Overview

overview

7

Static

static

3

2026-11-03...nj.exe

windows10-2004-x64

7

2026-11-03...nj.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/11/2026, 17:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-03_6fe0776800d54598035bc509616283ba_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
  • Size 6.1MB
  • Sample261104-vz2faayt5j
  • SHA256 d930a337b5d529fc5e6b7d5d876f765812df8f18961acb5c18a537c82505ddb1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryspywarestealertrojan

Malware Config

Signatures

  • Executes dropped EXE 22 IoCs
  • Loads dropped DLL 60 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 41 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 40 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 1 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 49 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-03_6fe0776800d54598035bc509616283ba_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-03_6fe0776800d54598035bc509616283ba_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies trusted root certificate store through registry
    • Reads the TCP/IP host and domain name from the registry
    • Checks processor information in registry
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4696
    • C:\Users\Admin\AppData\Local\Temp\2026-11-03_6fe0776800d54598035bc509616283ba_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
      C:\Users\Admin\AppData\Local\Temp\2026-11-03_6fe0776800d54598035bc509616283ba_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
      2⤵
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • Checks SCSI registry key(s)
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:716
      • C:\Users\Admin\AppData\Local\Temp\steamsysinfo.exe
        C:\Users\Admin\AppData\Local\Temp\steamsysinfo.exe -steamid 0 -buildid 1792618285 -logdir C:\Users\Admin\AppData\Local\Temp\logs -nocrashdialog -query 1 -out-file C:\Users\Admin\AppData\Local\Temp\6DEE.tmp
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1476
      • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
        C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe -nocrashdialog "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=716" "-buildid=1792618285" "-steamid=0" "-logdir=C:\Users\Admin\AppData\Local\Temp\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Users\Admin\AppData\Local\Temp\clientui" "-steampath=C:\Users\Admin\AppData\Local\Temp\2026-11-03_6fe0776800d54598035bc509616283ba_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe" "-launcher=0" --valve-enable-site-isolation "--crl-sets-path=C:\Users\Admin\AppData\Local\Temp\resource\crl-set" --enable-smooth-scrolling "--log-file=C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --disable-quick-menu --disable-component-update "--gaia-url=http://disabled.invalid" "--enable-features=PlatformHEVCDecoderSupport" "--disable-features=WinRetrieveSuggestionsOnlyOnDemand,SpareRendererForSitePerProcess,BlockPromptsIfIgnoredOften,WebUsbDeviceDetection,ValveFFmpegAllowLowDelayHEVC"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Reads the TCP/IP host and domain name from the registry
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:4436
        • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
          "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe" --type=gpu-process --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1792618285 --steamid=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1948,i,15248392537411479592,17301228518499594487,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=1500 --mojo-platform-channel-handle=1944 /prefetch:2
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4716
        • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
          "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1792618285 --steamid=0 --field-trial-handle=2272,i,15248392537411479592,17301228518499594487,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2284 --mojo-platform-channel-handle=2280 /prefetch:11
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          • System Time Discovery
          PID:5080
        • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
          "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1792618285 --steamid=0 --field-trial-handle=2384,i,15248392537411479592,17301228518499594487,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2400 --mojo-platform-channel-handle=2396 /prefetch:13
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2928
        • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
          "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1792618285 --steamid=0 --gaia-url=http://disabled.invalid --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3744,i,15248392537411479592,17301228518499594487,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=3764 --mojo-platform-channel-handle=3756 /prefetch:1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5960
        • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
          "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1792618285 --steamid=0 --field-trial-handle=5192,i,15248392537411479592,17301228518499594487,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5236 --mojo-platform-channel-handle=5232 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          PID:2412
      • C:\Users\Admin\AppData\Local\Temp\bin\gldriverquery64.exe
        .\bin\gldriverquery64.exe
        3⤵
        • Executes dropped EXE
        PID:5424
      • C:\Users\Admin\AppData\Local\Temp\bin\gldriverquery.exe
        .\bin\gldriverquery.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1708
      • C:\Users\Admin\AppData\Local\Temp\bin\vulkandriverquery64.exe
        .\bin\vulkandriverquery64.exe
        3⤵
        • Executes dropped EXE
        PID:2868
      • C:\Users\Admin\AppData\Local\Temp\bin\vulkandriverquery.exe
        .\bin\vulkandriverquery.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:5164
  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3528
  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:5672
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    PID:1516
  • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    PID:3444
  • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    1⤵
    • Executes dropped EXE
    PID:3232
  • C:\Windows\SysWow64\perfhost.exe
    C:\Windows\SysWow64\perfhost.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:2656
  • C:\Windows\System32\ReFsDedupSvc.exe
    C:\Windows\System32\ReFsDedupSvc.exe
    1⤵
    • Executes dropped EXE
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    PID:3204
  • C:\Windows\System32\SensorDataService.exe
    C:\Windows\System32\SensorDataService.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Checks SCSI registry key(s)
    PID:2352
  • C:\Windows\System32\OpenSSH\ssh-agent.exe
    C:\Windows\System32\OpenSSH\ssh-agent.exe
    1⤵
    • Executes dropped EXE
    PID:4664
  • C:\Windows\system32\AgentService.exe
    C:\Windows\system32\AgentService.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:4440
  • C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\SearchIndexer.exe /Embedding
    1⤵
    • Executes dropped EXE
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2992
    • C:\Windows\System32\SearchProtocolHost.exe
      "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
      2⤵
      • Modifies data under HKEY_USERS
      PID:1260
    • C:\Windows\System32\SearchProtocolHost.exe
      "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4057491610-3392471755-192832105-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4057491610-3392471755-192832105-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
      2⤵
        PID:5364
      • C:\Windows\System32\SearchFilterHost.exe
        "C:\Windows\System32\SearchFilterHost.exe" 952 2848 2856 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
        2⤵
        • Modifies data under HKEY_USERS
        PID:4576
      • C:\Windows\System32\SearchFilterHost.exe
        "C:\Windows\System32\SearchFilterHost.exe" 952 2888 2904 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
        2⤵
        • Modifies data under HKEY_USERS
        PID:4236
      • C:\Windows\System32\SearchProtocolHost.exe
        "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
        2⤵
        • Modifies data under HKEY_USERS
        PID:2052
      • C:\Windows\System32\SearchFilterHost.exe
        "C:\Windows\System32\SearchFilterHost.exe" 952 2848 2856 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
        2⤵
          PID:4260
        • C:\Windows\System32\SearchFilterHost.exe
          "C:\Windows\System32\SearchFilterHost.exe" 952 2888 2904 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
          2⤵
            PID:928
        • C:\Windows\system32\AUDIODG.EXE
          C:\Windows\system32\AUDIODG.EXE 0x000000000000050C 0x0000000000000510
          1⤵
            PID:3388
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
            1⤵
              PID:1036
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
              1⤵
              • Modifies data under HKEY_USERS
              PID:4160

