36cda6b6c07ef46e5d218bb0320f99d67b9bb4aa3892caee6582101ddcb1a3fa

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 10:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe
Size 5.0MB
Sample260511-mph7ysay3n
SHA256 36cda6b6c07ef46e5d218bb0320f99d67b9bb4aa3892caee6582101ddcb1a3fa
MD5 7315fc89a9d9fdb2255560dee26f04ba
SHA1 96a67a3c9602d9972b92112fc11968cd3bcfb40d
SHA512 41087dd1ea50700bde7dc5ecf93fa5aa19ad33a8e0cf37118769d874263e3b5383a25e9416f8573c5958f02aa9d0241476feb2c354722640c8174f28fc7af91a
SSDEEP 98304:s6F1xh3MUZgmVsHGSyvQKG4nI+Tia60aKQwsNvwXhS:lvxpZXviaLa1Tq
TLSH
T1D236CF12FA41C071E9D2027565AFAB7A497EAE300739C4C397D43D6AD8311D33B3A79A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe

Executes dropped EXE 12 IoCs

pid	Process
7256	steamsysinfo.exe
7344	steamwebhelper.exe
7428	steamwebhelper.exe
7744	steamwebhelper.exe
8072	steamwebhelper.exe
8104	steamwebhelper.exe
8644	gldriverquery64.exe
8700	steamwebhelper.exe
4220	gldriverquery.exe
3796	vulkandriverquery64.exe
3932	vulkandriverquery.exe
9864	steamwebhelper.exe

Loads dropped DLL 54 IoCs

pid	Process
20948	2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe
20948	2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe
20948	2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe
20948	2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe
20948	2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe
20948	2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe
20948	2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe
20948	2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe
20948	2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe
20948	2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe
20948	2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe
20948	2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe
20948	2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe
20948	2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe
20948	2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe
20948	2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe
7256	steamsysinfo.exe
7256	steamsysinfo.exe
7256	steamsysinfo.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7428	steamwebhelper.exe
7428	steamwebhelper.exe
20948	2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe
20948	2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe
7744	steamwebhelper.exe
7744	steamwebhelper.exe
7744	steamwebhelper.exe
7744	steamwebhelper.exe
7744	steamwebhelper.exe
7744	steamwebhelper.exe
7744	steamwebhelper.exe
7744	steamwebhelper.exe
7744	steamwebhelper.exe
7744	steamwebhelper.exe
7344	steamwebhelper.exe
8072	steamwebhelper.exe
8072	steamwebhelper.exe
8072	steamwebhelper.exe
8104	steamwebhelper.exe
8104	steamwebhelper.exe
8104	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
20948	2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe
8700	steamwebhelper.exe
8700	steamwebhelper.exe
8700	steamwebhelper.exe
8700	steamwebhelper.exe
9864	steamwebhelper.exe
9864	steamwebhelper.exe
9864	steamwebhelper.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gldriverquery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vulkandriverquery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steamsysinfo.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
8072	steamwebhelper.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steamwebhelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steamwebhelper.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	steamwebhelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	steamwebhelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	steamwebhelper.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	steamwebhelper.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134229695647533901"	steamwebhelper.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
20948	2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe
20948	2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe
20948	2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe
20948	2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
20948	2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe
20948	2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe
20948	2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe
20948	2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe
20948	2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe
20948	2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe
20948	2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe
20948	2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe
20948	2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe
20948	2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
20948	2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	7344	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	7344	steamwebhelper.exe
Token: SeShutdownPrivilege	7344	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	7344	steamwebhelper.exe
Token: SeShutdownPrivilege	7344	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	7344	steamwebhelper.exe
Token: SeShutdownPrivilege	7344	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	7344	steamwebhelper.exe
Token: SeShutdownPrivilege	7344	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	7344	steamwebhelper.exe
Token: SeShutdownPrivilege	7344	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	7344	steamwebhelper.exe
Token: SeShutdownPrivilege	7344	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	7344	steamwebhelper.exe
Token: SeShutdownPrivilege	7344	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	7344	steamwebhelper.exe
Token: SeShutdownPrivilege	7344	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	7344	steamwebhelper.exe
Token: SeShutdownPrivilege	7344	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	7344	steamwebhelper.exe
Token: SeShutdownPrivilege	7344	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	7344	steamwebhelper.exe
Token: SeShutdownPrivilege	7344	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	7344	steamwebhelper.exe
Token: SeShutdownPrivilege	7344	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	7344	steamwebhelper.exe
Token: SeShutdownPrivilege	7344	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	7344	steamwebhelper.exe
Token: SeShutdownPrivilege	7344	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	7344	steamwebhelper.exe
Token: SeShutdownPrivilege	7344	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	7344	steamwebhelper.exe
Token: SeShutdownPrivilege	7344	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	7344	steamwebhelper.exe
Token: SeShutdownPrivilege	7344	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	7344	steamwebhelper.exe
Token: SeShutdownPrivilege	7344	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	7344	steamwebhelper.exe
Token: SeShutdownPrivilege	7344	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	7344	steamwebhelper.exe
Token: SeShutdownPrivilege	7344	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	7344	steamwebhelper.exe
Token: SeShutdownPrivilege	7344	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	7344	steamwebhelper.exe
Token: SeShutdownPrivilege	7344	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	7344	steamwebhelper.exe
Token: SeShutdownPrivilege	7344	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	7344	steamwebhelper.exe
Token: SeShutdownPrivilege	7344	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	7344	steamwebhelper.exe
Token: SeShutdownPrivilege	7344	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	7344	steamwebhelper.exe
Token: SeShutdownPrivilege	7344	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	7344	steamwebhelper.exe
Token: SeShutdownPrivilege	7344	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	7344	steamwebhelper.exe
Token: SeShutdownPrivilege	7344	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	7344	steamwebhelper.exe
Token: SeShutdownPrivilege	7344	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	7344	steamwebhelper.exe
Token: SeShutdownPrivilege	7344	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	7344	steamwebhelper.exe
Token: SeShutdownPrivilege	7344	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	7344	steamwebhelper.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe
7344	steamwebhelper.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
20948	2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 20948	4544	2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe	101
PID 20948 wrote to memory of 7256	20948	2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe	102
PID 20948 wrote to memory of 7344	20948	2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe	104
PID 7344 wrote to memory of 7428	7344	steamwebhelper.exe	105
PID 7344 wrote to memory of 7744	7344	steamwebhelper.exe	106
PID 7344 wrote to memory of 7744	7344	steamwebhelper.exe	106
PID 7344 wrote to memory of 8072	7344	steamwebhelper.exe	108
PID 7344 wrote to memory of 8104	7344	steamwebhelper.exe	109
PID 7344 wrote to memory of 8104	7344	steamwebhelper.exe	109
PID 20948 wrote to memory of 8644	20948	2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe	111
PID 7344 wrote to memory of 8700	7344	steamwebhelper.exe	112
PID 7344 wrote to memory of 8700	7344	steamwebhelper.exe	112
PID 20948 wrote to memory of 4220	20948	2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe	113
PID 20948 wrote to memory of 3796	20948	2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe	114
PID 20948 wrote to memory of 3932	20948	2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe	116
PID 7344 wrote to memory of 9864	7344	steamwebhelper.exe	119

