Overview

overview

7

Static

static

3

2026-10-17...nj.exe

windows10-2004-x64

7

2026-10-17...nj.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    18/10/2026, 20:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-17_bf26dd575bcdf9d52f3e40fac6644389_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
  • Size 6.1MB
  • Sample261018-y2ldmace39
  • SHA256 e68c7cd5082164bbd787d2324990c4052ec27efc96420a2053e9b82f5f19800a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryransomwarespywarestealertrojan

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 33 IoCs
  • Loads dropped DLL 56 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 29 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

    Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 14 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 1 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 30 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-17_bf26dd575bcdf9d52f3e40fac6644389_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-17_bf26dd575bcdf9d52f3e40fac6644389_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies trusted root certificate store through registry
    • Reads the TCP/IP host and domain name from the registry
    • Checks processor information in registry
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5740
    • C:\Users\Admin\AppData\Local\Temp\2026-10-17_bf26dd575bcdf9d52f3e40fac6644389_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
      C:\Users\Admin\AppData\Local\Temp\2026-10-17_bf26dd575bcdf9d52f3e40fac6644389_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
      2⤵
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • Checks SCSI registry key(s)
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:9204
      • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
        C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe -nocrashdialog "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=9204" "-buildid=1791918634" "-steamid=0" "-logdir=C:\Users\Admin\AppData\Local\Temp\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Users\Admin\AppData\Local\Temp\clientui" "-steampath=C:\Users\Admin\AppData\Local\Temp\2026-10-17_bf26dd575bcdf9d52f3e40fac6644389_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling "--log-file=C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --disable-quick-menu --disable-component-update "--gaia-url=http://disabled.invalid" "--enable-features=PlatformHEVCDecoderSupport" "--disable-features=WinRetrieveSuggestionsOnlyOnDemand,SpareRendererForSitePerProcess,BlockPromptsIfIgnoredOften,WebUsbDeviceDetection,ValveFFmpegAllowLowDelayHEVC"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Reads the TCP/IP host and domain name from the registry
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:9812
        • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
          "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe" --type=gpu-process --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1791918634 --steamid=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1932,i,716877085518738883,4286124540398483972,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=1884 --mojo-platform-channel-handle=1928 /prefetch:2
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:6272
        • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
          "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1791918634 --steamid=0 --field-trial-handle=2236,i,716877085518738883,4286124540398483972,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2284 --mojo-platform-channel-handle=2280 /prefetch:3
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          • System Time Discovery
          PID:6160
        • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
          "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1791918634 --steamid=0 --field-trial-handle=2324,i,716877085518738883,4286124540398483972,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2404 --mojo-platform-channel-handle=2388 /prefetch:8
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1460
        • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
          "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1791918634 --steamid=0 --gaia-url=http://disabled.invalid --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=4012,i,716877085518738883,4286124540398483972,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4032 --mojo-platform-channel-handle=4028 /prefetch:1
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4776
        • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
          "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1791918634 --steamid=0 --field-trial-handle=4932,i,716877085518738883,4286124540398483972,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5044 --mojo-platform-channel-handle=5040 /prefetch:8
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          PID:11736
      • C:\Users\Admin\AppData\Local\Temp\steamsysinfo.exe
        C:\Users\Admin\AppData\Local\Temp\steamsysinfo.exe -steamid 0 -buildid 1791918634 -logdir C:\Users\Admin\AppData\Local\Temp\logs -nocrashdialog -query 1 -out-file C:\Users\Admin\AppData\Local\Temp\C65.tmp
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:9824
      • C:\Users\Admin\AppData\Local\Temp\bin\gldriverquery64.exe
        .\bin\gldriverquery64.exe
        3⤵
        • Executes dropped EXE
        PID:3120
      • C:\Users\Admin\AppData\Local\Temp\bin\gldriverquery.exe
        .\bin\gldriverquery.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2244
      • C:\Users\Admin\AppData\Local\Temp\bin\vulkandriverquery64.exe
        .\bin\vulkandriverquery64.exe
        3⤵
        • Executes dropped EXE
        PID:1920
      • C:\Users\Admin\AppData\Local\Temp\bin\vulkandriverquery.exe
        .\bin\vulkandriverquery.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2136
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    PID:5748
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    PID:1240
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:5228
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:3280
    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:5620
    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:2484
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:2128
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:972
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:3336
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:5756
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3832
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:5520
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:2468
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      PID:2360
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:3456
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:5068
      • C:\Windows\System32\OpenSSH\ssh-agent.exe
        C:\Windows\System32\OpenSSH\ssh-agent.exe
        1⤵
        • Executes dropped EXE
        PID:4468
      • C:\Windows\system32\TieringEngineService.exe
        C:\Windows\system32\TieringEngineService.exe
        1⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:4296
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1036
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:2904
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3664
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:9992
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        PID:9932
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Direct Volume Access: Opens a physical disk for reading
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:7532
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:8972
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 0 920 924 932 8192 928 904
          2⤵
          • Modifies data under HKEY_USERS
          PID:8996
      • C:\Windows\system32\AUDIODG.EXE
        C:\Windows\system32\AUDIODG.EXE 0x534 0x530
        1⤵
          PID:1260
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
          1⤵
            PID:11612

