Overview

overview

10

Static

static

10

2026-07-10...al.exe

windows10-2004-x64

10

2026-07-10...al.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/07/2026, 14:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-10_715d7cee4a9a566cb2463067689f9178_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe
  • Size 5.5MB
  • Sample260710-rhvpmac16v
  • SHA256 6bff62290d70fed4b94b1dd7f1a3e6db0894770f651a6166bdec7b84c18e91ce
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryneshtapersistencespywarestealertrojan

Malware Config

Signatures

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Detect Neshta payload 9 IoCs
  • Executes dropped EXE 14 IoCs
  • Loads dropped DLL 64 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 8 IoCs
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 1 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-10_715d7cee4a9a566cb2463067689f9178_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-10_715d7cee4a9a566cb2463067689f9178_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe"
    1⤵
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:5352
    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-07-10_715d7cee4a9a566cb2463067689f9178_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-07-10_715d7cee4a9a566cb2463067689f9178_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe"
      2⤵
      • Executes dropped EXE
      • Modifies trusted root certificate store through registry
      • Checks processor information in registry
      • Modifies system certificate store
      • Suspicious use of WriteProcessMemory
      PID:4856
      • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-07-10_715d7cee4a9a566cb2463067689f9178_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe
        C:\Users\Admin\AppData\Local\Temp\3582-490\2026-07-10_715d7cee4a9a566cb2463067689f9178_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks SCSI registry key(s)
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1244
        • C:\Users\Admin\AppData\Local\Temp\3582-490\steamsysinfo.exe
          C:\Users\Admin\AppData\Local\Temp\3582-490\steamsysinfo.exe -steamid 0 -buildid 1782866176 -logdir C:\Users\Admin\AppData\Local\Temp\3582-490\logs -nocrashdialog -query 1 -out-file C:\Users\Admin\AppData\Local\Temp\17DF.tmp
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1160
        • C:\Users\Admin\AppData\Local\Temp\3582-490\bin\cef\cef.win64\steamwebhelper.exe
          C:\Users\Admin\AppData\Local\Temp\3582-490\bin\cef\cef.win64\steamwebhelper.exe -nocrashdialog "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=1244" "-buildid=1782866176" "-steamid=0" "-logdir=C:\Users\Admin\AppData\Local\Temp\3582-490\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Users\Admin\AppData\Local\Temp\3582-490\clientui" "-steampath=C:\Users\Admin\AppData\Local\Temp\3582-490\2026-07-10_715d7cee4a9a566cb2463067689f9178_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling "--log-file=C:\Users\Admin\AppData\Local\Temp\3582-490\logs\cef_log.txt" --disable-quick-menu --disable-component-update "--gaia-url=http://disabled.invalid" "--enable-features=PlatformHEVCDecoderSupport" "--disable-features=WinRetrieveSuggestionsOnlyOnDemand,SpareRendererForSitePerProcess,DcheckIsFatal,BlockPromptsIfIgnoredOften,WebUsbDeviceDetection,ValveFFmpegAllowLowDelayHEVC"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Windows directory
          • Checks processor information in registry
          • Enumerates system info in registry
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:4964
          • C:\Users\Admin\AppData\Local\Temp\3582-490\bin\cef\cef.win64\steamwebhelper.exe
            C:\Users\Admin\AppData\Local\Temp\3582-490\bin\cef\cef.win64\steamwebhelper.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\3582-490\dumps "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1782866176 --initial-client-data=0x2b4,0x2b8,0x2bc,0x2b0,0x2c0,0x7ffb7381aea0,0x7ffb7381aeac,0x7ffb7381aeb8
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1408
          • C:\Users\Admin\AppData\Local\Temp\3582-490\bin\cef\cef.win64\steamwebhelper.exe
            "C:\Users\Admin\AppData\Local\Temp\3582-490\bin\cef\cef.win64\steamwebhelper.exe" --type=gpu-process --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1782866176 --steamid=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1636,i,2982672108141697402,15516909398023652932,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=1836 --mojo-platform-channel-handle=1632 /prefetch:2
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3648
          • C:\Users\Admin\AppData\Local\Temp\3582-490\bin\cef\cef.win64\steamwebhelper.exe
            "C:\Users\Admin\AppData\Local\Temp\3582-490\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1782866176 --steamid=0 --field-trial-handle=2056,i,2982672108141697402,15516909398023652932,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2116 --mojo-platform-channel-handle=2112 /prefetch:11
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Time Discovery
            PID:4896
          • C:\Users\Admin\AppData\Local\Temp\3582-490\bin\cef\cef.win64\steamwebhelper.exe
            "C:\Users\Admin\AppData\Local\Temp\3582-490\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1782866176 --steamid=0 --field-trial-handle=2188,i,2982672108141697402,15516909398023652932,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2240 --mojo-platform-channel-handle=2232 /prefetch:13
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4128
          • C:\Users\Admin\AppData\Local\Temp\3582-490\bin\cef\cef.win64\steamwebhelper.exe
            "C:\Users\Admin\AppData\Local\Temp\3582-490\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1782866176 --steamid=0 --gaia-url=http://disabled.invalid --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=4164,i,2982672108141697402,15516909398023652932,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4184 --mojo-platform-channel-handle=4180 /prefetch:1
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:27900
          • C:\Users\Admin\AppData\Local\Temp\3582-490\bin\cef\cef.win64\steamwebhelper.exe
            "C:\Users\Admin\AppData\Local\Temp\3582-490\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1782866176 --steamid=0 --field-trial-handle=5192,i,2982672108141697402,15516909398023652932,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5152 --mojo-platform-channel-handle=5132 /prefetch:14
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:26736
        • C:\Users\Admin\AppData\Local\Temp\3582-490\bin\gldriverquery64.exe
          .\bin\gldriverquery64.exe
          4⤵
          • Executes dropped EXE
          PID:28332
        • C:\Users\Admin\AppData\Local\Temp\3582-490\bin\gldriverquery.exe
          .\bin\gldriverquery.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:26340
        • C:\Users\Admin\AppData\Local\Temp\3582-490\bin\vulkandriverquery64.exe
          .\bin\vulkandriverquery64.exe
          4⤵
          • Executes dropped EXE
          PID:26356
        • C:\Users\Admin\AppData\Local\Temp\3582-490\bin\vulkandriverquery.exe
          .\bin\vulkandriverquery.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:9836
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x00000000000004F0 0x00000000000004F8
    1⤵
      PID:3056
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
      1⤵
        PID:26116
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
        1⤵
        • Modifies data under HKEY_USERS
        PID:26324

