Analysis
- user interaction
yes - max time kernel
1348s - max time network
812s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
02/06/2026, 01:10
Errors
Reason
Machine shutdown
General
- Target Radeon.Core.BasePatch.dll
- Size 7.8MB
- Sample260602-bjscwsat21
- SHA256 be5451c28fcf2eadb51258d5bb274df8fbf411972a2c669833a53f128d6382bd
Score
9/10
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
- Renames multiple (6139) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Downloads MZ/PE file 1 IoCs
- Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- Themida packer 28 IoCs
Detects Themida, an advanced Windows software protection system.
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 3 IoCs
- Drops desktop.ini file(s) 1 IoCs
- Drops file in System32 directory 10 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
- Access Token Manipulation: Create Process with Token 1 TTPs 6 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies trusted root certificate store through registry 1 TTPs 2 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
- System Location Discovery: System Language Discovery 1 TTPs 20 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 6 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 16 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 37 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 18 IoCs
- Modifies Internet Explorer settings 1 TTPs 29 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 4 IoCs
- NTFS ADS 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 3 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 8 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Radeon.Core.BasePatch.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Radeon.Core.BasePatch.dll,#12⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xdc,0x110,0x7ffcbfe1c728,0x7ffcbfe1c734,0x7ffcbfe1c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1604,i,16986120465940235974,5154816101841905434,262144 --field-trial-handle=1920,i,1209141227771918354,12362261879597846248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1900 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1460,i,5388254170327181534,2632663332665801617,524288 --field-trial-handle=1920,i,1209141227771918354,12362261879597846248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2264 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,2072268513410892156,5271987340252659528,524288 --field-trial-handle=1920,i,1209141227771918354,12362261879597846248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2392 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,8246820789118389316,13520152543248624693,2097152 --field-trial-handle=1920,i,1209141227771918354,12362261879597846248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3364 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3236,i,17127851155530574330,15651594207192907696,2097152 --field-trial-handle=1920,i,1209141227771918354,12362261879597846248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3500 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4444,i,8200841877680947539,14639567607620134313,2097152 --field-trial-handle=1920,i,1209141227771918354,12362261879597846248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4468 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4660,i,14910753054426770482,9995242259214922347,2097152 --field-trial-handle=1920,i,1209141227771918354,12362261879597846248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4760 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5524,i,3535834510962753227,4083340234284986748,524288 --field-trial-handle=1920,i,1209141227771918354,12362261879597846248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5532 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5904,i,13350572280501820256,12416691503486443066,2097152 --field-trial-handle=1920,i,1209141227771918354,12362261879597846248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5828 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3568,i,4582240162115535069,16162733776722586975,2097152 --field-trial-handle=1920,i,1209141227771918354,12362261879597846248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3548 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3612,i,5036085824326256364,16199398724607226825,2097152 --field-trial-handle=1920,i,1209141227771918354,12362261879597846248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6128 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4764,i,827812484321534895,795325011940605528,2097152 --field-trial-handle=1920,i,1209141227771918354,12362261879597846248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3496 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5556,i,1897089895187643678,16985315531531236538,524288 --field-trial-handle=1920,i,1209141227771918354,12362261879597846248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5844 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6692,i,6192546105938563039,16802553325671790023,524288 --field-trial-handle=1920,i,1209141227771918354,12362261879597846248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6748 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6500,i,11034748098870487785,5009040394782445517,524288 --field-trial-handle=1920,i,1209141227771918354,12362261879597846248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=216 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6640,i,9862492666111365409,3968713893904077632,524288 --field-trial-handle=1920,i,1209141227771918354,12362261879597846248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6456 /prefetch:142⤵