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                elevation_service.exe
                • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                • Size 2.7MB
                • SHA256 ffac2df26b4803cdc6e7924b5bc87a8bc8a9325adcbd6fcf166fab0bdf1d5150
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                maintenanceservice.exe
                • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                • Size 845KB
                • SHA256 fa120211df5ff9531cc01934735137c32bd9f2005a2ce54418950c207f5ba473
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                7z.exe
                • Path C:\Program Files\7-Zip\7z.exe
                • Size 1.1MB
                • SHA256 9b392481b19ca2962f324687df23b9b045db3f4bdc7087460ff129db4c9b5302
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                7zFM.exe
                • Path C:\Program Files\7-Zip\7zFM.exe
                • Size 1.5MB
                • SHA256 21ef325f5f10ba6dcb1a567dee74a23e8a88443c237f355b015ffea532159233
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                7zG.exe
                • Path C:\Program Files\7-Zip\7zG.exe
                • Size 1.2MB
                • SHA256 f4fa4ae800cfa563463d508d51bbf82916201252488831adc52c8d4c362ec079
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Uninstall.exe
                • Path C:\Program Files\7-Zip\Uninstall.exe
                • Size 599KB
                • SHA256 ba4ad41c40cacc0154f9591fbf076223b881fae206d923d0cf975e598769c672
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AppVShNotify.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
                • Size 859KB
                • SHA256 ff04ccc720aaf4274e2dd8eae67f26843f5b3d1aa098b73f4aa3e4996eb8d4ab
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                IntegratedOffice.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
                • Size 4.7MB
                • SHA256 7574065922231d7da33e9e1d65f2419c699c7d2853770f3f8c5f232ac2fca131
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MavInject32.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
                • Size 928KB
                • SHA256 e8b3602a258d929f8930055569e501c0590eea02b2fdd6a0085623c01b494881
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                OfficeC2RClient.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
                • Size 24.0MB
                • SHA256 d3492dc429651a5539b224abd174b9de17d577a169565f835e5c594a3c2d3ab6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                appvcleaner.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
                • Size 2.7MB
                • SHA256 aad537836393c101a75648788b69733ff14a266a0dc8385a594eb92a0945cf46
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                LICLUA.EXE
                • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
                • Size 1.1MB
                • SHA256 675e630680a55da09348df93ce798ae782baf998794db977a87d59e716ae9759
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                OSE.EXE
                • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                • Size 825KB
                • SHA256 2d3ec718a87758b87ab45be100cc4c1643d32bf68b5e2215943d8824938782d5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                VSTOInstaller.exe
                • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
                • Size 675KB
                • SHA256 a6962aec0e641ce9f07fb26b63bc04b6d212b2944568065c077fba496f1d5bc8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                chrome_pwa_launcher.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
                • Size 2.3MB
                • SHA256 702342efb98e3464d38c3016f1cc493e07f2c2110625866d12129f949ff29d45
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                elevation_service.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                • Size 2.8MB
                • SHA256 75a230158caaf1bbce67fc6ac1534952b633c38515548921bdcf2151a6e58f7a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                wmpnetwk.exe
                • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
                • Size 1.5MB
                • SHA256 92713479bd70a826e49fae0b4a75d85f679efa1aeeb0100fb19394c622684025
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                dotnet.exe
                • Path C:\Program Files\dotnet\dotnet.exe
                • Size 718KB
                • SHA256 2204f751e6420aebc4aaa4a336b7664ce6343c3ed947bbf5320aed35a14444aa
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                09c7c5b1-6528-419e-9747-57af654f6ee6.tmp
                • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\09c7c5b1-6528-419e-9747-57af654f6ee6.tmp
                • Size 2KB
                • SHA256 6b0ae8d314450b991abc0378cfe3519cd5a1cec47b6f3bb06301409358fd1270
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                7011bcb6-91eb-4fa3-9b5f-14348b79a134.tmp
                • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\7011bcb6-91eb-4fa3-9b5f-14348b79a134.tmp
                • Size 1KB
                • SHA256 356d708a7a2ff9278ac54cfb46d2ad33639d37cbd428f045c9615b23d23a6e9b
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                906ecdcb-7027-4608-9b0b-415076aaede6.tmp
                • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\906ecdcb-7027-4608-9b0b-415076aaede6.tmp
                • Size 7KB
                • SHA256 9847ee43477cb981a3052c4e8ef8ecf7a9dd31917c11f920270d6456b222e71d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                data_0
                • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Cache\Cache_Data\data_0
                • Size 8KB
                • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                data_1
                • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Cache\Cache_Data\data_1
                • Size 264KB
                • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                data_2
                • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Cache\Cache_Data\data_2
                • Size 8KB
                • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                data_3
                • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Cache\Cache_Data\data_3
                • Size 8KB
                • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                temp-index
                • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Code Cache\js\index-dir\temp-index
                • Size 360B
                • SHA256 59a557483b0795cb3e4991ab35fac2cb98563530b048a8c3a1114673930860af
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                the-real-index
                • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Code Cache\wasm\index-dir\the-real-index
                • Size 48B
                • SHA256 daa7a58c7d66bcbcb536657ab8f6c87a8da53bbb128fe24225ef7246c00de3f1
                • MD5 SHA1 SHA512
                Submit Download

                MANIFEST-000001
                • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Extension Rules\MANIFEST-000001
                • Size 41B
                • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                • MD5 SHA1 SHA512
                Submit Download

