fd393085263d9908e5eedb8b9fbeebf7e609443f8cd305a0180c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                default-browser-agent.exe
                • Path C:\Program Files\Mozilla Firefox\default-browser-agent.exe
                • Size 1.5MB
                • SHA256 6456fd171f8a7488a0ba747c789c236db0355b199ec1bd428b67adea2d533d45
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                firefox.exe
                • Path C:\Program Files\Mozilla Firefox\firefox.exe
                • Size 1.2MB
                • SHA256 2b7ed9b158d4469e56edafc4379fb8b1958241a3f85f7e7bf5bbfb1390420064
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                maintenanceservice.exe
                • Path C:\Program Files\Mozilla Firefox\maintenanceservice.exe
                • Size 1.7MB
                • SHA256 621606947e167f6818f9568141cd335c0b6dda65abd65a101826ed0d20de3482
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                nmhproxy.exe
                • Path C:\Program Files\Mozilla Firefox\nmhproxy.exe
                • Size 1.1MB
                • SHA256 bc415a8e804e18f81745a3cfaa3fa2baacf6b2347a12b8d5405f2a3ddd5a96e2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pingsender.exe
                • Path C:\Program Files\Mozilla Firefox\pingsender.exe
                • Size 1.5MB
                • SHA256 b53191b6d4ded715ddabb99ba9a5bd24168e7f86c2059f7b7776e89317f49e17
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                plugin-container.exe
                • Path C:\Program Files\Mozilla Firefox\plugin-container.exe
                • Size 1.6MB
                • SHA256 eb5dca2047e897478fff82760b138a7111ee38fa3dfdd82df92f7f24d7f0630b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                private_browsing.exe
                • Path C:\Program Files\Mozilla Firefox\private_browsing.exe
                • Size 1.5MB
                • SHA256 65fb36da23c9bbab1be8ded0e6499821eb8b450bbf825866ad5344529da9265a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                updater.exe
                • Path C:\Program Files\Mozilla Firefox\updater.exe
                • Size 1.9MB
                • SHA256 a167768e51075364b57b930d8f09a993516d18c3474a82ac601dcef483ce1095
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                wmpnetwk.exe
                • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
                • Size 2.2MB
                • SHA256 d392a6a501f43a98b0798d724d690ca2e66753f4d05f3759bb192ff770443bc1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                the-real-index
                • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Code Cache\js\index-dir\the-real-index
                • Size 48B
                • SHA256 cc708bc667d61560a10bb0d82a94cfc2015a9cfc2d8f4345c4611ff971591b5b
                • MD5 SHA1 SHA512
                Submit Download

                the-real-index
                • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Code Cache\js\index-dir\the-real-index
                • Size 384B
                • SHA256 81870ceaf5c050766a61532f6fd2c33a7261a13cbec419d745fe1467a3e4a67c
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                CURRENT
                • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Extension Rules\CURRENT
                • Size 16B
                • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                • MD5 SHA1 SHA512
                Submit Download

                MANIFEST-000001
                • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Extension Rules\MANIFEST-000001
                • Size 41B
                • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                • MD5 SHA1 SHA512
                Submit Download

                data_0
                • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_0
                • Size 8KB
                • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                data_1
                • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_1
                • Size 264KB
                • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                data_2
                • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_2
                • Size 8KB
                • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                data_3
                • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_3
                • Size 8KB
                • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                SCT Auditing Pending Reports
                • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\SCT Auditing Pending Reports
                • Size 2B
                • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                • MD5 SHA1 SHA512
                Submit Download

