Overview

overview

7

Static

static

3

2026-10-17...nj.exe

windows10-2004-x64

7

2026-10-17...nj.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    18/10/2026, 20:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-17_bf26dd575bcdf9d52f3e40fac6644389_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
  • Size 6.1MB
  • Sample261018-y2ldmace39
  • SHA256 e68c7cd5082164bbd787d2324990c4052ec27efc96420a2053e9b82f5f19800a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryransomwarespywarestealertrojan

Malware Config

Signatures

  • Executes dropped EXE 33 IoCs
  • Loads dropped DLL 58 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 30 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 14 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 46 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 1 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-17_bf26dd575bcdf9d52f3e40fac6644389_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-17_bf26dd575bcdf9d52f3e40fac6644389_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies trusted root certificate store through registry
    • Reads the TCP/IP host and domain name from the registry
    • Checks processor information in registry
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1796
    • C:\Users\Admin\AppData\Local\Temp\2026-10-17_bf26dd575bcdf9d52f3e40fac6644389_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
      C:\Users\Admin\AppData\Local\Temp\2026-10-17_bf26dd575bcdf9d52f3e40fac6644389_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
      2⤵
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • Checks SCSI registry key(s)
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:21776
      • C:\Users\Admin\AppData\Local\Temp\steamsysinfo.exe
        C:\Users\Admin\AppData\Local\Temp\steamsysinfo.exe -steamid 0 -buildid 1791918634 -logdir C:\Users\Admin\AppData\Local\Temp\logs -nocrashdialog -query 1 -out-file C:\Users\Admin\AppData\Local\Temp\32D9.tmp
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3328
      • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
        C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe -nocrashdialog "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=21776" "-buildid=1791918634" "-steamid=0" "-logdir=C:\Users\Admin\AppData\Local\Temp\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Users\Admin\AppData\Local\Temp\clientui" "-steampath=C:\Users\Admin\AppData\Local\Temp\2026-10-17_bf26dd575bcdf9d52f3e40fac6644389_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling "--log-file=C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --disable-quick-menu --disable-component-update "--gaia-url=http://disabled.invalid" "--enable-features=PlatformHEVCDecoderSupport" "--disable-features=WinRetrieveSuggestionsOnlyOnDemand,SpareRendererForSitePerProcess,BlockPromptsIfIgnoredOften,WebUsbDeviceDetection,ValveFFmpegAllowLowDelayHEVC"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Reads the TCP/IP host and domain name from the registry
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:4584
        • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
          "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe" --type=gpu-process --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1791918634 --steamid=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1884,i,7707254944149451183,15454092974442148605,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=1384 --mojo-platform-channel-handle=1880 /prefetch:2
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:8976
        • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
          "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1791918634 --steamid=0 --field-trial-handle=2108,i,7707254944149451183,15454092974442148605,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2184 --mojo-platform-channel-handle=2180 /prefetch:11
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          • System Time Discovery
          PID:4148
        • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
          "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1791918634 --steamid=0 --field-trial-handle=2232,i,7707254944149451183,15454092974442148605,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2252 --mojo-platform-channel-handle=2248 /prefetch:13
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:6284
        • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
          "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1791918634 --steamid=0 --gaia-url=http://disabled.invalid --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=4164,i,7707254944149451183,15454092974442148605,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4192 --mojo-platform-channel-handle=4188 /prefetch:1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:6556
        • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
          "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1791918634 --steamid=0 --field-trial-handle=4952,i,7707254944149451183,15454092974442148605,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4972 --mojo-platform-channel-handle=4964 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          PID:9488
      • C:\Users\Admin\AppData\Local\Temp\bin\gldriverquery64.exe
        .\bin\gldriverquery64.exe
        3⤵
        • Executes dropped EXE
        PID:9044
      • C:\Users\Admin\AppData\Local\Temp\bin\gldriverquery.exe
        .\bin\gldriverquery.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:9076
      • C:\Users\Admin\AppData\Local\Temp\bin\vulkandriverquery64.exe
        .\bin\vulkandriverquery64.exe
        3⤵
        • Executes dropped EXE
        PID:9092
      • C:\Users\Admin\AppData\Local\Temp\bin\vulkandriverquery.exe
        .\bin\vulkandriverquery.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:9192
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    PID:5112
  • C:\Windows\System32\GameInputSvc.exe
    C:\Windows\System32\GameInputSvc.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4884
    • C:\Windows\System32\GameInputSvc.exe
      "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      PID:2752
  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:6060
  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:52
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in Program Files directory
    PID:4244
  • C:\Windows\System32\msdtc.exe
    C:\Windows\System32\msdtc.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Windows directory
    PID:2228
  • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    PID:5092
  • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    1⤵
    • Executes dropped EXE
    PID:4664
  • C:\Windows\SysWow64\perfhost.exe
    C:\Windows\SysWow64\perfhost.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:2860
  • C:\Windows\System32\ReFsDedupSvc.exe
    C:\Windows\System32\ReFsDedupSvc.exe
    1⤵
    • Executes dropped EXE
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    PID:4328
  • C:\Windows\system32\locator.exe
    C:\Windows\system32\locator.exe
    1⤵
    • Executes dropped EXE
    PID:3820
  • C:\Windows\System32\SensorDataService.exe
    C:\Windows\System32\SensorDataService.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Checks SCSI registry key(s)
    PID:2784
  • C:\Windows\System32\snmptrap.exe
    C:\Windows\System32\snmptrap.exe
    1⤵
    • Executes dropped EXE
    • Reads the TCP/IP host and domain name from the registry
    PID:5060
  • C:\Windows\System32\OpenSSH\ssh-agent.exe
    C:\Windows\System32\OpenSSH\ssh-agent.exe
    1⤵
    • Executes dropped EXE
    PID:2856
  • C:\Windows\system32\TieringEngineService.exe
    C:\Windows\system32\TieringEngineService.exe
    1⤵
    • Executes dropped EXE
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    PID:3972
  • C:\Windows\system32\AgentService.exe
    C:\Windows\system32\AgentService.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:3472
  • C:\Windows\System32\vds.exe
    C:\Windows\System32\vds.exe
    1⤵
    • Executes dropped EXE
    PID:3660
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:8820
  • C:\Windows\system32\wbengine.exe
    "C:\Windows\system32\wbengine.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:7732
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
    • Executes dropped EXE
    • Reads the TCP/IP host and domain name from the registry
    PID:8496
  • C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\SearchIndexer.exe /Embedding
    1⤵
    • Executes dropped EXE
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:10692
    • C:\Windows\System32\SearchProtocolHost.exe
      "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
      2⤵
      • Modifies data under HKEY_USERS
      PID:22292
    • C:\Windows\System32\SearchProtocolHost.exe
      "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2714045687-1127350534-2056456672-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2714045687-1127350534-2056456672-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
      2⤵
        PID:9784
      • C:\Windows\System32\SearchFilterHost.exe
        "C:\Windows\System32\SearchFilterHost.exe" 952 2904 2900 940 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
        2⤵
          PID:10432
        • C:\Windows\System32\SearchFilterHost.exe
          "C:\Windows\System32\SearchFilterHost.exe" 952 2324 2720 940 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
          2⤵
          • Modifies data under HKEY_USERS
          PID:10484
      • C:\Windows\system32\AUDIODG.EXE
        C:\Windows\system32\AUDIODG.EXE 0x00000000000004A8 0x00000000000004B0
        1⤵
          PID:8692
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
          1⤵
            PID:9664
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
            1⤵
              PID:9700

