Analysis

  • max time kernel
    149s
  • max time network
    160s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260911-en
  • resource tags

    arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    13/09/2026, 09:16

General

  • Target
    steamcmd/steamcmd.exe
  • Size 5.2MB
  • Sample260913-k8f6laxthy
  • SHA256 4254b193ecb34ed539a691f254f78bfc10112bb6800111e4b43c24ad2d7f9e92
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 6 IoCs
  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies system certificate store 2 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\steamcmd\steamcmd.exe
    "C:\Users\Admin\AppData\Local\Temp\steamcmd\steamcmd.exe"
    1⤵
    • Modifies trusted root certificate store through registry
    • Checks processor information in registry
    • Modifies system certificate store
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:2488
    • C:\Users\Admin\AppData\Local\Temp\steamcmd\steamcmd.exe
      C:\Users\Admin\AppData\Local\Temp\steamcmd\steamcmd.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      PID:1888

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        103621DE9CD5414CC2538780B4B75751

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
        • Size 808B
        • SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
        • MD5 SHA1 SHA512 TLSH

        3A767990486D5F3A6998AC0560150370

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3A767990486D5F3A6998AC0560150370
        • Size 175KB
        • SHA256 fb5964a738eda1a6272cc997f73194646b9dd2a02aa2f184250415dbb0ad8d28
        • MD5 SHA1 SHA512 SSDEEP TLSH

        F15827BEC5BABE89C21DCDAE77464BF1

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
        • Size 701B
        • SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
        • MD5 SHA1 SHA512 TLSH

        103621DE9CD5414CC2538780B4B75751

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
        • Size 192B
        • SHA256 beb6c1a77817d6d4f4562a052248c17dd789d28d9a12e1cc3cc0331bd950084f
        • MD5 SHA1 SHA512 TLSH

        3A767990486D5F3A6998AC0560150370

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3A767990486D5F3A6998AC0560150370
        • Size 246B
        • SHA256 7eba51c441f388599c8eba9741bf1102dc99e6556a3d403daf27bce9b298e550
        • MD5 SHA1 SHA512 TLSH

        F15827BEC5BABE89C21DCDAE77464BF1

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
        • Size 192B
        • SHA256 8f1139727161b08bb4ff67c46b0eda94eb83177fea145374b1833cf0cc0edf70
        • MD5 SHA1 SHA512 TLSH

        steamservice.dll

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\bin\steamservice.dll
        • Size 4.4MB
        • SHA256 5a5991b796af2e61d4490dbe5408629fb685415c21571e949d71fb0c937342be
        • MD5 SHA1 SHA512 SSDEEP TLSH

        steamservice.exe

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\bin\steamservice.exe
        • Size 3.4MB
        • SHA256 595f7b080180e3c3dbaf6f5c64f6846f3c8a36a69a700195b5c7ac26968aaee9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        crashhandler.dll

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\crashhandler.dll
        • Size 400KB
        • SHA256 140cddb8d64d8ebaba163f64694ab4508eec090058e06513ae0db83fa90ef17d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        crashhandler64.dll

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\crashhandler64.dll
        • Size 485KB
        • SHA256 f1f7d8e173b8ab37ab180fe00b143e79d16900f8a91dc4d4e5dff28236d708ba
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bootstrap_log.txt

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\logs\bootstrap_log.txt
        • Size 5KB
        • SHA256 0a1e699dd34181286b32d8f5f063d2bf7dbe3f27c350b4d4c30561100d991778
        • MD5 SHA1 SHA512 SSDEEP TLSH

        steam_cmd_metrics.bin

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\package\steam_cmd_metrics.bin
        • Size 1KB
        • SHA256 85c13b6d745431b5922247fe910399d41e66f633bc42d712b0437980bad9efa9
        • MD5 SHA1 SHA512 TLSH

        steam_cmd_win64.installed

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\package\steam_cmd_win64.installed
        • Size 10KB
        • SHA256 828e59261f54d11283a551aa291b284202f48c83bd3f01e4100aee5c8f3516ae
        • MD5 SHA1 SHA512 SSDEEP TLSH