                SCT Auditing Pending Reports
                • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\SCT Auditing Pending Reports
                • Size 2B
                • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                • MD5 SHA1 SHA512
                Submit Download

                TransportSecurity
                • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity
                • Size 188B
                • SHA256 eacb239cd6c89a7c2933ce38c319b4121ef9c883eeb130ce77250cc44e47ec45
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                ffcfd9d9-2c98-40e6-b958-75bfb36b0ffc.tmp
                • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\ffcfd9d9-2c98-40e6-b958-75bfb36b0ffc.tmp
                • Size 188B
                • SHA256 9469ca46d996772ef161ab38e21ebb83b55321568b7a17a3fdeda6a77cabed14
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Preferences
                • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences
                • Size 7KB
                • SHA256 6673d9f606cbb0cde6f1d9186d9a6fa64171f468d99cf8fc76afc30f1f0eef01
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                CURRENT
                • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Sync Data\LevelDB\CURRENT
                • Size 16B
                • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                • MD5 SHA1 SHA512
                Submit Download

                Local State
                • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
                • Size 888B
                • SHA256 1ec454ae509bf578e9c67ea3241cebb8f560fec6ad183010f551ce5156a9cd82
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                a2f44663-5cb1-4e6a-8dc9-37e00f735173.tmp
                • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\a2f44663-5cb1-4e6a-8dc9-37e00f735173.tmp
                • Size 2KB
                • SHA256 7bf5233cec47e0fe248511a7d360053167a1ce04b279053eba4edc9fae99916d
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                SDL3.dll
                • Path C:\Users\Admin\AppData\Local\Temp\SDL3.dll
                • Size 2.9MB
                • SHA256 66db88c627480b1b15123c98fab459ae25905e1375a4737e87b0830928980151
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SteamUI.dll
                • Path C:\Users\Admin\AppData\Local\Temp\SteamUI.dll
                • Size 18.5MB
                • SHA256 1b9457943205dc3af0bd53463ba331cbd2a381388699705c02271aac7a2b1252
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                config.vdf
                • Path C:\Users\Admin\AppData\Local\Temp\config\config.vdf
                • Size 117B
                • SHA256 a3d8a2cba6e356e02c0f33b50e3a9e61d2f9dfb6a26b5983e30e7786da95dba7
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                config.vdf.async9204.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\config\config.vdf.async9204.tmp
                • Size 1KB
                • SHA256 f3847b5e4a40d9cf76df35398bb555117dfe3626c00a91f2babdedb619d6ad53
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                config.vdf.async9204.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\config\config.vdf.async9204.tmp
                • Size 1KB
                • SHA256 8f9f970835f133258a7f740126012439385bbaa5a1d6a9d0d967a390977441c3
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                config.vdf.async9204.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\config\config.vdf.async9204.tmp
                • Size 11KB
                • SHA256 66f6141dcea0319f53881a50ef6ab84319327cbb83d3d66cbb9557bb4a86fa53
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                config.vdf.async9204.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\config\config.vdf.async9204.tmp
                • Size 11KB
                • SHA256 ec5482e0d82d7e389556857005120babcc7f12558392325ddf20e61d30796e93
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                crashhandler64.dll
                • Path C:\Users\Admin\AppData\Local\Temp\crashhandler64.dll
                • Size 499KB
                • SHA256 bfac9e7c90e20cc9a3ce36d4ed0074c1d18717283e983b0d556d24801c174b9a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                libavcodec-62.dll
                • Path C:\Users\Admin\AppData\Local\Temp\libavcodec-62.dll
                • Size 7.2MB
                • SHA256 a7d85d28a2ede4e1767dc26f7017566b97f8b5533b2bd52431599850017eb2bc
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                libavutil-60.dll
                • Path C:\Users\Admin\AppData\Local\Temp\libavutil-60.dll
                • Size 2.3MB
                • SHA256 eaef6e4ba7283e1ac7ae80c26b41f8f05d5437640c7ff78719089d16b72974e0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                libpyrowave-shared-1.dll
                • Path C:\Users\Admin\AppData\Local\Temp\libpyrowave-shared-1.dll
                • Size 2.6MB