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  elevation_service.exe
                  • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                  • Size 2.7MB
                  • SHA256 f2ba4702bc046d87181b3b834c4dc18bb52c138111b49e168dc584f84af056ce
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  maintenanceservice.exe
                  • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                  • Size 1.5MB
                  • SHA256 4d13efc8f1f872f0a33ecb01f1204d2002b5411ecd537525f3535bfb1c9602af
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  7z.exe
                  • Path C:\Program Files\7-Zip\7z.exe
                  • Size 1.8MB
                  • SHA256 52948b2660bc690aa4fc51846d2f5c496a774ff7d0d73f9bb772a01ed244df25
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  7zFM.exe
                  • Path C:\Program Files\7-Zip\7zFM.exe
                  • Size 1.5MB
                  • SHA256 5387cc4939e8464adac3c14c4812a7a9232d8cde043fca0203332590de5bceae
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  7zG.exe
                  • Path C:\Program Files\7-Zip\7zG.exe
                  • Size 1.2MB
                  • SHA256 bf5118f0bc197a8a250a434db245f304634a46738095a0309a6aba3f4ad1036f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Uninstall.exe
                  • Path C:\Program Files\7-Zip\Uninstall.exe
                  • Size 1.2MB
                  • SHA256 51f8ea6beb3da74887670e7154c205de127e0905c7c150e47a1cadff16101ee3
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  AppVShNotify.exe
                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
                  • Size 1.5MB
                  • SHA256 211e866332a643819aeb3a4b4cf10069875a570e4ec7dbdf45bea2db1d4b968b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  IntegratedOffice.exe
                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
                  • Size 4.6MB
                  • SHA256 47ee517146cea78129f6ab5b125702f78f78d2bc97f4f3f9e55b31657cef2b77
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MavInject32.exe
                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
                  • Size 1.6MB
                  • SHA256 1730550f16fff26570dd09e7cf5d0f874302d79fa5f7fc4005e4bb6c92550a22
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  OfficeC2RClient.exe
                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
                  • Size 24.0MB
                  • SHA256 89fc62599fcbd454ce1515c28273f6497534900ffae64486ed59ae3f91d706ef
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  appvcleaner.exe
                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
                  • Size 2.7MB
                  • SHA256 a9a50da3de19ca826507045a7d94eb9014b52ab615a566008920143184ff36f4
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  LICLUA.EXE
                  • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
                  • Size 1.1MB
                  • SHA256 23de1186311556a8e1d80ec0d0e1cacd7ba4d6bf2edbb7656e7ec77d407973b4
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  OSE.EXE
                  • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                  • Size 1.5MB
                  • SHA256 12b8b3066368afd700bd17b54a6f2c522cb9d833dce10ebdc3a12c7b72c80433
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  VSTOInstaller.exe
                  • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
                  • Size 1.3MB
                  • SHA256 27ef0156ddd4c341baaa04725fcad5f226298de17d2d780f746b5a028a19c060
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  chrmstp.exe
                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
                  • Size 6.6MB
                  • SHA256 fb8c68d8023850a29c681d24ce60e4d15d13a1fa57cb239897cfd08f609c4c5e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  setup.exe
                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
                  • Size 6.6MB
                  • SHA256 063639b399fe4997bbdc479205de8bfc91154412f42adf84954e180969c33f9b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  chrome_pwa_launcher.exe
                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
                  • Size 2.3MB
                  • SHA256 931e759cac1166924877a1b1a0bc4aeac7d05e2bb8074bb0a1847f1dbc8a3b78
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  elevated_tracing_service.exe
                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
                  • Size 4.0MB
                  • SHA256 f5c0d9332ea0a1e4bc96e0a6665c67e40fa08af40a217600b7b4015a3fe40fec
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  elevation_service.exe
                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                  • Size 2.8MB
                  • SHA256 c9f701fa0bb0d8072ba7c57a53ed8face9c5648af13f13ae0467a755e79a0e22
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  notification_helper.exe
                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
                  • Size 2.2MB
                  • SHA256 12926231dfb83c92c19fc3a6eb4bccb685856e2fa92ccbcca8aee51083eb535b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  os_update_handler.exe
                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
                  • Size 2.4MB
                  • SHA256 7631079b635c58aac8d0ec8e473eddf561cbf2ed758cc5042c66e4d88727a62f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  chrome_proxy.exe
                  • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
                  • Size 2.0MB
                  • SHA256 953b4085da409263eb9be4ea5cfa1da3e0850dc6b1fa27d1ba1f64f87a219507
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  appletviewer.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
                  • Size 1.2MB
                  • SHA256 137b383ddd7f3ab00b9262e0ad9e0e55d73239b94485d6012433c4c9eac53de8
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  extcheck.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
                  • Size 1.2MB
                  • SHA256 10dc232e0cf41b2240c7b46015942803a2632f8c6baa8686c28356bf9e4fb16c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  idlj.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
                  • Size 1.2MB
                  • SHA256 87fcb3820cd30b7b6f9fbb8251e56dc555f40cf5867a3935aba2315e4972610f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  jabswitch.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
                  • Size 1.3MB
                  • SHA256 a716fc0339b7eb35e3d508f698835c642ce8e2eb0e37c61489bafde3ba39af37
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  jar.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
                  • Size 1.2MB
                  • SHA256 4e3cddf8a9add92bc28b214da3a62c1b8aeac2299907177a42953d1b88f42c88
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  jarsigner.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
                  • Size 1.2MB
                  • SHA256 e2a65b469d441befbcabbf7ab440a998793b6ca6d97bf56e8fe45bdbbf089745
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  java-rmi.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
                  • Size 1.2MB
                  • SHA256 e4fbc267111b640ba97bb01d1852ed23c20e8abe84b34ef32d428d9df09a3fc6
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  java.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
                  • Size 1.5MB
                  • SHA256 c9165edb79ee146b9d4c86c0550e7315f725b6c06d92cc59e8842cab883bb2f9
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  javac.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
                  • Size 1.2MB
                  • SHA256 333b4bebc3128b91723a3d9f7f0dc606bf60b9ecfb4dba4a0393af5ee5d5760b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  javadoc.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
                  • Size 1.2MB
                  • SHA256 153d2205714cc7b7ed23e52c797df8452559f3460dfd6e32ba278ae6ddd9e123
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  javafxpackager.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
                  • Size 1.4MB
                  • SHA256 4772e3b13a69ccca226974abc33e3b24450dd988b550107a5d7ac7ef800174b5
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  javah.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
                  • Size 1.2MB
                  • SHA256 904808755f434793e089f2877efeb612bc67d62731f2854cf53d313145fdece9
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  javap.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
                  • Size 1.2MB
                  • SHA256 de709c1074e494c14c303791b11c8ec45f4a1aa4c655768c40334645cf732921
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  javapackager.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
                  • Size 1.4MB
                  • SHA256 09fc7b89209692db0c4a2dd3ceb260ab9d69f19674b3c5c301859cdadefb2a74
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  javaw.exe
                  • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
                  • Size 1.5MB
                  • SHA256 64a7b9dbe7ce577f9723021fc43b9f7dbc7d8e7eb6e5a15db9bbd275a455125e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MsSense.exe
                  • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
                  • Size 1.7MB
                  • SHA256 1c97bdd3806ed558901a98a5778977de61896b20ff43058efa3101427386a9f2
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  NisSrv.exe
                  • Path C:\Program Files\Windows Defender\NisSrv.exe
                  • Size 3.5MB
                  • SHA256 653787a6a3faca5effb5d579391957c1d20c72b9d4e3d77b80cf142c6628432f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  wmpnetwk.exe
                  • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
                  • Size 1.4MB
                  • SHA256 5d6c0015cc87411fe2cbc3b31932846379ce9b6c12a98f8bea3633d4af7fc97e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  dotnet.exe
                  • Path C:\Program Files\dotnet\dotnet.exe
                  • Size 1.4MB
                  • SHA256 87256ce0aaa0233ead01d4b2fdd36c9101104744e93dad9590afafec975eb397
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Windows.db
                  • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
                  • Size 1.1MB
                  • SHA256 2dcd2a6cace31d8ec01de0bfe3a580c0395c55f6234b6cbd87d0679280b52572
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Windows.db-wal
                  • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
                  • Size 1.4MB
                  • SHA256 cfd3f9df75860d96b3ed9dab9e4a68a20d801e0e2799ebb341871437f6190a08
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  0814705a-86f2-4fad-8322-686d6a62d200.tmp
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\0814705a-86f2-4fad-8322-686d6a62d200.tmp
                  • Size 2KB
                  • SHA256 249466cf61d5f537cb33f726ec7d39df2bccedc04c00b0045b1e2c8d1fd8103a
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  791f9075-285b-42d9-8307-1d5e8ac97b87.tmp
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\791f9075-285b-42d9-8307-1d5e8ac97b87.tmp
                  • Size 2KB
                  • SHA256 ba25d1229ee32e98bf9525389e413c822fcfa84db4fa644d198d51246c2b0558
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  8040e686-f1b4-4d7e-b672-2692bb29ae31.tmp
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\8040e686-f1b4-4d7e-b672-2692bb29ae31.tmp
                  • Size 1KB
                  • SHA256 eb5a680046da453cddb0a6279cc119c918f59052bae7b407a466453c9caf82a1
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  9177a4eb-3e72-4a01-9ee9-509c0918f2f8.tmp
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\9177a4eb-3e72-4a01-9ee9-509c0918f2f8.tmp
                  • Size 7KB
                  • SHA256 26eea34bc838c0a050c46794a758b8e6c98c61cbf4e98d0812d0d10c72ac783b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  temp-index
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Code Cache\js\index-dir\temp-index
                  • Size 360B
                  • SHA256 4136465c46263e910f15fa7f7f60a9a7550b2198342232b950ac922c2e735aea
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  the-real-index
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Code Cache\js\index-dir\the-real-index
                  • Size 48B
                  • SHA256 1ed70ef25cfff05ff5182e7266dd3bb3047232fd81714572e02bb65d24cae507
                  • MD5 SHA1 SHA512
                  Submit Download