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  elevation_service.exe
                  • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                  • Size 2.7MB
                  • SHA256 7eb21ef2818476b37c61ce7e6f90c00811c4a4ff548d0edf1fdc0fdb71f2123a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  maintenanceservice.exe
                  • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                  • Size 845KB
                  • SHA256 d1586f40363faa5dc91b330c82e80dec49e1c7d27206139da9025bfd09368e92
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  7z.exe
                  • Path C:\Program Files\7-Zip\7z.exe
                  • Size 1.1MB
                  • SHA256 60ba967ec520ebd27b9aa502efddc3c259ff138cf9163f7aefcecdb7374fbf92
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  7zFM.exe
                  • Path C:\Program Files\7-Zip\7zFM.exe
                  • Size 1.5MB
                  • SHA256 dbd33649869eeae5091d752e51c3162bdd71026d3d9fa657132fe999c4f0fb90
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  7zG.exe
                  • Path C:\Program Files\7-Zip\7zG.exe
                  • Size 1.2MB
                  • SHA256 3f8d400511cd1f6036a65350dbdc54699b783266c5b2681b08e0e49c74c8d5c3
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Uninstall.exe
                  • Path C:\Program Files\7-Zip\Uninstall.exe
                  • Size 599KB
                  • SHA256 f1102013b21baa5c7997c5a512a523f137c6cdf020235ce77088ae66a6a1130a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  AppVShNotify.exe
                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
                  • Size 859KB
                  • SHA256 da1f31931a7e13f4937f57e1ba9d1c6ab9b5e1c752f5a718a12a4be16b13f31a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  IntegratedOffice.exe
                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
                  • Size 4.7MB
                  • SHA256 0e64b06deb3d9a217e79c4042adb7dc9b1779c74152773c956a3f920a376479b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MavInject32.exe
                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
                  • Size 928KB
                  • SHA256 0f7c432a3b2b38923582c39d1bf18dcc21be93727cf23233431858c1b4c377e7
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  appvcleaner.exe
                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
                  • Size 2.7MB
                  • SHA256 014bde6caae2fec851718a599857fca23ee19ffc9ad9b53bfbd4ca148ecf3f2d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  OSE.EXE
                  • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                  • Size 825KB
                  • SHA256 044dfaecbd2857e8809ed12c3619048c83aba44ceaf8b4832c5232e571afacb5
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  elevation_service.exe
                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                  • Size 2.8MB
                  • SHA256 a7cfc50884ba9505c17f85303a6e7ad23664478409f0b63f1c5b97709d1009d9
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MsSense.exe
                  • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
                  • Size 1.0MB
                  • SHA256 ca656c1953acd82ccec6ca731f44cbfa0ab6b8e183fede55485c5ed517fd0ef1
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  NisSrv.exe
                  • Path C:\Program Files\Windows Defender\NisSrv.exe
                  • Size 3.6MB
                  • SHA256 fee6412fd47632428c9f4fee80c8769361c8f7b2080ef04ed29918a38a55653f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  wmpnetwk.exe
                  • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
                  • Size 1.5MB
                  • SHA256 e0c7cf2766f9d0c7c657c0a813a150c5e853e36ea33deef4c862a5e1c9629f9e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Windows.db-wal
                  • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
                  • Size 12KB
                  • SHA256 9e063da90a65ebee290f21bf6c1fc123a3a271b8de253f45dd531fe762f768dd
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  08b2b94a-db5c-40aa-af7e-269aa5051bc9.tmp
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\08b2b94a-db5c-40aa-af7e-269aa5051bc9.tmp
                  • Size 2KB
                  • SHA256 8901772824f8a68a3c578c9fb8471f41d8ddb3b570716a7b463d5415751fc184
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  6d3a259d-b336-44ac-88ef-c763bc60929a.tmp
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\6d3a259d-b336-44ac-88ef-c763bc60929a.tmp
                  • Size 7KB
                  • SHA256 23d6ab49d531b13002205dfcc08f9ab9aa9df318213ac19b2631e0ec7a02e485
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  data_0
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Cache\Cache_Data\data_0
                  • Size 8KB
                  • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  data_2
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Cache\Cache_Data\data_2
                  • Size 8KB
                  • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  data_3
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Cache\Cache_Data\data_3
                  • Size 8KB
                  • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  temp-index
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Code Cache\js\index-dir\temp-index
                  • Size 360B
                  • SHA256 7030d9d5547aef9375bcffcbd0062379b1a64fcf837e09ba040811b9b073f8bf
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  the-real-index
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Code Cache\js\index-dir\the-real-index
                  • Size 48B
                  • SHA256 ee46827fa47261be1fe4fa1571c1e3fba91e588d228195712b33b6e71d8544cd
                  • MD5 SHA1 SHA512
                  Submit Download