-
-
C:\Users\Admin\Downloads\SteamSetup.exe"C:\Users\Admin\Downloads\SteamSetup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Steam\bin\steamservice.exe"C:\Program Files (x86)\Steam\bin\steamservice.exe" /Install3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Program Files (x86)\Steam\Steam.exe"C:\Program Files (x86)\Steam\steam.exe" -silent1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies trusted root certificate store through registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Steam\Steam.exe"C:\Program Files (x86)\Steam\Steam.exe" -silent2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Steam\Steam.exe"C:\Program Files (x86)\Steam\Steam.exe" -silent3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Steam\steamsysinfo.exe"C:\Program Files (x86)\Steam\steamsysinfo.exe" -steamid 0 -buildid 1780352834 -logdir "C:\Program Files (x86)\Steam\logs" -nocrashdialog -query 1 -out-file C:\Users\Admin\AppData\Local\Temp\6032.tmp4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" -nocrashdialog "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=12920" "-buildid=1780352834" "-steamid=0" "-logdir=C:\Program Files (x86)\Steam\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Program Files (x86)\Steam\clientui" "-steampath=C:\Program Files (x86)\Steam\Steam.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling "--log-file=C:\Program Files (x86)\Steam\logs\cef_log.txt" --disable-quick-menu --disable-component-update "--gaia-url=http://disabled.invalid" "--enable-features=PlatformHEVCDecoderSupport" "--disable-features=WinRetrieveSuggestionsOnlyOnDemand,SpareRendererForSitePerProcess,DcheckIsFatal,BlockPromptsIfIgnoredOften,ValveFFmpegAllowLowDelayHEVC"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files (x86)\Steam\dumps" "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1780352834 --initial-client-data=0x294,0x298,0x29c,0x290,0x2a0,0x7ffc978eaf00,0x7ffc978eaf0c,0x7ffc978eaf185⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=gpu-process --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1780352834 --steamid=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1832,i,11917460298898017084,11276782293442332352,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=1836 --mojo-platform-channel-handle=1828 /prefetch:25⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1780352834 --steamid=0 --field-trial-handle=2064,i,11917460298898017084,11276782293442332352,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2208 --mojo-platform-channel-handle=2204 /prefetch:115⤵
- Executes dropped EXE
- Loads dropped DLL
- System Time Discovery
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1780352834 --steamid=0 --field-trial-handle=2260,i,11917460298898017084,11276782293442332352,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2424 --mojo-platform-channel-handle=2416 /prefetch:135⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1780352834 --steamid=0 --gaia-url=http://disabled.invalid --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3976,i,11917460298898017084,11276782293442332352,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=3996 --mojo-platform-channel-handle=3992 /prefetch:15⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1780352834 --steamid=0 --field-trial-handle=5028,i,11917460298898017084,11276782293442332352,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5036 --mojo-platform-channel-handle=3304 /prefetch:145⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1780352834 --steamid=0 --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5064,i,11917460298898017084,11276782293442332352,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4744 --mojo-platform-channel-handle=1392 /prefetch:105⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Program Files (x86)\Steam\bin\gldriverquery64.exe.\bin\gldriverquery64.exe4⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\gldriverquery.exe.\bin\gldriverquery.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Steam\bin\vulkandriverquery64.exe.\bin\vulkandriverquery64.exe4⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\vulkandriverquery.exe.\bin\vulkandriverquery.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Steam\steamerrorreporter64.exeC:\Program Files (x86)\Steam\steamerrorreporter64.exe -pid=129204⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