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Persistence

            Event Triggered Execution

            1
            T1546

            Change Default File Association

            1
            T1546.001

            Privilege Escalation

            Event Triggered Execution

            1
            T1546

            Change Default File Association

            1
            T1546.001

            Defense Evasion

            Modify Registry

            2
            T1112

            Subvert Trust Controls

            2
            T1553

            Install Root Certificate

            2
            T1553.004

            Credential Access

            Credentials from Password Stores

            1
            T1555

            Credentials from Web Browsers

            1
            T1555.003

            Unsecured Credentials

            1
            T1552

            Credentials In Files

            1
            T1552.001

            Discovery

            Peripheral Device Discovery

            1
            T1120

            Query Registry

            3
            T1012

            System Information Discovery

            4
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            System Time Discovery

            1
            T1124

            Lateral Movement

            Collection

            Data from Local System

            1
            T1005

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            ACROTE~1.EXE
            • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
            • Size 86KB
            • SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            the-real-index
            • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Code Cache\js\index-dir\the-real-index
            • Size 48B
            • SHA256 3256f2f45f8851d3d96c5c11f0676d4204e6c46a64c0223f01ff086c4704ed7b
            • MD5 SHA1 SHA512
            Submit Download

            the-real-index
            • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Code Cache\js\index-dir\the-real-index
            • Size 360B
            • SHA256 eeab72dbe600506950f390fe8aae2358d0c95f881787516bc4415ff26fd19058
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            data_0
            • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_0
            • Size 8KB
            • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            data_2
            • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_2
            • Size 8KB
            • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            data_3
            • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_3
            • Size 8KB
            • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SCT Auditing Pending Reports
            • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\SCT Auditing Pending Reports
            • Size 2B
            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
            • MD5 SHA1 SHA512
            Submit Download