                  data_1
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\DawnGraphiteCache\data_1
                  • Size 264KB
                  • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  MANIFEST-000001
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Extension Rules\MANIFEST-000001
                  • Size 41B
                  • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                  • MD5 SHA1 SHA512
                  Submit Download

                  SCT Auditing Pending Reports
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\SCT Auditing Pending Reports
                  • Size 2B
                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                  • MD5 SHA1 SHA512
                  Submit Download

                  TransportSecurity
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity
                  • Size 188B
                  • SHA256 aaf984337b19338ab227f5cef57acb774d8197af48eae29c42fe51ece30573e1
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  aa40d39d-e028-4b5b-b553-6130f7c4ec82.tmp
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\aa40d39d-e028-4b5b-b553-6130f7c4ec82.tmp
                  • Size 188B
                  • SHA256 00a000a3bfe563fcb2d653313e7291cd65ccd22e1b2a4e55fdadf98661ef2e69
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Preferences
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences
                  • Size 7KB
                  • SHA256 2864948834ecf0b9981d19bc6326423b1e4e5c7be6fa46900d09f97f74ba0f08
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  CURRENT
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Site Characteristics Database\CURRENT
                  • Size 16B
                  • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                  • MD5 SHA1 SHA512
                  Submit Download

                  Local State
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
                  • Size 890B
                  • SHA256 2ee8d88e9752078092ddd0c214454889dca5e43f2d94e92049cce7e77eff5a45
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  b24a6c17-cf87-4bde-8f1c-fc6cf5b2c1c4.tmp
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\b24a6c17-cf87-4bde-8f1c-fc6cf5b2c1c4.tmp
                  • Size 1KB
                  • SHA256 939edbfadccb3c9cb25a10229d7de1df950e6ab84c35d2ca706c9762cd817a56
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  f75f28c3-63e8-45e1-9623-4726147339fe.tmp
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\f75f28c3-63e8-45e1-9623-4726147339fe.tmp
                  • Size 2KB
                  • SHA256 2a55e2572e9ed9e99d6497994f07842b3717a5d4cd07ec60131cbe04c042f79c
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  SDL3.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\SDL3.dll
                  • Size 2.9MB
                  • SHA256 66db88c627480b1b15123c98fab459ae25905e1375a4737e87b0830928980151
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  chrome_200_percent.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\chrome_200_percent.pak
                  • Size 1.0MB
                  • SHA256 08d5c02b08e3d76d9e806d0d4037eb8fdae1855139704efe10e7b67fe58f8eac
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  config.vdf
                  • Path C:\Users\Admin\AppData\Local\Temp\config\config.vdf
                  • Size 117B
                  • SHA256 a3d8a2cba6e356e02c0f33b50e3a9e61d2f9dfb6a26b5983e30e7786da95dba7
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  config.vdf.async21776.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\config\config.vdf.async21776.tmp
                  • Size 184B
                  • SHA256 661f122934bbc692266940a1fe2e5e51d4d460efb29d75695b8d5241c6e11da7
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  config.vdf.async21776.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\config\config.vdf.async21776.tmp
                  • Size 1KB
                  • SHA256 8f9f970835f133258a7f740126012439385bbaa5a1d6a9d0d967a390977441c3
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  config.vdf.async21776.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\config\config.vdf.async21776.tmp
                  • Size 11KB
                  • SHA256 31ebc287af56faa3fae331c40998a007507ce4eaca5ca4f344b683f5f758f3bd
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  crashhandler64.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\crashhandler64.dll
                  • Size 499KB
                  • SHA256 bfac9e7c90e20cc9a3ce36d4ed0074c1d18717283e983b0d556d24801c174b9a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libavcodec-62.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\libavcodec-62.dll
                  • Size 7.2MB
                  • SHA256 a7d85d28a2ede4e1767dc26f7017566b97f8b5533b2bd52431599850017eb2bc
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libavutil-60.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\libavutil-60.dll
                  • Size 2.3MB