                Preferences
                • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences
                • Size 7KB
                • SHA256 5109e82e87ced2291c8c0943d3328b3a5624e3e945900d4ce43e8efa19d89c0d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Preferences~RFe5af04d.TMP
                • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences~RFe5af04d.TMP
                • Size 7KB
                • SHA256 714f343a65c426ebc821bcb1aa9053e73564d9e521d5a352bf2b8c6a97abb2d2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Local State
                • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
                • Size 2KB
                • SHA256 7767f476926a0a6535b784e101e3d229167ceba64d2740d97e6f9cf35b8ed8ad
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Local State
                • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
                • Size 1KB
                • SHA256 54e802f97156b36787ac3700edadb49b2d6dacb9c6ecc44cce6ce48a3841ed7c
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Local State
                • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
                • Size 2KB
                • SHA256 9a269cf622f4eb7d53ea64cd569486070482c23b3e6ec39ce1c0dcd28aaf5de6
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Local State
                • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
                • Size 2KB
                • SHA256 aabb6262577a1ae1d9e8484c77aad6b5581e4a814c1617d4c1b0c7975926d966
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Local State~RFe5a9d89.TMP
                • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State~RFe5a9d89.TMP
                • Size 890B
                • SHA256 3715efc736a8cc7c1e6a7c495bfc4e122b42639c217f769932f0c675721833ea
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                config.vdf
                • Path C:\Users\Admin\AppData\Local\Temp\config\config.vdf
                • Size 117B
                • SHA256 a3d8a2cba6e356e02c0f33b50e3a9e61d2f9dfb6a26b5983e30e7786da95dba7
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                config.vdf
                • Path C:\Users\Admin\AppData\Local\Temp\config\config.vdf
                • Size 1KB
                • SHA256 f3847b5e4a40d9cf76df35398bb555117dfe3626c00a91f2babdedb619d6ad53
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                config.vdf
                • Path C:\Users\Admin\AppData\Local\Temp\config\config.vdf
                • Size 10KB
                • SHA256 5ee862137f6c11363627417c7049be1ad54306552181fa33c7729f616e5ac404
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                config.vdf
                • Path C:\Users\Admin\AppData\Local\Temp\config\config.vdf
                • Size 1KB
                • SHA256 8f9f970835f133258a7f740126012439385bbaa5a1d6a9d0d967a390977441c3
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                service_log.txt
                • Path C:\Users\Admin\AppData\Local\Temp\logs\service_log.txt
                • Size 1KB
                • SHA256 e915cbdb2c9e99ca5b4c6eb1f54c3f25459dd531f3224a575b5dfde7fda28e44
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                steam_client_win64
                • Path C:\Users\Admin\AppData\Local\Temp\package\steam_client_win64
                • Size 7KB
                • SHA256 ee29f4f7f5195bb184d883146d72d4eb05a92f6f10cffc8d176d2410c52af93a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                btnOvrOffBottom.tga_
                • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\btnOvrOffBottom.tga_
                • Size 444B
                • SHA256 ecd13153d9d438809a38de30f3abbb0f6f92837a7e3cacb442a9a9309bcd78d9
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                [email protected]_
                • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\[email protected]_
                • Size 6KB
                • SHA256 5afc5816946e0d7b6d57a99a60be71d9e88670d9a63c18e249c9266d8e95cd2f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                cloud_localfiles.tga_
                • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\cloud_localfiles.tga_
                • Size 14KB
                • SHA256 c7a1b0021d1f943e497c592d83050ac85a3b93aff732f9b94cd26d9c41b37ca3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                [email protected]_
                • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\[email protected]_
                • Size 15KB
                • SHA256 983aa3928f15f5154266be7063a75e1fce87238bbe81a910219dea01d5376824
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                [email protected]_
                • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\[email protected]_
                • Size 92KB
                • SHA256 e0ce36b93ae67846424364085ad79ee24fe5c036e5f6a78a4acbe1583f22daab
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                icon_button_news_mousedown.tga_
                • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\icon_button_news_mousedown.tga_
                • Size 20KB
                • SHA256 cab3a68b64d8bf22c44080f12d7eab5b281102a8761f804224074ab1f6130fe2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                tabStdBottom.tga_
                • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\tabStdBottom.tga_
                • Size 48B
                • SHA256 5caa5fa3e79dcd8ec5ec20256ed7c77efaae77e0ae8d89e4a974c484cb177d84
                • MD5 SHA1 SHA512
                Submit Download

                steam_cloudsync.ico_
                • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\public\steam_cloudsync.ico_
                • Size 47KB
                • SHA256 5aaca90948de8f7d11264ed608a2f96acba061e6463d337d658b00ed1c552449
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                steam_cloudsync_posix.tga_
                • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\public\steam_cloudsync_posix.tga_
                • Size 64KB
                • SHA256 fd2abb8945c06a6b9c5444baf6ea523b52bf7a03a58b34ebe0a6a110630ed5f8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                steam_tray.tga_
                • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\public\steam_tray.tga_
                • Size 1KB
                • SHA256 f747d5fd27e74412be05bb376c0ff12fcebb7f39c158eaa89ab6a0a9d92ef3b6
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                filter_clean_bulgarian.txt.gz_
                • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\resource\filter_clean_bulgarian.txt.gz_
                • Size 23B
                • SHA256 6feb83ca306745d634903cf09274b7baf0ac38e43c6b3fab1a608be344c3ef64
                • MD5 SHA1 SHA512
                Submit Download

