Analysis
- max time kernel
150s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
02/06/2026, 12:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe
Resource
win11-20260513-en
windows11-21h2-x64
22 signatures
150 seconds
General
- Target 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe
- Size 5.6MB
- Sample260602-pkfx5set6k
- SHA256 f0880a83bdb21ed03493cd034926abbdeee6ac67ad9e8afd6e3d3b083836fb59
- MD5 23e3973da4cdd5bfa20a0b10340b1873
- SHA1 f786cfb05ddefe4bb2b28264ba0a555ed4639bc2
- SHA512 0aba300decae7ff80de5863d1ec53814be92eef2b4c610ba77e5118360804d51b19361639749f07226a778bcecb571ef6a088ac1dd6dc3174ee5d38ba2c33346
- SSDEEP 98304:xd+rQnG8zOp7r+fcpKaFdNffTRfWQuZX25ke:b+QnJzOp7rgcpKaFdNffThOZXmr
- TLSH T15256AD56A6A850E8D5B7C178CA568617E7F27C1503719BCF02A0A77A1F33AE12F3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe - Executes dropped EXE 19 IoCs
pid Process 2480 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 1668 icsys.icn.exe 3032 explorer.exe 3216 spoolsv.exe 3932 svchost.exe 2472 spoolsv.exe 25016 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 25216 steamsysinfo.exe 25300 steamwebhelper.exe 25372 steamwebhelper.exe 25580 steamwebhelper.exe 6396 steamwebhelper.exe 800 steamwebhelper.exe 10464 gldriverquery64.exe 8936 steamwebhelper.exe 8432 gldriverquery.exe 6776 vulkandriverquery64.exe 11100 vulkandriverquery.exe 13056 steamwebhelper.exe - Loads dropped DLL 61 IoCs
pid Process 25016 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 25016 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 25016 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 25016 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 25016 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 25016 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 25016 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 25016 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 25016 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 25016 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 25016 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 25016 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 25016 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 25016 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 25016 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 25016 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 25016 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 25216 steamsysinfo.exe 25216 steamsysinfo.exe 25216 steamsysinfo.exe 25300 steamwebhelper.exe 25300 steamwebhelper.exe 25300 steamwebhelper.exe 25372 steamwebhelper.exe 25372 steamwebhelper.exe 25580 steamwebhelper.exe 25580 steamwebhelper.exe 25580 steamwebhelper.exe 25580 steamwebhelper.exe 25580 steamwebhelper.exe 25580 steamwebhelper.exe 25580 steamwebhelper.exe 25580 steamwebhelper.exe 25580 steamwebhelper.exe 6396 steamwebhelper.exe 6396 steamwebhelper.exe 800 steamwebhelper.exe 800 steamwebhelper.exe 25300 steamwebhelper.exe 25300 steamwebhelper.exe 25300 steamwebhelper.exe 25300 steamwebhelper.exe 25300 steamwebhelper.exe 25300 steamwebhelper.exe 25300 steamwebhelper.exe 25300 steamwebhelper.exe 25300 steamwebhelper.exe 25016 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 25300 steamwebhelper.exe 25300 steamwebhelper.exe 25300 steamwebhelper.exe 25016 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 25016 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 25016 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 8936 steamwebhelper.exe 8936 steamwebhelper.exe 8936 steamwebhelper.exe 25300 steamwebhelper.exe 25300 steamwebhelper.exe 13056 steamwebhelper.exe 13056 steamwebhelper.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe - Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\Resources\Themes\icsys.icn.exe 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe File opened for modification \??\c:\windows\resources\themes\explorer.exe icsys.icn.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\SystemTemp steamwebhelper.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies trusted root certificate store through registry 1 TTPs 2 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe - System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icsys.icn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gldriverquery.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vulkandriverquery.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 6396 steamwebhelper.exe - Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe - Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 steamwebhelper.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz steamwebhelper.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS steamwebhelper.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer steamwebhelper.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName steamwebhelper.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry steamwebhelper.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134248770752827713" steamwebhelper.exe - Modifies system certificate store 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4920 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 4920 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 4920 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 4920 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 4920 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 4920 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 4920 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 4920 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 4920 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 4920 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 4920 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 4920 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 4920 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 4920 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 4920 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 4920 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 4920 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 4920 