C:\Users\Admin\AppData\Local\Temp\2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe"
1⤵
- Modifies trusted root certificate store through registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Users\Admin\AppData\Local\Temp\2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe
  C:\Users\Admin\AppData\Local\Temp\2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:20948
- - C:\Users\Admin\AppData\Local\Temp\steamsysinfo.exe
    C:\Users\Admin\AppData\Local\Temp\steamsysinfo.exe -steamid 0 -buildid 1769731672 -logdir C:\Users\Admin\AppData\Local\Temp\logs -query 1 -out-file C:\Users\Admin\AppData\Local\Temp\ECAD.tmp
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:7256
- - C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
    C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe -nocrashdialog "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=20948" "-buildid=1769731672" "-steamid=0" "-logdir=C:\Users\Admin\AppData\Local\Temp\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Users\Admin\AppData\Local\Temp\clientui" "-steampath=C:\Users\Admin\AppData\Local\Temp\2026-05-11_7315fc89a9d9fdb2255560dee26f04ba_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling "--log-file=C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --disable-quick-menu --disable-component-update "--gaia-url=http://disabled.invalid" "--enable-features=PlatformHEVCDecoderSupport" "--disable-features=WinRetrieveSuggestionsOnlyOnDemand,SpareRendererForSitePerProcess,DcheckIsFatal,BlockPromptsIfIgnoredOften,ValveFFmpegAllowLowDelayHEVC"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:7344
  - - C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
      C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\dumps "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1769731672 --initial-client-data=0x244,0x248,0x24c,0x240,0x250,0x7ff8c1baaf00,0x7ff8c1baaf0c,0x7ff8c1baaf18
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:7428
  - - C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe" --type=gpu-process --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1769731672 --steamid=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1920,i,498837424317963132,12898502213749702364,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=1924 --mojo-platform-channel-handle=1908 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:7744
  - - C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1769731672 --steamid=0 --field-trial-handle=1984,i,498837424317963132,12898502213749702364,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2188 --mojo-platform-channel-handle=2184 /prefetch:3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Time Discovery
      PID:8072
  - - C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1769731672 --steamid=0 --field-trial-handle=2236,i,498837424317963132,12898502213749702364,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2360 --mojo-platform-channel-handle=2356 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:8104
  - - C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1769731672 --steamid=0 --gaia-url=http://disabled.invalid --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=4028,i,498837424317963132,12898502213749702364,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4048 --mojo-platform-channel-handle=4044 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:8700
  - - C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1769731672 --steamid=0 --field-trial-handle=4980,i,498837424317963132,12898502213749702364,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5000 --mojo-platform-channel-handle=4996 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:9864
- - C:\Users\Admin\AppData\Local\Temp\bin\gldriverquery64.exe
    .\bin\gldriverquery64.exe
    3⤵
    - Executes dropped EXE
    PID:8644
- - C:\Users\Admin\AppData\Local\Temp\bin\gldriverquery.exe
    .\bin\gldriverquery.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4220
- - C:\Users\Admin\AppData\Local\Temp\bin\vulkandriverquery64.exe
    .\bin\vulkandriverquery64.exe
    3⤵
    - Executes dropped EXE
    PID:3796
- - C:\Users\Admin\AppData\Local\Temp\bin\vulkandriverquery.exe
    .\bin\vulkandriverquery.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3932

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4e4 0x4f0
1⤵
PID:7900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:9948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

the-real-index

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 7031aa3b7b8886910238b3a0838738f75dd712d31fe59d5af4edd4369e6bf4d6
MD5 956fd3471255f35dc25c756bf1aabc0a
SHA1 50dd0152b563d3001ca198cc583b603bb3ad4648
SHA512 4daa71655866a67a41d96aab3b23ee1670a8f936d9585139d0f19a40a87bd997de49254c8dace5424825eee3be9caa57fb70a3a92528129aa5f172dd1c19277a
TLSH
T183D092240DDA45E2EF0023F605814C5E37A16B758A5F7E4366ECED7CDCB2AD565C6021
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 85afbefcd3981f4eaa5d1116f0e3f67e037cde8805b840fc394427ea546289ae
MD5 ee892c2f05e03c33f0f5fad6c09b64a6
SHA1 d7a40bdac5b58e376f3622b82ac6c21498008849
SHA512 7b9e77d90ce0236fa77604d0bca91fea69cae3040cdbffa2c480a5089f1b8da23d93839489e5955761294da71d00497f39405db50712cb4871cc849daaf1d5dd
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a1a30.TMP

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\Network Persistent State~RFe5a1a30.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity
Size 188B
SHA256 ff465767c230859e94d4f81c13dc1f8eb8de719c91dcbfca2ef1e65957fc2048
MD5 d45287c08965d23ce5ff8bc1b316f83c
SHA1 5e83a3e616f0be575d187d4550038a8be301aded
SHA512 251a72bdfac76a80ccb8179003f6b8900feba543dc8cfe91442cbb52dab4aa69184148e61c0b1462b5dc3b39cccc1a07ae0fa78c75b80d1bfad3972642105fbf
TLSH
T10CC02262402AA036603C0A324984BE816F3AB1300281A0E8D3530968A001C664103002
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe599f05.TMP

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity~RFe599f05.TMP
Size 188B
SHA256 c1b01d1b3fde2c3e614d75e40983d650c5a53e3d9c8d05a9dd29132532e239eb
MD5 87e8a7e1ef1b455a7724fdb25124141a
SHA1 a81c58e6bd7e29aa84bb051789e8461b95ab7675
SHA512 9d9118541cba85723a0f6e9ffde307f8b8b2a1079961c090f2b5dba424295a94b273d94233831cb50ed054c75c57573cb39cdfbe27e96d9974d4a136befd31fc
TLSH
T1F8C0C072403FE03E603809224DC0FE035F3AF572018170FCDA56057CB0001764103053
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences
Size 7KB
SHA256 5ec62ad51bd5f306f16e68730964413164f9295dcfed3050bf685f2df02aab07
MD5 2e0fccc8d1d4a544abefae507eae4769
SHA1 05032a866f8c2d04d3aac2c131471f3ba4de6442
SHA512 9a15e095018393c59b6710c61f6ac2653953b4a0bec423fcbc3a86882ffa9cf8d562a5dd7689d5d283c1365d95251b6886ca56e123ec0bfdde52891ec33249a4
SSDEEP 192:rpC5SefnXV++wpuptLk/2OPM6yIsnDjwgQ:rpC5JX/wkjk/2PQ
TLSH
T1C2F1851A6C28AA7F5CDAE719FA257B43D7F5103135D03D48E6F88A1C28E76DC2227907
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59572e.TMP