                • SHA256 f6ef66e609865a2167493a635e5fa2da978b9e124bb26e62558892f071bb8a17
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                bootstrap_log.txt
                • Path C:\Users\Admin\AppData\Local\Temp\logs\bootstrap_log.txt
                • Size 10KB
                • SHA256 c149d5634fe93101b2c1020fd1d23e2ac5208359e82c56591d21800d3a5b80aa
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                service_log.txt
                • Path C:\Users\Admin\AppData\Local\Temp\logs\service_log.txt
                • Size 277B
                • SHA256 6f69b8bf7f32bccbd571027485e6e96923c36063493f2c6c0fbc98963129a771
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                service_log.txt
                • Path C:\Users\Admin\AppData\Local\Temp\logs\service_log.txt
                • Size 638B
                • SHA256 0803df77169cc1d33e9aac7e40a0d26e331e9c28d275ef3d3e1593162dcaa06e
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                bins_codecs_win64.zip.vz.c01daf4a0716b88602056bd92acc644129b22e45_7421009
                • Path C:\Users\Admin\AppData\Local\Temp\package\bins_codecs_win64.zip.vz.c01daf4a0716b88602056bd92acc644129b22e45_7421009
                • Size 7.1MB
                • SHA256 4e0688746e470316fe915c2e0b672c840842525a11f4038c9bf5389ff30de210
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                bins_hardware_all.zip.vz.e20ce22310e0bd34afb47fa5a502b8aeeb2a095a_298634
                • Path C:\Users\Admin\AppData\Local\Temp\package\bins_hardware_all.zip.vz.e20ce22310e0bd34afb47fa5a502b8aeeb2a095a_298634
                • Size 291KB
                • SHA256 f41b156386ce0648ff8d5a219b0f21a78673d650e84686836d3e25d90b155de5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                bins_hardware_win64.zip.827a01a60b8b7fd6c3df0f00c938f6c97b03276b
                • Path C:\Users\Admin\AppData\Local\Temp\package\bins_hardware_win64.zip.827a01a60b8b7fd6c3df0f00c938f6c97b03276b
                • Size 8.1MB
                • SHA256 0c6dbf35a61502b59da0477e09aa212b0acf0ef542815eb5f357feb264dadc62
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                bins_misc_win64.zip.vz.7803168fa078e80df23870952e39eea3f424a5b7_12196250
                • Path C:\Users\Admin\AppData\Local\Temp\package\bins_misc_win64.zip.vz.7803168fa078e80df23870952e39eea3f424a5b7_12196250
                • Size 11.6MB
                • SHA256 494fe63824ef42a24de3cb1214ffbecb3ab50814dc05938f12f1ffa5bda895b6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                bins_webhelpers_win64.zip.vz.310d1fb549d361d8124e010b14dc8f2a67d9f212_2720886
                • Path C:\Users\Admin\AppData\Local\Temp\package\bins_webhelpers_win64.zip.vz.310d1fb549d361d8124e010b14dc8f2a67d9f212_2720886
                • Size 2.6MB
                • SHA256 cef01728b05afb4e8ab53b03f4e4262bbc0abeceb245da601db3ea4a2200717a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                bins_win64.zip.vz.62fef8f5cb95bcfb5619f34a2efc32db2071a6bb_35474054
                • Path C:\Users\Admin\AppData\Local\Temp\package\bins_win64.zip.vz.62fef8f5cb95bcfb5619f34a2efc32db2071a6bb_35474054
                • Size 33.8MB
                • SHA256 23c409f3bb0d5265a637baeab2bd7d2b93ba3898207efde68dbfbf693ec17e87
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                public_all.zip.vz.fad74034d307ee2b036f775df839bf9e6ad48b7b_24182960
                • Path C:\Users\Admin\AppData\Local\Temp\package\public_all.zip.vz.fad74034d307ee2b036f775df839bf9e6ad48b7b_24182960
                • Size 23.1MB
                • SHA256 3adade20ed5b28ba53d3f6d0cf2660f24c049064ef7936212ce6a52829e472d0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                resources_all.zip.vz.ef4c575e0ebeda2c391b9e56182d51ce688f222e_3488108
                • Path C:\Users\Admin\AppData\Local\Temp\package\resources_all.zip.vz.ef4c575e0ebeda2c391b9e56182d51ce688f222e_3488108
                • Size 3.3MB
                • SHA256 e3b3d053d2a4ac25a2d6175bb5df98726c046393090d8c7bbffcc85e03a297f1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                resources_hidpi_all.zip.vz.3de815c3117712cb9eeb7ea4c8b275faf481dcfd_56342
                • Path C:\Users\Admin\AppData\Local\Temp\package\resources_hidpi_all.zip.vz.3de815c3117712cb9eeb7ea4c8b275faf481dcfd_56342
                • Size 55KB
                • SHA256 e9cfba9af633e9d216a0cde97b1177d4cbca2a1aca7e83aaf38655dbd9be4b7d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                resources_misc_all.zip.vz.e86a975545f3ab21a77373870cb311ef93934b8c_2224876
                • Path C:\Users\Admin\AppData\Local\Temp\package\resources_misc_all.zip.vz.e86a975545f3ab21a77373870cb311ef93934b8c_2224876
                • Size 2.1MB
                • SHA256 5e9ca0aac16b4d5caa2ac77ab2ce239e8dbcabe5ba6f0565112239ebb127ab2b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                steam_client_metrics.bin
                • Path C:\Users\Admin\AppData\Local\Temp\package\steam_client_metrics.bin