            TransportSecurity
            • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity
            • Size 188B
            • SHA256 a1c2c961d685cab546e177eb00380d245c0241a5b32d8ad7f957a0f491958ec7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            TransportSecurity~RFe5afba7.TMP
            • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity~RFe5afba7.TMP
            • Size 188B
            • SHA256 e0945244e4fb4c602a4fe9939cb3cc66ef9431a2ad734fc556d3d8f3d8bcc7de
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Preferences
            • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences
            • Size 7KB
            • SHA256 53c1ca7f552d4fa7b620d464c663c836daf2d7be7372c32e7c94afe177f936d0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Preferences~RFe5aa663.TMP
            • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences~RFe5aa663.TMP
            • Size 7KB
            • SHA256 0f9dac21e721ba7dec6b8f6673eb955e458eaaa7a70b08eefa653a7736f10a03
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CURRENT
            • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Sync Data\LevelDB\CURRENT
            • Size 16B
            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
            • MD5 SHA1 SHA512
            Submit Download

            MANIFEST-000001
            • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Sync Data\LevelDB\MANIFEST-000001
            • Size 41B
            • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
            • MD5 SHA1 SHA512
            Submit Download

            Local State
            • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
            • Size 2KB
            • SHA256 515533ed4b79042c7302c12441630f312d5ad095a194d9e6f66e7beb2235ea19
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Local State
            • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
            • Size 1KB
            • SHA256 9f97eed082bb3853223bd5287343a73be7b92acfb3992644314db821e10d431f
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Local State
            • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
            • Size 2KB
            • SHA256 f4f93017109b37f1a32869b503e48448f52f65a48ba3e0b9cdcf257ab209356c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Local State~RFe5a3c01.TMP
            • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State~RFe5a3c01.TMP
            • Size 889B
            • SHA256 3438e724773287f7e1b10c49993c65072b9e2ca814befba46b05f787b22e1848
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            2026-07-10_715d7cee4a9a566cb2463067689f9178_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\2026-07-10_715d7cee4a9a566cb2463067689f9178_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe
            • Size 5.5MB
            • SHA256 a4647c09213f4cedfaaddd82dd593ff4483f70cecca54b6a10c7ee8095b57b4a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SDL3.dll
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\SDL3.dll
            • Size 2.9MB
            • SHA256 95f4d71b795efc11ded38271609715fbeeb7c57dbe22af277dd493bd6858e6b3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_elf.dll
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\bin\cef\cef.win64\chrome_elf.dll
            • Size 1.3MB
            • SHA256 faca109a09005e8bf7ffe42ec5946149634910263d8f88f46267f8d3b5d1f4e7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            crash_reporter.cfg
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\bin\cef\cef.win64\crash_reporter.cfg
            • Size 378B
            • SHA256 cc44ed5e97d845029bfd7598930a0f34a95810b8964d21da526db2d5cf680213
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            steamwebhelper.exe
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\bin\cef\cef.win64\steamwebhelper.exe
            • Size 7.2MB
            • SHA256 701037bd1d362080ee0f2fc3891b6a3b163a4041d570709db8dc309812dcbf02
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chromehtml.dll
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\bin\chromehtml.dll
            • Size 1.6MB
            • SHA256 122bfca12e18689cd561e6698cf9bca6e3b0f790cf282ff588eeb2d266a0b12c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            filesystem_stdio.dll
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\bin\filesystem_stdio.dll
            • Size 258KB
            • SHA256 350ba1b507c1bc55ee5cd3143460c019c1bb93c63e1b6f7ccf4522e47418fe36
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            steamservice.dll
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\bin\steamservice.dll
            • Size 3.6MB
            • SHA256 6e8870c59fc89908fc64e25560d306ce3d6d3e420212a9a29b488d120d18f100
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vgui2_s.DLL
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\bin\vgui2_s.DLL
            • Size 4.0MB
            • SHA256 0e7fa2637012a46985cf5685242cda144c4f677b08667591d9911b4d03c74b0f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            config.vdf