                  • SHA256 eaef6e4ba7283e1ac7ae80c26b41f8f05d5437640c7ff78719089d16b72974e0
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libpyrowave-shared-1.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\libpyrowave-shared-1.dll
                  • Size 2.6MB
                  • SHA256 f6ef66e609865a2167493a635e5fa2da978b9e124bb26e62558892f071bb8a17
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  bootstrap_log.txt
                  • Path C:\Users\Admin\AppData\Local\Temp\logs\bootstrap_log.txt
                  • Size 14KB
                  • SHA256 32abdf983d9c1cd8f158dab6af8e782e67e8cb65bd7f75676fce3efb9b62a230
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  service_log.txt
                  • Path C:\Users\Admin\AppData\Local\Temp\logs\service_log.txt
                  • Size 277B
                  • SHA256 d440a44737df763e9bbd64712973fe50e973571aae73150b44df3aefb8272cce
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  service_log.txt
                  • Path C:\Users\Admin\AppData\Local\Temp\logs\service_log.txt
                  • Size 638B
                  • SHA256 2f656684dcf655fe29e985197313ed890a94d94a2080cb9dbb814d3304d1953f
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  bins_codecs_win64.zip.vz.c01daf4a0716b88602056bd92acc644129b22e45_7421009
                  • Path C:\Users\Admin\AppData\Local\Temp\package\bins_codecs_win64.zip.vz.c01daf4a0716b88602056bd92acc644129b22e45_7421009
                  • Size 7.1MB
                  • SHA256 4e0688746e470316fe915c2e0b672c840842525a11f4038c9bf5389ff30de210
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  bins_hardware_all.zip.vz.e20ce22310e0bd34afb47fa5a502b8aeeb2a095a_298634
                  • Path C:\Users\Admin\AppData\Local\Temp\package\bins_hardware_all.zip.vz.e20ce22310e0bd34afb47fa5a502b8aeeb2a095a_298634
                  • Size 291KB
                  • SHA256 f41b156386ce0648ff8d5a219b0f21a78673d650e84686836d3e25d90b155de5
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  bins_hardware_win64.zip.827a01a60b8b7fd6c3df0f00c938f6c97b03276b
                  • Path C:\Users\Admin\AppData\Local\Temp\package\bins_hardware_win64.zip.827a01a60b8b7fd6c3df0f00c938f6c97b03276b
                  • Size 8.1MB
                  • SHA256 0c6dbf35a61502b59da0477e09aa212b0acf0ef542815eb5f357feb264dadc62
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  bins_misc_win64.zip.vz.7803168fa078e80df23870952e39eea3f424a5b7_12196250
                  • Path C:\Users\Admin\AppData\Local\Temp\package\bins_misc_win64.zip.vz.7803168fa078e80df23870952e39eea3f424a5b7_12196250
                  • Size 11.6MB
                  • SHA256 494fe63824ef42a24de3cb1214ffbecb3ab50814dc05938f12f1ffa5bda895b6
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  bins_webhelpers_win64.zip.vz.310d1fb549d361d8124e010b14dc8f2a67d9f212_2720886
                  • Path C:\Users\Admin\AppData\Local\Temp\package\bins_webhelpers_win64.zip.vz.310d1fb549d361d8124e010b14dc8f2a67d9f212_2720886
                  • Size 2.6MB
                  • SHA256 cef01728b05afb4e8ab53b03f4e4262bbc0abeceb245da601db3ea4a2200717a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  bins_win64.zip.vz.62fef8f5cb95bcfb5619f34a2efc32db2071a6bb_35474054
                  • Path C:\Users\Admin\AppData\Local\Temp\package\bins_win64.zip.vz.62fef8f5cb95bcfb5619f34a2efc32db2071a6bb_35474054
                  • Size 33.8MB
                  • SHA256 23c409f3bb0d5265a637baeab2bd7d2b93ba3898207efde68dbfbf693ec17e87
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  public_all.zip.vz.fad74034d307ee2b036f775df839bf9e6ad48b7b_24182960
                  • Path C:\Users\Admin\AppData\Local\Temp\package\public_all.zip.vz.fad74034d307ee2b036f775df839bf9e6ad48b7b_24182960
                  • Size 23.1MB
                  • SHA256 3adade20ed5b28ba53d3f6d0cf2660f24c049064ef7936212ce6a52829e472d0
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  resources_all.zip.vz.ef4c575e0ebeda2c391b9e56182d51ce688f222e_3488108
                  • Path C:\Users\Admin\AppData\Local\Temp\package\resources_all.zip.vz.ef4c575e0ebeda2c391b9e56182d51ce688f222e_3488108
                  • Size 3.3MB
                  • SHA256 e3b3d053d2a4ac25a2d6175bb5df98726c046393090d8c7bbffcc85e03a297f1
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  resources_hidpi_all.zip.vz.3de815c3117712cb9eeb7ea4c8b275faf481dcfd_56342
                  • Path C:\Users\Admin\AppData\Local\Temp\package\resources_hidpi_all.zip.vz.3de815c3117712cb9eeb7ea4c8b275faf481dcfd_56342
                  • Size 55KB
                  • SHA256 e9cfba9af633e9d216a0cde97b1177d4cbca2a1aca7e83aaf38655dbd9be4b7d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  resources_misc_all.zip.vz.e86a975545f3ab21a77373870cb311ef93934b8c_2224876
                  • Path C:\Users\Admin\AppData\Local\Temp\package\resources_misc_all.zip.vz.e86a975545f3ab21a77373870cb311ef93934b8c_2224876
                  • Size 2.1MB
                  • SHA256 5e9ca0aac16b4d5caa2ac77ab2ce239e8dbcabe5ba6f0565112239ebb127ab2b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  steam_client_metrics.bin