C:\Program Files (x86)\Common Files\Steam\steamservice.exe"C:\Program Files (x86)\Common Files\Steam\steamservice.exe" /RunAsService1⤵
- Executes dropped EXE
- Access Token Manipulation: Create Process with Token
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Steam\steam.exe"C:\Program Files (x86)\Steam\steam.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\ConvertToOut.gif1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/Desktop/ConvertToOut.gif"2⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x308,0x7ffcae14c188,0x7ffcae14c194,0x7ffcae14c1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1640,i,8698585104448411031,9881650443692898620,524288 --field-trial-handle=2072,i,2011970809092990503,18195873817795960880,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1512,i,13599663685472451603,5833629631354164916,262144 --field-trial-handle=2072,i,2011970809092990503,18195873817795960880,262144 --variations-seed-version --mojo-platform-channel-handle=1804 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,3862614449455911684,12325803884893925508,524288 --field-trial-handle=2072,i,2011970809092990503,18195873817795960880,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:133⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,7719491314198410518,7236488533383573021,2097152 --field-trial-handle=2072,i,2011970809092990503,18195873817795960880,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,12285106268071466250,715810968912099793,2097152 --field-trial-handle=2072,i,2011970809092990503,18195873817795960880,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4940,i,13749989987177878556,1304356594769994942,524288 --field-trial-handle=2072,i,2011970809092990503,18195873817795960880,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,13571626064363271580,7436021166594655926,524288 --field-trial-handle=2072,i,2011970809092990503,18195873817795960880,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,11476747701819463296,7944895599770927160,524288 --field-trial-handle=2072,i,2011970809092990503,18195873817795960880,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,11476747701819463296,7944895599770927160,524288 --field-trial-handle=2072,i,2011970809092990503,18195873817795960880,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,10618281902435189335,6516524456405473375,524288 --field-trial-handle=2072,i,2011970809092990503,18195873817795960880,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:143⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11284⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x23c,0x210,0x7ffcae14c188,0x7ffcae14c194,0x7ffcae14c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1624,i,7041723201814514020,12293708259463600902,524288 --field-trial-handle=2384,i,74000177544808931,3984465564641490865,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2112,i,6054405397943959981,15375447167350886934,524288 --field-trial-handle=2384,i,74000177544808931,3984465564641490865,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1496,i,5485756215716136697,11887133325968710593,262144 --field-trial-handle=2384,i,74000177544808931,3984465564641490865,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,1888685531283603504,631209057006843115,524288 --field-trial-handle=2384,i,74000177544808931,3984465564641490865,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,1888685531283603504,631209057006843115,524288 --field-trial-handle=2384,i,74000177544808931,3984465564641490865,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4812,i,15671565900787288471,1540630535917403793,524288 --field-trial-handle=2384,i,74000177544808931,3984465564641490865,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4816,i,11286090326296637980,11709093964687853007,524288 --field-trial-handle=2384,i,74000177544808931,3984465564641490865,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4820,i,17107719536254684505,10656079649886549635,524288 --field-trial-handle=2384,i,74000177544808931,3984465564641490865,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,16862020709347959564,18030532502377486511,524288 --field-trial-handle=2384,i,74000177544808931,3984465564641490865,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2648,i,5282885270431224785,2045048253537133862,524288 --field-trial-handle=2384,i,74000177544808931,3984465564641490865,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,14240072672123021777,7107754073008008625,524288 --field-trial-handle=2384,i,74000177544808931,3984465564641490865,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4724,i,10083077793235814800,1510722122158636654,524288 --field-trial-handle=2384,i,74000177544808931,3984465564641490865,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4544,i,11452768134672668033,8685931793891841340,262144 --field-trial-handle=2384,i,74000177544808931,3984465564641490865,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:104⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,3353510614446197376,1803417315049732459,524288 --field-trial-handle=2384,i,74000177544808931,3984465564641490865,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4044,i,1354979511162186319,1030261945812013836,524288 --field-trial-handle=2384,i,74000177544808931,3984465564641490865,262144 --variations-seed-version --mojo-platform-channel-handle=1032 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3232,i,11768486379791785550,558255500844895753,524288 --field-trial-handle=2384,i,74000177544808931,3984465564641490865,262144 --variations-seed-version --mojo-platform-channel-handle=3204 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3976,i,11214140201233462099,8789336180135111908,524288 --field-trial-handle=2384,i,74000177544808931,3984465564641490865,262144 --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3204,i,9342112854889474315,8179308538363960890,524288 --field-trial-handle=2384,i,74000177544808931,3984465564641490865,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Common Files\Steam\steamservice.exe"C:\Program Files (x86)\Common Files\Steam\steamservice.exe" /RunAsService1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Access Token Manipulation: Create Process with Token
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Common Files\Steam\SteamServiceTmp.exe"C:\Program Files (x86)\Common Files\Steam\SteamServiceTmp.exe" /Update2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Common Files\Steam\steamservice.exe"C:\Program Files (x86)\Common Files\Steam\steamservice.exe" /RunAsService1⤵
- Executes dropped EXE
- Loads dropped DLL
- Access Token Manipulation: Create Process with Token
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004EC1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Program Files (x86)\Steam\Steam.exe"C:\Program Files (x86)\Steam\Steam.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Steam\steamsysinfo.exe"C:\Program Files (x86)\Steam\steamsysinfo.exe" -steamid 0 -buildid 1780352834 -logdir "C:\Program Files (x86)\Steam\logs" -nocrashdialog -query 1 -out-file C:\Users\Admin\AppData\Local\Temp\974C.tmp2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" -nocrashdialog "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=20984" "-buildid=1780352834" "-steamid=0" "-logdir=C:\Program Files (x86)\Steam\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Program Files (x86)\Steam\clientui" "-steampath=C:\Program Files (x86)\Steam\Steam.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling "--log-file=C:\Program Files (x86)\Steam\logs\cef_log.txt" --disable-quick-menu --disable-component-update "--gaia-url=http://disabled.invalid" "--enable-features=PlatformHEVCDecoderSupport" "--disable-features=WinRetrieveSuggestionsOnlyOnDemand,SpareRendererForSitePerProcess,DcheckIsFatal,BlockPromptsIfIgnoredOften,ValveFFmpegAllowLowDelayHEVC"2⤵
- Executes dropped EXE
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files (x86)\Steam\dumps" "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1780352834 --initial-client-data=0x28c,0x290,0x294,0x288,0x298,0x7ffc978eaf00,0x7ffc978eaf0c,0x7ffc978eaf183⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=gpu-process --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1780352834 --steamid=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1788,i,9372171592128332169,14863125077321788007,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=1792 --mojo-platform-channel-handle=1780 /prefetch:23⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1780352834 --steamid=0 --field-trial-handle=2128,i,9372171592128332169,14863125077321788007,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2192 --mojo-platform-channel-handle=2188 /prefetch:113⤵
- Executes dropped EXE
- System Time Discovery
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1780352834 --steamid=0 --field-trial-handle=2256,i,9372171592128332169,14863125077321788007,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2276 --mojo-platform-channel-handle=2272 /prefetch:133⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1780352834 --steamid=0 --gaia-url=http://disabled.invalid --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3916,i,9372171592128332169,14863125077321788007,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=3936 --mojo-platform-channel-handle=3932 /prefetch:13⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1780352834 --steamid=0 --field-trial-handle=4944,i,9372171592128332169,14863125077321788007,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4960 --mojo-platform-channel-handle=4956 /prefetch:143⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1780352834 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4708,i,9372171592128332169,14863125077321788007,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5072 --mojo-platform-channel-handle=5068 /prefetch:13⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1780352834 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=5480,i,9372171592128332169,14863125077321788007,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5324 --mojo-platform-channel-handle=5304 /prefetch:13⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1780352834 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4568,i,9372171592128332169,14863125077321788007,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=644 --mojo-platform-channel-handle=4552 /prefetch:13⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1780352834 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5824,i,9372171592128332169,14863125077321788007,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4556 --mojo-platform-channel-handle=5244 /prefetch:13⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1780352834 --steamid=0 --field-trial-handle=5268,i,9372171592128332169,14863125077321788007,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5304 --mojo-platform-channel-handle=5544 /prefetch:123⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1780352834 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5520,i,9372171592128332169,14863125077321788007,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5972 --mojo-platform-channel-handle=5976 /prefetch:13⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1780352834 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5964,i,9372171592128332169,14863125077321788007,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=6008 --mojo-platform-channel-handle=4308 /prefetch:13⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1780352834 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5044,i,9372171592128332169,14863125077321788007,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5052 --mojo-platform-channel-handle=5896 /prefetch:13⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1780352834 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=6124,i,9372171592128332169,14863125077321788007,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=6080 --mojo-platform-channel-handle=6092 /prefetch:13⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1780352834 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5560,i,9372171592128332169,14863125077321788007,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5988 --mojo-platform-channel-handle=5060 /prefetch:13⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1780352834 --steamid=0 --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5724,i,9372171592128332169,14863125077321788007,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5100 --mojo-platform-channel-handle=4608 /prefetch:103⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1780352834 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5848,i,9372171592128332169,14863125077321788007,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5952 --mojo-platform-channel-handle=5704 /prefetch:13⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1780352834 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5164,i,9372171592128332169,14863125077321788007,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5156 --mojo-platform-channel-handle=5828 /prefetch:13⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1780352834 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=6020,i,9372171592128332169,14863125077321788007,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=6068 --mojo-platform-channel-handle=6048 /prefetch:13⤵
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1780352834 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=5140,i,9372171592128332169,14863125077321788007,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5692 --mojo-platform-channel-handle=5840 /prefetch:13⤵
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1780352834 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=3080,i,9372171592128332169,14863125077321788007,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2804 --mojo-platform-channel-handle=5852 /prefetch:13⤵
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1780352834 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=5244,i,9372171592128332169,14863125077321788007,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5176 --mojo-platform-channel-handle=5868 /prefetch:13⤵
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1780352834 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=5684,i,9372171592128332169,14863125077321788007,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5804 --mojo-platform-channel-handle=5692 /prefetch:13⤵
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1780352834 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=5932,i,9372171592128332169,14863125077321788007,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5320 --mojo-platform-channel-handle=5264 /prefetch:13⤵
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1780352834 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=5728,i,9372171592128332169,14863125077321788007,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=6068 --mojo-platform-channel-handle=5924 /prefetch:13⤵