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences~RFe59572e.TMP
Size 7KB
SHA256 c0762d32c22424b5307f1f58e0d55bb1b4db9443ee67b1feffde82a730d01d06
MD5 f78f1bdcf1d3a0a39743afdaa3152af1
SHA1 bc8bc03f33cb46b44056b9f518ca8773abbfbf26
SHA512 8cd8b3d2563dd33ffd4a0542bf18fde4ec5733e54cba49280543dae548cc2368cf1d3d893af24d6ce243c998b17175fe5c03520bef789a56fa18ea50659e576b
SSDEEP 192:rpC53efnXV++wpuptLk/2OPM6yIsnDjwgQ:rpC5eX/wkjk/2PQ
TLSH
T198F1851A6C28AA7F5CDAE719FA257B43D7F5103135D03D48E6F88A1C28E76DC2227807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
Size 2KB
SHA256 489557871fb4085efc1ee28956038aff160c189531b1529d3d3aaf602386dde9
MD5 9956012dc32965c8430f4e0f6c0693ab
SHA1 14614547a4984970ecbf09830906e777cf8eb1c8
SHA512 18139cf5ea303025fd872ae8b319a89bc04d85ffd3c37dcb6eb937f76990672bca8893b27b55ed1466108379e45131b9bdcc6c0e9c1600055fa126a96cf77f4a
TLSH
T1AA517432F4A8CD7755BBC541B6063B039EB5116AB6606B98E1DE0F1C13EB9EC2302C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
Size 1KB
SHA256 27b28d50c51b4a78b3c3a4cb5d56d9934fa7e1444bad0c556b9501944019344d
MD5 e350077a9fbe1c8487600134e064eafd
SHA1 64e8defe611bd034cbbed34f6b6d5240dff35f04
SHA512 8597bb5a333762b7492fc9b8eeddf8812f4967953b2c68c8f1ed531190189dee60a934aba077e248c94855c17f6dc3890af9bd2b316535e621ccb248683a180c
TLSH
T1781112B3F4A84AA6B99B4505B70667032E32016AA1214B4C72DE4E5553F789C7617C26
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
Size 2KB
SHA256 031637c11b6f82c0a78a21bc16df747b0ffd8af7a2e209349afc9f530857c734
MD5 107b4eb0dc8574694bb2fbfb11236cc2
SHA1 5c49a15fcc5583820ffa33b62ab45a7475c2bfad
SHA512 269c3af30f00e41dfbbb8c60509208eb9e089c680641be2e172ea029cf5ace0218a29f0313f7ff23587e28c7cacb60a3772e1780224fa247acd44e0efe738eae
TLSH
T16F517432F4A8CD7755BBC541B6067B039EB5116AB6606B98E1DE0F1C13EB8EC2302C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe58f364.TMP

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State~RFe58f364.TMP
Size 890B
SHA256 c464fe4d504d649fe0763a8719ba4e962df5fb983fc564a88ccc09b84c822fc6
MD5 40ae9a30556bdf20e80aceedf9ceee45
SHA1 721079f16e8768ef999e16d2385c4f563310c769
SHA512 1c14ce4952deba2b8558e85756537002b534f5550715126699498f5308a66639659c0b16910f9421000a5095089a65cc4de6c3a4e9499dd7852f7e07e90a81d2
TLSH
T1801123B3E8A50B65BDA64105B20767022D22016BD2254B0CB2DE4B5513FB4AC6617C26
MD5 SHA1 SHA512 TLSH

Submit Download

SDL3.dll

Path C:\Users\Admin\AppData\Local\Temp\SDL3.dll
Size 2.3MB
SHA256 db01ec466db9c4e19cc5fe8c878ac89bc1b6057136432554842b3cd4dca88669
MD5 1dce0a69dc92b95716d992428dd31054
SHA1 3a47ade3421c790b134c3157ad9b70ae41ed8607
SHA512 a8e0202d23379986dd712a8d0dce94674db8c436b755527ca412ecf7620266ccc7c8df188a64c31b778a2910f88d1404b5f1de8544c7260c5ade1ece9c1c6fe9
SSDEEP 49152:qZuFySYom8m1K8F/UV1LpUMRUV3UrwAXGeOreWlatxK+JRUVrnS6EQia6c:qZXOm8m1K4/UV1LpUYUV3UrfXG/iWEZk
TLSH
T18CB5BF21BD538116ECD704B7D2BEBFB60D3E7A2813BD06E7ABC4289468605D2617871F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\chrome_100_percent.pak
Size 665KB
SHA256 5bae7e1edacb8da2abb5c64853ffd3d5be0f2f495ce9d45364c313390db78e0f
MD5 ba24f7efcb97f1ecd06f71a4e38d9554
SHA1 d3cc1139e276bce735c6335e6b8eabf95c15e783
SHA512 963ba34897812f409d2b4898bd3307725164e9f59b2b3e10b7d04a1a31452096237aef6ee4c89885c96eb82e003f53c58881300810106c6bab12b9937e747b53
SSDEEP 12288:YiI3H1fJljzgsz5B0GDJQrnKs8SNP+QSsSilxNzJ0D+wIivWXuoO0TehErwJ:83VBl7zEEmPLSUNzJ0KwpvW+oO0TOvJ
TLSH
T1CEE412D773B4EC7DEEAB1677A26500B4FC7349685A52010A178EE8796A53708D8CD3C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\chrome_200_percent.pak
Size 1.0MB
SHA256 708180733b8f697c433329a07453a93995d4dfce09faf41e51697695ad7a8f4c
MD5 16e85e5e11ef09e3a9c671952931e266
SHA1 140729a22beb3a3760ab14b65252446c34db00ec
SHA512 0515d5fa9acf143ce7d14b59b80dedbd8d5c2f9f8a4b55d834fd4ef4c491f587f99384256c2dbf45f84a4b4eb44dd72e86557bf3e966b80550700e59854b0270
SSDEEP 24576:K3zB69v5zLmmibkFR8+mZZhQumegvQtCP0KhwvABEbaB6edhOLoeuJ:K3m53mNbkFRJmPhQRhQsP0KCvABljrOa
TLSH
T1313512D7A3B4DC7DCD630BB3925A01F0FDB510360A76110B07AAAD793A567889DCA6C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_elf.dll

Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\chrome_elf.dll
Size 1.3MB
SHA256 b253997ec12d825ff5a560072fc71a4bc381887ff65410f55f7db5ec46d6be43
MD5 cabe102a67c8c3f38264d3a2ce64a4bb
SHA1 f4aac2f0204dfc6c07d0a0ef37ac5ab9f436e93e
SHA512 326afdbe6212cd33643f7973ffc3a87f6f47a6b39f1a22fff746ee9f2de883d0f15edc89b8dbec420604ad26df913aff32aabd5b8c066ced709c49de95404bf2
SSDEEP 24576:4y8ARpeMdd26ugRZiZaIzJbHJKVwpRPzJh:j8qpq6ugRZ2aMUVwp7h
TLSH
T139559D17B2D981A8D06ED17487578236EA72BC520B30B6EF0390B6192E77FE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crash_reporter.cfg

Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\crash_reporter.cfg
Size 378B
SHA256 5b880085b0c173bd752fbe09a6191f9e32eeb9d17f377413c864144917a77728
MD5 abe8c15464dc8e69e053c901356b88c5
SHA1 24a30112eb53a2ba3aaba16a7385682b94a4f078
SHA512 5548c0570515415f7c88ae0bb5020e927c09348d6938aee3a7c36904d145d05b7abe255bcb31095ad3e6ad8b80710fa761a62f73ef90eaf6ec1f15931ac630e4
TLSH
T1E0E0C0FAAA5E71BD9536C3F2C45401483F31D327070B002A71021EA973ACC4407BA63E
MD5 SHA1 SHA512 TLSH