                • Size 3KB
                • SHA256 0a917ebc97a7fd17a897645f1ac829301d3ce936780ff8e79fdbc192ed341026
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                steam_client_win64.installed
                • Path C:\Users\Admin\AppData\Local\Temp\package\steam_client_win64.installed
                • Size 499KB
                • SHA256 82f4b98de40f708f053293fe502113d209399d397eee3a025f72a945c9f79924
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                steam_client_win64.manifest
                • Path C:\Users\Admin\AppData\Local\Temp\package\steam_client_win64.manifest
                • Size 7KB
                • SHA256 5bb90281e2c4690de6432756512fae3946ba667a3ba6cb1cd89f749a1fcd1133
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                steam_win64_steamrow.zip.vz.ac1682b3fda1156b6c29a900f37fdb00b00789d9_2165629
                • Path C:\Users\Admin\AppData\Local\Temp\package\steam_win64_steamrow.zip.vz.ac1682b3fda1156b6c29a900f37fdb00b00789d9_2165629
                • Size 2.1MB
                • SHA256 aee04fdeac282371d38c3cb5b0024972821357de684520b623f084a82bacc6c8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                steamui_websrc_all.zip.vz.b5e3049b293bba61b67b93fee0fe9eea62a817a9_28679890
                • Path C:\Users\Admin\AppData\Local\Temp\package\steamui_websrc_all.zip.vz.b5e3049b293bba61b67b93fee0fe9eea62a817a9_28679890
                • Size 27.4MB
                • SHA256 3f784dddfec25ec36a3ddf297e5e42545a8fc600e5a9fef4258a0ffdd999ce36
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                steamui_websrc_movies_all.zip.40e78cdda48e9a8a74baf614e0cdc7a6b96d26d1
                • Path C:\Users\Admin\AppData\Local\Temp\package\steamui_websrc_movies_all.zip.40e78cdda48e9a8a74baf614e0cdc7a6b96d26d1
                • Size 10.4MB
                • SHA256 885a32533327f0fd5ea98e6c6f13552e965cab4852dad7ce9ccf3d929d726b5b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                steamui_websrc_sounds_all.zip.vz.5ba6acd8f4dfe4b93437895b20344fab5bb3ff96_3714779
                • Path C:\Users\Admin\AppData\Local\Temp\package\steamui_websrc_sounds_all.zip.vz.5ba6acd8f4dfe4b93437895b20344fab5bb3ff96_3714779
                • Size 3.5MB
                • SHA256 ac62e3d0e6213bcbdcfe973c624eda0486977dccdc4098c10b60b62e894ea93b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                strings_all.zip.vz.1518f222a37456b048acfb3d6c3d97865a612666_2079871
                • Path C:\Users\Admin\AppData\Local\Temp\package\strings_all.zip.vz.1518f222a37456b048acfb3d6c3d97865a612666_2079871
                • Size 2.0MB
                • SHA256 da8abc499d1b675f4b303823e85f228a0385b4341ba785ba6fa3b8ea1d4df124
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                strings_en_all.zip.e716a67d7fa91ba70490a6417e25d45c5435e393
                • Path C:\Users\Admin\AppData\Local\Temp\package\strings_en_all.zip.e716a67d7fa91ba70490a6417e25d45c5435e393
                • Size 111KB
                • SHA256 0c56193fac4fa518eaaac0dc66ecd21a3cee510ece85594b6c308f8d31ee98a3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                tenfoot_images_all.zip.vz.193cb8c4eb4446698ea2c0a9e8c4e6b6a623dac7_5572671
                • Path C:\Users\Admin\AppData\Local\Temp\package\tenfoot_images_all.zip.vz.193cb8c4eb4446698ea2c0a9e8c4e6b6a623dac7_5572671
                • Size 5.3MB
                • SHA256 e1fee3beffa9d08a415a35ddc7d3141af6c44269c67e67aa0a3eea6e56889bd7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                btnOvrOffTop.tga_
                • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\btnOvrOffTop.tga_
                • Size 444B
                • SHA256 ecd13153d9d438809a38de30f3abbb0f6f92837a7e3cacb442a9a9309bcd78d9
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                [email protected]_
                • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\[email protected]_
                • Size 15KB
                • SHA256 d3af480fe975487ea4754c88dd56df0d4cfe68633eb9abb2458f42ae3df34479
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                [email protected]_
                • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\[email protected]_
                • Size 92KB
                • SHA256 f200aca23ac6739a6d521298094972383f835d8fcac24b7bdef820181ae8c37a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                icon_button_news.tga_
                • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\icon_button_news.tga_
                • Size 20KB
                • SHA256 42c410136a35b64c7e0a410b1d2fd2e2712782039cd7237615219ea57d7c40fa
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                tabStdTop.tga_
                • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\tabStdTop.tga_
                • Size 48B
                • SHA256 5caa5fa3e79dcd8ec5ec20256ed7c77efaae77e0ae8d89e4a974c484cb177d84
                • MD5 SHA1 SHA512
                Submit Download