                  data_1
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\DawnWebGPUCache\data_1
                  • Size 264KB
                  • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  MANIFEST-000001
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Extension Rules\MANIFEST-000001
                  • Size 41B
                  • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                  • MD5 SHA1 SHA512
                  Submit Download

                  data_0
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_0
                  • Size 8KB
                  • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  data_2
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_2
                  • Size 8KB
                  • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  data_3
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_3
                  • Size 8KB
                  • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  SCT Auditing Pending Reports
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\SCT Auditing Pending Reports
                  • Size 2B
                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                  • MD5 SHA1 SHA512
                  Submit Download

                  TransportSecurity
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity
                  • Size 188B
                  • SHA256 f34edaa09425f8a6e3dd392cd6f0028224fa6a4b1dcc458d4d630c9f5b30d437
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  be3a21f6-1dfa-47db-9a1c-15c53962abf4.tmp
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\be3a21f6-1dfa-47db-9a1c-15c53962abf4.tmp
                  • Size 188B
                  • SHA256 d8aeb614ab493a4b6b95c7d9bb5bc1d9132402b4bd1762a63cd2528b6b8e5f15
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Preferences
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences
                  • Size 7KB
                  • SHA256 2bd1f2ab949450c9076939cadf8c53664adcd8a434d19dfa741aea29abc4e48a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  CURRENT
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Sync Data\LevelDB\CURRENT
                  • Size 16B
                  • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                  • MD5 SHA1 SHA512
                  Submit Download