                  • Path C:\Users\Admin\AppData\Local\Temp\package\steam_client_metrics.bin
                  • Size 3KB
                  • SHA256 ebbfd1bdb77687437baf5435f7c41ce8f5b525e8458490483b71ae2227b326ad
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  steam_client_win64.installed
                  • Path C:\Users\Admin\AppData\Local\Temp\package\steam_client_win64.installed
                  • Size 499KB
                  • SHA256 7979fd28e93b24f7194ecfc8c157f18be540536dc4a1cbb0596f25601aa3319c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  steam_client_win64.manifest
                  • Path C:\Users\Admin\AppData\Local\Temp\package\steam_client_win64.manifest
                  • Size 7KB
                  • SHA256 5bb90281e2c4690de6432756512fae3946ba667a3ba6cb1cd89f749a1fcd1133
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  steam_win64_steamrow.zip.vz.ac1682b3fda1156b6c29a900f37fdb00b00789d9_2165629
                  • Path C:\Users\Admin\AppData\Local\Temp\package\steam_win64_steamrow.zip.vz.ac1682b3fda1156b6c29a900f37fdb00b00789d9_2165629
                  • Size 2.1MB
                  • SHA256 aee04fdeac282371d38c3cb5b0024972821357de684520b623f084a82bacc6c8
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  steamui_websrc_all.zip.vz.b5e3049b293bba61b67b93fee0fe9eea62a817a9_28679890
                  • Path C:\Users\Admin\AppData\Local\Temp\package\steamui_websrc_all.zip.vz.b5e3049b293bba61b67b93fee0fe9eea62a817a9_28679890
                  • Size 27.4MB
                  • SHA256 3f784dddfec25ec36a3ddf297e5e42545a8fc600e5a9fef4258a0ffdd999ce36
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  steamui_websrc_movies_all.zip.40e78cdda48e9a8a74baf614e0cdc7a6b96d26d1
                  • Path C:\Users\Admin\AppData\Local\Temp\package\steamui_websrc_movies_all.zip.40e78cdda48e9a8a74baf614e0cdc7a6b96d26d1
                  • Size 10.4MB
                  • SHA256 885a32533327f0fd5ea98e6c6f13552e965cab4852dad7ce9ccf3d929d726b5b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  steamui_websrc_sounds_all.zip.vz.5ba6acd8f4dfe4b93437895b20344fab5bb3ff96_3714779
                  • Path C:\Users\Admin\AppData\Local\Temp\package\steamui_websrc_sounds_all.zip.vz.5ba6acd8f4dfe4b93437895b20344fab5bb3ff96_3714779
                  • Size 3.5MB
                  • SHA256 ac62e3d0e6213bcbdcfe973c624eda0486977dccdc4098c10b60b62e894ea93b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  strings_all.zip.vz.1518f222a37456b048acfb3d6c3d97865a612666_2079871
                  • Path C:\Users\Admin\AppData\Local\Temp\package\strings_all.zip.vz.1518f222a37456b048acfb3d6c3d97865a612666_2079871
                  • Size 2.0MB
                  • SHA256 da8abc499d1b675f4b303823e85f228a0385b4341ba785ba6fa3b8ea1d4df124
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  strings_en_all.zip.e716a67d7fa91ba70490a6417e25d45c5435e393
                  • Path C:\Users\Admin\AppData\Local\Temp\package\strings_en_all.zip.e716a67d7fa91ba70490a6417e25d45c5435e393
                  • Size 111KB
                  • SHA256 0c56193fac4fa518eaaac0dc66ecd21a3cee510ece85594b6c308f8d31ee98a3
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  tenfoot_images_all.zip.vz.193cb8c4eb4446698ea2c0a9e8c4e6b6a623dac7_5572671
                  • Path C:\Users\Admin\AppData\Local\Temp\package\tenfoot_images_all.zip.vz.193cb8c4eb4446698ea2c0a9e8c4e6b6a623dac7_5572671
                  • Size 5.3MB
                  • SHA256 e1fee3beffa9d08a415a35ddc7d3141af6c44269c67e67aa0a3eea6e56889bd7
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  btnOvrOffTop.tga_
                  • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\btnOvrOffTop.tga_
                  • Size 444B
                  • SHA256 ecd13153d9d438809a38de30f3abbb0f6f92837a7e3cacb442a9a9309bcd78d9
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  [email protected]_
                  • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\[email protected]_
                  • Size 15KB
                  • SHA256 d3af480fe975487ea4754c88dd56df0d4cfe68633eb9abb2458f42ae3df34479
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  [email protected]_
                  • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\[email protected]_
                  • Size 92KB
                  • SHA256 f200aca23ac6739a6d521298094972383f835d8fcac24b7bdef820181ae8c37a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  icon_button_news.tga_
                  • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\icon_button_news.tga_
                  • Size 20KB
                  • SHA256 42c410136a35b64c7e0a410b1d2fd2e2712782039cd7237615219ea57d7c40fa
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  tabStdTop.tga_
                  • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\tabStdTop.tga_
                  • Size 48B
                  • SHA256 5caa5fa3e79dcd8ec5ec20256ed7c77efaae77e0ae8d89e4a974c484cb177d84
                  • MD5 SHA1 SHA512
                  Submit Download