                steam_updating.ico_
                • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\public\steam_updating.ico_
                • Size 47KB
                • SHA256 5aaca90948de8f7d11264ed608a2f96acba061e6463d337d658b00ed1c552449
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                steam_updating_posix.tga_
                • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\public\steam_updating_posix.tga_
                • Size 64KB
                • SHA256 fd2abb8945c06a6b9c5444baf6ea523b52bf7a03a58b34ebe0a6a110630ed5f8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                filter_banned_thai.txt.gz_
                • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\resource\filter_banned_thai.txt.gz_
                • Size 23B
                • SHA256 6feb83ca306745d634903cf09274b7baf0ac38e43c6b3fab1a608be344c3ef64
                • MD5 SHA1 SHA512
                Submit Download

                steambootstrapper_english.txt
                • Path C:\Users\Admin\AppData\Local\Temp\public\steambootstrapper_english.txt
                • Size 4KB
                • SHA256 fbc09c1b9a55d04b57be8fb2ad5ab58b38f76054ecd3d1b70440a2d08191b05b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                tier0_s64.dll
                • Path C:\Users\Admin\AppData\Local\Temp\tier0_s64.dll
                • Size 867KB
                • SHA256 855e5c958aa52b5e3d5b7694228a1750ef35f38ffb3bd468201c70c118500797
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ba313271227ba850.bin
                • Path C:\Users\Admin\AppData\Roaming\ba313271227ba850.bin
                • Size 12KB
                • SHA256 ef037e02c38517ac821bde8fc14cbf616746e4c3d3fdf5df3d67d12358c01c02
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                perfhost.exe
                • Path C:\Windows\SysWOW64\perfhost.exe
                • Size 606KB
                • SHA256 0cdadd078a2c5033928d7ad1d0984a63cbb99cf3270db95a0f59da93f006ccce
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AgentService.exe
                • Path C:\Windows\System32\AgentService.exe
                • Size 1.7MB
                • SHA256 4bb97bdbe4642e5d0c78184fbf3c746cbd74a0d291a2e55e9f57360d62063850
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                DiagnosticsHub.StandardCollector.Service.exe
                • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                • Size 677KB
                • SHA256 cc9cf134605c47cbb8a281c821f39c97abf5bf638c134eda430bb2df450d2245
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                FXSSVC.exe
                • Path C:\Windows\System32\FXSSVC.exe
                • Size 1.2MB
                • SHA256 0401bb5be6fa3f9c338f837c82a9b16063dd7c4766416de131e10dea72630f3a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Locator.exe
                • Path C:\Windows\System32\Locator.exe
                • Size 596KB
                • SHA256 60f8a79ea02f2e0490022f62b11bcb6111c6e94fa5618a4e829072ad52dd9720
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ssh-agent.exe
                • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                • Size 959KB
                • SHA256 aaf24adca088a6152871c0cf43de670ee7b5f0501b1421329a1145af22501116
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                PerceptionSimulationService.exe
                • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
                • Size 689KB
                • SHA256 7e9a69c2648a2d37abe679b94cbb4ff43f465de5bf559624df48289342d8644f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SearchIndexer.exe
                • Path C:\Windows\System32\SearchIndexer.exe
                • Size 1.5MB
                • SHA256 23f6ba666c3020fcf6b5d7d564a4eb4c5e9b3ca748efdfbc6d0d4567fddde65e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SensorDataService.exe
                • Path C:\Windows\System32\SensorDataService.exe
                • Size 1.8MB
                • SHA256 893a182702f94545ee947b90f96dd24f6a7f102c311b1df2396a5d3c8c70222a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Spectrum.exe
                • Path C:\Windows\System32\Spectrum.exe
                • Size 1.4MB
                • SHA256 1a26c268a7ff2a566aaa78be159780865b8e7bda7529a20e2c41f4a5031360ae
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                TieringEngineService.exe
                • Path C:\Windows\System32\TieringEngineService.exe
                • Size 903KB
                • SHA256 08b36d30d643c129b0ba73e502687a9447301ed26453b5ff4c34e1e52bb14e96
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                VSSVC.exe
                • Path C:\Windows\System32\VSSVC.exe
                • Size 2.0MB
                • SHA256 400ac52ff20dc69f3663c73057dc7169aeb75c56f201a6cce1c5e31772287b89
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                alg.exe
                • Path C:\Windows\System32\alg.exe
                • Size 678KB
                • SHA256 0da86f2c1e999dcd9f8dd9e30d689364ac2be0beab4bdb72a2aac097e39cbe32
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                msdtc.exe
                • Path C:\Windows\System32\msdtc.exe
                • Size 730KB
                • SHA256 2cfd80e130027f479389153f68739191066c98178aeaa7b999540763b2643f0f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                snmptrap.exe
                • Path C:\Windows\System32\snmptrap.exe
                • Size 601KB
                • SHA256 accad5044039b77a662a81513c3f613a281b882371394d2731a8fe6ab53f5cde
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                vds.exe
                • Path C:\Windows\System32\vds.exe
                • Size 1.3MB
                • SHA256 a7269c10f77dc29a4b5f570cf9935552ce40f88534b8c03b4e528128cf2793dd
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                WmiApSrv.exe
                • Path C:\Windows\System32\wbem\WmiApSrv.exe
                • Size 790KB
                • SHA256 26e82345bb7d9ba3c91f471ffab6acb11303fcb219803861c7d986e4e5d0dd26
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                wbengine.exe
                • Path C:\Windows\System32\wbengine.exe
                • Size 2.1MB
                • SHA256 05932048d86e437284ffbb72f4a8e149b9fac35f7e668d3cbf9de16975690782
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AppVClient.exe
                • Path C:\Windows\system32\AppVClient.exe
                • Size 1.3MB
                • SHA256 fc8441e59795f3adf7adf57950658970a1e406ea3ad7f406b3c62e9f0cf988be
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SgrmBroker.exe
                • Path C:\Windows\system32\SgrmBroker.exe
                • Size 895KB
                • SHA256 add3e41ab77a3d5dac83607e1744ac3ed6a12c08873115fc2aba0f0b257fc9b3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                msiexec.exe
                • Path C:\Windows\system32\msiexec.exe
                • Size 653KB
                • SHA256 50bd54fc81d1f135b465ef37328475a8eabd6d9b17a9bce298342725e03956d6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/972-170-0x00007FF7BF810000-0x00007FF7BF923000-memory.dmp
                Download

                memory/972-93-0x000002986D6D0000-0x000002986D736000-memory.dmp
                Download

                memory/972-92-0x000002986D6D0000-0x000002986D736000-memory.dmp
                Download

                memory/972-91-0x00007FF7BF810000-0x00007FF7BF923000-memory.dmp
                Download

                memory/1036-201-0x00007FF6D34F0000-0x00007FF6D3918000-memory.dmp
                Download