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 4920 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 4920 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 4920 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 4920 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 4920 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 4920 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 4920 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 4920 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 4920 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 4920 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 4920 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 4920 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 4920 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 4920 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 1668 icsys.icn.exe 1668 icsys.icn.exe 1668 icsys.icn.exe 1668 icsys.icn.exe 1668 icsys.icn.exe 1668 icsys.icn.exe 1668 icsys.icn.exe 1668 icsys.icn.exe 1668 icsys.icn.exe 1668 icsys.icn.exe 1668 icsys.icn.exe 1668 icsys.icn.exe 1668 icsys.icn.exe 1668 icsys.icn.exe 1668 icsys.icn.exe 1668 icsys.icn.exe 1668 icsys.icn.exe 1668 icsys.icn.exe 1668 icsys.icn.exe 1668 icsys.icn.exe 1668 icsys.icn.exe 1668 icsys.icn.exe 1668 icsys.icn.exe 1668 icsys.icn.exe 1668 icsys.icn.exe 1668 icsys.icn.exe 1668 icsys.icn.exe 1668 icsys.icn.exe 1668 icsys.icn.exe 1668 icsys.icn.exe 1668 icsys.icn.exe 1668 icsys.icn.exe - Suspicious behavior: GetForegroundWindowSpam 3 IoCs
pid Process 3932 svchost.exe 3032 explorer.exe 25016 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 25300 steamwebhelper.exe Token: SeCreatePagefilePrivilege 25300 steamwebhelper.exe Token: SeShutdownPrivilege 25300 steamwebhelper.exe Token: SeCreatePagefilePrivilege 25300 steamwebhelper.exe Token: SeShutdownPrivilege 25300 steamwebhelper.exe Token: SeCreatePagefilePrivilege 25300 steamwebhelper.exe Token: SeShutdownPrivilege 25300 steamwebhelper.exe Token: SeCreatePagefilePrivilege 25300 steamwebhelper.exe Token: SeShutdownPrivilege 25300 steamwebhelper.exe Token: SeCreatePagefilePrivilege 25300 steamwebhelper.exe Token: SeShutdownPrivilege 25300 steamwebhelper.exe Token: SeCreatePagefilePrivilege 25300 steamwebhelper.exe Token: SeShutdownPrivilege 25300 steamwebhelper.exe Token: SeCreatePagefilePrivilege 25300 steamwebhelper.exe Token: SeShutdownPrivilege 25300 steamwebhelper.exe Token: SeCreatePagefilePrivilege 25300 steamwebhelper.exe Token: SeShutdownPrivilege 25300 steamwebhelper.exe Token: SeCreatePagefilePrivilege 25300 steamwebhelper.exe Token: SeShutdownPrivilege 25300 steamwebhelper.exe Token: SeCreatePagefilePrivilege 25300 steamwebhelper.exe Token: SeShutdownPrivilege 25300 steamwebhelper.exe Token: SeCreatePagefilePrivilege 25300 steamwebhelper.exe Token: SeShutdownPrivilege 25300 steamwebhelper.exe Token: SeCreatePagefilePrivilege 25300 steamwebhelper.exe Token: SeShutdownPrivilege 25300 steamwebhelper.exe Token: SeCreatePagefilePrivilege 25300 steamwebhelper.exe Token: SeShutdownPrivilege 25300 steamwebhelper.exe Token: SeCreatePagefilePrivilege 25300 steamwebhelper.exe Token: SeShutdownPrivilege 25300 steamwebhelper.exe Token: SeCreatePagefilePrivilege 25300 steamwebhelper.exe Token: SeShutdownPrivilege 25300 steamwebhelper.exe Token: SeCreatePagefilePrivilege 25300 steamwebhelper.exe Token: SeShutdownPrivilege 25300 steamwebhelper.exe Token: SeCreatePagefilePrivilege 25300 steamwebhelper.exe Token: SeShutdownPrivilege 25300 steamwebhelper.exe Token: SeCreatePagefilePrivilege 25300 steamwebhelper.exe Token: SeShutdownPrivilege 25300 steamwebhelper.exe Token: SeCreatePagefilePrivilege 25300 steamwebhelper.exe Token: SeShutdownPrivilege 25300 steamwebhelper.exe Token: SeCreatePagefilePrivilege 25300 steamwebhelper.exe Token: SeShutdownPrivilege 25300 steamwebhelper.exe Token: SeCreatePagefilePrivilege 25300 steamwebhelper.exe Token: SeShutdownPrivilege 25300 steamwebhelper.exe Token: SeCreatePagefilePrivilege 25300 steamwebhelper.exe Token: SeShutdownPrivilege 25300 steamwebhelper.exe Token: SeCreatePagefilePrivilege 25300 steamwebhelper.exe Token: SeShutdownPrivilege 25300 steamwebhelper.exe Token: SeCreatePagefilePrivilege 25300 steamwebhelper.exe Token: SeShutdownPrivilege 25300 steamwebhelper.exe Token: SeCreatePagefilePrivilege 25300 steamwebhelper.exe Token: SeShutdownPrivilege 25300 steamwebhelper.exe Token: SeCreatePagefilePrivilege 25300 steamwebhelper.exe Token: SeShutdownPrivilege 25300 steamwebhelper.exe Token: SeCreatePagefilePrivilege 25300 steamwebhelper.exe Token: SeShutdownPrivilege 25300 steamwebhelper.exe Token: SeCreatePagefilePrivilege 25300 steamwebhelper.exe Token: SeShutdownPrivilege 25300 steamwebhelper.exe Token: SeCreatePagefilePrivilege 25300 steamwebhelper.exe Token: SeShutdownPrivilege 25300 steamwebhelper.exe Token: SeCreatePagefilePrivilege 25300 steamwebhelper.exe Token: SeShutdownPrivilege 25300 steamwebhelper.exe Token: SeCreatePagefilePrivilege 25300 steamwebhelper.exe Token: SeShutdownPrivilege 25300 steamwebhelper.exe Token: SeCreatePagefilePrivilege 25300 steamwebhelper.exe - Suspicious use of FindShellTrayWindow 33 IoCs
pid Process 25300 steamwebhelper.exe 25300 steamwebhelper.exe 25300 steamwebhelper.exe 25300 steamwebhelper.exe 25300 steamwebhelper.exe 25300 steamwebhelper.exe 25300 steamwebhelper.exe 25300 steamwebhelper.exe 25300 steamwebhelper.exe 25300 steamwebhelper.exe 25300 steamwebhelper.exe 25300 steamwebhelper.exe 25300 steamwebhelper.exe 25300 steamwebhelper.exe 25300 steamwebhelper.exe 25300 steamwebhelper.exe 25300 steamwebhelper.exe 25300 steamwebhelper.exe 25300 steamwebhelper.exe 25300 steamwebhelper.exe 25300 steamwebhelper.exe 25300 steamwebhelper.exe 25300 steamwebhelper.exe 25300 steamwebhelper.exe 25300 steamwebhelper.exe 25300 steamwebhelper.exe 25300 steamwebhelper.exe 25300 steamwebhelper.exe 25300 steamwebhelper.exe 25300 steamwebhelper.exe 25300 steamwebhelper.exe 25300 steamwebhelper.exe 25300 steamwebhelper.exe - Suspicious use of SendNotifyMessage 6 IoCs
