Overview

overview

10

Static

static

10

2026-06-26...al.exe

windows10-2004-x64

10

2026-06-26...al.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260617-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/06/2026, 10:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-26_ffbabff477e0b0b36fa83f32c9f4d854_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe
  • Size 5.5MB
  • Sample260629-ms32jaa131
  • SHA256 c35b19e11e5742f5dde6279c2715fa0155bf515f2ca3047c0eea81dfe81851e6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryneshtapersistencespywarestealertrojan

Malware Config

Signatures

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Detect Neshta payload 8 IoCs
  • Executes dropped EXE 14 IoCs
  • Loads dropped DLL 64 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 1 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-26_ffbabff477e0b0b36fa83f32c9f4d854_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-26_ffbabff477e0b0b36fa83f32c9f4d854_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe"
    1⤵
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2680
    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-06-26_ffbabff477e0b0b36fa83f32c9f4d854_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-06-26_ffbabff477e0b0b36fa83f32c9f4d854_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe"
      2⤵
      • Executes dropped EXE
      • Modifies trusted root certificate store through registry
      • Checks processor information in registry
      • Modifies system certificate store
      • Suspicious use of WriteProcessMemory
      PID:2880
      • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-06-26_ffbabff477e0b0b36fa83f32c9f4d854_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe
        C:\Users\Admin\AppData\Local\Temp\3582-490\2026-06-26_ffbabff477e0b0b36fa83f32c9f4d854_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks SCSI registry key(s)
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:28624
        • C:\Users\Admin\AppData\Local\Temp\3582-490\steamsysinfo.exe
          C:\Users\Admin\AppData\Local\Temp\3582-490\steamsysinfo.exe -steamid 0 -buildid 1782533657 -logdir C:\Users\Admin\AppData\Local\Temp\3582-490\logs -nocrashdialog -query 1 -out-file C:\Users\Admin\AppData\Local\Temp\A07C.tmp
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:6244
        • C:\Users\Admin\AppData\Local\Temp\3582-490\bin\cef\cef.win64\steamwebhelper.exe
          C:\Users\Admin\AppData\Local\Temp\3582-490\bin\cef\cef.win64\steamwebhelper.exe -nocrashdialog "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=28624" "-buildid=1782533657" "-steamid=0" "-logdir=C:\Users\Admin\AppData\Local\Temp\3582-490\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Users\Admin\AppData\Local\Temp\3582-490\clientui" "-steampath=C:\Users\Admin\AppData\Local\Temp\3582-490\2026-06-26_ffbabff477e0b0b36fa83f32c9f4d854_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling "--log-file=C:\Users\Admin\AppData\Local\Temp\3582-490\logs\cef_log.txt" --disable-quick-menu --disable-component-update "--gaia-url=http://disabled.invalid" "--enable-features=PlatformHEVCDecoderSupport" "--disable-features=WinRetrieveSuggestionsOnlyOnDemand,SpareRendererForSitePerProcess,DcheckIsFatal,BlockPromptsIfIgnoredOften,WebUsbDeviceDetection,ValveFFmpegAllowLowDelayHEVC"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Windows directory
          • Checks processor information in registry
          • Enumerates system info in registry
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:4960
          • C:\Users\Admin\AppData\Local\Temp\3582-490\bin\cef\cef.win64\steamwebhelper.exe
            C:\Users\Admin\AppData\Local\Temp\3582-490\bin\cef\cef.win64\steamwebhelper.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\3582-490\dumps "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1782533657 --initial-client-data=0x2a8,0x2ac,0x2b0,0x2a4,0x2b4,0x7ffd4a69aea0,0x7ffd4a69aeac,0x7ffd4a69aeb8
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5004
          • C:\Users\Admin\AppData\Local\Temp\3582-490\bin\cef\cef.win64\steamwebhelper.exe
            "C:\Users\Admin\AppData\Local\Temp\3582-490\bin\cef\cef.win64\steamwebhelper.exe" --type=gpu-process --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1782533657 --steamid=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1880,i,10097528130450417022,13624927813581960630,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=1884 --mojo-platform-channel-handle=1876 /prefetch:2
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:6756
          • C:\Users\Admin\AppData\Local\Temp\3582-490\bin\cef\cef.win64\steamwebhelper.exe
            "C:\Users\Admin\AppData\Local\Temp\3582-490\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1782533657 --steamid=0 --field-trial-handle=2136,i,10097528130450417022,13624927813581960630,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2148 --mojo-platform-channel-handle=2144 /prefetch:11
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Time Discovery
            PID:4780
          • C:\Users\Admin\AppData\Local\Temp\3582-490\bin\cef\cef.win64\steamwebhelper.exe
            "C:\Users\Admin\AppData\Local\Temp\3582-490\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1782533657 --steamid=0 --field-trial-handle=2204,i,10097528130450417022,13624927813581960630,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2212 --mojo-platform-channel-handle=2196 /prefetch:13
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1260
          • C:\Users\Admin\AppData\Local\Temp\3582-490\bin\cef\cef.win64\steamwebhelper.exe
            "C:\Users\Admin\AppData\Local\Temp\3582-490\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1782533657 --steamid=0 --gaia-url=http://disabled.invalid --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=4124,i,10097528130450417022,13624927813581960630,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4144 --mojo-platform-channel-handle=4140 /prefetch:1
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5524
          • C:\Users\Admin\AppData\Local\Temp\3582-490\bin\cef\cef.win64\steamwebhelper.exe
            "C:\Users\Admin\AppData\Local\Temp\3582-490\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1782533657 --steamid=0 --field-trial-handle=5124,i,10097528130450417022,13624927813581960630,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5132 --mojo-platform-channel-handle=4764 /prefetch:14
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:7252
        • C:\Users\Admin\AppData\Local\Temp\3582-490\bin\gldriverquery64.exe
          .\bin\gldriverquery64.exe
          4⤵
          • Executes dropped EXE
          PID:4732
        • C:\Users\Admin\AppData\Local\Temp\3582-490\bin\gldriverquery.exe
          .\bin\gldriverquery.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:6388
        • C:\Users\Admin\AppData\Local\Temp\3582-490\bin\vulkandriverquery64.exe
          .\bin\vulkandriverquery64.exe
          4⤵
          • Executes dropped EXE
          PID:6416
        • C:\Users\Admin\AppData\Local\Temp\3582-490\bin\vulkandriverquery.exe
          .\bin\vulkandriverquery.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:6528
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004F0
    1⤵
      PID:2440
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
      1⤵
        PID:7416
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
        1⤵
        • Modifies data under HKEY_USERS
        PID:7520