Submit Download

debug.log

Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\debug.log
Size 726B
SHA256 530820d1f8e4e44a641e21b69dd664d3086ae4745a95202ec07c517e7306b661
MD5 82786050027c44155878bdadebd8346b
SHA1 7cccbafb698465a3ce3fa343f23efc606d7df974
SHA512 91f566fba095fb6771746d47358247bc81b8ec9f477d70ddffc70f37fb05e81b9485088b114c72c8236095e71f766234eec9c5a7287bddb4dae7cc4985293b3d
TLSH
T1BC01F771D52B0844AAB8517AA67929F275C5540F7307A83CE3612384E7CC4CE28EBDE8
MD5 SHA1 SHA512 TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\icudtl.dat
Size 10.0MB
SHA256 9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92
MD5 ffd67c1e24cb35dc109a24024b1ba7ec
SHA1 99f545bc396878c7a53e98a79017d9531af7c1f5
SHA512 e1a865e685d2d3bacd0916d4238a79462519d887feb273a251120bb6af2b4481d025f3b21ce9a1a95a49371a0aa3ecf072175ba756974e831dbfde1f0feaeb79
SSDEEP 196608:+SPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2Y6U:++wkpHiXUxY/iJ53IWhlVjEeIZU
TLSH
T160B63807A2FB8DC6F9F76F30E8F452679567BD496E32805911042F3B1D332A08661BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\locales\en-US.pak
Size 467KB
SHA256 ec3bf34eaa69c30da913923aa5e86866934e8cdfc60f14018d9e2a7244b864ae
MD5 796cf132ed80eee3dff08c20554156cf
SHA1 0941cdd68c45d32dc8b6aff229f2fee37299825c
SHA512 207478bffb429362e857abc21cfeff7d40054dbe670ba8a445047b54c93c6dfe0061fe6d44970c82b7eb1df7e6c84b275383b6a69dbedf5777ef901e4aa9e9d8
SSDEEP 6144:x/XYLLwUW2Ctla99OjphA/4m9MP9e2qDWfaYe1Vcg5gdxAng5H/tsQwp:x/XYLMf49OVhY9M9qDvn5AxSQwp
TLSH
T16DA45C1FF744122A069312A27F0956A2FF36D06CA35112567CBD812C33B7B66C37B6E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\resources.pak
Size 8.3MB
SHA256 d4afca779efff4fc775f6b9239a4c3dff2e7a635d0b855d1e7aa18729f9d4015
MD5 3a061ddef8025bed24f4ad5442cc2787
SHA1 558bd610957d10e60842633ff919f49bc02e6463
SHA512 bd05906d0399fe534fa6adc9708be1ccc5838225afad75681b65fbe3d9151ced6c274019bcf327f760498281da4d042384f7f572dfde503f32f109347ff9fe2e
SSDEEP 196608:S8VZ7K0M6jMpVOh5znyG1rlKeVKoTkruSguxT/:rVZ7BMxyHn4oTkrDxD
TLSH
T13F963392B7D0D13FC898933983994E7A160D78261AB5A62B308D722CFF356494FC617F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steamwebhelper.exe

Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
Size 7.3MB
SHA256 0469871a9f1b4a53c2b74d8fc56d1e7d4478994f287256087e4039d7910f3f08
MD5 ad3beff15b5b140be74d7c0dfae80a97
SHA1 973b29075c4254dccb30a50676933115e6f40b57
SHA512 b75adb0cbcdd25139191ecfaeae4f01e484d927e31e4643629fbbebe657de64a4ac96a3e58a71ed760231ea9a798b2d8f971798b02f78d1a14b174e504f3ba91
SSDEEP 196608:0bxTT5rvEAup53pXFOcnTAP6iJrIrQrrrrrrrrHwrrrrrrrrrrrrGrrrrrVrrrrC:0lTT5rvEAC3z/nTAP8
TLSH
T18C768C2AA3B440D9D4B7C17CC646D56BE6B17C4653219BCF12947BAA2F37AE05E3E300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chromehtml.dll

Path C:\Users\Admin\AppData\Local\Temp\bin\chromehtml.dll
Size 1.3MB
SHA256 8fe79a1fdbe89d489bbdae059c8c34dffb20de7f9a5298b56d6fff92d3e9e9c2
MD5 5b34edbc1c45a01656d9b9e59e1fe735
SHA1 d0b958aa4794d1a9e7d714c5e9ef7e53c8753e11
SHA512 8fe0f6c00adda15e7c3e6c6a6cf32b457701bb7a4146979b1cb443f178f9861b2e18633190e096036b3fd09631f67fd6b9d99d6ec424054aba2e86ec9347c9a8
SSDEEP 24576:Pb5CXyaHURRnXnbZ6YHoqAFMTSA4FrK+4ui:CSR2FMmA+rKAi
TLSH
T13B558D21B509C031F8EE5272687CBF7E299C9D290B7940D763C86E5D6A302E36F32756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

filesystem_stdio.dll

Path C:\Users\Admin\AppData\Local\Temp\bin\filesystem_stdio.dll
Size 208KB
SHA256 0a2a961facbd2aab13cb1a1e9779ac148dacde0b4fa89e4f0518c51ed6e64e89
MD5 2b0e32684902895f8782622d8520e72e
SHA1 c0fb5e1019c107a00b1fc97639566e5dff95715d
SHA512 94399214a73907ef225b8be989ceeb2efdc35abd838cdb6227810173df11f1a068c9c496d0c7be9e056e2c95d097787d04383fe97f7692d9aa2293d8d5396251
SSDEEP 3072:nXr9X47iaqZt4WacTg5uvKBcnp1a6n7+y2EuhflK8v5WYAYUn73X/kCLbz67:Xr9wdqZtk55B0p1a6Cv1K8C92
TLSH
T172249E02B881C471D0B71A305938DBB50EBDF6350BE4D9FBA3C8153A9F612D16B36D6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vgui2_s.dll

Path C:\Users\Admin\AppData\Local\Temp\bin\vgui2_s.dll
Size 3.1MB
SHA256 41c26ef770cddb01ac8b96d01d1f116819a995aecf5ec1d82897e67ce56f76e7
MD5 916996cf03c98bea76b540959f0e33d3
SHA1 2d75588180e35b5b08b2a66a4025ea4b8b058ff1
SHA512 ea5a06cea127f3b1c5ff005d391b851ebb85c7df3dc0fdd6aaedac3737d837b9d9dbcbf3f2d111af280f4da15226e0fe81bea454fcdc0201585dc6db0c8d6b5b
SSDEEP 49152:yZuL1+dj7L86DjQjkPnGvNUlGxrpy6XpKRk6bitPAydxMMJAJXdAcO/:yZuZ+dr86DkQPnGz35aydxMdo
TLSH
T16AE5AE02FA42C071E9B301B169BAAB7E493E9F254735C6F397D42E6548311D23B3B792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.vdf

Path C:\Users\Admin\AppData\Local\Temp\config\config.vdf
Size 15KB
SHA256 7fdcec703ab756daf3718ed6d50db9e7d1b5785e77339ec5b4b5aa694ead0407
MD5 1d9c24afcf5da34b00d7553f10000125
SHA1 3a2a4aff1b7b3afe75e0f1700d07b9b4eb8f26f6
SHA512 1720a1730dab12f42f085126a2efcb9c871200fc1fef09ff33b37d8ca773584418e7c5d2a9c15306610af4570d5a5770d58df8e63d881967395fbb0cb3866f96
SSDEEP 96:Pl9IvZD30BSWNQ3OHPGMpN7qZIsIWdUp4P80XMUCYPMUC/njVrr:99KZDiW2pWdUpKY
TLSH
T1BC623F47693C40AF13599E6D12E6A0DE129C427F6A9891F3B7E25B1B7108F1DB1BC338
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.vdf