pid Process 25300 steamwebhelper.exe 25300 steamwebhelper.exe 25300 steamwebhelper.exe 25300 steamwebhelper.exe 25300 steamwebhelper.exe 25300 steamwebhelper.exe - Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 4920 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 4920 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 1668 icsys.icn.exe 1668 icsys.icn.exe 3032 explorer.exe 3032 explorer.exe 3216 spoolsv.exe 3216 spoolsv.exe 3932 svchost.exe 3932 svchost.exe 2472 spoolsv.exe 2472 spoolsv.exe 25016 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe - Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 4920 wrote to memory of 2480 4920 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 80 PID 4920 wrote to memory of 1668 4920 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 81 PID 1668 wrote to memory of 3032 1668 icsys.icn.exe 82 PID 3032 wrote to memory of 3216 3032 explorer.exe 83 PID 3216 wrote to memory of 3932 3216 spoolsv.exe 84 PID 3932 wrote to memory of 2472 3932 svchost.exe 85 PID 2480 wrote to memory of 25016 2480 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 88 PID 25016 wrote to memory of 25216 25016 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 89 PID 25016 wrote to memory of 25300 25016 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 91 PID 25300 wrote to memory of 25372 25300 steamwebhelper.exe 92 PID 25300 wrote to memory of 25580 25300 steamwebhelper.exe 93 PID 25300 wrote to memory of 25580 25300 steamwebhelper.exe 93 PID 25300 wrote to memory of 6396 25300 steamwebhelper.exe 94 PID 25300 wrote to memory of 800 25300 steamwebhelper.exe 95 PID 25300 wrote to memory of 800 25300 steamwebhelper.exe 95 PID 25016 wrote to memory of 10464 25016 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 98 PID 25300 wrote to memory of 8936 25300 steamwebhelper.exe 99 PID 25300 wrote to memory of 8936 25300 steamwebhelper.exe 99 PID 25016 wrote to memory of 8432 25016 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 100 PID 25016 wrote to memory of 6776 25016 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 101 PID 25016 wrote to memory of 11100 25016 2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe 103 PID 25300 wrote to memory of 13056 25300 steamwebhelper.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\users\admin\appdata\local\temp\2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exec:\users\admin\appdata\local\temp\2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe2⤵
- Executes dropped EXE
- Modifies trusted root certificate store through registry
- Checks processor information in registry
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\users\admin\appdata\local\temp\2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe"c:\users\admin\appdata\local\temp\2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe "3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:25016 -
C:\Users\Admin\AppData\Local\Temp\steamsysinfo.exeC:\Users\Admin\AppData\Local\Temp\steamsysinfo.exe -steamid 0 -buildid 1780352834 -logdir c:\users\admin\appdata\local\temp\logs -nocrashdialog -query 1 -out-file C:\Users\Admin\AppData\Local\Temp\6632.tmp4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:25216
-
-
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exeC:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe -nocrashdialog "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=25016" "-buildid=1780352834" "-steamid=0" "-logdir=C:\Users\Admin\AppData\Local\Temp\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=c:\users\admin\appdata\local\temp\clientui" "-steampath=c:\users\admin\appdata\local\temp\2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe " "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling "--log-file=C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --disable-quick-menu --disable-component-update "--gaia-url=http://disabled.invalid" "--enable-features=PlatformHEVCDecoderSupport" "--disable-features=WinRetrieveSuggestionsOnlyOnDemand,SpareRendererForSitePerProcess,DcheckIsFatal,BlockPromptsIfIgnoredOften,ValveFFmpegAllowLowDelayHEVC"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:25300 -
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exeC:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler --database=c:\users\admin\appdata\local\temp\dumps "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1780352834 --initial-client-data=0x288,0x28c,0x290,0x284,0x294,0x7ffce674af00,0x7ffce674af0c,0x7ffce674af185⤵
- Executes dropped EXE
- Loads dropped DLL
PID:25372
-
-
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe"C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe" --type=gpu-process --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1780352834 --steamid=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1828,i,2241900256549599960,16552500218551132132,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=1832 --mojo-platform-channel-handle=1824 /prefetch:25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:25580
-
-
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe"C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1780352834 --steamid=0 --field-trial-handle=2124,i,2241900256549599960,16552500218551132132,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2228 --mojo-platform-channel-handle=2224 /prefetch:115⤵
- Executes dropped EXE
- Loads dropped DLL
- System Time Discovery
PID:6396
-
-
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe"C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1780352834 --steamid=0 --field-trial-handle=2152,i,2241900256549599960,16552500218551132132,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2580 --mojo-platform-channel-handle=2132 /prefetch:135⤵
- Executes dropped EXE
- Loads dropped DLL
PID:800
-
-
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe"C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1780352834 --steamid=0 --gaia-url=http://disabled.invalid --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3940,i,2241900256549599960,16552500218551132132,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=3964 --mojo-platform-channel-handle=3960 /prefetch:15⤵
- Executes dropped EXE
- Loads dropped DLL
PID:8936
-
-