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Persistence

            Event Triggered Execution

            1
            T1546

            Change Default File Association

            1
            T1546.001

            Privilege Escalation

            Event Triggered Execution

            1
            T1546

            Change Default File Association

            1
            T1546.001

            Defense Evasion

            Modify Registry

            2
            T1112

            Subvert Trust Controls

            2
            T1553

            Install Root Certificate

            2
            T1553.004

            Credential Access

            Credentials from Password Stores

            1
            T1555

            Credentials from Web Browsers

            1
            T1555.003

            Unsecured Credentials

            1
            T1552

            Credentials In Files

            1
            T1552.001

            Discovery

            Peripheral Device Discovery

            1
            T1120

            Query Registry

            3
            T1012

            System Information Discovery

            4
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            System Time Discovery

            1
            T1124

            Lateral Movement

            Collection

            Data from Local System

            1
            T1005

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            ACROTE~1.EXE
            • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
            • Size 86KB
            • SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            the-real-index
            • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Code Cache\js\index-dir\the-real-index
            • Size 360B
            • SHA256 e1aacc848b28adeb1cd21f650288251523cfda78947de7dbb8b46789ee6befb3
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            the-real-index~RFe5a2e55.TMP
            • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Code Cache\js\index-dir\the-real-index~RFe5a2e55.TMP
            • Size 48B
            • SHA256 3e99aed5ad02406a79975ef80e4effcbb4ef0d16cefe90aa0e57424d1ae7cae3
            • MD5 SHA1 SHA512
            Submit Download

            data_1
            • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\DawnGraphiteCache\data_1
            • Size 264KB
            • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            CURRENT
            • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Extension Rules\CURRENT
            • Size 16B
            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
            • MD5 SHA1 SHA512
            Submit Download

            data_0
            • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_0
            • Size 8KB
            • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            data_2
            • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_2
            • Size 8KB
            • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            data_3
            • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_3
            • Size 8KB
            • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Network Persistent State
            • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\Network Persistent State
            • Size 111B
            • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Network Persistent State~RFe5aed4f.TMP
            • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\Network Persistent State~RFe5aed4f.TMP
            • Size 59B
            • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            SCT Auditing Pending Reports
            • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\SCT Auditing Pending Reports
            • Size 2B
            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
            • MD5 SHA1 SHA512
            Submit Download