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1780352834 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=4584,i,9372171592128332169,14863125077321788007,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5900 --mojo-platform-channel-handle=5992 /prefetch:13⤵
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1780352834 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --field-trial-handle=5944,i,9372171592128332169,14863125077321788007,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5692 --mojo-platform-channel-handle=1540 /prefetch:13⤵
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1780352834 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --field-trial-handle=5472,i,9372171592128332169,14863125077321788007,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=6036 --mojo-platform-channel-handle=5664 /prefetch:13⤵
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1780352834 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --field-trial-handle=5076,i,9372171592128332169,14863125077321788007,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5260 --mojo-platform-channel-handle=5992 /prefetch:13⤵
-
-
-
C:\Program Files (x86)\Steam\bin\gldriverquery64.exe.\bin\gldriverquery64.exe2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\gldriverquery.exe.\bin\gldriverquery.exe2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\vulkandriverquery64.exe.\bin\vulkandriverquery64.exe2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\vulkandriverquery.exe.\bin\vulkandriverquery.exe2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\SteamService.exe"C:\Program Files (x86)\Steam\bin\SteamService.exe" /installscript "C:\Program Files (x86)\Steam\steamapps\common\RecRoom\runasadmin.vdf" 4717102⤵
- Executes dropped EXE
- Access Token Manipulation: Create Process with Token
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Steam\steamapps\common\RecRoom\RefereeClientInstaller.exe"C:\Program Files (x86)\Steam\steamapps\common\RecRoom\RefereeClientInstaller.exe" -install3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2019\Microsoft Visual C++ 2019 x86.cmd" "3⤵
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2019\VC_redist.x86.exe"C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2019\\VC_redist.x86.exe" /q /norestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{355B02AF-3E90-4B4C-A286-D04D489F8E01}\.cr\VC_redist.x86.exe"C:\Windows\Temp\{355B02AF-3E90-4B4C-A286-D04D489F8E01}\.cr\VC_redist.x86.exe" -burn.clean.room="C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2019\VC_redist.x86.exe" -burn.filehandle.attached=748 -burn.filehandle.self=752 /q /norestart5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2019\Microsoft Visual C++ 2019 x64.cmd" "3⤵
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2019\VC_redist.x64.exe"C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2019\\VC_redist.x64.exe" /q /norestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{C23FC8F4-D607-4AD6-926D-C82F98C24CAF}\.cr\VC_redist.x64.exe"C:\Windows\Temp\{C23FC8F4-D607-4AD6-926D-C82F98C24CAF}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2019\VC_redist.x64.exe" -burn.filehandle.attached=576 -burn.filehandle.self=584 /q /norestart5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Program Files (x86)\Steam\steamapps\common\RecRoom\Recroom_Release.exe"C:\Program Files (x86)\Steam\steamapps\common\RecRoom\Recroom_Release.exe" +forcemode:screen2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Program Files (x86)\Steam\steamapps\common\RecRoom\RecRoom.exe"C:\Program Files (x86)\Steam\steamapps\common\RecRoom\RecRoom.exe" +forcemode:screen3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Modifies system certificate store
- NTFS ADS
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
-
C:\Program Files (x86)\Steam\steamapps\common\RecRoom\UnityCrashHandler64.exe"C:\Program Files (x86)\Steam\steamapps\common\RecRoom\UnityCrashHandler64.exe" --attach 26708 28549857976324⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Program Files (x86)\Steam\steamapps\common\RecRoom\UnityCrashHandler64.exe"C:\Program Files (x86)\Steam\steamapps\common\RecRoom\UnityCrashHandler64.exe" "26708" "2854985797632"5⤵
- Executes dropped EXE
-
-
-
-
-
C:\Program Files (x86)\Steam\gameoverlayui64.exe"C:\Program Files (x86)\Steam\gameoverlayui64.exe" -pid 26708 -steampid 20984 -manuallyclearframes 0 -gameid 4717102⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Program Files (x86)\Steam\Steam.exe"C:\Program Files (x86)\Steam\Steam.exe"2⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Steam\steamsysinfo.exe"C:\Program Files (x86)\Steam\steamsysinfo.exe" -steamid 0 -buildid 1780352834 -logdir "C:\Program Files (x86)\Steam\logs" -nocrashdialog -query 1 -out-file C:\Users\Admin\AppData\Local\Temp\918B.tmp3⤵