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe"C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1780352834 --steamid=0 --field-trial-handle=4936,i,2241900256549599960,16552500218551132132,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4988 --mojo-platform-channel-handle=4972 /prefetch:145⤵
- Executes dropped EXE
- Loads dropped DLL
PID:13056
-
-
-
C:\Users\Admin\AppData\Local\Temp\bin\gldriverquery64.exe.\bin\gldriverquery64.exe4⤵
- Executes dropped EXE
PID:10464
-
-
C:\Users\Admin\AppData\Local\Temp\bin\gldriverquery.exe.\bin\gldriverquery.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:8432
-
-
C:\Users\Admin\AppData\Local\Temp\bin\vulkandriverquery64.exe.\bin\vulkandriverquery64.exe4⤵
- Executes dropped EXE
PID:6776
-
-
C:\Users\Admin\AppData\Local\Temp\bin\vulkandriverquery.exe.\bin\vulkandriverquery.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:11100
-
-
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe3⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE4⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3216 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe5⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3932 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2472
-
-
-
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004D4 0x00000000000004D81⤵PID:6260
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:7980
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
3Subvert Trust Controls
2Install Root Certificate
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Code Cache\js\index-dir\the-real-index
- Size 360B
- SHA256 869e1986c775d67c7bcdaf6600fab86aa688e463a1b18433c67f643e45dc9bb3
- MD5 7bfa44457f011fa5f18f2f3d723a9d49
- SHA1 a757591d6910be47c4faa9eea362d6cf5800c753
- SHA512 f7b9b62dc3b3faf57f0b4364235c400b4b04bf58199061de1f241b2314193cccff150c42a53866ce6f8aa536288066017e1769327c2e4a370a115b5844615654
- TLSH T17DE0EC514CF45ECEE7045179C8EA4A92B47713457E075A66C3500DA469537A14602F03
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Code Cache\js\index-dir\the-real-index
- Size 360B
- SHA256 ebde85e7fc985e15662476fad20d7afcc9055b0be389867105428ad4861b7385
- MD5 25a0ee129eca112e3d4326c411b74176
- SHA1 a062fc95eb34e3689123b2d1a784e02341804d99
- SHA512 1230250655c193cb0d7769253a4c0d307a60d5358baf2944507b74d5da3674191f3fcd00ea740446dcd6669433805d4f4f05e06362fad7f0b40db4d9c3239dcb
- TLSH T1C2E0125145F8BCC2D7050679E9C358E0707112995FD34F5B076B0DF4A473B90DA08D0B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Code Cache\js\index-dir\the-real-index~RFe59de8f.TMP
- Size 48B
- SHA256 5fe29744521ba05ef0a3739f06114990ef29158604a061eed80cb8f41a4282c4
- MD5 b049dcdca4c2fcfaa14f37c83c884440
- SHA1 7530a66f3a0be1909f70fe04e04c97050bbd1c96
- SHA512 6d182d44b14c65a63554132d3cbeb3df2d2b1f5e7bcf78ace895986657e129ec81b2fa01c5b423770f09e93112b2d0866fd4fecd2d46d9804a0ee06714f8c7dd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Extension Rules\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Extension Rules\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_1
- Size 264KB
- SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
- MD5 d0d388f3865d0523e451d6ba0be34cc4
- SHA1 8571c6a52aacc2747c048e3419e5657b74612995
- SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
- SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\Network Persistent State
- Size 111B
- SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
- MD5 285252a2f6327d41eab203dc2f402c67
- SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
- SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
- TLSH T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\Network Persistent State~RFe5a93b6.TMP
- Size 59B
- SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
- MD5 2800881c775077e1c4b6e06bf4676de4
- SHA1 2873631068c8b3b9495638c865915be822442c8b
- SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
- TLSH T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity
- Size 188B
- SHA256 c9bccb1c2ab60489da4c645d23ff21ac2f0b2be67c303747f4593085ec42573c
- MD5 7962c396efa31affd0fb2b55a4a6d112
- SHA1 950de6cb7020e0ac3e48718facbd853178498a1e
- SHA512 aa069a09488482a929b290eeee0e8d34cab3eb85e3905a555989f74b7fce2b1923649f1dcbd431c34c6b1ffada0eb29649de67dca96ff2c5d1cfed1dbd811133
- TLSH T127C012A34169A87E50685A365984BD45BE7BE135028198E89692466DB06117A5503412
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity~RFe5a3431.TMP
- Size 188B
- SHA256 3b082252f3c53007560113c583d1a97ea1de3402570fad130a3cb1e73c432133
- MD5 cb3f5fbf814796c1ac1ec7befc3f4773
- SHA1 04cfe7a88de11a49dec5595c708eda34d9fe96fe
- SHA512 3615dbdd7ec760b352d6663facb1dbbe3d8cfccbf1ffcb2de71b9f520c12358306a73cac598be5e58f2da059d4e8cadfca2433c843b15b45fe43f34d899f99f7
- TLSH T18BC0226200AAA43A2068053A0D84BF00BE3FE034014458ECC14342AC902016A5103903
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences
- Size 7KB
- SHA256 183f5b7647caa05f9f2d0141bfcf8ab1b6c2519b909f9fea9eb08b6cb675de9e
- MD5 2d7b098158e609b619fa23fe530c9df9
- SHA1 8e7014ce5839c15bf08666e6e11a270aa896958c
- SHA512 224992b4fb0ecda16ae3c1d3035096862d5bf84111b3dffd4d80490820a1853e4a936b587e9f1277a6c7f7c4801f13be24a21ef1b9ec27d13d39c5d2f09486fb
- SSDEEP 96:rE+751YBcdVie2Ec76ZFX7/x+hHMSm+tpae2p+m1CXR6Q2MMAy8yIsnIejhAhgtS:rz/CeffXV++wpCp+mkNPM6yIsnDjwgQ
- TLSH T146F1721E6D28AA7F4CC6E729F9357B52D3F9103235903948E7F88A1C24D76DD222750B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences~RFe59c27b.TMP
- Size 7KB
- SHA256 d9fc33ae5cf7f72ab88d1dd885363e2056dcdd27368a8684c99550c0c8e526a8
- MD5 bf879bad558587e70f8bbebe316b3319
- SHA1 b5232b1eeec0d5bc74c55c03218c8e8375623493
- SHA512 26054c914e451fa1f1a27c351a5ce911b6190b24dcd09637c1bd4ebb6a860cce18a0d447b81105245312629f0f85750bacfcd0069729c6584a9d8a80c9b9be7c
- SSDEEP 96:rE+751YBcdcie2Ec76ZFX7/x+hHMSm+tpae2p+m1CXR6Q2MMAy8yIsnIejhAhgtB:rz/1effXV++wpCp+mkNPM6yIsnDjwgf
- TLSH T143E1511EA9286A7F4CC6E729F9367B43D3F9103235903948E7F88A1C24D76DD222751B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
- Size 2KB
- SHA256 4e76077e6043b44018ce1316331d93430a7ed902f3bdd216646caf481e1b2f4a
- MD5 d1a4c6d071eeccaa03cedb3a2385a42d
- SHA1 f09996021a01ed045df1e185fdfb30181a915949