            TransportSecurity
            • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity
            • Size 186B
            • SHA256 7a722d8ebe12bf4cf5e2849649caa251b7647cc24a2ada5dd3316b438feee215
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            TransportSecurity~RFe5a8108.TMP
            • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity~RFe5a8108.TMP
            • Size 186B
            • SHA256 c92b47b1dacf8f5b55e36db84f699409b82b1a6a3a2099716aebbb9468e90efa
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Preferences
            • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences
            • Size 7KB
            • SHA256 1c30b45591a6578e74620462486bc25acd185e3273c67bb890ceb8b508f0f11d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Preferences~RFe5a2a4d.TMP
            • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences~RFe5a2a4d.TMP
            • Size 7KB
            • SHA256 349bfb499f61b049a958566f1e20b0f1e564f4b34b328158d9fe20d190a1b329
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MANIFEST-000001
            • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Site Characteristics Database\MANIFEST-000001
            • Size 41B
            • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
            • MD5 SHA1 SHA512
            Submit Download

            Local State
            • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
            • Size 2KB
            • SHA256 9e2a47080c24f33b8d8e1b784d57baa374e05b94294c04ea31341690c4367941
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Local State
            • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
            • Size 1KB
            • SHA256 67d503158a91b46db0062f168fffe0f001e70b8ac4e96a72baedfcfacce8751b
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Local State
            • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
            • Size 2KB
            • SHA256 85e8f8f1a79a6edf7dbd1ab195cd11e9f9da2984624190a8d992cb35a601e053
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Local State
            • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
            • Size 2KB
            • SHA256 6fa75d7efabceee9ad3b66bbf8012326e4fd8b63189ec0b04eb24c27bf496f96
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Local State~RFe59c421.TMP
            • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State~RFe59c421.TMP
            • Size 889B
            • SHA256 5a16942edce56d9e3c50f7d7179e8669a234823f59d7327a4406feb2e55c28f5
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            2026-06-26_ffbabff477e0b0b36fa83f32c9f4d854_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\2026-06-26_ffbabff477e0b0b36fa83f32c9f4d854_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe
            • Size 5.5MB
            • SHA256 b697c80be59f08e529eba54ed5af1cc2269ebdf471e491921b5da5cdd4293bfc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SDL3.dll
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\SDL3.dll
            • Size 2.9MB
            • SHA256 95f4d71b795efc11ded38271609715fbeeb7c57dbe22af277dd493bd6858e6b3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_elf.dll
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\bin\cef\cef.win64\chrome_elf.dll
            • Size 1.3MB
            • SHA256 faca109a09005e8bf7ffe42ec5946149634910263d8f88f46267f8d3b5d1f4e7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            steamwebhelper.exe
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\bin\cef\cef.win64\steamwebhelper.exe
            • Size 7.2MB
            • SHA256 701037bd1d362080ee0f2fc3891b6a3b163a4041d570709db8dc309812dcbf02
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chromehtml.dll
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\bin\chromehtml.dll
            • Size 1.6MB
            • SHA256 122bfca12e18689cd561e6698cf9bca6e3b0f790cf282ff588eeb2d266a0b12c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            filesystem_stdio.dll
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\bin\filesystem_stdio.dll
            • Size 258KB
            • SHA256 350ba1b507c1bc55ee5cd3143460c019c1bb93c63e1b6f7ccf4522e47418fe36
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            steamservice.dll
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\bin\steamservice.dll
            • Size 3.6MB
            • SHA256 6e8870c59fc89908fc64e25560d306ce3d6d3e420212a9a29b488d120d18f100
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vgui2_s.DLL
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\bin\vgui2_s.DLL
            • Size 4.0MB
            • SHA256 0e7fa2637012a46985cf5685242cda144c4f677b08667591d9911b4d03c74b0f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            config.vdf