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" -nocrashdialog "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=9760" "-buildid=1780352834" "-steamid=0" "-logdir=C:\Program Files (x86)\Steam\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Program Files (x86)\Steam\clientui" "-steampath=C:\Program Files (x86)\Steam\Steam.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling "--log-file=C:\Program Files (x86)\Steam\logs\cef_log.txt" --disable-quick-menu --disable-component-update "--gaia-url=http://disabled.invalid" "--enable-features=PlatformHEVCDecoderSupport" "--disable-features=WinRetrieveSuggestionsOnlyOnDemand,SpareRendererForSitePerProcess,DcheckIsFatal,BlockPromptsIfIgnoredOften,ValveFFmpegAllowLowDelayHEVC"3⤵
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files (x86)\Steam\dumps" "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1780352834 --initial-client-data=0x29c,0x7c,0x2a0,0x298,0x2a4,0x7ffc97ecaf00,0x7ffc97ecaf0c,0x7ffc97ecaf184⤵
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=gpu-process --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1780352834 --steamid=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1828,i,2649729895069860596,9609417123105413327,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=1840 --mojo-platform-channel-handle=1824 /prefetch:24⤵
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1780352834 --steamid=0 --field-trial-handle=2184,i,2649729895069860596,9609417123105413327,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2188 --mojo-platform-channel-handle=2180 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1780352834 --steamid=0 --field-trial-handle=2256,i,2649729895069860596,9609417123105413327,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2280 --mojo-platform-channel-handle=2276 /prefetch:134⤵
-
-
-
C:\Program Files (x86)\Steam\bin\gldriverquery64.exe.\bin\gldriverquery64.exe3⤵
-
-
C:\Program Files (x86)\Steam\bin\gldriverquery.exe.\bin\gldriverquery.exe3⤵
-
-
C:\Program Files (x86)\Steam\bin\vulkandriverquery64.exe.\bin\vulkandriverquery64.exe3⤵
-
-
C:\Program Files (x86)\Steam\bin\vulkandriverquery.exe.\bin\vulkandriverquery.exe3⤵
-
-
-
C:\Program Files (x86)\Common Files\Steam\steamservice.exe"C:\Program Files (x86)\Common Files\Steam\steamservice.exe" /RunAsService1⤵
- Executes dropped EXE
- Access Token Manipulation: Create Process with Token
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files (x86)\Steam\steamapps\common\RecRoom\RefereeClientApp.exe"C:\Program Files (x86)\Steam\steamapps\common\RecRoom\RefereeClientApp.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Program Files (x86)\Steam\steamapps\common\RecRoom\RefereeClientApp.exe"C:\Program Files (x86)\Steam\steamapps\common\RecRoom\RefereeClientApp.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004EC1⤵
-
C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe"C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub notifications1⤵
-
C:\Program Files (x86)\Common Files\Steam\steamservice.exe"C:\Program Files (x86)\Common Files\Steam\steamservice.exe" /RunAsService1⤵
- Access Token Manipulation: Create Process with Token
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3928055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Access Token Manipulation
1Create Process with Token
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Access Token Manipulation
1Create Process with Token
1Modify Registry
3Subvert Trust Controls
3Install Root Certificate
2SIP and Trust Provider Hijacking
1Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
SteamService.dll
SteamServiceTmp.exe
cpuidsdk.dll
crashhandler.dll
drivers.exe.new
secure_desktop_capture.exe
service_default_Public_versions.vdf
service_minimum_versions.vdf
steamerrorreporter.exe
steamxboxutil64.exe
Steam.exe
appinfo.vdf
appinfo.vdf~RFe5feb15.TMP
bd2b709a08caf7286f73c51d3b3937667f7aa053.jpg
795e85364189511f4990861b578084deef086cb1.jpg
SteamService.exe
config.vdf
config.vdf
config.vdf
config.vdf
config.vdf
config.vdf
config.vdf~RFe5a78fa.TMP
settings.dat
cef_log.txt
cef_log.txt
cef_log.txt
btnOvrOffBottom.tga_
cloud_localfiles.tga_
icon_button_news_mousedown.tga_
tabStdBottom.tga_
steam_cloudsync.ico_
steam_cloudsync_posix.tga_
steam_tray.tga_
filter_clean_bulgarian.txt.gz_
filter_clean_schinese.txt.gz_
game_details_header_green.tga_
steambootstrapper_brazilian.txt
steambootstrapper_bulgarian.txt
steambootstrapper_czech.txt
steambootstrapper_danish.txt
steambootstrapper_dutch.txt
steambootstrapper_english.txt
steambootstrapper_finnish.txt
steambootstrapper_french.txt
steambootstrapper_german.txt
steambootstrapper_greek.txt
steambootstrapper_hungarian.txt
steambootstrapper_indonesian.txt
steambootstrapper_italian.txt
steambootstrapper_japanese.txt
steambootstrapper_koreana.txt
steambootstrapper_latam.txt
steambootstrapper_norwegian.txt
steambootstrapper_polish.txt
steambootstrapper_portuguese.txt
steambootstrapper_romanian.txt
steambootstrapper_russian.txt
steambootstrapper_schinese.txt
steambootstrapper_spanish.txt
steambootstrapper_swedish.txt
steambootstrapper_tchinese.txt
steambootstrapper_thai.txt
steambootstrapper_turkish.txt
steambootstrapper_ukrainian.txt
steambootstrapper_vietnamese.txt