                  Local State
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
                  • Size 890B
                  • SHA256 a81bb06b58948e26627e33c2ec8a1616c907869aab847c189dad0cfbe1076e07
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  b21fe2c7-e2fc-4567-957a-b2d5bf9bc82e.tmp
                  • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\b21fe2c7-e2fc-4567-957a-b2d5bf9bc82e.tmp
                  • Size 2KB
                  • SHA256 88a5f9a6bd7b01ad5080a94419572b12d150c5df355b94abb03d283dab4e8923
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  config.vdf
                  • Path C:\Users\Admin\AppData\Local\Temp\config\config.vdf
                  • Size 117B
                  • SHA256 a3d8a2cba6e356e02c0f33b50e3a9e61d2f9dfb6a26b5983e30e7786da95dba7
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  config.vdf.async716.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\config\config.vdf.async716.tmp
                  • Size 1KB
                  • SHA256 8f9f970835f133258a7f740126012439385bbaa5a1d6a9d0d967a390977441c3
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  config.vdf.async716.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\config\config.vdf.async716.tmp
                  • Size 13KB
                  • SHA256 14b16bfab86b61c7df174f780257e4a4cd686c0795fe298c81a53e7a10f23055
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  crashhandler64.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\crashhandler64.dll
                  • Size 499KB
                  • SHA256 71dac2711f6c23016e3fdd379e2fa2863303d2cdc26cf38249379eabfa1a96f1
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  bootstrap_log.txt
                  • Path C:\Users\Admin\AppData\Local\Temp\logs\bootstrap_log.txt
                  • Size 14KB
                  • SHA256 9ce20bd9730dde5f25a0d384aba2e123f9a79b5bb5e45ff3870545f0c7ee100c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  service_log.txt
                  • Path C:\Users\Admin\AppData\Local\Temp\logs\service_log.txt
                  • Size 277B
                  • SHA256 3a52b155514b96d824748277dfcb3f4b2c7e92edadf6cfc9570380a669c683e3
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  service_log.txt
                  • Path C:\Users\Admin\AppData\Local\Temp\logs\service_log.txt
                  • Size 638B
                  • SHA256 30ea3bf775c8c7ebad73466bf16303707b6c7ec595b13aeedaeaf6462596ae42
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  bins_codecs_win64.zip.vz.c01daf4a0716b88602056bd92acc644129b22e45_7421009
                  • Path C:\Users\Admin\AppData\Local\Temp\package\bins_codecs_win64.zip.vz.c01daf4a0716b88602056bd92acc644129b22e45_7421009
                  • Size 7.1MB
                  • SHA256 4e0688746e470316fe915c2e0b672c840842525a11f4038c9bf5389ff30de210
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  bins_hardware_all.zip.vz.b7bacd960fd19cefde78219c11c7774a8ee00d4c_298751
                  • Path C:\Users\Admin\AppData\Local\Temp\package\bins_hardware_all.zip.vz.b7bacd960fd19cefde78219c11c7774a8ee00d4c_298751
                  • Size 291KB
                  • SHA256 abdcb4d7d038660f71732956f1902c18a5f4d854645cbb9196ae9997aed9f2d0
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  bins_hardware_win64.zip.827a01a60b8b7fd6c3df0f00c938f6c97b03276b
                  • Path C:\Users\Admin\AppData\Local\Temp\package\bins_hardware_win64.zip.827a01a60b8b7fd6c3df0f00c938f6c97b03276b
                  • Size 8.1MB
                  • SHA256 0c6dbf35a61502b59da0477e09aa212b0acf0ef542815eb5f357feb264dadc62
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  bins_misc_win64.zip.vz.7803168fa078e80df23870952e39eea3f424a5b7_12196250
                  • Path C:\Users\Admin\AppData\Local\Temp\package\bins_misc_win64.zip.vz.7803168fa078e80df23870952e39eea3f424a5b7_12196250
                  • Size 11.6MB
                  • SHA256 494fe63824ef42a24de3cb1214ffbecb3ab50814dc05938f12f1ffa5bda895b6
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  bins_webhelpers_win64.zip.vz.c43eca2835681675168481d7353774725d92871e_2720066
                  • Path C:\Users\Admin\AppData\Local\Temp\package\bins_webhelpers_win64.zip.vz.c43eca2835681675168481d7353774725d92871e_2720066
                  • Size 2.6MB
                  • SHA256 c3d1f587350db7c044eb022053862805cb91caf46884a6c4141847d2c1acb3c5
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  bins_win64.zip.vz.4a749655e9810ef81d0326e9436a7bea2a9f01cb_35488701
                  • Path C:\Users\Admin\AppData\Local\Temp\package\bins_win64.zip.vz.4a749655e9810ef81d0326e9436a7bea2a9f01cb_35488701
                  • Size 33.8MB
                  • SHA256 7f44ab790e6461cc1015f0ead6beff20ac9e281990553028363f7f474cc01f9a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  public_all.zip.vz.54c72b908da906e7af3bee17206b30830d6f627a_25274088
                  • Path C:\Users\Admin\AppData\Local\Temp\package\public_all.zip.vz.54c72b908da906e7af3bee17206b30830d6f627a_25274088
                  • Size 24.1MB
                  • SHA256 eb29b4c243cdcdc62b9d5453dfd46250613248995485ad60549f92cf015ed1c4
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  resources_all.zip.vz.ef4c575e0ebeda2c391b9e56182d51ce688f222e_3488108
                  • Path C:\Users\Admin\AppData\Local\Temp\package\resources_all.zip.vz.ef4c575e0ebeda2c391b9e56182d51ce688f222e_3488108
                  • Size 3.3MB
                  • SHA256 e3b3d053d2a4ac25a2d6175bb5df98726c046393090d8c7bbffcc85e03a297f1
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  resources_hidpi_all.zip.vz.3de815c3117712cb9eeb7ea4c8b275faf481dcfd_56342