        steam_cmd_win64.manifest

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\package\steam_cmd_win64.manifest
        • Size 2KB
        • SHA256 cb5260ca4e87fcad6a039b92e80cde4e4e6d2cfbbc28a8b3eaa53e7d9558adfc
        • MD5 SHA1 SHA512 TLSH

        steamcmd_bins_win64.zip.vz.ba649d96f761f61cce74babfeca319457bb04b70_15205384

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\package\steamcmd_bins_win64.zip.vz.ba649d96f761f61cce74babfeca319457bb04b70_15205384
        • Size 14.5MB
        • SHA256 620254560356e5a3ee11428318108ac042f0d117dbd48d66eb58052e2f5cdc8f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        steamcmd_public_all.zip.9acb456879ee932518117972e2b09b938f19063b

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\package\steamcmd_public_all.zip.9acb456879ee932518117972e2b09b938f19063b
        • Size 58KB
        • SHA256 6fad0bff904dac6cce1c56d9bdf60915e8041e9e3d12b3ca3baeca31d1e00acc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        steamcmd_siteserverui_win64.zip.vz.4742d7d09a6b4e37814b5795ea557d3d9f0185fe_10929462

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\package\steamcmd_siteserverui_win64.zip.vz.4742d7d09a6b4e37814b5795ea557d3d9f0185fe_10929462
        • Size 10.4MB
        • SHA256 925169f0d0c2819a27a8b1056c889291182d848f91a5c96ff2efc7916a71c8a7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        steamcmd_steamerrorreporter_win64.zip.84ec6c7f1abbed7c0d25ddc3362c521f8e0cbc4b

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\package\steamcmd_steamerrorreporter_win64.zip.84ec6c7f1abbed7c0d25ddc3362c521f8e0cbc4b
        • Size 238KB
        • SHA256 5b1b5e3cf0d6a2a5f655104adb380a237cc99d6784c93a53e24797b0cba79a79
        • MD5 SHA1 SHA512 SSDEEP TLSH

        steamcmd_steamservice_win64.zip.vz.7a2397c8a9976f8e9aa4dfa8e1b96abb3f093f3f_2036063

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\package\steamcmd_steamservice_win64.zip.vz.7a2397c8a9976f8e9aa4dfa8e1b96abb3f093f3f_2036063
        • Size 1.9MB
        • SHA256 dc01de393142630a2b3cbfaa7180c6db331202f37584b4f39b8a1e78a113da60
        • MD5 SHA1 SHA512 SSDEEP TLSH

        steamcmd_win64.zip.vz.e829dda457d38b4a758a9991555fbf60cc976c6d_2030453

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\package\steamcmd_win64.zip.vz.e829dda457d38b4a758a9991555fbf60cc976c6d_2030453
        • Size 1.9MB
        • SHA256 dab8bc836083981f44066405135ba24ce4658cd564919e4228756e44bdb7dd42
        • MD5 SHA1 SHA512 SSDEEP TLSH