Path C:\Users\Admin\AppData\Local\Temp\config\config.vdf
Size 1KB
SHA256 f3847b5e4a40d9cf76df35398bb555117dfe3626c00a91f2babdedb619d6ad53
MD5 6e6a2b18264504cc084caa3ad0bfc6ae
SHA1 b177d719bd3c1bc547d5c97937a584b8b7d57196
SHA512 74199ff275400b451642cde0a13b56709735676959d65da11ac76dd645ab11dac5de048ff7ede0cb8adb3a3056b3ecbeb3dc7481bac3768d02051e564c74b679
TLSH
T1FA119E5C6BB7490FCF1E0877C28FB955582FB08D79C354D8BFA448997E10E22106ED15
MD5 SHA1 SHA512 TLSH

Submit Download

config.vdf

Path C:\Users\Admin\AppData\Local\Temp\config\config.vdf
Size 11KB
SHA256 ae3353774aeffc3536bb1c6e41750f97e8fa77f9c8d982221783d3e1440b16f7
MD5 7e1296da2184f757296d407a7148c33d
SHA1 bb5ea6ff737bb059cdc4964232851b119587d625
SHA512 0f6020ffeb4234acf0eef76cef05efea4cd47af77a7a218073080b4052485879825e9efb33ccca07d6515f1d8ab39831e5bbe553e1a4cdfac9db1435c9ec104c
SSDEEP 96:Pl9EITqqAsDEnZfO0bBESdWNdQt3VOvHQPaGXMgpBNNu7+ZHFIwIsIdItIWMUCYY:99lAsDEn04RHy9pK6kY
TLSH
T120426E47693D409F13994E6D16E6A0DE129C427F6A9892F3B7E24B0B7108F19B1BC339
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.vdf

Path C:\Users\Admin\AppData\Local\Temp\config\config.vdf
Size 1KB
SHA256 8f9f970835f133258a7f740126012439385bbaa5a1d6a9d0d967a390977441c3
MD5 a2ec2e91c3ef8c42e22c4887d032b333
SHA1 e2c738a2e9400535b74e2263c7e7d1ecefe575f2
SHA512 b069d241efb19e09ec8b5e60ef6c43e00d5cc0f774b9340127c2180356dd1964ac625c1afdfaee5f99e72b26f56046fc329aadbbc365b403af765a55e9c9aab3
TLSH
T1A121002E2BBB491FCE0E0C7BC18FB9A0543FB15C39C314C4BEA4489E7D20E11506DA14
MD5 SHA1 SHA512 TLSH

Submit Download

config.vdf~RFe58f74c.TMP

Path C:\Users\Admin\AppData\Local\Temp\config\config.vdf~RFe58f74c.TMP
Size 117B
SHA256 a3d8a2cba6e356e02c0f33b50e3a9e61d2f9dfb6a26b5983e30e7786da95dba7
MD5 b46cdf246adb25dd32b81a328e154f53
SHA1 181a1ead2bf44bfafa67339153c4e446863b450f
SHA512 9230a9ca314bc2ab9dfffbf2ff069e7fb7ab9f57f130cb20e44776b7a82060fb0c2f93359b91d7be95f50ddfedc203a58a623cafbb07170c5822dd06f8a549d3
TLSH
T1B0B09243E89CC4AE01680A5DC0A2C4C1214A0677885105E23A9A9618E95E111456D94E
MD5 SHA1 SHA512 TLSH

Submit Download

crashhandler.dll

Path C:\Users\Admin\AppData\Local\Temp\crashhandler.dll
Size 381KB
SHA256 e90218de2e066babb8220e61c787eb75a7c037ab65e7d44d0241264e2952879a
MD5 e663392bd0be254cdbad56ebf5997bee
SHA1 d666a9923d17751ee3dbca5c2b3e2b35e19101d2
SHA512 4649253d0e2d48f3ba5041e3c4c6405cebb1998277f7945f32da8a5b1d3aca86203a036999411ce0eaa4db819853a905269ddc5be9904ec66479c3357ba44e98
SSDEEP 6144:/Q8iO0NcrDFvGevkgH+wutt5kcsmabq/s4ugZKfqy78AOfWZSyDogmu:Ij3NcrRvMtwuttXsmQAyANWZbDo5u
TLSH
T12B849E11F4D2C072D9BE14307878AF6A1A7DB9600F74A5EBE3C8197B5E306C29735B1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashhandler64.dll

Path C:\Users\Admin\AppData\Local\Temp\crashhandler64.dll
Size 484KB
SHA256 209d560ac43ce5dcf984c63d4ea41b64a0f6f4e42c53436a56be72c1f4e4cedf
MD5 c6ad02e9c21f29acb8768f2aa9f84b3b
SHA1 067a9a1a119d936cbe9d661b302066747ad84f8f
SHA512 845c5b63f1b707177b42d0413ebc42c0267a84f7ffdd3af4e6f5d316ce766b7c524171d32829a41e6de0cb4a28bb182705e163ef09cc3c7824af53ba60e3ceb5
SSDEEP 12288:LxvgjajPxLZ/hWeFYSgzTM2TPmkhcr5Nqo/EydWqW:Lx6ajPxF/IeFMnM2TPm5NqvFqW
TLSH
T1ADB48D59B7A400B9E5B78138CA538947D7B2B8150760A7DF03E4D67A2F27BE11A3F321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\dumps\settings.dat
Size 56B
SHA256 f01601408f4302157fba055f12857f73bfcfc9defb0c4f9ee330cb2bf79d0e1c
MD5 1c239d94dcbf093f2bf4c77ecc042cf9
SHA1 956ab2ecc567c88b1e7c5b7d4276e8ebc1c2bfa6
SHA512 e1ae366367e59f712f018fd6bd651a3c083172f83956bc1bff6b9ae81ffdb27be3af014b9a78dcefaa92517d17778d26b38b4627c7e495748220ab61b18bee30
MD5 SHA1 SHA512

Submit Download

libavcodec-62.dll

Path C:\Users\Admin\AppData\Local\Temp\libavcodec-62.dll
Size 5.2MB
SHA256 898b4da48262301d53f03a00fa273c0c7af203dbfc9e8a0c0bea7b944f011cea
MD5 82ed7c6b2d2139629f0dc82cb5717168
SHA1 8cc0027efaa46b3be1929c7038c9810cc07a39e2
SHA512 dfa17cc75bb941bab6873d7fc63c609b1bed789ad2476563b543b986397d5fcb33da199b74d244eefdb01292db22d864fdc75f7ee5dae2cf647ee7268a490a14
SSDEEP 98304:3zGtICFcRCrUstYK6666666666666666666666666666666x666666666666666t:DGtICFcRCrUstYfpBF9csVNyx6DcLteO
TLSH
T16046BF52F362A271D88B4CB196BE6EF7643C1939031886FB96D80DB599319C23736F07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libavfilter-11.dll