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\config\config.vdf
            • Size 1KB
            • SHA256 f3847b5e4a40d9cf76df35398bb555117dfe3626c00a91f2babdedb619d6ad53
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            config.vdf
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\config\config.vdf
            • Size 9KB
            • SHA256 bc77d42e152f58c1826939f17560ecd229adae552be650eee82ece21ecce9c38
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            config.vdf
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\config\config.vdf
            • Size 1KB
            • SHA256 8f9f970835f133258a7f740126012439385bbaa5a1d6a9d0d967a390977441c3
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            config.vdf~RFe5a46af.TMP
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\config\config.vdf~RFe5a46af.TMP
            • Size 117B
            • SHA256 a3d8a2cba6e356e02c0f33b50e3a9e61d2f9dfb6a26b5983e30e7786da95dba7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            crashhandler64.dll
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\crashhandler64.dll
            • Size 485KB
            • SHA256 b0683d77581df5e1f0c95c4e040bea4a28a3b4d97fd3a7dc96da7c47e44f37c1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libavcodec-62.dll
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\libavcodec-62.dll
            • Size 7.1MB
            • SHA256 861d200b4a35bad9a2eaac069c8fd9711d2296e36287308f927c247c86135bcd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libavfilter-11.dll
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\libavfilter-11.dll
            • Size 1.1MB
            • SHA256 84567243e4d7e7295b4ac16d2cd3936357a0f6ea3d43e04ac5b0c1be04a9ede4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libavformat-62.dll
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\libavformat-62.dll
            • Size 2.2MB
            • SHA256 066926450a6cf4993d283e845074f8a3d137e00f813e5f2ff15214c0d8baa3d9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libavutil-60.dll
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\libavutil-60.dll
            • Size 2.2MB
            • SHA256 e6098cadf383c0c4d9cb3b5f82708528fa1cca35f4d8658cef166831bb83afe9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libswresample-6.dll
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\libswresample-6.dll
            • Size 801KB
            • SHA256 e6aac1d5b0f7eec17646b47abf60388ec3c64e486259f7e6e62b921e7cb20657
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libswscale-9.dll
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\libswscale-9.dll
            • Size 1.7MB
            • SHA256 15202c54c1344d0990667adeb42d1335d669f7d09f4419dcb14a039f16df1ebb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            bootstrap_log.txt
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\logs\bootstrap_log.txt
            • Size 15KB
            • SHA256 f48a86090ddab252e7c67b6f5f9588fb32ff0582b39b4e582790a3c3d6dfee15
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            service_log.txt
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\logs\service_log.txt
            • Size 685B
            • SHA256 be7cb56be3749a3f05bc9104eabd4b93638498667454de04ba6cb3142ac96f91
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            steam_client_metrics.bin
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\package\steam_client_metrics.bin
            • Size 3KB
            • SHA256 e37f9c4899bb47a313c217030865c8dec8c1218a3253c3ea619239c8c069c01d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            steam_client_win64.installed
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\package\steam_client_win64.installed
            • Size 497KB
            • SHA256 7a462d2fafbfab4815defcaeaba4c985ff5ad23a27efb81f16de2872aa25245d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            steam_client_win64.manifest
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\package\steam_client_win64.manifest
            • Size 7KB
            • SHA256 6289a7228da67422d4b917fc7ecacf7fe654a865ce11cc78f9615c6701c8b204
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            [email protected]_
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\package\tmp\graphics\[email protected]_
            • Size 15KB
            • SHA256 983aa3928f15f5154266be7063a75e1fce87238bbe81a910219dea01d5376824
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            icon_button_news_mousedown.tga_
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\package\tmp\graphics\icon_button_news_mousedown.tga_
            • Size 20KB
            • SHA256 cab3a68b64d8bf22c44080f12d7eab5b281102a8761f804224074ab1f6130fe2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            filter_clean_bulgarian.txt.gz_
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\package\tmp\resource\filter_clean_bulgarian.txt.gz_
            • Size 23B
            • SHA256 6feb83ca306745d634903cf09274b7baf0ac38e43c6b3fab1a608be344c3ef64
            • MD5 SHA1 SHA512
            Submit Download