                filter_clean_schinese.txt.gz_
                • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\resource\filter_clean_schinese.txt.gz_
                • Size 33B
                • SHA256 77f0055faba992867817c485930c5f60cf64e65c65b410128426dc35fd8d862b
                • MD5 SHA1 SHA512
                Submit Download

                game_details_header_green.tga_
                • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\steam\cached\game_details_header_green.tga_
                • Size 2.1MB
                • SHA256 a24832de8b80e206143170a899ab91e76e85685aed74963fe2f490344bbf6427
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                perfhost.exe
                • Path C:\Windows\SysWOW64\perfhost.exe
                • Size 1.5MB
                • SHA256 f57bff90ef0bbf2533377e7c05f0ceb7203c04040d189a7404012739f56c5bad
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AgentService.exe
                • Path C:\Windows\System32\AgentService.exe
                • Size 1.7MB
                • SHA256 a8f1865c777d7ff650fdda62e25916c71b266c665113dd021744fec663cd6f90
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Locator.exe
                • Path C:\Windows\System32\Locator.exe
                • Size 1.5MB
                • SHA256 386baa05566b962e9fbff45ed7e7212aeb7f4dbc3d14d0ba97e95b22f2190bbf
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ssh-agent.exe
                • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                • Size 1.8MB
                • SHA256 db24c7203cb8588f82720efc18fffb5c664ffa1a1739865fa539f6d214297886
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                PerceptionSimulationService.exe
                • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
                • Size 1.5MB
                • SHA256 9d22b92a6c17171f3a006e2a2c0a32ce4bb533467401b979c0be3c63b40bc035
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SearchIndexer.exe
                • Path C:\Windows\System32\SearchIndexer.exe
                • Size 1.4MB
                • SHA256 917c3a9497c4d944fb4a368fe37d4b55de24269bf649ed66ba7d8afa11223558
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SensorDataService.exe
                • Path C:\Windows\System32\SensorDataService.exe
                • Size 1.8MB
                • SHA256 2060763b9268916e649e0135946b1f53966db2977736b75dedd4867395b30e5c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Spectrum.exe
                • Path C:\Windows\System32\Spectrum.exe
                • Size 1.4MB
                • SHA256 190a476be2d3218473828a4a4d595a91c6867d19df4b9e4fa814677fa67d7e4f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                TieringEngineService.exe
                • Path C:\Windows\System32\TieringEngineService.exe
                • Size 1.8MB
                • SHA256 8e52d20f92faed70dd7b7bba6f8d531a510c66bb0a87589641dbc092ea029c73
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                VSSVC.exe
                • Path C:\Windows\System32\VSSVC.exe
                • Size 2.0MB
                • SHA256 e55f25a54c67c00f43fc82738c1f6264b9faa248ec9ec485d66e10c4ab9b5651
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                alg.exe
                • Path C:\Windows\System32\alg.exe
                • Size 850KB
                • SHA256 5853bb36b64866908c162e71bda9cf4250c8ab6cd43997de74fa3dcb47eff2e2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                msdtc.exe
                • Path C:\Windows\System32\msdtc.exe
                • Size 1.6MB
                • SHA256 088810b7b8de796c5162d8ec7c00e8a8c5872bb484081a8ad1640c826c2c0bc2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                snmptrap.exe
                • Path C:\Windows\System32\snmptrap.exe
                • Size 1.5MB
                • SHA256 71d2289159515c1b8ae252d76013efdcc73955f4c235b1fecf88611da4341b90
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                vds.exe
                • Path C:\Windows\System32\vds.exe
                • Size 1.3MB
                • SHA256 e71ddc1975d36b520dc47ec110a8ccd154b38f5f83cc1759a0cb6c3cec243474
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                WmiApSrv.exe
                • Path C:\Windows\System32\wbem\WmiApSrv.exe
                • Size 1.6MB
                • SHA256 9250c64fab1948e71b50094d7589972ba530e358d28cac7e8289cca25823c4a5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                wbengine.exe
                • Path C:\Windows\System32\wbengine.exe
                • Size 2.1MB
                • SHA256 0307fa69a48e4584d9694341f7c5e07c71a6545c6e6037e69905d149326564cb
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AgentService.exe
                • Path C:\Windows\system32\AgentService.exe
                • Size 2.5MB
                • SHA256 89dff34f9e4965071a54924107b08375197c64f672e3d7bdf52db4dc353890ed
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AppVClient.exe
                • Path C:\Windows\system32\AppVClient.exe
                • Size 1.5MB
                • SHA256 6eb11198e151010d67443fbb36cf75e1442c096abaffb00fa24e95485671a0a9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                DiagnosticsHub.StandardCollector.Service.exe
                • Path C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                • Size 849KB
                • SHA256 28696cf22a62f58cd89bf745e434af167d0a82212e6e738878137c7fc8f6f102
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SgrmBroker.exe
                • Path C:\Windows\system32\SgrmBroker.exe
                • Size 2.5MB
                • SHA256 c8ce9a4b82aff35f9f5285edfc7ba63d82153c5b181869897b92600e98cba3d8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                fxssvc.exe
                • Path C:\Windows\system32\fxssvc.exe
                • Size 1.4MB
                • SHA256 7d7841fcebed2abced34f97efc27875d46971af7bf56e437c0276d22bfd50c2d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                msiexec.exe
                • Path C:\Windows\system32\msiexec.exe
                • Size 2.2MB
                • SHA256 203d28b796282c6d58c0c90a74e1bca82cbfe679a12efe3bee1701df2dc35e6c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/212-57-0x0000000140000000-0x00000001402D4000-memory.dmp
                Download