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\config\config.vdf
            • Size 117B
            • SHA256 a3d8a2cba6e356e02c0f33b50e3a9e61d2f9dfb6a26b5983e30e7786da95dba7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            config.vdf
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\config\config.vdf
            • Size 1KB
            • SHA256 f3847b5e4a40d9cf76df35398bb555117dfe3626c00a91f2babdedb619d6ad53
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            config.vdf
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\config\config.vdf
            • Size 10KB
            • SHA256 a70044116d050321f7439285c8ae62d49a9dd3a4cf4d7b87de77f4027c702124
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            config.vdf
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\config\config.vdf
            • Size 1KB
            • SHA256 8f9f970835f133258a7f740126012439385bbaa5a1d6a9d0d967a390977441c3
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            crashhandler64.dll
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\crashhandler64.dll
            • Size 485KB
            • SHA256 b0683d77581df5e1f0c95c4e040bea4a28a3b4d97fd3a7dc96da7c47e44f37c1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libavcodec-62.dll
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\libavcodec-62.dll
            • Size 7.1MB
            • SHA256 861d200b4a35bad9a2eaac069c8fd9711d2296e36287308f927c247c86135bcd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libavfilter-11.dll
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\libavfilter-11.dll
            • Size 1.1MB
            • SHA256 84567243e4d7e7295b4ac16d2cd3936357a0f6ea3d43e04ac5b0c1be04a9ede4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libavformat-62.dll
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\libavformat-62.dll
            • Size 2.2MB
            • SHA256 066926450a6cf4993d283e845074f8a3d137e00f813e5f2ff15214c0d8baa3d9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libavutil-60.dll
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\libavutil-60.dll
            • Size 2.2MB
            • SHA256 e6098cadf383c0c4d9cb3b5f82708528fa1cca35f4d8658cef166831bb83afe9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libswresample-6.dll
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\libswresample-6.dll
            • Size 801KB
            • SHA256 e6aac1d5b0f7eec17646b47abf60388ec3c64e486259f7e6e62b921e7cb20657
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libswscale-9.dll
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\libswscale-9.dll
            • Size 1.7MB
            • SHA256 15202c54c1344d0990667adeb42d1335d669f7d09f4419dcb14a039f16df1ebb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            bootstrap_log.txt
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\logs\bootstrap_log.txt
            • Size 14KB
            • SHA256 1ef08264027438a699e96ca48dbe95db5e96393b3e9c54ab0eb2025abca36af2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            steam_client_metrics.bin
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\package\steam_client_metrics.bin
            • Size 3KB
            • SHA256 4abcafacbaf8df7c7f2d95671ddd4ce88114a3451bb2dd97d2abd0e3a1f6f627
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            steam_client_win64.installed
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\package\steam_client_win64.installed
            • Size 497KB
            • SHA256 b2f1b9c543fbdb9162aa5ae4f0cfbf07ce8bd615f6449d94fd6f481691321e19
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            steam_client_win64.manifest
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\package\steam_client_win64.manifest
            • Size 7KB
            • SHA256 476ff259c2ba6400eaf5a32f4c2e99710dcd054c17cef4ae42a4afa22eceaa17
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            [email protected]_
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\package\tmp\graphics\[email protected]_
            • Size 15KB
            • SHA256 983aa3928f15f5154266be7063a75e1fce87238bbe81a910219dea01d5376824
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            icon_button_news_mousedown.tga_
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\package\tmp\graphics\icon_button_news_mousedown.tga_
            • Size 20KB
            • SHA256 cab3a68b64d8bf22c44080f12d7eab5b281102a8761f804224074ab1f6130fe2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            filter_clean_bulgarian.txt.gz_
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\package\tmp\resource\filter_clean_bulgarian.txt.gz_
            • Size 23B
            • SHA256 6feb83ca306745d634903cf09274b7baf0ac38e43c6b3fab1a608be344c3ef64
            • MD5 SHA1 SHA512
            Submit Download