- SHA512 2c6bddbade6ebf5fddc7fbfb074bfb95169792f61e2886dfb16c35ba13a269f7830f831ac449ce82b1a47e280646bc0a5ac984022c22d85ea934a0fdbe63a534
- TLSH T1BA518536E4B8C97786B7D592B5167B038FB95037E650AFA4E1DE0B0D02EF5D8034291B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
- Size 2KB
- SHA256 9501ddbe4214574404705f88a10f65a3dc500ce278960bb3284b02a7e567d920
- MD5 a6c4d7f6feb6395c25a19241c299a6f5
- SHA1 ac9081664c67792a5dd8321947b3689d9a9bd463
- SHA512 ca3264d5261cf29121a6ff538e5cb02d404c06607d4694499e0d5f2bfdb7bf4832c0d1941c730df7d23a919c752b93344eb643dcf8335ae983a0dbad7e9ede2a
- TLSH T162518536E4B8897386B7E592B5167B038FB9503BE6506EA4E1DE0B0D02EF5DC0342917
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
- Size 2KB
- SHA256 14838333fb63957061fb846640ce3ecc5df3cc73bf1752254c67fe5ab48d85e5
- MD5 1fcf1a0276f00465e6966df6cbcb85e9
- SHA1 0b22770282cbed667742281e770f4ae752c138cb
- SHA512 cfee7ee65a09fe65e6160698afb802846a048c8f6d0ff4580af25f1507f97963cb0dd20fdaea66ac63eafccd181f4f5a00fdbee74686be686e1aec5e67b4fe81
- TLSH T1B251A636E4B88D7786B7D492B9267B038FA91037E6106FA4E1DE0B0D01EB5DC0302917
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
- Size 2KB
- SHA256 b97b971d02168e55b760917593c0302afb84e61ca66cbc893e47624fba24e1ed
- MD5 7dbdbe818892451469f2b65acdeb9fac
- SHA1 3915eb190cdf9c624733f33c1451d142588e0506
- SHA512 46b444b9c0308728960214df455066fc5aa57ee7e5c00784e83c2d87a8919dbc0932b022f40ddcccdce2fc730b92da7d9a3f2a59b1b3889fc1f9cd7b50d0e4d7
- TLSH T171518536E4B8897386B7E592B5167B038FB9503BE6506EA4E1DE0B0D02EF5DC0342917
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
- Size 1KB
- SHA256 12af50674901ee76004988f4b945944c0ca651bb9d01776312e133c7500d2db7
- MD5 e5aa7674c32848077ad353773d5300b0
- SHA1 994d9902e88b6103db193639f0c37bc50277e374
- SHA512 2d116fb15c193ff353988131a2c96d5454c43aeaac9a0e3424474725cef30bd49e093f98766a509b34b5824347759c1eeef31d38ec78fe3c03fefdcdc2e7926b
- TLSH T14B116833F4B40A72AAD69E6A375A67130E3540378115CED862CF470606F75C94716D36
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State~RFe596ad6.TMP
- Size 890B
- SHA256 75e2fb28987972d655d5dddc7d6a591cf24b3c24b05f1401ef336d2c77585b36
- MD5 40b6873ebf740d754eeb732c971adb1f
- SHA1 33b7439f5c0b08a11848f49db8d843202ffb9c7b
- SHA512 42ab1bc2b99f625313696244b62c863ecc5bef4c22c7f8cd882bc26b90f70dd7820aa4af2b52761413b3a9801a159fe366059e8cdacf583d28da5c61224af7dc
- TLSH T13C115633E8B40E32ABE55A66375A7B470D250537C2148E9862DF430319FB2898A16C36
- MD5 SHA1 SHA512 TLSH
2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe
- Path C:\Users\Admin\AppData\Local\Temp\2026-06-02_23e3973da4cdd5bfa20a0b10340b1873_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe
- Size 5.5MB
- SHA256 15c11a46cedc02ccb618ff34d52d9dc8dc7f77c18fec1e39ad73865537982ba9
- MD5 a555236f0c3e6e34409a45916cb909c9
- SHA1 aec79f14d52560cb31954fac416680d93cd33778
- SHA512 890d785eb0e4fd8919e627f65ed0b4b63667a80235f10cc2da34d5ca7eac9ae96cb44a41087e23658fe32bb73cdbc0b2680dc0a595d60d639156f8c501181211
- SSDEEP 98304:9d+rQnG8zOp7r+fcpKaFdNffTRfWQuZX25kQ:3+QnJzOp7rgcpKaFdNffThOZXmv
- TLSH T1BE46AE56A6A450E8D5BBC038CA468617E7F27C1513719BDF06A0A77A1F33AE12F3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\SDL3.dll
- Size 2.8MB
- SHA256 2b393d7bda34c4bd13793127c2132a138d0918797a6f87e18439878f7e469f25
- MD5 8ffd3211d3ac26ebbbb7156bba693c3a
- SHA1 dd911d43279535c4798ecfbbdcfd8a8987974772
- SHA512 96f5504240478b44f1d47af3edbf9fdfc2cc382664f76e6f644cc940c7a62be5b533473c50637606bf0e25a6e959c38e8156672d60c22debe6fe14a8dcab642f
- SSDEEP 49152:WyfzwwYUEO4lSJo5FEomwizNf4XCauPLPkJM+mcRCgoU73K/HX/XxJ1rRUlrny6Z:W3lAo5F5mwi7pZgoHX/8Rky
- TLSH T106D5AE8DA3B60199D8738079C257A217E672B4082B915BEF579447B93F33BE1227F720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\SteamUI.dll
- Size 17.9MB
- SHA256 a211ed35fc55df64d5a04c290b5ee07f138b35d72b86559ae074087129a59234
- MD5 c09aa419cdabd1cfcbb07ed6aeacabc4
- SHA1 6a7f70e0cd5e32ba4a02cc5db8cdb5167034eff3
- SHA512 9a6f2cbcc8b5a328cba2b8a272f4b0195624a807b8e0ab2ff3865cc614bc588c11dc752c28b09af54fea58b0e0744c752f7314078a12964bb785f6c9d8770282
- SSDEEP 393216:vOoDjzyTT6OVuSYm4wlZ5zbJx5y68085R:vtDjVSYto4
- TLSH T182177C0B72B80098D5A7D379CA12920BDFB27C62136497CF186547AE9F736E17A7E310
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\chrome_elf.dll
- Size 1.3MB
- SHA256 e8327f69a8144d924e86ae3e3bc0ba731663c4139a98d9c0133281895110bf57
- MD5 d001b46659172b64860218810b529a92
- SHA1 9763fa62cba865804197d5f63a106420d2692f42
- SHA512 930b54686c4b0f069c6e44000f79c0953f6a92aea8ac9f403f503ae0ee639a28a6e22a9884b9c8d291c3610fe9e18ed5d80dbbe3ea5e8a1571dbc34c51666e73
- SSDEEP 24576:7y8ARpeMdd26ugRZiZaIzJbHJKVwpRPCju:O8qpq6ugRZ2aMUVwpUu
- TLSH T109559D17B2D981A8D06ED17487578236EA72BC520B30B6EF0390B6192E77FE46B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\crash_reporter.cfg
- Size 378B
- SHA256 6ca87a4c98bb6afb8d2a153e734bd18b997fe40c673ae921013f2bf021f0bc3b
- MD5 0caf29e0d155c09aa24bf4a88103a4f6
- SHA1 f6104996cdf6b55c3d01fa2cb725d4705e3d6a6f
- SHA512 ad0f63ed625ce6b1f3d6b36bdbfe378e63ab969ead6127bbb985da2f839c1070982ab472b47d3c5153f8ecaccfbfb224b9e654a93ed7b0853c1c0568a1b684f3
- TLSH T126E068BAAA5E7179912683F2845442983E319227070B002A71025E99739CC0407BA53E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\bin\chromehtml.dll
- Size 1.6MB
- SHA256 e33456cf10c56aabba372cb0abbf0bc55c82675fac425d126332ed779837c7d6
- MD5 f3c8afd49763c61343864eec83a2ca70
- SHA1 f4f8ee76405925ca0fc297145a951f5dc137cb73
- SHA512 9c03ec76cffa226f1552f012d2400e2c270ba0ac9307a9ffcc760f72e201972dcf2c0debf1808f4b7c61c6475f9a9c108ef0751408c4177a72fd060a598ca9dc
- SSDEEP 49152:bhqK0zjaLV9rkM4pS0yrdgGmb7n5FRFzqupBbkga77:1SlPn5FRO
- TLSH T176758D0BB5A84059D07BD27C9607690BEBB178020F61DBCF06A50BAE6F677E14E7E350
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\bin\filesystem_stdio.dll
- Size 258KB
- SHA256 ee3f4e1d643f4992d6865042cc8e9ad1c5905692acc429982ad2e79d9d00e5fb
- MD5 dff5b0466d493152e0b66c4ae1729364
- SHA1 de87e42ea9f478a4f4a330100fdcf74e8912209f
- SHA512 4b9b038536113c546164f08938a950dae22f21aa04cf535fc4ccf4598437a41c0cf50c40b0aada1b2b5f441dc780726314f125a0733676d59873cca017c7959c
- SSDEEP 3072:kFYdHZmv7TQ0rnuQkUiO81AeKfrtXEa3TdMCxeW+psfvTlt91cMpWwBBuAobXH/E:kFa90fb81AeKfR0YpjWSlH1t9J1Rm6