                memory/212-165-0x0000000140000000-0x00000001402D4000-memory.dmp
                Download

                memory/212-49-0x0000000000890000-0x00000000008F0000-memory.dmp
                Download

                memory/212-48-0x0000000000890000-0x00000000008F0000-memory.dmp
                Download

                memory/212-54-0x0000000000890000-0x00000000008F0000-memory.dmp
                Download

                memory/408-120-0x0000000000400000-0x000000000057A000-memory.dmp
                Download

                memory/408-112-0x0000000000600000-0x0000000000667000-memory.dmp
                Download

                memory/408-117-0x0000000000600000-0x0000000000667000-memory.dmp
                Download

                memory/408-240-0x0000000000400000-0x000000000057A000-memory.dmp
                Download

                memory/540-265-0x0000000140000000-0x0000000140179000-memory.dmp
                Download

                memory/540-262-0x0000000000610000-0x0000000000670000-memory.dmp
                Download

                memory/540-314-0x000000000A1F0000-0x000000000A1F8000-memory.dmp
                Download

                memory/540-545-0x0000000140000000-0x0000000140179000-memory.dmp
                Download

                memory/540-555-0x000000000D300000-0x000000000D308000-memory.dmp
                Download

                memory/540-296-0x0000000001DB0000-0x0000000001DC0000-memory.dmp
                Download

                memory/540-280-0x0000000001B00000-0x0000000001B10000-memory.dmp
                Download

                memory/540-256-0x0000000000610000-0x0000000000670000-memory.dmp
                Download

                memory/560-187-0x0000000140000000-0x00000001401C5000-memory.dmp
                Download

                memory/560-188-0x0000000000500000-0x0000000000560000-memory.dmp
                Download

                memory/560-181-0x0000000000500000-0x0000000000560000-memory.dmp
                Download

                memory/560-532-0x0000000140000000-0x00000001401C5000-memory.dmp
                Download

                memory/1716-527-0x0000000140000000-0x00000001401E5000-memory.dmp
                Download

                memory/1716-179-0x0000000140000000-0x00000001401E5000-memory.dmp
                Download

                memory/1716-176-0x0000000000C90000-0x0000000000CF0000-memory.dmp
                Download

                memory/1716-170-0x0000000000C90000-0x0000000000CF0000-memory.dmp
                Download

                memory/2196-458-0x0000000140000000-0x0000000140179000-memory.dmp
                Download