            steambootstrapper_english.txt
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\public\steambootstrapper_english.txt
            • Size 4KB
            • SHA256 fbc09c1b9a55d04b57be8fb2ad5ab58b38f76054ecd3d1b70440a2d08191b05b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            url_list.txt
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\public\url_list.txt
            • Size 23KB
            • SHA256 4ebf9ebd12e0de227a3651466cc6423c045138a7a53bbb9d277c202053df2394
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            steamsysinfo.exe
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\steamsysinfo.exe
            • Size 1.3MB
            • SHA256 b6c25539e451b0b4285280488d84b9dc6c5cbda0053973c5d3d7f1a43e67e27e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            steamui.dll
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\steamui.dll
            • Size 17.9MB
            • SHA256 82b1c925903fc25d3612e45b061331e46e0bef3e2be8109ac845375ee7d1c98e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            tier0_s64.dll
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\tier0_s64.dll
            • Size 880KB
            • SHA256 b8035bc454247b331a82fca714625199c0bd547bdd66624d173eefc0387a2390
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            video64.dll
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\video64.dll
            • Size 5.1MB
            • SHA256 0e2ac328c31bffb7c17d6c767f7fcef20f53dab0099055df91c1b57bb31a9c70
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vstdlib_s64.dll
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\vstdlib_s64.dll
            • Size 475KB
            • SHA256 3eca25b308e2b34dc7e00cc03c654bd4f47b134bc6a5dc01cc1a22c491f3b755
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            steamui_english.txt
            • Path \??\c:\users\admin\appdata\local\temp\3582-490\public\steamui_english.txt
            • Size 329KB
            • SHA256 e3b8377ddd57ebf76259acae0d48ea74b0edd1b0fc1dfe902b9995d2c512a083
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            overlay_english.txt
            • Path \??\c:\users\admin\appdata\local\temp\3582-490\resource\overlay_english.txt
            • Size 16KB
            • SHA256 53c278d04118806622dfb131c0113cc775ef5e40266a7f918960dd292e9ce74a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            platform_english.txt
            • Path \??\c:\users\admin\appdata\local\temp\3582-490\resource\platform_english.txt
            • Size 3KB
            • SHA256 3e12b8ff2f38fe27d9ca33cef94d1d9333e3a83ab3c3fbbad86b536b8f7cadcd
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            steamscheme.res
            • Path \??\c:\users\admin\appdata\local\temp\3582-490\resource\steamscheme.res
            • Size 14KB
            • SHA256 69dfa517ab922d579dacf49fb80c5cb66958a03c3d8513109a9466e1d1133e0b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            steam.styles
            • Path \??\c:\users\admin\appdata\local\temp\3582-490\resource\styles\steam.styles
            • Size 76KB
            • SHA256 2414ec8b97c2bb0c336d13411dcc63fb4fb2a661eef74594878c24d50173e549
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vgui_english.txt
            • Path \??\c:\users\admin\appdata\local\temp\3582-490\resource\vgui_english.txt
            • Size 9KB
            • SHA256 9f0397524e96b9421b79a984625f79a7190ba57216709042aed3ebcb03a62b88
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            steamui_postlogon_english.txt
            • Path \??\c:\users\admin\appdata\local\temp\3582-490\steam\cached\steamui_postlogon_english.txt
            • Size 3KB
            • SHA256 cd97f377fdd459117ad2ac663f49c65965dfc5d0105b24de52c12087b03df6ee
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/1408-7100-0x000001E8BEC30000-0x000001E8BED89000-memory.dmp
            Download

            memory/3648-7101-0x000001EFE3600000-0x000001EFE3759000-memory.dmp
            Download

            memory/4128-6889-0x00007FFB95BC0000-0x00007FFB95BC1000-memory.dmp
            Download

            memory/4128-6890-0x00007FFB95660000-0x00007FFB95661000-memory.dmp
            Download

            memory/4128-7116-0x0000016D588C0000-0x0000016D588EF000-memory.dmp
            Download

            memory/4964-7120-0x00000243D6600000-0x00000243D6759000-memory.dmp
            Download

            memory/4964-7031-0x00000243D6600000-0x00000243D6759000-memory.dmp
            Download

            memory/5352-6850-0x0000000000400000-0x000000000041B000-memory.dmp
            Download

            memory/5352-6744-0x0000000000400000-0x000000000041B000-memory.dmp
            Download

            memory/5352-6791-0x0000000000400000-0x000000000041B000-memory.dmp
            Download

            memory/5352-6565-0x0000000000400000-0x000000000041B000-memory.dmp
            Download

            memory/5352-334-0x0000000000400000-0x000000000041B000-memory.dmp
            Download

            memory/5352-159-0x0000000000400000-0x000000000041B000-memory.dmp
            Download

            memory/5352-152-0x0000000000400000-0x000000000041B000-memory.dmp
            Download

            memory/5352-144-0x0000000000400000-0x000000000041B000-memory.dmp
            Download

            memory/27900-7119-0x00000265CD8F0000-0x00000265CD91F000-memory.dmp
            Download