                  • Path C:\Users\Admin\AppData\Local\Temp\package\resources_hidpi_all.zip.vz.3de815c3117712cb9eeb7ea4c8b275faf481dcfd_56342
                  • Size 55KB
                  • SHA256 e9cfba9af633e9d216a0cde97b1177d4cbca2a1aca7e83aaf38655dbd9be4b7d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  resources_misc_all.zip.vz.e86a975545f3ab21a77373870cb311ef93934b8c_2224876
                  • Path C:\Users\Admin\AppData\Local\Temp\package\resources_misc_all.zip.vz.e86a975545f3ab21a77373870cb311ef93934b8c_2224876
                  • Size 2.1MB
                  • SHA256 5e9ca0aac16b4d5caa2ac77ab2ce239e8dbcabe5ba6f0565112239ebb127ab2b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  steam_client_metrics.bin
                  • Path C:\Users\Admin\AppData\Local\Temp\package\steam_client_metrics.bin
                  • Size 3KB
                  • SHA256 24ecb2da3ce27eff2d8e4135e20160a9a5aae5958968299c6bab481c44c9cfc2
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  steam_client_win64.installed
                  • Path C:\Users\Admin\AppData\Local\Temp\package\steam_client_win64.installed
                  • Size 499KB
                  • SHA256 87716d1f1141549250bc311d1d6c3da524f6793d0c2ffa9c8d370c74a03d22aa
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  steam_client_win64.manifest
                  • Path C:\Users\Admin\AppData\Local\Temp\package\steam_client_win64.manifest
                  • Size 7KB
                  • SHA256 15ac2b305546f07bc33a2e9b2053685826fb5e9aa698b8c9a5961aef6f1cace6
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  steam_win64_steamrow.zip.vz.e9430db5afee3e3932b6948af15ad0c4b4f19255_2166823
                  • Path C:\Users\Admin\AppData\Local\Temp\package\steam_win64_steamrow.zip.vz.e9430db5afee3e3932b6948af15ad0c4b4f19255_2166823
                  • Size 2.1MB
                  • SHA256 d6d0567f01d3f7fe8678b470e7d375a205315702c0b91429227f78111ff11efe
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  steamui_websrc_all.zip.vz.3dcd2f1c6a5e8a1f3bd080203b3c0fd48c324a25_28679233
                  • Path C:\Users\Admin\AppData\Local\Temp\package\steamui_websrc_all.zip.vz.3dcd2f1c6a5e8a1f3bd080203b3c0fd48c324a25_28679233
                  • Size 27.4MB
                  • SHA256 8a60b5bcc3899c9df081e58552250abf7e1e8975b32bd3b4f9dab261b589dd3d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  steamui_websrc_movies_all.zip.40e78cdda48e9a8a74baf614e0cdc7a6b96d26d1
                  • Path C:\Users\Admin\AppData\Local\Temp\package\steamui_websrc_movies_all.zip.40e78cdda48e9a8a74baf614e0cdc7a6b96d26d1
                  • Size 10.4MB
                  • SHA256 885a32533327f0fd5ea98e6c6f13552e965cab4852dad7ce9ccf3d929d726b5b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  steamui_websrc_sounds_all.zip.vz.5ba6acd8f4dfe4b93437895b20344fab5bb3ff96_3714779
                  • Path C:\Users\Admin\AppData\Local\Temp\package\steamui_websrc_sounds_all.zip.vz.5ba6acd8f4dfe4b93437895b20344fab5bb3ff96_3714779
                  • Size 3.5MB
                  • SHA256 ac62e3d0e6213bcbdcfe973c624eda0486977dccdc4098c10b60b62e894ea93b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  strings_all.zip.vz.1518f222a37456b048acfb3d6c3d97865a612666_2079871
                  • Path C:\Users\Admin\AppData\Local\Temp\package\strings_all.zip.vz.1518f222a37456b048acfb3d6c3d97865a612666_2079871
                  • Size 2.0MB
                  • SHA256 da8abc499d1b675f4b303823e85f228a0385b4341ba785ba6fa3b8ea1d4df124
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  strings_en_all.zip.e716a67d7fa91ba70490a6417e25d45c5435e393
                  • Path C:\Users\Admin\AppData\Local\Temp\package\strings_en_all.zip.e716a67d7fa91ba70490a6417e25d45c5435e393
                  • Size 111KB
                  • SHA256 0c56193fac4fa518eaaac0dc66ecd21a3cee510ece85594b6c308f8d31ee98a3
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  tenfoot_images_all.zip.vz.193cb8c4eb4446698ea2c0a9e8c4e6b6a623dac7_5572671
                  • Path C:\Users\Admin\AppData\Local\Temp\package\tenfoot_images_all.zip.vz.193cb8c4eb4446698ea2c0a9e8c4e6b6a623dac7_5572671
                  • Size 5.3MB
                  • SHA256 e1fee3beffa9d08a415a35ddc7d3141af6c44269c67e67aa0a3eea6e56889bd7
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  btnOvrOffTop.tga_
                  • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\btnOvrOffTop.tga_
                  • Size 444B
                  • SHA256 ecd13153d9d438809a38de30f3abbb0f6f92837a7e3cacb442a9a9309bcd78d9
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  [email protected]_
                  • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\[email protected]_
                  • Size 15KB
                  • SHA256 d3af480fe975487ea4754c88dd56df0d4cfe68633eb9abb2458f42ae3df34479
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  [email protected]_
                  • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\[email protected]_
                  • Size 92KB
                  • SHA256 f200aca23ac6739a6d521298094972383f835d8fcac24b7bdef820181ae8c37a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  icon_button_news.tga_
                  • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\icon_button_news.tga_
                  • Size 20KB
                  • SHA256 42c410136a35b64c7e0a410b1d2fd2e2712782039cd7237615219ea57d7c40fa
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  tabStdTop.tga_
                  • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\tabStdTop.tga_
                  • Size 48B
                  • SHA256 5caa5fa3e79dcd8ec5ec20256ed7c77efaae77e0ae8d89e4a974c484cb177d84
                  • MD5 SHA1 SHA512
                  Submit Download