                memory/2196-152-0x00000000006F0000-0x0000000000750000-memory.dmp
                Download

                memory/2196-146-0x00000000006F0000-0x0000000000750000-memory.dmp
                Download

                memory/2196-155-0x0000000140000000-0x0000000140179000-memory.dmp
                Download

                memory/2356-494-0x0000000000690000-0x00000000006F0000-memory.dmp
                Download

                memory/2356-505-0x0000000140000000-0x00000001401D7000-memory.dmp
                Download

                memory/2356-264-0x0000000140000000-0x00000001401D7000-memory.dmp
                Download

                memory/2356-139-0x0000000000690000-0x00000000006F0000-memory.dmp
                Download

                memory/2356-143-0x0000000140000000-0x00000001401D7000-memory.dmp
                Download

                memory/2356-133-0x0000000000690000-0x00000000006F0000-memory.dmp
                Download

                memory/2436-0-0x0000000001FB0000-0x000000000210C000-memory.dmp
                Download

                memory/2436-69-0x0000000140000000-0x0000000141785000-memory.dmp
                Download

                memory/2436-7175-0x0000000002C90000-0x0000000002CF0000-memory.dmp
                Download

                memory/2436-7226-0x0000000140000000-0x0000000141785000-memory.dmp
                Download

                memory/2436-7174-0x0000000001F10000-0x0000000001F93000-memory.dmp
                Download

                memory/2436-14-0x0000000002C90000-0x0000000002CF0000-memory.dmp
                Download

                memory/2436-22-0x0000000002C90000-0x0000000002CF0000-memory.dmp
                Download

                memory/2436-9-0x0000000140000000-0x0000000141785000-memory.dmp
                Download

                memory/2436-1-0x0000000001F10000-0x0000000001F93000-memory.dmp
                Download

                memory/2436-7-0x0000000001F10000-0x0000000001F93000-memory.dmp
                Download

                memory/3152-538-0x0000000140000000-0x00000001401FC000-memory.dmp
                Download

                memory/3152-225-0x0000000000700000-0x0000000000760000-memory.dmp
                Download

                memory/3152-228-0x0000000140000000-0x00000001401FC000-memory.dmp
                Download

                memory/3152-219-0x0000000000700000-0x0000000000760000-memory.dmp
                Download

                memory/3260-142-0x0000000140000000-0x00000001402E9000-memory.dmp
                Download

                memory/3260-35-0x0000000000C40000-0x0000000000CA0000-memory.dmp
                Download

                memory/3260-45-0x0000000000C40000-0x0000000000CA0000-memory.dmp
                Download

                memory/3260-44-0x0000000140000000-0x00000001402E9000-memory.dmp
                Download

                memory/3500-216-0x0000000140000000-0x00000001401B2000-memory.dmp
                Download

                memory/3500-87-0x0000000000510000-0x0000000000570000-memory.dmp
                Download

                memory/3500-96-0x0000000140000000-0x00000001401B2000-memory.dmp
                Download

                memory/3500-93-0x0000000000510000-0x0000000000570000-memory.dmp
                Download

                memory/3780-213-0x0000000000B60000-0x0000000000BC0000-memory.dmp
                Download

                memory/3780-217-0x0000000140000000-0x0000000140147000-memory.dmp
                Download

                memory/3780-536-0x0000000140000000-0x0000000140147000-memory.dmp
                Download

                memory/3780-207-0x0000000000B60000-0x0000000000BC0000-memory.dmp
                Download

                memory/3804-237-0x0000000000B80000-0x0000000000BE0000-memory.dmp
                Download

                memory/3804-241-0x0000000140000000-0x0000000140216000-memory.dmp
                Download

                memory/3804-231-0x0000000000B80000-0x0000000000BE0000-memory.dmp
                Download

                memory/3804-541-0x0000000140000000-0x0000000140216000-memory.dmp
                Download

                memory/3880-98-0x0000000000B20000-0x0000000000B80000-memory.dmp
                Download

                memory/3880-104-0x0000000000B20000-0x0000000000B80000-memory.dmp
                Download

                memory/3880-227-0x0000000140000000-0x000000014018E000-memory.dmp
                Download

                memory/3880-107-0x0000000140000000-0x000000014018E000-memory.dmp
                Download