        steambootstrapper_english.txt

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\public\steambootstrapper_english.txt
        • Size 4KB
        • SHA256 fbc09c1b9a55d04b57be8fb2ad5ab58b38f76054ecd3d1b70440a2d08191b05b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-console-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\siteserverui\win32\api-ms-win-core-console-l1-1-0.dll
        • Size 18KB
        • SHA256 94a5df1227818edbfd0d5091c6a48f86b4117c38550343f780c604eee1cd6231
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-datetime-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\siteserverui\win32\api-ms-win-core-datetime-l1-1-0.dll
        • Size 17KB
        • SHA256 90fae0e7c3644a6754833c42b0ac39b6f23859f9a7cf4b6c8624820f59b9dad3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-debug-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\siteserverui\win32\api-ms-win-core-debug-l1-1-0.dll
        • Size 17KB
        • SHA256 c310cc91464c9431ab0902a561af947fa5c973925ff70482d3de017ed3f73b7d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-errorhandling-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\siteserverui\win32\api-ms-win-core-errorhandling-l1-1-0.dll
        • Size 17KB
        • SHA256 a97dcca76cdb12e985dff71040815f28508c655ab2b073512e386dd63f4da325
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-file-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\siteserverui\win32\api-ms-win-core-file-l1-1-0.dll
        • Size 21KB
        • SHA256 7ea06b7050f9ea2bcc12af34374bdf1173646d4e5ebf66ad690b37f4df5f3d4e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-file-l1-2-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\siteserverui\win32\api-ms-win-core-file-l1-2-0.dll
        • Size 17KB
        • SHA256 c8c499b012d0d63b7afc8b4ca42d6d996b2fcf2e8b5f94cacfbec9e6f33e8a03
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-file-l2-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\siteserverui\win32\api-ms-win-core-file-l2-1-0.dll
        • Size 17KB
        • SHA256 c85dc081b1964b77d289aac43cc64746e7b141d036f248a731601eb98f827719
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-handle-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\siteserverui\win32\api-ms-win-core-handle-l1-1-0.dll
        • Size 17KB
        • SHA256 945cc64ee04b1964c1f9fcdc3124dd83973d332f5cfb696cdf128ca5c4cbd0e5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-heap-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\siteserverui\win32\api-ms-win-core-heap-l1-1-0.dll
        • Size 17KB
        • SHA256 44f6df4280c8ecc9c6e609b1a4bfee041332d337d84679cfe0d6678ce8f2998a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-interlocked-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\siteserverui\win32\api-ms-win-core-interlocked-l1-1-0.dll
        • Size 17KB
        • SHA256 deccd75fc3fc2bb31338b6fe26deffbd7914c6cd6a907e76fd4931b7d141718c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-libraryloader-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\siteserverui\win32\api-ms-win-core-libraryloader-l1-1-0.dll
        • Size 18KB
        • SHA256 bb25ccf8694d1fcfce85a7159dcf6985fdb54728d29b021cb3d14242f65909ce
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-localization-l1-2-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\siteserverui\win32\api-ms-win-core-localization-l1-2-0.dll
        • Size 20KB
        • SHA256 03ad57c24ff2cf895b5f533f0ecbd10266fd8634c6b9053cc9cb33b814ad5d97
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-memory-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\siteserverui\win32\api-ms-win-core-memory-l1-1-0.dll
        • Size 18KB
        • SHA256 bb33a9e906a5863043753c44f6f8165afe4d5edb7e55efa4c7e6e1ed90778eca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-namedpipe-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\siteserverui\win32\api-ms-win-core-namedpipe-l1-1-0.dll
        • Size 17KB
        • SHA256 c4f60f911068ab6d7f578d449ba7b5b9969f08fc683fd0ce8e2705bbf061f507
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-processenvironment-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\siteserverui\win32\api-ms-win-core-processenvironment-l1-1-0.dll
        • Size 18KB
        • SHA256 96898930ffb338da45497be019ae1adcd63c5851141169d3023e53ce4c7a483e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-processthreads-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\siteserverui\win32\api-ms-win-core-processthreads-l1-1-0.dll
        • Size 18KB
        • SHA256 9dab884071b1f7d7a167f9bec94ba2bee875e3365603fa29b31de286c6a97a1d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-processthreads-l1-1-1.dll