- TLSH T118449D5977A81CB9E5F3C639CA51C64FD6B278120760D7FF07A0462A2F236D0563EB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\bin\vgui2_s.dll
- Size 4.0MB
- SHA256 8738a64abb39064f0c05f8123a8e4ac6b025f7c4f46df842ed2ba460c2996188
- MD5 3eec4919ffda0ec78b7558a1072b7a85
- SHA1 77ee77aebb70696e15bc1bb9abe4f65cb8f6e76c
- SHA512 d592c1fe9eb9b3b91c1b44bd8925de54ef78f54834327b574dc3951110bb1c00cb7bf7d3ccad71c7c8830617ef6715f05b69ec69fcc04ac4214d29d4cc28a664
- SSDEEP 98304:Jp+egh3GyN2MgdmCKHwW3zTzluJJZzHbW:Hzgh3GA2MgdmCKQW3zTzlufZD6
- TLSH T1A9169E56A6B400F8D8B7C179C956852FEBF2781513B08BFB02A096791F33BE1663E750
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\config\config.vdf
- Size 11KB
- SHA256 99e5b882519cdd6a61b02e0115937719c2d206b44b16dacd27d4fd229b49b2aa
- MD5 ecd94bcfe066f4c84f45f2fd38705583
- SHA1 8de727a4ca2004fde6c3b10e71cc4c0a0175ff45
- SHA512 d66ea5280f31ff4e3a28daa315ebe7293b58c47b6e216b9d7c035dd1af75166cb88aa132221c282e899e55fb8c15eb01f937314c78fbf55339041e074e08e8f4
- SSDEEP 96:Pl9qcwgDDmhAnYBdu8/KcQroXEqWNbBQzGfOVditlSHNP0dcvOgOH7IJISILMUCT:993nYBdu8/KdVHMG7JY
- TLSH T1FE426B47693D409F03984E6D16E6E0DE129C427F6A9892F3B7E25B0B7108F19B1BC339
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\config\config.vdf
- Size 12KB
- SHA256 f5e872e6e19731155bf299b309368ad1053e4c80fb938853160475219a23b067
- MD5 f03e0834da82a5e8fef6eac07cfddf12
- SHA1 ec10d29e02c04683c2aeef0d960e9bf85f930420
- SHA512 0783fbe413eee4cb3a03debce2cb8f379c0f3c8ec8bd4d78e5c7e3d6fbb060b18716e6067569f6a0b4a841f6e1032935c2fb9122d0b0c38360e71a8c40aa9090
- SSDEEP 96:Pl96fGFFSqUVoEWNBzfVilHPdvgQqIR86WsUuXrQOqc30amtbWMNXrpBNZtIHI0C:99w6FSPawz+zuX+n6omY
- TLSH T13C427F476D3D509F03984EAD15E6A0DE129C427F6A9892F3B7E25B0B7108F19B1BC339
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\config\config.vdf
- Size 965B
- SHA256 66f3f49300a602ec120df558f6166fb2f52b72eae13e06e6b471315b35716745
- MD5 2c0545b265309c79b2110cb6ba1c5564
- SHA1 12b7e653f8a32c540f920405a134c50c7d09b1da
- SHA512 bbb305cc7dbf379aac5d24c7ff1a15629f9dd3b4784adffacf41709c19f0c65c37a505802556bc188a8bcc15c8a99dba83dc3a992409eb46674c5a50fbe83822
- TLSH T1B6115C2C6BB7490FCF1F48B7C18FFA51543BB09D79C35498BFA44899BE20E6260A8915
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\config\config.vdf
- Size 1KB
- SHA256 f3847b5e4a40d9cf76df35398bb555117dfe3626c00a91f2babdedb619d6ad53
- MD5 6e6a2b18264504cc084caa3ad0bfc6ae
- SHA1 b177d719bd3c1bc547d5c97937a584b8b7d57196
- SHA512 74199ff275400b451642cde0a13b56709735676959d65da11ac76dd645ab11dac5de048ff7ede0cb8adb3a3056b3ecbeb3dc7481bac3768d02051e564c74b679
- TLSH T1FA119E5C6BB7490FCF1E0877C28FB955582FB08D79C354D8BFA448997E10E22106ED15
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\config\config.vdf
- Size 1KB
- SHA256 8f9f970835f133258a7f740126012439385bbaa5a1d6a9d0d967a390977441c3
- MD5 a2ec2e91c3ef8c42e22c4887d032b333
- SHA1 e2c738a2e9400535b74e2263c7e7d1ecefe575f2
- SHA512 b069d241efb19e09ec8b5e60ef6c43e00d5cc0f774b9340127c2180356dd1964ac625c1afdfaee5f99e72b26f56046fc329aadbbc365b403af765a55e9c9aab3
- TLSH T1A121002E2BBB491FCE0E0C7BC18FB9A0543FB15C39C314C4BEA4489E7D20E11506DA14
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\config\config.vdf~RFe597fe4.TMP
- Size 117B
- SHA256 a3d8a2cba6e356e02c0f33b50e3a9e61d2f9dfb6a26b5983e30e7786da95dba7
- MD5 b46cdf246adb25dd32b81a328e154f53
- SHA1 181a1ead2bf44bfafa67339153c4e446863b450f
- SHA512 9230a9ca314bc2ab9dfffbf2ff069e7fb7ab9f57f130cb20e44776b7a82060fb0c2f93359b91d7be95f50ddfedc203a58a623cafbb07170c5822dd06f8a549d3
- TLSH T1B0B09243E89CC4AE01680A5DC0A2C4C1214A0677885105E23A9A9618E95E111456D94E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\crashhandler64.dll
- Size 485KB
- SHA256 72552638b56451b172e6b0f96f952d7ae1ee0262aa8293c3cbe56ff7b0481b91
- MD5 73f374d6d4494312acc51eb2d44b7ace
- SHA1 35339aa81a8bf79b7b93dc0a166cfc2274eba450
- SHA512 956c97b11bb8107d19df532985cbea14acf42f196857c6408aa6260ea963aee5c49931cc47d76e06356db670852c7ca3978af3f8462ccdeb61ec3773ebd78122
- SSDEEP 12288:PaUodcD+bVKInyXHSlIfPNQnr57WLaQDm:PmcD+b8iOHSlI857cF6
- TLSH T176B48D69B7A440B9E5778538CA938A07D7B2B8560760A7CF03D0DAB61F27BE0573E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\libavcodec-62.dll
- Size 7.1MB
- SHA256 861d200b4a35bad9a2eaac069c8fd9711d2296e36287308f927c247c86135bcd
- MD5 14cc0194f70845dc4f410e2120cf83a7
- SHA1 579b8f04346334021df80126f6eceb5bf0eae30f
- SHA512 748bdb86b40b6b334203e88f90710fbba717b7c5f6a717661041be980936e260a07df1d72bdf290c81c0047762cb7f3a9e4dd34edb619e122575ed0c60912ed6
- SSDEEP 49152:L05rexkQJ13WzkZb6W8Vt4wYVrKHaRAXNlkVpai+TYEDyellDQdT6CrLHCQ5OHnB:LHN+u1EWsLt2U++legnh
- TLSH T1F576AF9AF3A222F8D53BC478856E994BF668341E432057FB1AE485642F33BD0573EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\libavfilter-11.dll
- Size 1.1MB
- SHA256 84567243e4d7e7295b4ac16d2cd3936357a0f6ea3d43e04ac5b0c1be04a9ede4
- MD5 9e5d82420636709c4a4c2f679137939f
- SHA1 2b01b1bab13810a26ac91e9eaae62a4347926fea
- SHA512 45e1f5f96745d6a5b700951db5d1d4ad9292a59c36b5aa0bb1a3fc791e1c05fd94da16bf3e97a8b58a276286e7de1b8863f3539bc44c4adce9e47e8ca99b822a
- SSDEEP 12288:U73lIOMR5GNvPLL+EkfjfJd+7pJtposebr5g5JiRvDdT2vgR1:k3lIOMR5GdLL+Ek9dyJjoJg5wRpT2W1
- TLSH T11A35C06677E91396D0BBD03DC5978B5AFAB174100330ABCB02A496A92F13FE45A3F711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\libavformat-62.dll
- Size 2.2MB
- SHA256 066926450a6cf4993d283e845074f8a3d137e00f813e5f2ff15214c0d8baa3d9
- MD5 7544a23a54a5f8603f849d57f1bcaabc
- SHA1 df42d8b11d238f8cdcad82f605468f77695f1f9d
- SHA512 2702348594cba4d64929f626425c9a371de932344e425bddda62bc35d494c63ac91faf1d63e6620a44740c921cac4f17d6979e61072a9868c97ebbe1111f421c
- SSDEEP 24576:dL7Oo6WAozsD/0pRzXFHMjZpl+rTCAMNm4aCaeN/uC4kF5GsnThUnIlNy:dL7g/D/0pxXFHkpcrH4shQ5nnTq
- TLSH T148B59D5673B81199D6BBC23D86874B57EBB1B4040720ABEF059486B92F23FE51A3F311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\libavutil-60.dll
- Size 2.2MB
- SHA256 e6098cadf383c0c4d9cb3b5f82708528fa1cca35f4d8658cef166831bb83afe9
- MD5 975b0fbd6840b19132701f4de62dfab9
- SHA1 6295c6296045fbdc3bd31fae771b3b4342301eba