                  steam_updating.ico_
                  • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\public\steam_updating.ico_
                  • Size 47KB
                  • SHA256 5aaca90948de8f7d11264ed608a2f96acba061e6463d337d658b00ed1c552449
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  steam_updating_posix.tga_
                  • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\public\steam_updating_posix.tga_
                  • Size 64KB
                  • SHA256 fd2abb8945c06a6b9c5444baf6ea523b52bf7a03a58b34ebe0a6a110630ed5f8
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  filter_banned_thai.txt.gz_
                  • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\resource\filter_banned_thai.txt.gz_
                  • Size 23B
                  • SHA256 6feb83ca306745d634903cf09274b7baf0ac38e43c6b3fab1a608be344c3ef64
                  • MD5 SHA1 SHA512
                  Submit Download

                  steambootstrapper_english.txt
                  • Path C:\Users\Admin\AppData\Local\Temp\public\steambootstrapper_english.txt
                  • Size 4KB
                  • SHA256 fbc09c1b9a55d04b57be8fb2ad5ab58b38f76054ecd3d1b70440a2d08191b05b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  steamui.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\steamui.dll
                  • Size 18.5MB
                  • SHA256 1b9457943205dc3af0bd53463ba331cbd2a381388699705c02271aac7a2b1252
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  tier0_s64.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\tier0_s64.dll
                  • Size 867KB
                  • SHA256 855e5c958aa52b5e3d5b7694228a1750ef35f38ffb3bd468201c70c118500797
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  video64.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\video64.dll
                  • Size 5.1MB
                  • SHA256 17138d62b1d7b082ab0d0926ad0fb0439e0645ad910c2ec869e9c1017f7a5a23
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  vstdlib_s64.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\vstdlib_s64.dll
                  • Size 476KB
                  • SHA256 80a4f74863ac6a9dcced7f3f5c7fcb9847a3c7967e4724fce3d27a234f0c8205
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  58ef9519e4fea11e.bin
                  • Path C:\Users\Admin\AppData\Roaming\58ef9519e4fea11e.bin
                  • Size 12KB
                  • SHA256 b4703aa0de34c617e1f720b41ee05baa5e533bff499617bfb85ca123248ccd86
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  perfhost.exe
                  • Path C:\Windows\SysWOW64\perfhost.exe
                  • Size 606KB
                  • SHA256 8062baab02484dbfb6dd25d16d745040469899866a98ee9de3a57d43c737744e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  AgentService.exe
                  • Path C:\Windows\System32\AgentService.exe
                  • Size 1.4MB
                  • SHA256 35c6246c35bde28e52fafe608764d8143bb5c32b41f4dd6166a624dfea2805f3
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  GameInputSvc.exe
                  • Path C:\Windows\System32\GameInputSvc.exe
                  • Size 660KB
                  • SHA256 8429fc5465368f097afca338a38d804054d030cdf4bef2fc41536b518c53fdef
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Locator.exe
                  • Path C:\Windows\System32\Locator.exe
                  • Size 624KB
                  • SHA256 3511a1c4cc60af317d0ce9502303a8050d9ecc4d70d2d57351572a6d39d45eb6
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ssh-agent.exe
                  • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                  • Size 1.1MB
                  • SHA256 c8a8e38a7b6e8cbeaf91ba17e0c550979719f2c5879969b0a734122712107543
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  PerceptionSimulationService.exe
                  • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
                  • Size 828KB
                  • SHA256 7647097a3e7dd321fff8dfcea4d784f18e9d16d00fc96d7b6b7f42fc3ec24281
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ReFsDedupSvc.exe
                  • Path C:\Windows\System32\ReFsDedupSvc.exe
                  • Size 2.7MB
                  • SHA256 129f4be53a7acd81f4f98f9758de1854643224ee83ae7c3c45f95d3c115feaab
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  SearchIndexer.exe
                  • Path C:\Windows\System32\SearchIndexer.exe
                  • Size 1.5MB
                  • SHA256 d202bd71fe0195a1e205902242dee86eb7896d9777250e3bd0101a539adb1dc1
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  SensorDataService.exe
                  • Path C:\Windows\System32\SensorDataService.exe
                  • Size 1.7MB
                  • SHA256 d114411b27c9c564595f93a8bcfd1319a618c190d3a942471d039b070459fed3
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  TieringEngineService.exe
                  • Path C:\Windows\System32\TieringEngineService.exe
                  • Size 932KB
                  • SHA256 022b6f485e2ec985f501670858929b4692ddf9b417cb338502fadf91a24f9d05
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  VSSVC.exe
                  • Path C:\Windows\System32\VSSVC.exe
                  • Size 2.0MB
                  • SHA256 1190ea03f77406e3105bd63bed997744871c5d7ba818c193f81cac2897d59d50
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  alg.exe
                  • Path C:\Windows\System32\alg.exe
                  • Size 776KB
                  • SHA256 fbd512eff35ecd5ae04df5dc04dc57881d4bcd5b018e3c7b300fcf6a735acca7
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  msdtc.exe
                  • Path C:\Windows\System32\msdtc.exe
                  • Size 760KB
                  • SHA256 ebdbf342463fc13040eeed89858c8ce1628df9f10c5eba35ab1c5904cbbaaa3f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  snmptrap.exe
                  • Path C:\Windows\System32\snmptrap.exe
                  • Size 632KB
                  • SHA256 41aa1e0ee4fd0a8edad80d1ba4dcece78551f1529b5bd2d8880a3bbd0c6302f4
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  vds.exe
                  • Path C:\Windows\System32\vds.exe
                  • Size 1.2MB
                  • SHA256 84d20def28f724fa51dfac3d4fcb65e8d16d6f2004facc988476b5177343ad93
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  WmiApSrv.exe
                  • Path C:\Windows\System32\wbem\WmiApSrv.exe
                  • Size 792KB
                  • SHA256 a27dee61fc64c73436111026a0c5ab3028ca52d67c24eb245352c89492b8c124
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  wbengine.exe
                  • Path C:\Windows\System32\wbengine.exe
                  • Size 2.1MB
                  • SHA256 9400f2ffc3fe7b6d6c8f6c6d0e83f51defd7faf26107fb7bcf8b63248e4a1e4e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  AppVClient.exe
                  • Path C:\Windows\system32\AppVClient.exe
                  • Size 1.3MB
                  • SHA256 634a33db59460c6f3aed038a5748c934018c887d9b5c6097c276c29f25ba5157
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  SgrmBroker.exe
                  • Path C:\Windows\system32\Sgrm\SgrmBroker.exe
                  • Size 988KB
                  • SHA256 e20cb818ddc86551b981d09ec45c3a4c50ef048258837d2eae67761c25fcf50e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  msiexec.exe
                  • Path C:\Windows\system32\msiexec.exe
                  • Size 768KB
                  • SHA256 5d811b89679ff7fb40e4c838dd009883f251a105495e933568ab2e730906baed
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  memory/52-71-0x00000266D3910000-0x00000266D3A86000-memory.dmp
                  Download

                  memory/52-72-0x00000266D3BB0000-0x00000266D3C16000-memory.dmp
                  Download

                  memory/52-73-0x00000266D3BB0000-0x00000266D3C16000-memory.dmp
                  Download