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\siteserverui\win32\api-ms-win-core-processthreads-l1-1-1.dll
        • Size 18KB
        • SHA256 91eeb842973495deb98cef0377240d2f9c3d370ac4cf513fd215857e9f265a6a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-profile-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\siteserverui\win32\api-ms-win-core-profile-l1-1-0.dll
        • Size 17KB
        • SHA256 8eb5270fa99069709c846db38be743a1a80a42aa1a88776131f79e1d07cc411c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-rtlsupport-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\siteserverui\win32\api-ms-win-core-rtlsupport-l1-1-0.dll
        • Size 17KB
        • SHA256 2257fea1e71f7058439b3727ed68ef048bd91dcacd64762eb5c64a9d49df0b57
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-string-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\siteserverui\win32\api-ms-win-core-string-l1-1-0.dll
        • Size 17KB
        • SHA256 7670fdede524a485c13b11a7c878015e9b0d441b7d8eb15ca675ad6b9c9a7311
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-synch-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\siteserverui\win32\api-ms-win-core-synch-l1-1-0.dll
        • Size 19KB
        • SHA256 5dd4ccd63e6ed07ca3987ab5634ca4207d69c47c2544dfefc41935617652820f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-synch-l1-2-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\siteserverui\win32\api-ms-win-core-synch-l1-2-0.dll
        • Size 18KB
        • SHA256 30d99ce1d732f6c9cf82671e1d9088aa94e720382066b79175e2d16778a3dad1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-sysinfo-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\siteserverui\win32\api-ms-win-core-sysinfo-l1-1-0.dll
        • Size 18KB
        • SHA256 4b704b36e1672ae02e697efd1bf46f11b42d776550ba34a90cd189f6c5c61f92
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-timezone-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\siteserverui\win32\api-ms-win-core-timezone-l1-1-0.dll
        • Size 17KB
        • SHA256 24c9aa0b70e557a49dac159c825a013a71a190df5e7a837bfa047a06bba59eca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-util-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\siteserverui\win32\api-ms-win-core-util-l1-1-0.dll
        • Size 17KB
        • SHA256 f7d450a0f59151bcefb98d20fcae35f76029df57138002db5651d1b6a33adc86
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-conio-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\siteserverui\win32\api-ms-win-crt-conio-l1-1-0.dll
        • Size 18KB
        • SHA256 9ca21763c528584bdb4efebe914faaf792c9d7360677c87e93bd7ba7bb4367f2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-convert-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\siteserverui\win32\api-ms-win-crt-convert-l1-1-0.dll
        • Size 21KB
        • SHA256 3cc1377d495260c380e8d225e5ee889cbb2ed22e79862d4278cfa898e58e44d1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-environment-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\siteserverui\win32\api-ms-win-crt-environment-l1-1-0.dll
        • Size 18KB
        • SHA256 c0d75d1887c32a1b1006b3cffc29df84a0d73c435cdcb404b6964be176a61382
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-filesystem-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\siteserverui\win32\api-ms-win-crt-filesystem-l1-1-0.dll
        • Size 19KB
        • SHA256 7633774effe7c0add6752ffe90104d633fc8262c87871d096c2fc07c20018ed2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-heap-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\siteserverui\win32\api-ms-win-crt-heap-l1-1-0.dll
        • Size 18KB
        • SHA256 f5cf623ba14b017af4aec6c15eee446c647ab6d2a5dee9d6975adc69994a113d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-locale-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\siteserverui\win32\api-ms-win-crt-locale-l1-1-0.dll
        • Size 18KB
        • SHA256 565a2eec5449eeeed68b430f2e9b92507f979174f9c9a71d0c36d58b96051c33
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-math-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\siteserverui\win32\api-ms-win-crt-math-l1-1-0.dll
        • Size 28KB
        • SHA256 bece7bab83a5d0ec5c35f0841cbbf413e01ac878550fbdb34816ed55185dcfed
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-multibyte-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\siteserverui\win32\api-ms-win-crt-multibyte-l1-1-0.dll
        • Size 25KB
        • SHA256 66abf3a1147751c95689f5bc6a259e55281ec3d06d3332dd0ba464effa716735
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-private-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\siteserverui\win32\api-ms-win-crt-private-l1-1-0.dll
        • Size 71KB
        • SHA256 65ded8d2ce159b2f5569f55b2caf0e2c90f3694bd88c89de790a15a49d8386b9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-process-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\siteserverui\win32\api-ms-win-crt-process-l1-1-0.dll
        • Size 18KB
        • SHA256 c03124ba691b187917ba79078c66e12cbf5387a3741203070ba23980aa471e8b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-runtime-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\siteserverui\win32\api-ms-win-crt-runtime-l1-1-0.dll
        • Size 22KB
        • SHA256 c9bbc07a033bab6a828ecc30648b501121586f6f53346b1cd0649d7b648ea60b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-stdio-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\siteserverui\win32\api-ms-win-crt-stdio-l1-1-0.dll
        • Size 23KB
        • SHA256 b1e702b840aebe2e9244cd41512d158a43e6e9516cd2015a84eb962fa3ff0df7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-string-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\siteserverui\win32\api-ms-win-crt-string-l1-1-0.dll
        • Size 22KB
        • SHA256 73cc56f20268bfb329ccd891822e2e70dd70fe21fc7101deb3fa30c34a08450c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-time-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\siteserverui\win32\api-ms-win-crt-time-l1-1-0.dll
        • Size 20KB
        • SHA256 69885fd581641b4a680846f93c2dd21e5dd8e3ba37409783bc5b3160a919cb5d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-utility-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\siteserverui\win32\api-ms-win-crt-utility-l1-1-0.dll
        • Size 18KB
        • SHA256 a1d1d6b0cb0a8421d7c0d1297c4c389c95514493cd0a386b49dc517ac1b9a2b0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        d3dcompiler_47.dll