            steambootstrapper_english.txt
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\public\steambootstrapper_english.txt
            • Size 4KB
            • SHA256 fbc09c1b9a55d04b57be8fb2ad5ab58b38f76054ecd3d1b70440a2d08191b05b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            url_list.txt
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\public\url_list.txt
            • Size 23KB
            • SHA256 4ebf9ebd12e0de227a3651466cc6423c045138a7a53bbb9d277c202053df2394
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            steamsysinfo.exe
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\steamsysinfo.exe
            • Size 1.3MB
            • SHA256 b6c25539e451b0b4285280488d84b9dc6c5cbda0053973c5d3d7f1a43e67e27e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            steamui.dll
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\steamui.dll
            • Size 17.9MB
            • SHA256 82b1c925903fc25d3612e45b061331e46e0bef3e2be8109ac845375ee7d1c98e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            tier0_s64.dll
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\tier0_s64.dll
            • Size 880KB
            • SHA256 b8035bc454247b331a82fca714625199c0bd547bdd66624d173eefc0387a2390
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            video64.dll
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\video64.dll
            • Size 5.1MB
            • SHA256 0e2ac328c31bffb7c17d6c767f7fcef20f53dab0099055df91c1b57bb31a9c70
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vstdlib_s64.dll
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\vstdlib_s64.dll
            • Size 475KB
            • SHA256 3eca25b308e2b34dc7e00cc03c654bd4f47b134bc6a5dc01cc1a22c491f3b755
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            steamui_english.txt
            • Path \??\c:\users\admin\appdata\local\temp\3582-490\public\steamui_english.txt
            • Size 329KB
            • SHA256 e3b8377ddd57ebf76259acae0d48ea74b0edd1b0fc1dfe902b9995d2c512a083
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            overlay_english.txt
            • Path \??\c:\users\admin\appdata\local\temp\3582-490\resource\overlay_english.txt
            • Size 16KB
            • SHA256 53c278d04118806622dfb131c0113cc775ef5e40266a7f918960dd292e9ce74a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            platform_english.txt
            • Path \??\c:\users\admin\appdata\local\temp\3582-490\resource\platform_english.txt
            • Size 3KB
            • SHA256 3e12b8ff2f38fe27d9ca33cef94d1d9333e3a83ab3c3fbbad86b536b8f7cadcd
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            steamscheme.res
            • Path \??\c:\users\admin\appdata\local\temp\3582-490\resource\steamscheme.res
            • Size 14KB
            • SHA256 69dfa517ab922d579dacf49fb80c5cb66958a03c3d8513109a9466e1d1133e0b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            steam.styles
            • Path \??\c:\users\admin\appdata\local\temp\3582-490\resource\styles\steam.styles
            • Size 76KB
            • SHA256 2414ec8b97c2bb0c336d13411dcc63fb4fb2a661eef74594878c24d50173e549
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vgui_english.txt
            • Path \??\c:\users\admin\appdata\local\temp\3582-490\resource\vgui_english.txt
            • Size 9KB
            • SHA256 9f0397524e96b9421b79a984625f79a7190ba57216709042aed3ebcb03a62b88
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            steamui_postlogon_english.txt
            • Path \??\c:\users\admin\appdata\local\temp\3582-490\steam\cached\steamui_postlogon_english.txt
            • Size 3KB
            • SHA256 cd97f377fdd459117ad2ac663f49c65965dfc5d0105b24de52c12087b03df6ee
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/1260-7117-0x0000015443D80000-0x0000015444476000-memory.dmp
            Download

            memory/1260-6890-0x00007FFD70DB0000-0x00007FFD70DB1000-memory.dmp
            Download

            memory/1260-6889-0x00007FFD71320000-0x00007FFD71321000-memory.dmp
            Download

            memory/2680-1319-0x0000000000400000-0x000000000041B000-memory.dmp
            Download

            memory/2680-6743-0x0000000000400000-0x000000000041B000-memory.dmp
            Download

            memory/2680-6756-0x0000000000400000-0x000000000041B000-memory.dmp
            Download

            memory/2680-6793-0x0000000000400000-0x000000000041B000-memory.dmp
            Download

            memory/2680-158-0x0000000000400000-0x000000000041B000-memory.dmp
            Download

            memory/2680-154-0x0000000000400000-0x000000000041B000-memory.dmp
            Download

            memory/2680-145-0x0000000000400000-0x000000000041B000-memory.dmp
            Download

            memory/5524-7118-0x0000026BD0E10000-0x0000026BD1506000-memory.dmp
            Download