                  memory/1796-0-0x000001A5BE390000-0x000001A5BE4F0000-memory.dmp
                  Download

                  memory/1796-2-0x000001A5BE610000-0x000001A5BE676000-memory.dmp
                  Download

                  memory/1796-6894-0x000001A5BE610000-0x000001A5BE676000-memory.dmp
                  Download

                  memory/1796-3-0x000001A5BE610000-0x000001A5BE676000-memory.dmp
                  Download

                  memory/1796-1-0x000001A5BE610000-0x000001A5BE676000-memory.dmp
                  Download

                  memory/2228-93-0x00000142DD6E0000-0x00000142DD746000-memory.dmp
                  Download

                  memory/2228-92-0x00007FF751090000-0x00007FF7511A9000-memory.dmp
                  Download

                  memory/2228-94-0x00000142DD6E0000-0x00000142DD746000-memory.dmp
                  Download

                  memory/2228-152-0x00007FF751090000-0x00007FF7511A9000-memory.dmp
                  Download

                  memory/2752-34-0x000001D70A800000-0x000001D70A866000-memory.dmp
                  Download

                  memory/2752-35-0x000001D70A800000-0x000001D70A866000-memory.dmp
                  Download

                  memory/2752-33-0x00007FF61BCD0000-0x00007FF61BD98000-memory.dmp
                  Download

                  memory/2752-77-0x00007FF61BCD0000-0x00007FF61BD98000-memory.dmp
                  Download

                  memory/2784-160-0x0000016587520000-0x0000016587586000-memory.dmp
                  Download

                  memory/2784-1320-0x0000016587520000-0x0000016587586000-memory.dmp
                  Download

                  memory/2784-158-0x00007FF6501A0000-0x00007FF6505B6000-memory.dmp
                  Download

                  memory/2784-2229-0x00007FF6501A0000-0x00007FF6505B6000-memory.dmp
                  Download

                  memory/2784-159-0x0000016587520000-0x0000016587586000-memory.dmp
                  Download

                  memory/2784-207-0x00007FF6501A0000-0x00007FF6505B6000-memory.dmp
                  Download

                  memory/2856-2208-0x00007FF694E00000-0x00007FF6950A2000-memory.dmp
                  Download

                  memory/2856-179-0x00000201FBE20000-0x00000201FBE86000-memory.dmp
                  Download

                  memory/2856-177-0x00007FF694E00000-0x00007FF6950A2000-memory.dmp
                  Download

                  memory/2856-180-0x00000201FBE20000-0x00000201FBE86000-memory.dmp
                  Download

                  memory/2860-129-0x00000000009C0000-0x0000000000A29000-memory.dmp
                  Download

                  memory/2860-124-0x00000000009C0000-0x0000000000A29000-memory.dmp
                  Download

                  memory/2860-164-0x0000000000400000-0x00000000004AD000-memory.dmp
                  Download

                  memory/2860-123-0x0000000000400000-0x00000000004AD000-memory.dmp
                  Download

                  memory/3472-196-0x00007FF7A4DE0000-0x00007FF7A5100000-memory.dmp
                  Download

                  memory/3472-197-0x0000016235E10000-0x0000016235E76000-memory.dmp
                  Download

                  memory/3472-198-0x0000016235E10000-0x0000016235E76000-memory.dmp
                  Download

                  memory/3472-202-0x0000016235E10000-0x0000016235E76000-memory.dmp
                  Download

                  memory/3472-204-0x00007FF7A4DE0000-0x00007FF7A5100000-memory.dmp
                  Download

                  memory/3660-6783-0x00007FF7A14B0000-0x00007FF7A173A000-memory.dmp
                  Download

                  memory/3660-208-0x00007FF7A14B0000-0x00007FF7A173A000-memory.dmp
                  Download

                  memory/3660-210-0x0000019031FC0000-0x0000019032026000-memory.dmp
                  Download

                  memory/3660-209-0x0000019031FC0000-0x0000019032026000-memory.dmp
                  Download

                  memory/3820-148-0x0000024FC4700000-0x0000024FC4766000-memory.dmp
                  Download

                  memory/3820-147-0x0000024FC4700000-0x0000024FC4766000-memory.dmp
                  Download

                  memory/3820-193-0x00007FF6A11B0000-0x00007FF6A125D000-memory.dmp
                  Download

                  memory/3820-146-0x00007FF6A11B0000-0x00007FF6A125D000-memory.dmp
                  Download

                  memory/3972-2454-0x00007FF7C00C0000-0x00007FF7C0254000-memory.dmp
                  Download

                  memory/3972-192-0x00007FF7C00C0000-0x00007FF7C0254000-memory.dmp
                  Download

                  memory/3972-186-0x0000024142B40000-0x0000024142BA6000-memory.dmp
                  Download

                  memory/3972-187-0x0000024142B40000-0x0000024142BA6000-memory.dmp
                  Download

                  memory/4148-7241-0x0000017016F10000-0x0000017016F1A000-memory.dmp
                  Download

                  memory/4244-82-0x000002AB70ED0000-0x000002AB70F36000-memory.dmp
                  Download

                  memory/4244-88-0x000002AB70ED0000-0x000002AB70F36000-memory.dmp
                  Download

                  memory/4244-90-0x00007FF6BE050000-0x00007FF6BE1B7000-memory.dmp
                  Download

                  memory/4244-81-0x000002AB70ED0000-0x000002AB70F36000-memory.dmp
                  Download

                  memory/4244-80-0x00007FF6BE050000-0x00007FF6BE1B7000-memory.dmp
                  Download

                  memory/4328-139-0x00007FF74FED0000-0x00007FF750613000-memory.dmp
                  Download

                  memory/4328-6885-0x000002557A4C0000-0x000002557A526000-memory.dmp
                  Download