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\siteserverui\win32\d3dcompiler_47.dll
        • Size 3.3MB
        • SHA256 efbdbbcd0d954f8fdc53467de5d89ad525e4e4a9cfff8a15d07c6fdb350c407f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ffmpeg.dll

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\siteserverui\win32\ffmpeg.dll
        • Size 1.6MB
        • SHA256 043dddb8856f0c85b40ba2b2e92ec5b350d9efd2476c78e43de41db36a7bb71c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libEGL.dll

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\siteserverui\win32\libEGL.dll
        • Size 15KB
        • SHA256 696506310ac6089edc654f50ee8b89d623689e40af3e3064b3f9ac0eb6266d1d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libGLESv2.dll

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\siteserverui\win32\libGLESv2.dll
        • Size 2.4MB
        • SHA256 059cedea2a671d0f6a28deb45321f9172bda26848e8c816e773fcd5387feaa5f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msvcp140.dll

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\siteserverui\win32\msvcp140.dll
        • Size 429KB
        • SHA256 9c1dc36d319382e1501cdeaae36bad5b820ea84393ef6149e377d2fb2fc361a5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        node.dll

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\siteserverui\win32\node.dll
        • Size 13.5MB
        • SHA256 378691c7cec3e3b4e41b7860a3fe0be8e3ac313266d732bf52e28349cc892392
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ucrtbase.dll

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\siteserverui\win32\ucrtbase.dll
        • Size 1.1MB
        • SHA256 0bb8c77de80acf9c43de59a8fd75e611cc3eb8200c69f11e94389e8af2ceb7a9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        steamcmd.exe

        • Path C:\Users\Admin\AppData\Local\Temp\steamcmd\steamcmd.exe
        • Size 5.2MB
        • SHA256 88f791368cdb3a8c82b84d3ea53f25c18c33b425a0560d5a3f851bd709b35580
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/1888-293-0x000001DFB0200000-0x000001DFB1B7D000-memory.dmp

        memory/1888-301-0x000001DFB0200000-0x000001DFB1B7D000-memory.dmp

        memory/1888-299-0x000001DFB0200000-0x000001DFB1B7D000-memory.dmp

        memory/1888-303-0x000001DFB0200000-0x000001DFB1B7D000-memory.dmp

        memory/1888-305-0x000001DFB0200000-0x000001DFB1B7D000-memory.dmp

        memory/1888-307-0x000001DFB0200000-0x000001DFB1B7D000-memory.dmp

        memory/1888-309-0x000001DFB0200000-0x000001DFB1B7D000-memory.dmp

        memory/1888-311-0x000001DFB0200000-0x000001DFB1B7D000-memory.dmp

        memory/1888-297-0x000001DFB0200000-0x000001DFB1B7D000-memory.dmp

        memory/1888-295-0x000001DFB0200000-0x000001DFB1B7D000-memory.dmp

        memory/1888-291-0x000001DFB0200000-0x000001DFB1B7D000-memory.dmp

        memory/1888-289-0x000001DFB0200000-0x000001DFB1B7D000-memory.dmp

        memory/1888-287-0x000001DFB0200000-0x000001DFB1B7D000-memory.dmp

        memory/1888-285-0x000001DFB0200000-0x000001DFB1B7D000-memory.dmp

        memory/2488-282-0x00007FF732F60000-0x00007FF73361E000-memory.dmp