Path C:\Users\Admin\AppData\Local\Temp\libavfilter-11.dll
Size 891KB
SHA256 6aab9c1cfd361b1ce246a8bdfd134ef7dbc878601b5d8b9262356eead19f0381
MD5 6c0cbee5e8427975786901030851fd67
SHA1 b05d8eb610c416a85fdc02717b04f5630d28ff0d
SHA512 05d268bbac43aa69000b2213c82796a3aabde267e5f4318441bc33eeaa8bfbd66fff4a5afe86bdb6846d1cbefa3b752b1d1780091a76a183757346f1980cc1ad
SSDEEP 12288:UUh8PW8821MZd60u8TELV/RHrirAkvggfuMo1s9qXpr39PajqCXW9TzhUi:fhyF11c9u8oRrirAIFq5rIkTd
TLSH
T10815BF5178808265DCFA20FA52FCBB364A6DD0B00725A6D716884BFEDB145C2BB3395F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libavformat-62.dll

Path C:\Users\Admin\AppData\Local\Temp\libavformat-62.dll
Size 1.8MB
SHA256 a5a9a2dc31e273f18ee3c48a3fcf82b5999bed3ed241e32991459006578930b8
MD5 fa5d2cfcfa26726dcc6eee68e2ffe34f
SHA1 c95f3cb05a26be01167bb412467ce12c96d86f25
SHA512 6b397b2abf4fabb67f41c98eaeddd9543d482758edc300fa1061d69b4bd4c507a66f05957cf3645f7ee2634ca40b7bb24a40f91f53f6f6819864701a8dc16802
SSDEEP 24576:8VYmjSFEwjpXvwYuGV1OVa+cJmv9QzD/VCUhzH3QnQx2YDDuHjfTn:8V7XwJgKV+nv9IRDpBAYDSDfTn
TLSH
T174859D22FC408012ECE200B752FDAF725E7D9274072861D7668896F9EB649D37B3671B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libavutil-60.dll

Path C:\Users\Admin\AppData\Local\Temp\libavutil-60.dll
Size 1.6MB
SHA256 1dab172ad15ee5c85f496d44692c38e8e0654fe5b9dab70fe4cb552d7a350110
MD5 0aebee84c792ffc627f104d172a9eb94
SHA1 d15a388f5284fd69e3e7e29db7be37890ee9601e
SHA512 2f6908927c0da3b0bb71129987fcb76580d6feba5b90c7edb2abab87d78fa9507d9110ba89b5deed55cdb97bb94c75eaca0f72560fe48f1ca6fc8c01448218aa
SSDEEP 24576:U0UbEqSZLkldc2lI8XVNci3OCwLxErbhkKLi7kYHu9j4bl3:QbuiI2lbXVNci3OhxE3hkbbHeE3
TLSH
T19975CF0178808516ECE611BAA3FDBA370A3C61B4072855D74AD82EFEDA741D2BE73717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libswresample-6.dll

Path C:\Users\Admin\AppData\Local\Temp\libswresample-6.dll
Size 625KB
SHA256 43016c8aee2ae1b588963480b2987a02a9627661660d247a561a598368e0e04d
MD5 500903a4996b747d3a222a5659dd9d3a
SHA1 2740cddaa65c5e26df1205d61eeb00e971cfc18f
SHA512 ce9b7cd2deeeac9fcda1da2a0ae58283c296bfab255557c72e386a573c164f3faec84b9f2d3d9fe199d2410a9d5d6410cc941722af1bfbd29cbba296e1cf7e61
SSDEEP 6144:oyXafwgKUZ5+oDH8E677CotD/VBMuHdX6SO1xNjaluG/ks0UG3wZD:oHwcMoDX6H1F90quG/kR0D
TLSH
T188D49E51B48082A1ECEA20F652FCB737466DE4F00750E9D716C847FBDA206C1AB77B5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libswscale-9.dll

Path C:\Users\Admin\AppData\Local\Temp\libswscale-9.dll
Size 1.2MB
SHA256 91bf65fa6ae1289af0973fbbf76e29e9da30f2c0cd33c34dd52219ae31b7b7c1
MD5 fb66b2c5e5801c64bb0d74bddb68edcd
SHA1 662c52ba0311b6e8aaa315bad995df90dad71629
SHA512 c04cdd87dd1cf54d51cecb7a83e3cb73a974211b818e3f51c94951328461e133ba038fb39ef942486cb2b5f02df3a81a499e2d9dab0243cc491202e05b4d28a3
SSDEEP 12288:wZnvt/ttQkL21kVq0f9nAcJW2edHYgFI0YErjMlJ5M6E6aupAqTTaKsF2V1jZ6o0:wVvt/tqkpawAzQS
TLSH
T1C2559E6074824258DCF401FA93FDFBAA156C5678032499F765CC4AF7DA20AC27B73B1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libusb-1.0.dll

Path C:\Users\Admin\AppData\Local\Temp\libusb-1.0.dll
Size 265KB
SHA256 7a53d45841f73ef046450ade19608cde42905fdd7977e675f514be6f38ea1ae6
MD5 95899bbdf6b8a3aa767053f2f14344b1
SHA1 eca2454e2d95ad6bab429e9be239c0557bc0fb07
SHA512 ca87d1d25462a5239b99e752ab13ecfe1e1a0c35b98dda19bc37b85349eb043e14aade0e365a4f3a735a3b6cd77ecb9b33e056d19ca9caba12f44d7a1bea6b7e
SSDEEP 6144:yGufiExS5fJCSeES5lm3KTWmG/vCGDlVwiD/bEq:DuX2hCsSXWt9Dlmm/bEq
TLSH
T17844BF4BBAC0C8B1E8EE04351A66C776CB7DA6301F55C7CF53905CE95D202C2963AA9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bootstrap_log.txt

Path C:\Users\Admin\AppData\Local\Temp\logs\bootstrap_log.txt
Size 11KB
SHA256 625deec7d3d38d8afe0503e84713135c34d7db6804479e46e03cd182f6e4c5cd
MD5 8790b63820ce7744fd9126607ff30f0f
SHA1 1896441db330c869167f83c9bb9afcbc103f82b1
SHA512 e032643e198395fb28e043edd967ead30e95684fd8b6c37ff385d9b6278e114295fa793c246bc8fcbfe322a42f6abc7986ae8c1a5559a1617c538ba9d31e3162
SSDEEP 192:zmnnRMTEyzQljAVVkFaTcyac/nefU/V4pjb03VzZ5YRH4RFaaLPatrnZRX:CNyzaMVVkFRsEt9IFSX
TLSH
T1E232DE972B69C53F88D20031E6261F5A5E093A135716BDB0BF781848B4A2C789DAF17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steam_client_metrics.bin

Path C:\Users\Admin\AppData\Local\Temp\package\steam_client_metrics.bin
Size 4KB
SHA256 298d9c1fad2466d4d9986b9888c7897e0d13595e62036b06caca5e6cd079bc61
MD5 c21b6977f4e5e93eb676715e49bb0a69
SHA1 ca26827f5176121e3d932d503f9727fae2e24fb0
SHA512 0d15dff50a53157b315799769677ba3d91be0d3c911d1b1ee7f677bfcfbdf3fae35e55ea75a6ea2a9a0e9d93c3765f5ca451de797fe908bfc5901dec8eeae01a
SSDEEP 48:ovvfynBh3JHakYFrSvT1eDEWeo5OivhoFGaoqhvrnbIbgIPF:ov4h3JHaZFG71eYcvvuFuA/MbN
TLSH
T1D791CFE42152C2789BB70F4C4841919EDA35141FC833BE9ED2DECE497A016849FEF86E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steam_client_win32.installed