                memory/4160-82-0x0000000000CB0000-0x0000000000D10000-memory.dmp
                Download

                memory/4160-76-0x0000000000CB0000-0x0000000000D10000-memory.dmp
                Download

                memory/4160-75-0x0000000140000000-0x000000014019C000-memory.dmp
                Download

                memory/4160-200-0x0000000140000000-0x000000014019C000-memory.dmp
                Download

                memory/4624-7271-0x00000275A28C0000-0x00000275A28D0000-memory.dmp
                Download

                memory/4624-7269-0x00000275A28C0000-0x00000275A28D0000-memory.dmp
                Download

                memory/4624-7268-0x00000275A28C0000-0x00000275A28D0000-memory.dmp
                Download

                memory/4624-7266-0x00000275A28C0000-0x00000275A28D0000-memory.dmp
                Download

                memory/4624-7272-0x00000275A28C0000-0x00000275A28D0000-memory.dmp
                Download

                memory/4624-7267-0x00000275A28C0000-0x00000275A28D0000-memory.dmp
                Download

                memory/4624-7273-0x00000275A28C0000-0x00000275A28D0000-memory.dmp
                Download

                memory/4624-7275-0x00000275A28C0000-0x00000275A28D0000-memory.dmp
                Download

                memory/4624-7270-0x00000275A28C0000-0x00000275A28D0000-memory.dmp
                Download

                memory/4624-7274-0x00000275A28C0000-0x00000275A28D0000-memory.dmp
                Download

                memory/4724-542-0x0000000140000000-0x00000001401A9000-memory.dmp
                Download

                memory/4724-249-0x0000000000690000-0x00000000006F0000-memory.dmp
                Download

                memory/4724-253-0x0000000140000000-0x00000001401A9000-memory.dmp
                Download

                memory/4744-252-0x0000000140000000-0x0000000140178000-memory.dmp
                Download

                memory/4744-128-0x00000000006E0000-0x0000000000740000-memory.dmp
                Download

                memory/4744-122-0x00000000006E0000-0x0000000000740000-memory.dmp
                Download

                memory/4744-131-0x0000000140000000-0x0000000140178000-memory.dmp
                Download

                memory/4860-65-0x0000000000CD0000-0x0000000000D30000-memory.dmp
                Download

                memory/4860-71-0x0000000000CD0000-0x0000000000D30000-memory.dmp
                Download

                memory/4860-73-0x0000000140000000-0x00000001401B8000-memory.dmp
                Download

                memory/4860-70-0x0000000140000000-0x00000001401B8000-memory.dmp
                Download

                memory/4860-59-0x0000000000CD0000-0x0000000000D30000-memory.dmp
                Download

                memory/5076-203-0x00000000005F0000-0x0000000000650000-memory.dmp
                Download

                memory/5076-198-0x00000000005F0000-0x0000000000650000-memory.dmp
                Download

                memory/5076-201-0x0000000140000000-0x00000001401C0000-memory.dmp
                Download

                memory/5076-192-0x00000000005F0000-0x0000000000650000-memory.dmp
                Download

                memory/5076-205-0x0000000140000000-0x00000001401C0000-memory.dmp
                Download

                memory/5088-166-0x0000000140000000-0x0000000140169000-memory.dmp
                Download

                memory/5088-157-0x00000000006A0000-0x0000000000700000-memory.dmp
                Download

                memory/5088-163-0x00000000006A0000-0x0000000000700000-memory.dmp
                Download

                memory/5088-524-0x0000000140000000-0x0000000140169000-memory.dmp
                Download

                memory/5512-7210-0x0000000140000000-0x0000000141785000-memory.dmp
                Download

                memory/5512-7264-0x00000000025F0000-0x0000000002650000-memory.dmp
                Download

                memory/5512-7189-0x0000000002220000-0x00000000022A3000-memory.dmp
                Download

                memory/5512-7258-0x00000000025F0000-0x0000000002650000-memory.dmp
                Download

                memory/5512-13864-0x0000000140000000-0x0000000141785000-memory.dmp
                Download

                memory/5512-13842-0x0000000140000000-0x0000000141785000-memory.dmp
                Download

                memory/5512-7195-0x0000000002220000-0x00000000022A3000-memory.dmp
                Download