                memory/1036-195-0x00007FF6D34F0000-0x00007FF6D3918000-memory.dmp
                Download

                memory/1036-199-0x000002089DD60000-0x000002089DDC6000-memory.dmp
                Download

                memory/1036-193-0x000002089DD60000-0x000002089DDC6000-memory.dmp
                Download

                memory/1036-192-0x000002089DD60000-0x000002089DDC6000-memory.dmp
                Download

                memory/1240-74-0x00007FF79FD50000-0x00007FF79FE33000-memory.dmp
                Download

                memory/1240-21-0x00007FF79FD50000-0x00007FF79FE33000-memory.dmp
                Download

                memory/1240-22-0x000001ECBE240000-0x000001ECBE2A6000-memory.dmp
                Download

                memory/1240-23-0x000001ECBE240000-0x000001ECBE2A6000-memory.dmp
                Download

                memory/1240-24-0x000001ECBE240000-0x000001ECBE2A6000-memory.dmp
                Download

                memory/2128-79-0x0000023912120000-0x0000023912186000-memory.dmp
                Download

                memory/2128-80-0x00007FF6547B0000-0x00007FF654917000-memory.dmp
                Download

                memory/2128-85-0x0000023912120000-0x0000023912186000-memory.dmp
                Download

                memory/2128-87-0x00007FF6547B0000-0x00007FF654917000-memory.dmp
                Download

                memory/2128-77-0x0000023912120000-0x0000023912186000-memory.dmp
                Download

                memory/2360-151-0x000001A60EAF0000-0x000001A60EB56000-memory.dmp
                Download

                memory/2360-204-0x00007FF6D0CF0000-0x00007FF6D0D9A000-memory.dmp
                Download

                memory/2360-150-0x000001A60EAF0000-0x000001A60EB56000-memory.dmp
                Download

                memory/2360-152-0x00007FF6D0CF0000-0x00007FF6D0D9A000-memory.dmp
                Download

                memory/2468-141-0x000001F2C02B0000-0x000001F2C0316000-memory.dmp
                Download

                memory/2468-189-0x00007FF6866A0000-0x00007FF686B0C000-memory.dmp
                Download

                memory/2468-187-0x000001F2C02B0000-0x000001F2C0316000-memory.dmp
                Download

                memory/2468-140-0x000001F2C02B0000-0x000001F2C0316000-memory.dmp
                Download

                memory/2468-146-0x00007FF6866A0000-0x00007FF686B0C000-memory.dmp
                Download

                memory/2484-68-0x000001FF0A970000-0x000001FF0A9D6000-memory.dmp
                Download

                memory/2484-67-0x000001FF0A6D0000-0x000001FF0A846000-memory.dmp
                Download

                memory/2484-69-0x000001FF0A970000-0x000001FF0A9D6000-memory.dmp
                Download

                memory/2904-6652-0x00007FF6327B0000-0x00007FF632A6D000-memory.dmp
                Download

                memory/2904-205-0x00007FF6327B0000-0x00007FF632A6D000-memory.dmp
                Download

                memory/3280-47-0x00007FF66C1E0000-0x00007FF66C467000-memory.dmp
                Download

                memory/3280-45-0x0000015CDE080000-0x0000015CDE0E6000-memory.dmp
                Download

                memory/3280-37-0x0000015CDE080000-0x0000015CDE0E6000-memory.dmp
                Download

                memory/3280-38-0x0000015CDE080000-0x0000015CDE0E6000-memory.dmp
                Download

                memory/3280-36-0x00007FF66C1E0000-0x00007FF66C467000-memory.dmp
                Download

                memory/3336-100-0x0000029BAAA10000-0x0000029BAAB86000-memory.dmp
                Download

                memory/3336-101-0x0000029BAAC70000-0x0000029BAACD6000-memory.dmp
                Download

                memory/3336-102-0x0000029BAAC70000-0x0000029BAACD6000-memory.dmp
                Download

                memory/3456-158-0x00000109A5C40000-0x00000109A5CA6000-memory.dmp
                Download

                memory/3456-160-0x00007FF799C50000-0x00007FF799F73000-memory.dmp
                Download

                memory/3456-159-0x00000109A5C40000-0x00000109A5CA6000-memory.dmp
                Download

                memory/3456-206-0x00007FF799C50000-0x00007FF799F73000-memory.dmp
                Download

                memory/3664-6904-0x00007FF6FDE80000-0x00007FF6FE35C000-memory.dmp
                Download

                memory/3664-216-0x00007FF6FDE80000-0x00007FF6FE35C000-memory.dmp
                Download

                memory/3664-211-0x0000024279D70000-0x0000024279DD6000-memory.dmp
                Download

                memory/3664-212-0x0000024279D70000-0x0000024279DD6000-memory.dmp
                Download

                memory/3832-126-0x00000000008A0000-0x0000000000909000-memory.dmp
                Download

                memory/3832-185-0x0000000000400000-0x0000000000548000-memory.dmp
                Download

                memory/3832-121-0x00000000008A0000-0x0000000000909000-memory.dmp
                Download

                memory/3832-120-0x0000000000400000-0x0000000000548000-memory.dmp
                Download

                memory/4296-1665-0x00007FF7B4A80000-0x00007FF7B4C0E000-memory.dmp
                Download

                memory/4296-180-0x000002BFEAA70000-0x000002BFEAAD6000-memory.dmp
                Download