Path C:\Users\Admin\AppData\Local\Temp\package\steam_client_win32.installed
Size 484KB
SHA256 deebcc2599bb7885be892c0568572df2bb32b577c155e276bfb2b57452c9b7ba
MD5 61ed31a53f61bf3196e03a4313381fbb
SHA1 222f7aec04cd36a3b5f46616a377ed3b31bfd19d
SHA512 e0b3d779fc0e1f2b003e4eb3270b242249895b4288a6017c0590aa2d57f0c35dab37e1635fca80ed38d37959537ae1577097c5cbc15aaca91f311f1303ad259b
SSDEEP 3072:AwDatx1kYuoQnJQybungES3Ce0RbbeJkUZrUV:PDaXuoQnJQybungES3Ce0RbbZUZrUV
TLSH
T1F7B41118AB74777743D76ACAF72BDE2D0D4081E6CB024B8F4309B6E891D6D81BA37854
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steam_client_win32.manifest

Path C:\Users\Admin\AppData\Local\Temp\package\steam_client_win32.manifest
Size 8KB
SHA256 cee78c3245b22e28deb3261a61d8041cbff110c8b3ac210ad74ffdb6aa5c1bc0
MD5 0856f688dd45e8ddcc5e29c944c13caa
SHA1 87fa7f5f12492f1bfe0fdf871a4085815d526b45
SHA512 01be71ffbd72aa727f071b9d903d9f8ac92ed1e037d4d5a49fce73d98a594091d6591efc5ff7cc112a10842c02da11d57075a0c5c3be1e7511cb09a342d5daea
SSDEEP 192:ZDPMpLQ1x8kH4z4tGUUBQZkJMEnIUFPoH4:ipLQH8g40BlwMEnIUFPB
TLSH
T16602A3A33A45B06426958B4B84305ED90FE8B64752BF2DEBCE2ECF1C98F2D4579E7004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

[email protected]_

Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\[email protected]_
Size 15KB
SHA256 983aa3928f15f5154266be7063a75e1fce87238bbe81a910219dea01d5376824
MD5 577b7286c7b05cecde9bea0a0d39740e
SHA1 144d97afe83738177a2dbe43994f14ec11e44b53
SHA512 8cd55264a6e973bb6683c6f376672b74a263b48b087240df8296735fd7ae6274ee688fdb16d7febad14288a866ea47e78b114c357a9b03471b1e72df053ebcb0
SSDEEP 192:JDApAAAAAAAAAAAAGPAAAAAAAAAAAAK5Oq:JDAfIq
TLSH
T1D5623E04FC24B31BD6B9E07EAA974B0B507F4CD9D84330D40C7A5CA8B98DB02A26643F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon_button_news_mouseover.tga_

Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\icon_button_news_mouseover.tga_
Size 20KB
SHA256 4c8894e710464deb81ef9a084f1d5d37803c55cae3959addc437516c0fefeef8
MD5 a8e17619ccb8d9d7244b1617969ca14e
SHA1 1ad665215a2f900369492fb143140c81d00fd779
SHA512 4d73cecdce46b483d273d99ef43d8683979f518660e74b2977e980270f00757b462cb73850860dcf36e938932ff19600fc15c37b87e25eb6a588ee33472d09aa
SSDEEP 48:NL8VWNf7I7777aT77TxjqzGooooooooooooOhs:NJNf7vqzGooooooooooooIs
TLSH
T1DF9283272AF81DFE8995580B5C362B9917066A3D30835FF51087B10FDAA8610BCB47D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

filter_clean_bulgarian.txt.gz_

Path C:\Users\Admin\AppData\Local\Temp\package\tmp\resource\filter_clean_bulgarian.txt.gz_
Size 23B
SHA256 6feb83ca306745d634903cf09274b7baf0ac38e43c6b3fab1a608be344c3ef64
MD5 836dd6b25a8902af48cd52738b675e4b
SHA1 449347c06a872bedf311046bca8d316bfba3830b
SHA512 6ab1e4a7fa9da6d33cee104344ba2ccb3e85cd2d013ba3e4c6790fd7fd482c85f5f76e9ae38c5190cdbbe246a48dae775501f7414bec4f6682a05685994e6b80
MD5 SHA1 SHA512

Submit Download

steambootstrapper_english.txt

Path C:\Users\Admin\AppData\Local\Temp\public\steambootstrapper_english.txt
Size 4KB
SHA256 fbc09c1b9a55d04b57be8fb2ad5ab58b38f76054ecd3d1b70440a2d08191b05b
MD5 27993eb75894ca4894db266ad9b5e61b
SHA1 4def653ee04b0514822b690052598435ec25e686
SHA512 eaebeee5b1a7dfb9bdf661623554793d7ef7e15d9f9cf01f94da1eb0b84b88c8f24176463d15c407ebf670c5b7fd4052daea33ba43e75c1de2979487c4987bab
SSDEEP 96:hSlb0IG997a8ICgARZ2pWHxUBnXPz5dc6LzIIivI/BxkHLs06706XDQH:8lHmbICgAr2oHaJc6LkIiQ/DOLsV7VTc
TLSH
T153A1016E072A71F145B1A26C760E06D3998871BFA3220E5816CEC31C2F5712B73F7364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steamsysinfo.exe

Path C:\Users\Admin\AppData\Local\Temp\steamsysinfo.exe
Size 1.0MB
SHA256 2358ad47cb1996bedb53732e00dad7a0895f79366031b73f065a8cc6605b103f
MD5 9a831b3a0112824a346952d955d5d535
SHA1 d152782a4695b6e4e84976314c2da71f2de6b2bd
SHA512 3a1b409fc0e4eda78784722d6d977298cdec9537033b545ef3f2e41f43d08b62a2c9631fc4a4da258f498041a4ebbaf224f4521942f2eb0f6cc6cd3e927685c0
SSDEEP 24576:Y9WrVS/bHz4T6rrvmgj7j9Dkd9denFcKyotliumjMTH7z2u5:YMrVS/PH6RenFcKyotliuC27z2u5
TLSH
T124358D31B405C032E9A241B37CBCEBAA55ACAD764B7644C7A3C42F2E65705D22F33A57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steamui.dll

Path C:\Users\Admin\AppData\Local\Temp\steamui.dll
Size 13.9MB
SHA256 0cad7c69ace13e802be17beb06df299f7f733f01b4450a74bc68709494b21ddb
MD5 b45b8b108c6db92f8d858d3fe48312b1
SHA1 dac6c47e8bbab682241dbce84cca1e1fd57bdbef
SHA512 beea3f0575a92f2928c667847b1463ad6d8a8350e6020c18aee9be5f2b4ebb4230be3da2046737ebbc7dd693926374e2a1ed92944dcf2806a70e890dc04cf5a6
SSDEEP 196608:LQshvG/mSnB5nm3ex3UF/gBwz076vt2e44axU64M0Kqvy8ly:L7vG/my+Ox3kfz0IaxEM0Kqq8Q
TLSH
T114E68D61B7058621F8E6427B99BF7F7D2E5C9922073882D365843D1E99B12D23F3E342
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tier0_s.dll