- SHA512 b2f1ba1636631fb3d63001f1c7b3a34e0896df7aa1caf653810b4422751a40150ff596ec6fa5bfb3426361020fe448afda8364da0abefc53a8325385cbbac5ca
- SSDEEP 24576:UdvrRZTsyVYeKEFowMksIrHs5ftFR9TzB259xrgUGu4weobaZAeg:UJlZTzxtowMYH0V9WxrgUG3Z2
- TLSH T14FB59E1567E00196D477813DD69B5B8AE27234028760B7EF12E14AA82F23FE51D7FB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\libswresample-6.dll
- Size 801KB
- SHA256 e6aac1d5b0f7eec17646b47abf60388ec3c64e486259f7e6e62b921e7cb20657
- MD5 18e4072a37f701a89e08da89dd0c6504
- SHA1 ac3814fabce374c890f3e97fbe078e609d89c0b9
- SHA512 74f237eea24af9bedb5b60e34f30109d06805ddacb158a3dcb23d02b45a31aa8aca501721cb08e1352f1f7599abd83f7654bca1df712e58ebeb9936ed564a855
- SSDEEP 12288:dHJ+lsGFYLycMVJMddDwrBNaf4CzdJpGAEuHvT:2lp2LycMVJWc9VCzdZL
- TLSH T1CB05AE567BE502D5D1B7D13DC6968B96EAB1F8240320ABCB01D482AD2F13FE45A3F712
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\libswscale-9.dll
- Size 1.7MB
- SHA256 15202c54c1344d0990667adeb42d1335d669f7d09f4419dcb14a039f16df1ebb
- MD5 480bf45ae180640b2292919132a99ad6
- SHA1 eee2809ce5a5da9879f7133a9177a6da612e1808
- SHA512 be06a2066594b9e8e16057f1c516af5a38f69c6ccddf1b9c6d8680ffd1659e473903602694a5a3f427dc590ff3870ef3f8f5de3deca4eba8c9ac8acdef21a1c8
- SSDEEP 24576:okyO7fzjdqGjytQRKrD0YPU9MgnmVR20ClxXevfTWKiYPWNaGVHWgJO49OOZnSh1:o/O7fzjdqG1nIiKiYPWNaGVHnZnSys
- TLSH T1F0859E93E36621D9D5B7803DC1E6879BBA60742503206FFF668586767E13BD06A3F302
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\logs\service_log.txt
- Size 685B
- SHA256 cda0fcc715e2730670bdaaa8afe6db5468501140efee18a6af87dbb6571b6a9b
- MD5 ba49e0be6365cadb52e6a2bd5c8e50d3
- SHA1 de864a820231bb5fc7bbb25db8ca5b90cbe8a7eb
- SHA512 12c7c84f5b4b3f7d46ee1f6e3110ef948117d8c410a94ac8de7713150bcb80dfa2a5b1a5d47a372d02acd99c649ffa3e61fe861a67eaeb5ceec8c92d3520d914
- TLSH T1E401FF339C8821FB51277584DD470D625E148B0E6375D41C35F0186F89E866D1FDB347
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\logs\service_log.txt
- Size 1KB
- SHA256 318b80d4171416abd9e2150227e904080b338538c5dafde9e499d13e38f53e3e
- MD5 a83623334cd8e467666caa4f3bf263d1
- SHA1 b7db01d958d3c87b406c61cee4a63e516a057335
- SHA512 1baa24eeeaf7f8593d42557c7c5e0f106d8ac668d3fbd05801df0be60ff9692647260e41cbe71ed8267c698781acb9a5af825e842feed0a17e29e8ffafcfd9e7
- TLSH T1A0110A739C8822FB91277585DD470D629F108B0E6375D42C35E0286F88E86AE2FDB347
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\[email protected]_
- Size 15KB
- SHA256 983aa3928f15f5154266be7063a75e1fce87238bbe81a910219dea01d5376824
- MD5 577b7286c7b05cecde9bea0a0d39740e
- SHA1 144d97afe83738177a2dbe43994f14ec11e44b53
- SHA512 8cd55264a6e973bb6683c6f376672b74a263b48b087240df8296735fd7ae6274ee688fdb16d7febad14288a866ea47e78b114c357a9b03471b1e72df053ebcb0
- SSDEEP 192:JDApAAAAAAAAAAAAGPAAAAAAAAAAAAK5Oq:JDAfIq
- TLSH T1D5623E04FC24B31BD6B9E07EAA974B0B507F4CD9D84330D40C7A5CA8B98DB02A26643F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\icon_button_news_mousedown.tga_
- Size 20KB
- SHA256 cab3a68b64d8bf22c44080f12d7eab5b281102a8761f804224074ab1f6130fe2
- MD5 00bf35778a90f9dfa68ce0d1a032d9b5
- SHA1 de6a3d102de9a186e1585be14b49390dcb9605d6
- SHA512 342c9732ef4185dee691c9c8657a56f577f9c90fc43a4330bdc173536750cee1c40af4adac4f47ac5aca6b80ab347ebe2d31d38ea540245b38ab72ee8718a041
- SSDEEP 48:X77qTxcazfhjZRRRRRRRRRRRRRRRRRRRKFvJJJhmAr:X774zmvJJJhmu
- TLSH T18F9209380E706CCE81CE9A27AB348AD2A9D2DC6F36632E348653350FC1948543EA734D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\package\tmp\resource\filter_clean_bulgarian.txt.gz_
- Size 23B
- SHA256 6feb83ca306745d634903cf09274b7baf0ac38e43c6b3fab1a608be344c3ef64
- MD5 836dd6b25a8902af48cd52738b675e4b
- SHA1 449347c06a872bedf311046bca8d316bfba3830b
- SHA512 6ab1e4a7fa9da6d33cee104344ba2ccb3e85cd2d013ba3e4c6790fd7fd482c85f5f76e9ae38c5190cdbbe246a48dae775501f7414bec4f6682a05685994e6b80
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\public\steambootstrapper_english.txt
- Size 4KB
- SHA256 fbc09c1b9a55d04b57be8fb2ad5ab58b38f76054ecd3d1b70440a2d08191b05b
- MD5 27993eb75894ca4894db266ad9b5e61b
- SHA1 4def653ee04b0514822b690052598435ec25e686
- SHA512 eaebeee5b1a7dfb9bdf661623554793d7ef7e15d9f9cf01f94da1eb0b84b88c8f24176463d15c407ebf670c5b7fd4052daea33ba43e75c1de2979487c4987bab
- SSDEEP 96:hSlb0IG997a8ICgARZ2pWHxUBnXPz5dc6LzIIivI/BxkHLs06706XDQH:8lHmbICgAr2oHaJc6LkIiQ/DOLsV7VTc
- TLSH T153A1016E072A71F145B1A26C760E06D3998871BFA3220E5816CEC31C2F5712B73F7364
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\steamsysinfo.exe
- Size 1.2MB
- SHA256 7d6767ab53cbd1d1066e68acfe4e7a70b9d34bf4920e22d5b5a7c262c841e5f9
- MD5 fa5bb33b0bddbcb83d1d74a92329af9a
- SHA1 d2cef9882c74b4ff595b2e4f08185574ea3980af
- SHA512 76f5c872270849d312b2b30f5d93e71535a164953cdf3f9c06d94fded569227f4d49a8dd73127a6951f8841fef70f43f3c1b51b7eec5259387593b1b8ac8f4f7
- SSDEEP 24576:9g8XvYJ4850Q4NlC+lZvCv/QpUqK0vYNlCPzs+lqQmzY/nx:9g8XvC4K0Q4NlflZvCAW+YNlCPzsTz4x
- TLSH T16F558D16A1A842FDD1BBD0B8D606594BEBB1780203B08BDB06D80B5A2F777E15F7E750
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tier0_s64.dll
- Size 431KB
- SHA256 db6da09a32157c2d1b185659c13ceaaf3f2c44cc373cd5b66dc69d654c4e2b9b
- MD5 fa89eb82108cbb564ca6db95d60ee8ee
- SHA1 96287c3ccec8b628556ce620b9801cb80c9e3b04
- SHA512 952c43e6141e562a87f66d8b36b3f6d76f4bddda69bc83ec1ae3f1ed5ae14386e9ab5f3011f31af86ef4590ca7eab74d31ac61936e9bce6982bb40e40ed35eb9
- SSDEEP 6144:bk0aBPp2yeoDSPsSmugNBYsIm+V4GYxHe5w1gNcqzpk+4gXuPeNU1per:0Bx2yeoDCi96VfY5+NcqO+4g+PX6r
- TLSH T1ED949E6AF3A800F9E477D179CED2460BD6B278160771D6FB03A496662F236E11B3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\video64.dll
- Size 5.1MB
- SHA256 cfafafbc48d719c789bb4a557101ddada424ee1995e0aa79d701612b1d49ac4c
- MD5 3ab4936b95c688a219fe0037a0191a67
- SHA1 84fd488494a97bf4c0173f9ac6db44a570ea6ce1
- SHA512 a2050bd3040c6b869e38019b55ed0ba049a9e52e18a23040486d03b89735fb763d9ac329fffb4825314a21adad69555f0509ffcd26585aabe2d0d3630b29b658
- SSDEEP 98304:EZ2z+S35gTfIEpUaRvehaiQxfU2O7N9slDmO:3NmTlpUaRvehXQxfUP7LsBJ
- TLSH T14C368D16B2A440A9D4B7D178CA478627E7B2B8151371DBDF02A0877A1F27BE12F3E750
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\vstdlib_s64.dll
- Size 471KB
- SHA256 a8f4a7e68833dee37732963c5f88b0ed7afdb7ba21014f780528888526719a01