                  steam_updating.ico_
                  • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\public\steam_updating.ico_
                  • Size 47KB
                  • SHA256 5aaca90948de8f7d11264ed608a2f96acba061e6463d337d658b00ed1c552449
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  steam_updating_posix.tga_
                  • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\public\steam_updating_posix.tga_
                  • Size 64KB
                  • SHA256 fd2abb8945c06a6b9c5444baf6ea523b52bf7a03a58b34ebe0a6a110630ed5f8
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  filter_banned_thai.txt.gz_
                  • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\resource\filter_banned_thai.txt.gz_
                  • Size 23B
                  • SHA256 6feb83ca306745d634903cf09274b7baf0ac38e43c6b3fab1a608be344c3ef64
                  • MD5 SHA1 SHA512
                  Submit Download

                  steambootstrapper_english.txt
                  • Path C:\Users\Admin\AppData\Local\Temp\public\steambootstrapper_english.txt
                  • Size 4KB
                  • SHA256 fbc09c1b9a55d04b57be8fb2ad5ab58b38f76054ecd3d1b70440a2d08191b05b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cdd43a2531e6882f.bin
                  • Path C:\Users\Admin\AppData\Roaming\cdd43a2531e6882f.bin
                  • Size 12KB
                  • SHA256 7f90862ee0b205fe110196a224b66d90308041ae6680773c7b0fd99b929d5a93
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  perfhost.exe
                  • Path C:\Windows\SysWOW64\perfhost.exe
                  • Size 1.2MB
                  • SHA256 b6060a0e34e1ce79ca25464b98f016b5e1cf7daaeec36e693fd402b1d6f27747
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  AgentService.exe
                  • Path C:\Windows\System32\AgentService.exe
                  • Size 1.4MB
                  • SHA256 7c0cfa7028f245d33270a5feed8f9f8ecdfc5214a7461d154942f8e26b103bce
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ssh-agent.exe
                  • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                  • Size 1.8MB
                  • SHA256 3ce778322da7a62c3a062c1a0b061cc52252f5ed24a8a27816bb5c491b4e0e2d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  PerceptionSimulationService.exe
                  • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
                  • Size 1.5MB
                  • SHA256 951610b245987da0f47712f65cce031150e5d80a8f38cd70512a19f14d160f44
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ReFsDedupSvc.exe
                  • Path C:\Windows\System32\ReFsDedupSvc.exe
                  • Size 2.6MB
                  • SHA256 1c1021d1ea671984bbd28f8c7005fa1042b6f4b6c3fa25159149b99303861fe5
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  SearchIndexer.exe
                  • Path C:\Windows\System32\SearchIndexer.exe
                  • Size 1.4MB
                  • SHA256 dd1d21766bb0668fd98854051686b2fb4baeff85d2bbffd3f080daa572d92608
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  SensorDataService.exe
                  • Path C:\Windows\System32\SensorDataService.exe
                  • Size 1.7MB
                  • SHA256 72273fa8bfad5d461b6103370433c82bcd6a1d74eb8b2627d23c95fde7d972d4
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  AppVClient.exe
                  • Path C:\Windows\system32\AppVClient.exe
                  • Size 1.3MB
                  • SHA256 24d192a90069163e7190b0a24e5072b3f61841ea4480362c353feccd42f3991f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  SgrmBroker.exe
                  • Path C:\Windows\system32\Sgrm\SgrmBroker.exe
                  • Size 1.6MB
                  • SHA256 c929e53436381f906f4949c100c0a7bb70bbe28f7f2d5d5d2fce5d7dd6044aa1
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  memory/716-6991-0x0000000001F50000-0x0000000001FB0000-memory.dmp
                  Download