Path C:\Users\Admin\AppData\Local\Temp\tier0_s.dll
Size 333KB
SHA256 a55dd102547933009247095a8bab8885f8e76aef12b423721490b4d259ab6a17
MD5 9d52cad923d305445618f17d75b2422a
SHA1 66a55f4978b460f5e89df2c8d75e461556ff5b1a
SHA512 6d3373df736cea950c7493fbf7ee432e859dddf62d9ceef36a9853b10331cbbebe4d448149f5469096e147000ca2ef5ef2897863e6f2707bb124927c789c7131
SSDEEP 6144:ZqwNTFv4hghESrLYOluQV4t2/P9LIRZhPEGm2reZnBcop4goObJj7PzB4f:bhvMmEOTluQV4tSP9LeL/rBop4go471M
TLSH
T1D174AF12F441C033E4F2157588B8DB7A097DA8220BA999FBA3C4497E4E356D35F39A1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

video.dll

Path C:\Users\Admin\AppData\Local\Temp\video.dll
Size 4.1MB
SHA256 70d3e8337b6a10d3341e2377b46e552e5bdccb4c9a24030f3c13094f54170900
MD5 2588ffc2cc6950ecf637bfbdf8bd0555
SHA1 7919279b736df86660dcb4451d6536545e4b5c0c
SHA512 87a572550b89dd91f5100e176a19533d307060629ff7a240b62848159f23c91be0b2a8e38e98543fc1507c1ce85440c0161e22835d3e78a286f6e8e8c07c0f23
SSDEEP 98304:g1vQCMTnN/IhPneWPn36G3b0Nomm5Jtac9:2IrRWCv1mvt9
TLSH
T13016BF12FA42C072E4DE02B664BE9B7E597DAA204338C4D39BD41D69DD301D23B3B796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vstdlib_s.dll

Path C:\Users\Admin\AppData\Local\Temp\vstdlib_s.dll
Size 583KB
SHA256 321d0c5dfd92baf5981dff354f49d582c6da412a41d4b1cccc0aa7b9e34c8f26
MD5 6558f47cd00639dfe9bb3c21d0084f91
SHA1 c325f8fcb41627b62e1c45b17af9fb52001667eb
SHA512 9de0c55062423b040ee3e2aa82b7701e28cb20de359fd830c946a8bd5fba925dd9cecc64e0be1e02e734f2a7ad9b4a59708ffdf8b88554727f8f64bed0dcc4cc
SSDEEP 6144:MfLLpZIT6ktkCaga4jf28OwlIzAYiDmQ0SR321AOShbSc:6pZW6UkCaMjf2W2B2A1Y8c
TLSH
T1D1C4AE03F891C073D9F91531197CEE6A0A2C6D210BB6D9F7ABD839A9EE302C25931757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

platform_english.txt

Path \??\c:\users\admin\appdata\local\temp\resource\platform_english.txt
Size 3KB
SHA256 3e12b8ff2f38fe27d9ca33cef94d1d9333e3a83ab3c3fbbad86b536b8f7cadcd
MD5 0e9d410478df4bd801323036a68e9dcc
SHA1 e0e3b38fdd22d9ce68b0b3f20c1adeec86ab2bf8
SHA512 1d6aa3a3000026f49d70ed932bfec48363c8cfb0416a48457e47e9cb22704b5beb0a2b479cffa85c955917df54b511cf48395e96606e881008aa0069382abeca
TLSH
T1E5817356834A483B059ACB09EC86992BB768D06F03127D1918B8257D74E7D8FF39324B
MD5 SHA1 SHA512 TLSH

Submit Download

steamscheme.res

Path \??\c:\users\admin\appdata\local\temp\resource\steamscheme.res
Size 14KB
SHA256 69dfa517ab922d579dacf49fb80c5cb66958a03c3d8513109a9466e1d1133e0b
MD5 2cf39cb82fad9fb79130cd76394a627d
SHA1 0592b391e4cebae722ecae3957e30dd8161e6ddd
SHA512 0c9d825ebaebd4c1fe949b59edcd914f6ffb70636a6f6e0d295f9f0528b0c51e8dedc43d14e04f31700a5e9619ca0dd18ac62df890156cd88ed58ce840b50edb
SSDEEP 384:GSv1HcdedMcYdIdgdidcdzpdyNYdqd7uqycdDdFd1dZdZnfqu4++uNuRORta2no:7U
TLSH
T10962E097730F01DE67A2965F5436CCC12F8ED074216EA8EAF60E386DDA94B72107A371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steam.styles

Path \??\c:\users\admin\appdata\local\temp\resource\styles\steam.styles
Size 76KB
SHA256 2414ec8b97c2bb0c336d13411dcc63fb4fb2a661eef74594878c24d50173e549
MD5 d627e08303a3736dc2679e9f52f209d4
SHA1 98f2f7f48063653ce8496ac9d66f82e90e62bd19
SHA512 4ec4e9ad6337d269d34f3931ce471d7c11c58ebd97bce497df4d25de08bd492302d9c59221062ea17215fd1c8c63cfb0201a89c8051a2c8b8bf0f3fecc929f8b
SSDEEP 1536:ZZWKpNegMOt3MOZHLMocjfxyT/O0+cVXUSigBBFpuvuUWA4nhoWLe8vUljuGOUf+:ZZWKpNegMOt3MOZHLMhjfxyT/O0+cVXj
TLSH
T194731F08F60A649BA77B965FBA339CC6EF4E803361059ACCBB2D014D1FB4157425CB9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4544-0-0x0000000000400000-0x0000000000992000-memory.dmp

Download

memory/4544-10-0x0000000000E60000-0x0000000000F3C000-memory.dmp

Download

memory/4544-11-0x0000000000400000-0x0000000000992000-memory.dmp

Download

memory/4544-6421-0x0000000000E60000-0x0000000000F3C000-memory.dmp

Download

memory/4544-6425-0x0000000000400000-0x0000000000992000-memory.dmp

Download

memory/7256-6464-0x0000000000D00000-0x0000000000DDC000-memory.dmp

Download

memory/7344-6716-0x00000197A66F0000-0x00000197A6717000-memory.dmp

Download

memory/7344-6717-0x00000197A6720000-0x00000197A675B000-memory.dmp

Download

memory/8104-6535-0x00007FF8EA0A0000-0x00007FF8EA0A1000-memory.dmp

Download

memory/8104-6534-0x00007FF8EB560000-0x00007FF8EB561000-memory.dmp

Download

memory/20948-6816-0x000000006DF30000-0x000000006F350000-memory.dmp

Download

memory/20948-6760-0x000000006DF30000-0x000000006F350000-memory.dmp

Download

memory/20948-6784-0x000000006DF30000-0x000000006F350000-memory.dmp

Download

memory/20948-6694-0x000000006DF30000-0x000000006F350000-memory.dmp

Download

memory/20948-6812-0x000000006DF30000-0x000000006F350000-memory.dmp

Download

memory/20948-6780-0x000000006DF30000-0x000000006F350000-memory.dmp

Download

memory/20948-6821-0x000000006DF30000-0x000000006F350000-memory.dmp

Download

memory/20948-6423-0x0000000000400000-0x0000000000992000-memory.dmp

Download

memory/20948-6695-0x0000000000400000-0x0000000000992000-memory.dmp

Download

memory/20948-6841-0x000000006DF30000-0x000000006F350000-memory.dmp

Download

memory/20948-6693-0x0000000000D50000-0x0000000000E2C000-memory.dmp

Download

memory/20948-6877-0x000000006DF30000-0x000000006F350000-memory.dmp

Download

memory/20948-6881-0x000000006DF30000-0x000000006F350000-memory.dmp

Download