- MD5 4b0966570805b6fcf34b831d29ae8848
- SHA1 5ba2f61a2254d815522c9cbce7be914dea8528df
- SHA512 a5aae9c19ebedd81d0ec528c619a289b2f86304e0ad773fc72170c49224cf42e3f855e213d3fad9bff42eda7f4ced53c91abcf1b7b1fa4e090fbae238dd2e984
- SSDEEP 12288:xbORyYOrBX/bBX/OZX/J6PoxkzTaAV+RkjyDpnr:ospzTamMr
- TLSH T16DA48CAAA26440E8E433813CC856860EE6F53E1957609BFB4694F776BE376F0123F351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Resources\Themes\explorer.exe
- Size 135KB
- SHA256 adc68c74b79fb5bbd1c5fe14562a229fc4bef5dab2998be99e37c75e30756590
- MD5 6c8002a0e6115d815eb69120931b909f
- SHA1 0d2ac0080269bfd8f698f75e42e3ebcf4c7eea19
- SHA512 5a4243088b7a462b1529a2cd526ab021d9ace29975127402c105c58f147e14bac0bd5836e0571b8af314e3271c4cbaa116c634e35f7a21d74fb604c29bbe9da2
- SSDEEP 1536:XfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbgtTDT//////////G:XVqoCl/YgjxEufVU0TbTyDDal2D6
- TLSH T181D30B237E10502ED822CAF26865D66EFA211F761BD1AD1B73A5FB112A7620775F030F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Resources\Themes\icsys.icn.exe
- Size 135KB
- SHA256 c63bfea0c139c8b98aa4534ade90a51c751f3c95b61ce668c4ebe9437c035dbd
- MD5 fe561f2176b624a5a4a8eee7dee8f8a9
- SHA1 a414349f6e822a4d8877681d4b56d38866d3c756
- SHA512 844eff85db8117525ebf31f00907481b94da83c4e05a7cebb99284d8ecefed8aa6aa70b38a3c07fff3bf6837afed9a94997a08c385204b801131d9d8d15509d8
- SSDEEP 1536:XfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbgtTDZ:XVqoCl/YgjxEufVU0TbTyDDal2DZ
- TLSH T14DD3EA237E54602EE421CEF06CA9DF6EBD211E391BA17D0B7266B7042672513B2F125F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Resources\spoolsv.exe
- Size 135KB
- SHA256 68053bd753e357d2ce5d999626282070f17f9353be489263209ce9587d785975
- MD5 28fd159edc17fc3a1b5c439789001b97
- SHA1 a44e391c14114ea9f2b86d6ac8afa0a46a0a00bc
- SHA512 72cfc799041aed41c5228b5ca3cd8111511bab218fa6c24d332f9c21d943176b4bf4f59d03eef434b85ca3e1763f0b8eb9384084cd21df22ed730366a88c1dd8
- SSDEEP 1536:XfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbgtTDy:XVqoCl/YgjxEufVU0TbTyDDal2Dy
- TLSH T1ECD3F8277E50502FC96184F02CB5D66EF9226E3B0FA4AE1737D6BB442675247B2F120B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Resources\svchost.exe
- Size 135KB
- SHA256 a0069ec904894b99a21dcefac00e2277e66592b298bec47af120985c3af318ff
- MD5 bbab46d78defa6a185c3c8b1774741c5
- SHA1 56e5a507c0edaa68196b8f843aade47038d7c045
- SHA512 4a75dc38b1e068ac50fec12b20bf56722a48565c5f6aa1a490f30f008a462f30e2e39a36bb1ca3e072d9731a113058fc9b1f5e852a44bb0cb95946b026e21ea3
- SSDEEP 1536:XfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbgtTD9:XVqoCl/YgjxEufVU0TbTyDDal2D9
- TLSH T128D3E8236E54546FD812C9F12CEADA2EB9121E260BF1BE473696BB0029F5503B5F131F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\users\admin\appdata\local\temp\bin\cef\cef.win64\steamwebhelper.exe
- Size 7.4MB
- SHA256 9b624476e11701b0eeb5a05c6a323d7d34157fc55f40810d1928326a212e24ba
- MD5 c541fc258022ddf0dccd5ba9df3b776a
- SHA1 21f78488b91fe7ec6ef564a1d98a74d5600f469f
- SHA512 c5de69ca656e4f7485cfe790a48627621a004be9c82276cb8216dde040ceb8c1c0d9dffaa6454f1973ecc108d891059439ce14765dab69b5b883aa45166adedf
- SSDEEP 196608:Ofxos8DLOyo+nrEv71mMzJrIrQrrrrrrrrHwrrrrrrrrrrrrGrrrrrVrrrrr3d+g:Ofxos8DLOynnrEv71bH
- TLSH T1B0768C26A3B440E8D4B7C17CC646D56BEAB17C52533197CB22947BA96F37AE05E3E300
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\users\admin\appdata\local\temp\logs\bootstrap_log.txt
- Size 12KB
- SHA256 f41cbf14443c56f4a0b0fff21e7ed7495286ab4bfd9d475357cf7eb1b59dbcfe
- MD5 a5032ea5c68ab828afb096accd0089f9
- SHA1 922e48ddb532b4d37a9ce04f26124149adaa3c88
- SHA512 7be938e8ea71a304fb2eb9350f391ee2995781f85127c1d2b7aa156349d7446756ce2190d4dd6f4c062ae9453d7116395480860e89fd983296869a5ed6418a7c
- SSDEEP 192:I8nRuyO9wB3bmV6am/5I5bkrmh91cL+jfLfdSpXM7n7:JUwB3CFmyvrd1
- TLSH T12052907F17B4E1BA68560149C42D1D5EA819303A1B279C8EF76835C8F09283CAEFB55B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\users\admin\appdata\local\temp\package\steam_client_metrics.bin
- Size 3KB
- SHA256 3771026309ae7c3426724610106a72577b8c13041206042a276009e58de22902
- MD5 344c80933fcbb65ddc5104725430ed91
- SHA1 0b14a2426c9f413ad447c3889bdef9e91b39ed7f
- SHA512 3edc531d8e885a7247452fb91c10d5cba4b265fdc89d4b701ad23de19a28cd3a103b9d7af0aaf1cfc60b3e8c6665c8def3df12fe3ab51deb055fcb9b352442c3
- TLSH T1DF716CE42152D2789BE74F4C4841C19EDA35105BD833BE99D6DECA4936026C09FEE46E
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\users\admin\appdata\local\temp\package\steam_client_win64.installed
- Size 496KB
- SHA256 ea9f8e46a55fb5a0786612a69b9cbe82f729ff3dc7a1eb5b5a81625990291b46
- MD5 27cb48a6924081acf37085bd73ad323a
- SHA1 7fdbe41c5945d940d12498e833f38993a541a8a9
- SHA512 810d914a3f08aa5743eb0b93abba006edb6ece036000661201e14a9107940c82ffa899e44be76bd42fe73714d0061536a4c9668d3d80c6180ac5489d6768c148
- SSDEEP 3072:FRBoakx1IoPPQnJQybu9gES3Ce0Rbb2aH+tMZrC8:JoawPPQnJQybu9gES3Ce0Rbb7etMZrC8
- TLSH T1E6B40018AB74777743D76ACAF72BDE2D0D8081E6CB014A8F4309BAF891D6D41BA37854
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\users\admin\appdata\local\temp\package\steam_client_win64.manifest
- Size 7KB
- SHA256 7727c02fc7b753c046bc0402fdd2c3785c1d30062a09e2611c8ea8da6ee5ce1a
- MD5 137347b98758b10384a3578fe3031b38
- SHA1 d0475a9da2d9f6586eedd028798645d4c0523115
- SHA512 612f9e188dd9b616ca62096e84356ec9612ffdeb0abf317478e240cd82056662f3009a491f88c2fdfea33e6008a5d08f9fd8f0ed2ea9f32c3e1ca522f2c34aac
- SSDEEP 96:z/o2AFCzPhLQyyY1aM8rBhoE6bkR9WFWx9DtDg0N1dYsHZOI/0/oSq:U2lpLQAEMCv1TmsXooSq
- TLSH T10CF1A8633684B4683B95874B85748ED90F98710761BF2CD7CE2E8B1EE0E6E4175EB14C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\users\admin\appdata\local\temp\resource\steamscheme.res
- Size 14KB
- SHA256 69dfa517ab922d579dacf49fb80c5cb66958a03c3d8513109a9466e1d1133e0b
- MD5 2cf39cb82fad9fb79130cd76394a627d
- SHA1 0592b391e4cebae722ecae3957e30dd8161e6ddd
- SHA512 0c9d825ebaebd4c1fe949b59edcd914f6ffb70636a6f6e0d295f9f0528b0c51e8dedc43d14e04f31700a5e9619ca0dd18ac62df890156cd88ed58ce840b50edb
- SSDEEP 384:GSv1HcdedMcYdIdgdidcdzpdyNYdqd7uqycdDdFd1dZdZnfqu4++uNuRORta2no:7U
- TLSH T10962E097730F01DE67A2965F5436CCC12F8ED074216EA8EAF60E386DDA94B72107A371
- MD5 SHA1 SHA512 SSDEEP TLSH