                memory/4296-179-0x000002BFEAA70000-0x000002BFEAAD6000-memory.dmp
                Download

                memory/4296-186-0x00007FF7B4A80000-0x00007FF7B4C0E000-memory.dmp
                Download

                memory/4468-168-0x000002368DBD0000-0x000002368DC36000-memory.dmp
                Download

                memory/4468-167-0x00007FF61E4D0000-0x00007FF61E6BE000-memory.dmp
                Download

                memory/4468-207-0x00007FF61E4D0000-0x00007FF61E6BE000-memory.dmp
                Download

                memory/4468-169-0x000002368DBD0000-0x000002368DC36000-memory.dmp
                Download

                memory/5520-134-0x00007FF759B60000-0x00007FF759C07000-memory.dmp
                Download

                memory/5520-133-0x000001C2C1AD0000-0x000001C2C1B36000-memory.dmp
                Download

                memory/5520-132-0x000001C2C1AD0000-0x000001C2C1B36000-memory.dmp
                Download

                memory/5520-194-0x00007FF759B60000-0x00007FF759C07000-memory.dmp
                Download

                memory/5620-57-0x000001D3ABFE0000-0x000001D3AC156000-memory.dmp
                Download

                memory/5620-59-0x000001D3AC280000-0x000001D3AC2E6000-memory.dmp
                Download

                memory/5620-58-0x000001D3AC280000-0x000001D3AC2E6000-memory.dmp
                Download

                memory/5740-3-0x00000273A77F0000-0x00000273A7856000-memory.dmp
                Download

                memory/5740-0-0x00000273A7560000-0x00000273A76C0000-memory.dmp
                Download

                memory/5740-1-0x00000273A77F0000-0x00000273A7856000-memory.dmp
                Download

                memory/5740-6918-0x00000273A77F0000-0x00000273A7856000-memory.dmp
                Download

                memory/5748-11-0x00007FF6E4040000-0x00007FF6E4126000-memory.dmp
                Download

                memory/5748-13-0x0000025E189E0000-0x0000025E18A46000-memory.dmp
                Download

                memory/5748-12-0x0000025E189E0000-0x0000025E18A46000-memory.dmp
                Download

                memory/5748-64-0x00007FF6E4040000-0x00007FF6E4126000-memory.dmp
                Download

                memory/5756-113-0x000001ECA4290000-0x000001ECA42F6000-memory.dmp
                Download

                memory/5756-176-0x00007FF699380000-0x00007FF699469000-memory.dmp
                Download

                memory/5756-115-0x00007FF699380000-0x00007FF699469000-memory.dmp
                Download

                memory/5756-112-0x000001ECA4290000-0x000001ECA42F6000-memory.dmp
                Download

                memory/7532-6829-0x00000268DE220000-0x00000268DE228000-memory.dmp
                Download

                memory/7532-6909-0x00007FF6E5260000-0x00007FF6E55B3000-memory.dmp
                Download

                memory/7532-6782-0x00000268D5C30000-0x00000268D5C40000-memory.dmp
                Download

                memory/7532-6934-0x00000268DF9B0000-0x00000268DF9B8000-memory.dmp
                Download

                memory/7532-6798-0x00000268D5E60000-0x00000268D5E70000-memory.dmp
                Download

                memory/7532-6653-0x00007FF6E5260000-0x00007FF6E55B3000-memory.dmp
                Download

                memory/7532-6654-0x00000268D4D10000-0x00000268D4D76000-memory.dmp
                Download

                memory/7532-6655-0x00000268D4D10000-0x00000268D4D76000-memory.dmp
                Download

                memory/8996-6943-0x0000018CBC3F0000-0x0000018CBC400000-memory.dmp
                Download

                memory/8996-6946-0x0000018CBC3F0000-0x0000018CBC400000-memory.dmp
                Download

                memory/8996-6941-0x0000018CBC3F0000-0x0000018CBC400000-memory.dmp
                Download

                memory/8996-6944-0x0000018CBC3F0000-0x0000018CBC400000-memory.dmp
                Download

                memory/8996-6942-0x0000018CBC3F0000-0x0000018CBC400000-memory.dmp
                Download

                memory/8996-6945-0x0000018CBC3F0000-0x0000018CBC400000-memory.dmp
                Download

                memory/9204-6921-0x0000024EDE710000-0x0000024EDE776000-memory.dmp
                Download

                memory/9204-6922-0x0000024EDE710000-0x0000024EDE776000-memory.dmp
                Download

                memory/9932-3241-0x000002738CA60000-0x000002738CAC6000-memory.dmp
                Download

                memory/9932-3240-0x000002738CA60000-0x000002738CAC6000-memory.dmp
                Download

                memory/9932-5416-0x00007FF7416E0000-0x00007FF74181A000-memory.dmp
                Download

                memory/9932-6908-0x00007FF7416E0000-0x00007FF74181A000-memory.dmp
                Download

                memory/9992-1583-0x0000021A8D2C0000-0x0000021A8D326000-memory.dmp
                Download

                memory/9992-1584-0x0000021A8D2C0000-0x0000021A8D326000-memory.dmp
                Download

                memory/9992-1977-0x00007FF7DBF30000-0x00007FF7DC45A000-memory.dmp
                Download

                memory/9992-6907-0x00007FF7DBF30000-0x00007FF7DC45A000-memory.dmp
                Download