                  memory/716-7154-0x0000000140000000-0x00000001407A4000-memory.dmp
                  Download

                  memory/716-6985-0x0000000001F50000-0x0000000001FB0000-memory.dmp
                  Download

                  memory/716-6984-0x0000000140000000-0x00000001407A4000-memory.dmp
                  Download

                  memory/1476-7066-0x00000000020D0000-0x0000000002130000-memory.dmp
                  Download

                  memory/1476-7076-0x00000000020D0000-0x0000000002130000-memory.dmp
                  Download

                  memory/1476-7078-0x0000000140000000-0x000000014036E000-memory.dmp
                  Download

                  memory/1476-7065-0x0000000140000000-0x000000014036E000-memory.dmp
                  Download

                  memory/1476-7072-0x00000000020D0000-0x0000000002130000-memory.dmp
                  Download

                  memory/1516-50-0x0000000002300000-0x0000000002360000-memory.dmp
                  Download

                  memory/1516-44-0x0000000002300000-0x0000000002360000-memory.dmp
                  Download

                  memory/1516-40-0x0000000140000000-0x000000014022C000-memory.dmp
                  Download

                  memory/1516-56-0x0000000002300000-0x0000000002360000-memory.dmp
                  Download

                  memory/1516-58-0x0000000140000000-0x000000014022C000-memory.dmp
                  Download

                  memory/1708-7090-0x0000000000400000-0x00000000005F3000-memory.dmp
                  Download

                  memory/1708-7092-0x0000000000400000-0x00000000005F3000-memory.dmp
                  Download

                  memory/2352-112-0x0000000000780000-0x00000000007E0000-memory.dmp
                  Download

                  memory/2352-111-0x0000000140000000-0x00000001401BA000-memory.dmp
                  Download

                  memory/2352-118-0x0000000000780000-0x00000000007E0000-memory.dmp
                  Download

                  memory/2352-329-0x0000000000780000-0x00000000007E0000-memory.dmp
                  Download

                  memory/2352-331-0x0000000140000000-0x00000001401BA000-memory.dmp
                  Download

                  memory/2412-7427-0x0000000140000000-0x00000001407DA000-memory.dmp
                  Download

                  memory/2412-7439-0x0000000140000000-0x00000001407DA000-memory.dmp
                  Download

                  memory/2412-7417-0x0000000002CA0000-0x0000000002D00000-memory.dmp
                  Download

                  memory/2412-7424-0x0000000002CA0000-0x0000000002D00000-memory.dmp
                  Download

                  memory/2412-7437-0x0000000002CA0000-0x0000000002D00000-memory.dmp
                  Download

                  memory/2656-89-0x0000000000800000-0x0000000000866000-memory.dmp
                  Download

                  memory/2656-327-0x0000000000400000-0x00000000005EE000-memory.dmp
                  Download

                  memory/2656-94-0x0000000000800000-0x0000000000866000-memory.dmp
                  Download

                  memory/2656-88-0x0000000000400000-0x00000000005EE000-memory.dmp
                  Download

                  memory/2868-7100-0x0000000000730000-0x0000000000790000-memory.dmp
                  Download

                  memory/2868-7104-0x0000000140000000-0x000000014021C000-memory.dmp
                  Download

                  memory/2868-7102-0x0000000000730000-0x0000000000790000-memory.dmp
                  Download

                  memory/2868-7091-0x0000000140000000-0x000000014021C000-memory.dmp
                  Download

                  memory/2928-7207-0x00007FFE2A060000-0x00007FFE2A061000-memory.dmp
                  Download

                  memory/2928-7208-0x00007FFE2A850000-0x00007FFE2A851000-memory.dmp
                  Download

                  memory/2928-7401-0x0000000140000000-0x00000001407DA000-memory.dmp
                  Download

                  memory/2928-7210-0x0000023AB6200000-0x0000023AB6260000-memory.dmp
                  Download

                  memory/2928-7233-0x0000023AB6200000-0x0000023AB6260000-memory.dmp
                  Download

                  memory/2928-7235-0x0000000140000000-0x00000001407DA000-memory.dmp
                  Download

                  memory/2992-160-0x0000000000620000-0x0000000000680000-memory.dmp
                  Download

                  memory/2992-153-0x0000000140000000-0x0000000140172000-memory.dmp
                  Download

                  memory/2992-154-0x0000000000620000-0x0000000000680000-memory.dmp
                  Download

                  memory/2992-336-0x0000000140000000-0x0000000140172000-memory.dmp
                  Download

                  memory/3204-328-0x0000000140000000-0x00000001402C9000-memory.dmp
                  Download

                  memory/3204-99-0x0000000140000000-0x00000001402C9000-memory.dmp
                  Download

                  memory/3204-355-0x0000000140000000-0x00000001402C9000-memory.dmp
                  Download

                  memory/3204-106-0x0000000000400000-0x0000000000460000-memory.dmp
                  Download

                  memory/3204-100-0x0000000000400000-0x0000000000460000-memory.dmp
                  Download

                  memory/3204-353-0x0000000000400000-0x0000000000460000-memory.dmp
                  Download