                  memory/4328-138-0x000002557A4C0000-0x000002557A526000-memory.dmp
                  Download

                  memory/4328-6890-0x00007FF74FED0000-0x00007FF750613000-memory.dmp
                  Download

                  memory/4328-140-0x000002557A4C0000-0x000002557A526000-memory.dmp
                  Download

                  memory/4328-191-0x00007FF74FED0000-0x00007FF750613000-memory.dmp
                  Download

                  memory/4584-7138-0x0000021B2D330000-0x0000021B2D33A000-memory.dmp
                  Download

                  memory/4664-114-0x00007FF687350000-0x00007FF687499000-memory.dmp
                  Download

                  memory/4664-157-0x00007FF687350000-0x00007FF687499000-memory.dmp
                  Download

                  memory/4664-116-0x00000227FE180000-0x00000227FE1E6000-memory.dmp
                  Download

                  memory/4664-117-0x00000227FE180000-0x00000227FE1E6000-memory.dmp
                  Download

                  memory/4884-66-0x00007FF61BCD0000-0x00007FF61BD98000-memory.dmp
                  Download

                  memory/4884-24-0x00007FF61BCD0000-0x00007FF61BD98000-memory.dmp
                  Download

                  memory/4884-25-0x000002560A110000-0x000002560A176000-memory.dmp
                  Download

                  memory/4884-27-0x000002560A110000-0x000002560A176000-memory.dmp
                  Download

                  memory/4884-26-0x000002560A110000-0x000002560A176000-memory.dmp
                  Download

                  memory/5060-214-0x00007FF7FDA90000-0x00007FF7FDB43000-memory.dmp
                  Download

                  memory/5060-169-0x00007FF7FDA90000-0x00007FF7FDB43000-memory.dmp
                  Download

                  memory/5060-171-0x000001CDCE7E0000-0x000001CDCE846000-memory.dmp
                  Download

                  memory/5060-170-0x000001CDCE7E0000-0x000001CDCE846000-memory.dmp
                  Download

                  memory/5092-105-0x00000225A95E0000-0x00000225A9756000-memory.dmp
                  Download

                  memory/5092-106-0x00000225A9760000-0x00000225A97C6000-memory.dmp
                  Download

                  memory/5092-107-0x00000225A9760000-0x00000225A97C6000-memory.dmp
                  Download

                  memory/5112-13-0x0000017D29C10000-0x0000017D29C76000-memory.dmp
                  Download

                  memory/5112-14-0x0000017D29C10000-0x0000017D29C76000-memory.dmp
                  Download

                  memory/5112-12-0x0000017D29C10000-0x0000017D29C76000-memory.dmp
                  Download

                  memory/5112-11-0x00007FF6E7360000-0x00007FF6E7482000-memory.dmp
                  Download

                  memory/5112-64-0x00007FF6E7360000-0x00007FF6E7482000-memory.dmp
                  Download

                  memory/6060-57-0x0000022F66650000-0x0000022F667C6000-memory.dmp
                  Download

                  memory/6060-59-0x0000022F667D0000-0x0000022F66836000-memory.dmp
                  Download

                  memory/6060-58-0x0000022F667D0000-0x0000022F66836000-memory.dmp
                  Download

                  memory/6284-7008-0x00000125D7220000-0x00000125D7221000-memory.dmp
                  Download

                  memory/6284-7242-0x00000125D71F0000-0x00000125D721A000-memory.dmp
                  Download

                  memory/6284-7007-0x00007FFD38680000-0x00007FFD38681000-memory.dmp
                  Download

                  memory/6556-7096-0x0000024575630000-0x0000024575631000-memory.dmp
                  Download

                  memory/6556-7249-0x0000024575600000-0x000002457562A000-memory.dmp
                  Download

                  memory/7732-6766-0x0000029A994F0000-0x0000029A99556000-memory.dmp
                  Download

                  memory/7732-6882-0x00007FF6871B0000-0x00007FF6876B6000-memory.dmp
                  Download

                  memory/7732-6727-0x00007FF6871B0000-0x00007FF6876B6000-memory.dmp
                  Download

                  memory/7732-6754-0x0000029A994F0000-0x0000029A99556000-memory.dmp
                  Download

                  memory/8496-6858-0x00000118624B0000-0x0000011862516000-memory.dmp
                  Download

                  memory/8496-6859-0x00000118624B0000-0x0000011862516000-memory.dmp
                  Download

                  memory/8496-6857-0x00007FF62ACB0000-0x00007FF62ADDE000-memory.dmp
                  Download

                  memory/8496-6905-0x00007FF62ACB0000-0x00007FF62ADDE000-memory.dmp
                  Download

                  memory/8820-6661-0x0000019BBD510000-0x0000019BBD576000-memory.dmp
                  Download

                  memory/8820-6662-0x0000019BBD510000-0x0000019BBD576000-memory.dmp
                  Download

                  memory/8820-6593-0x00007FF7B6F90000-0x00007FF7B7460000-memory.dmp
                  Download

                  memory/8820-6864-0x00007FF7B6F90000-0x00007FF7B7460000-memory.dmp
                  Download

                  memory/10692-6869-0x0000027CE7270000-0x0000027CE72D6000-memory.dmp
                  Download

                  memory/10692-6868-0x0000027CE7270000-0x0000027CE72D6000-memory.dmp
                  Download

                  memory/10692-6934-0x00007FF6105C0000-0x00007FF6108FE000-memory.dmp
                  Download

                  memory/10692-6867-0x00007FF6105C0000-0x00007FF6108FE000-memory.dmp
                  Download

                  memory/21776-6901-0x0000016245CA0000-0x0000016245D06000-memory.dmp
                  Download

                  memory/21776-6900-0x0000016245CA0000-0x0000016245D06000-memory.dmp
                  Download