                  memory/3232-85-0x0000000140000000-0x0000000140222000-memory.dmp
                  Download

                  memory/3232-83-0x0000000000CC0000-0x0000000000D20000-memory.dmp
                  Download

                  memory/3232-77-0x0000000000CC0000-0x0000000000D20000-memory.dmp
                  Download

                  memory/3232-325-0x0000000140000000-0x0000000140222000-memory.dmp
                  Download

                  memory/3444-65-0x00000000008B0000-0x0000000000910000-memory.dmp
                  Download

                  memory/3444-71-0x00000000008B0000-0x0000000000910000-memory.dmp
                  Download

                  memory/3444-284-0x0000000140000000-0x0000000140226000-memory.dmp
                  Download

                  memory/3444-64-0x0000000140000000-0x0000000140226000-memory.dmp
                  Download

                  memory/3528-22-0x0000000000C40000-0x0000000000CA0000-memory.dmp
                  Download

                  memory/3528-21-0x0000000140000000-0x00000001402E9000-memory.dmp
                  Download

                  memory/3528-13-0x0000000000C40000-0x0000000000CA0000-memory.dmp
                  Download

                  memory/3528-98-0x0000000140000000-0x00000001402E9000-memory.dmp
                  Download

                  memory/4436-7319-0x0000000140000000-0x00000001407DA000-memory.dmp
                  Download

                  memory/4436-7074-0x0000000140000000-0x00000001407DA000-memory.dmp
                  Download

                  memory/4436-7128-0x0000000002A80000-0x0000000002AE0000-memory.dmp
                  Download

                  memory/4436-7121-0x0000000002A80000-0x0000000002AE0000-memory.dmp
                  Download

                  memory/4440-137-0x0000000000730000-0x0000000000790000-memory.dmp
                  Download

                  memory/4440-148-0x0000000000730000-0x0000000000790000-memory.dmp
                  Download

                  memory/4440-150-0x0000000140000000-0x0000000140168000-memory.dmp
                  Download

                  memory/4440-136-0x0000000140000000-0x0000000140168000-memory.dmp
                  Download

                  memory/4440-143-0x0000000000730000-0x0000000000790000-memory.dmp
                  Download

                  memory/4664-124-0x0000000000D50000-0x0000000000DB0000-memory.dmp
                  Download

                  memory/4664-130-0x0000000140000000-0x0000000140295000-memory.dmp
                  Download

                  memory/4664-131-0x0000000000D50000-0x0000000000DB0000-memory.dmp
                  Download

                  memory/4664-333-0x0000000140000000-0x0000000140295000-memory.dmp
                  Download

                  memory/4696-6983-0x0000000140000000-0x00000001407A4000-memory.dmp
                  Download

                  memory/4696-6-0x0000000002080000-0x00000000020E0000-memory.dmp
                  Download

                  memory/4696-9-0x0000000140000000-0x00000001407A4000-memory.dmp
                  Download

                  memory/4696-76-0x0000000140000000-0x00000001407A4000-memory.dmp
                  Download

                  memory/4696-0-0x0000000002080000-0x00000000020E0000-memory.dmp
                  Download

                  memory/4696-6981-0x0000000002080000-0x00000000020E0000-memory.dmp
                  Download

                  memory/4716-7155-0x000001B7FCDE0000-0x000001B7FCE40000-memory.dmp
                  Download

                  memory/4716-7157-0x0000000140000000-0x00000001407DA000-memory.dmp
                  Download

                  memory/4716-7391-0x0000000140000000-0x00000001407DA000-memory.dmp
                  Download

                  memory/4716-7153-0x000001B7FCDE0000-0x000001B7FCE40000-memory.dmp
                  Download

                  memory/5080-7201-0x0000000002BF0000-0x0000000002C50000-memory.dmp
                  Download

                  memory/5080-7211-0x0000000002BF0000-0x0000000002C50000-memory.dmp
                  Download

                  memory/5080-7209-0x0000000140000000-0x00000001407DA000-memory.dmp
                  Download

                  memory/5080-7400-0x0000000140000000-0x00000001407DA000-memory.dmp
                  Download

                  memory/5164-7106-0x0000000000400000-0x000000000060F000-memory.dmp
                  Download

                  memory/5164-7127-0x0000000000400000-0x000000000060F000-memory.dmp
                  Download

                  memory/5164-7117-0x0000000000850000-0x00000000008B6000-memory.dmp
                  Download

                  memory/5164-7112-0x0000000000850000-0x00000000008B6000-memory.dmp
                  Download

                  memory/5424-7093-0x0000000140000000-0x000000014017F000-memory.dmp
                  Download

                  memory/5424-7084-0x0000000140000000-0x000000014017F000-memory.dmp
                  Download

                  memory/5672-36-0x0000000140000000-0x00000001402D4000-memory.dmp
                  Download

                  memory/5672-135-0x0000000140000000-0x00000001402D4000-memory.dmp
                  Download

                  memory/5672-37-0x00000000006E0000-0x0000000000740000-memory.dmp
                  Download

                  memory/5672-28-0x00000000006E0000-0x0000000000740000-memory.dmp
                  Download

                  memory/5960-7444-0x00000206D3DF0000-0x00000206D3F89000-memory.dmp
                  Download

                  memory/5960-7423-0x0000000140000000-0x00000001407DA000-memory.dmp
                  Download

                  memory/5960-7264-0x00000206D39B0000-0x00000206D3A10000-memory.dmp
                  Download

                  memory/5960-7265-0x00000206D39B0000-0x00000206D3A10000-memory.dmp
                  Download

                  memory/5960-7267-0x0000000140000000-0x00000001407DA000-memory.dmp
                  Download