filter_banned_english_cached_timestamp.txt
appmanifest_228980.acf
appmanifest_228980.acf
appmanifest_228980.acf~RFe604f5c.TMP
appmanifest_471710.acf
appmanifest_471710.acf
appmanifest_471710.acf
appmanifest_471710.acf
appmanifest_471710.acf
appmanifest_471710.acf
appmanifest_471710.acf
appmanifest_471710.acf~RFe604f7c.TMP
lib_burst_generated.dll
ucrtbased.dll
006e8cde54a3b51af767c9683fcafc75.bundle
0be4fb226ecad744f98890aa366c3d25.bundle
1494e3cd3164a64a2567fb35ca24957c.bundle
21c9259eee966b0fb6b2931277636231.bundle
33c71aa267272d84f3110cd852102bbc.bundle
34a9ca41f4579cb43da9172b8bf554d6.bundle
3731b6494959adf05405ad3a4da47bee.bundle
3cf8ff7ed525fe73d6c68e8dc2c2a9fc.bundle
4056f2fc0e2635c36096ef5d5294708e.bundle
4c763cf4d5019976381d3d28935ea2a0.bundle
4e1859d10aff3ab47c724b035f4bbadd.bundle
61a6dead81348303d9184b6b38266287.bundle
63e4cc31a156ae52c04be1cb2749c4ce.bundle
64f7d9e3a97213700dd64fdb10d86fd2.bundle
68313912f8e9528cf3cb21d3e84e270c.bundle
719628ff260b74ead402162674bd8c57.bundle
75bf8668a3a6d7e6ecac2102233ecb46.bundle
761f288f3ded0ce39b0ae72acb21013d.bundle
77ea7f3e16c479c388e138a2de921376.bundle
828e48614dfc278c5cdd1770b8db2c65.bundle
90bc02aec967df895f51cc0f73895da2.bundle
9580977251483283886c4e0d0833dece.bundle
96a9ca784433befa5280ecb885211558.bundle
97786061cffab83e9e176deacf3a310e.bundle
a4032d0817db75572bda5bf951d244f8.bundle
a445a70281c4a1d0594946deec9058e9.bundle
a85f2b6f3d8c238d6dd0fb1d894c0228.bundle
b1737eec1acaf0bd027c52649fb58e2a.bundle
bb54dbdd43eeac0671710b11b9c4e47b.bundle
c40580030593b233b349d276cc5d99fe.bundle
d37aa2e80bd056ef71458502f51c8ac1.bundle
e2b03cb197063088b7652cf390d85ff5.bundle
e36425f3542cdbae2492b3d90f3a7342.bundle
ee61d0666426349289ae3758fd511a22.bundle
f7d59a8baaf1f48d085b7f45da9ddfc6.bundle
level12
level18
level19
level20
level26
level34
level35
level36
level40
level42
level47
level57
level58
level68
level84
level88.resS
sharedassets0.assets
sharedassets10.assets
sharedassets103.resource
sharedassets12.assets
sharedassets16.assets
sharedassets17.assets.resS
sharedassets26.assets.resS
sharedassets31.assets
sharedassets50.assets
sharedassets52.assets.resS
sharedassets59.resource
sharedassets6.assets
sharedassets6.resource
sharedassets61.resource
sharedassets66.assets.resS
sharedassets68.assets.resS
sharedassets7.resource
sharedassets80.resource
sharedassets84.resource
sharedassets86.assets.resS
sharedassets98.resource
RefereeClientInstaller.exe
UnityPlayer.dll
Microsoft Visual C++ 2019 x64.cmd
Microsoft Visual C++ 2019 x86.cmd
VC_redist.x64.exe
VC_redist.x86.exe
installscript.vdf
063b6b6653aa642616fd21d3d4701899.bundle
0976d161a414d8d74fb22d37753aed65.bundle
16079ee01a0c29220760d8ebfcde3a67.bundle
18c123d6ac91200e89ad964373be8ed2.bundle
18ef1d8f9bbcd55ad98f5cf5c94cae8a.bundle
1a69c270f22345b84a4334a6d1fed7b4.bundle
1b69480d3296b3891f38ea4b04959017.bundle
27c8f43883158dff116e8ceb3959b564.bundle
3767bac4f4b11c4e127cde438f011a81.bundle
4f4a16365268bfd7d104e078af3de3e0.bundle
644d5b01259b0ca5686e0d4faa6b4cb8.bundle
6ba20137168b2020d7616f0163182e9d.bundle
77cecfb8a6a26a9e076008992ce56fc3.bundle
95dc9c097914b8ac0ebbdbb8718ba23f.bundle
9fbf72920ec531046a834462719eb0d4.bundle
e84539de527a78a108b8d52aa73c75a6.bundle
ef171c2b180dee3d018e9145c11c71dc.bundle
level104
level113
level41
level46
level48
level52
level53
level66
level67
level7
level75
level76
level80
level85
level86
level88
level91
level93
level94
level95
level97
level98
sharedassets10.assets.resS
sharedassets102.assets.resS
sharedassets103.assets.resS
sharedassets104.resource
sharedassets107.assets
sharedassets107.resource
sharedassets11.assets.resS
sharedassets12.assets.resS
sharedassets13.assets.resS
sharedassets18.assets
sharedassets18.assets.resS
sharedassets19.assets.resS
sharedassets21.assets.resS
sharedassets29.assets.resS
sharedassets3.resource
sharedassets30.resource
sharedassets31.assets.resS
sharedassets32.assets
sharedassets32.assets.resS
sharedassets35.assets.resS
sharedassets36.resource
sharedassets38.assets.resS
sharedassets39.assets.resS
sharedassets5.assets
sharedassets5.assets.resS
sharedassets50.assets.resS
sharedassets53.assets.resS
sharedassets54.resource
sharedassets55.assets
sharedassets55.assets.resS
sharedassets56.resource
sharedassets60.assets.resS
sharedassets63.resource
sharedassets64.assets.resS
sharedassets65.assets
sharedassets65.assets.resS
sharedassets66.assets
sharedassets67.resource
sharedassets69.assets.resS
sharedassets70.assets
sharedassets70.resource
sharedassets71.resource
sharedassets72.assets.resS
sharedassets72.resource
sharedassets74.assets.resS
sharedassets75.assets.resS
sharedassets76.assets.resS
sharedassets76.resource
sharedassets78.assets
sharedassets78.resource
sharedassets79.assets
sharedassets8.resource
sharedassets80.assets.resS
sharedassets81.assets
sharedassets82.assets.resS
sharedassets83.assets.resS
sharedassets84.assets
sharedassets84.assets.resS
sharedassets85.assets
sharedassets87.assets.resS
sharedassets88.assets.resS
sharedassets89.assets.resS
sharedassets9.assets
sharedassets9.assets.resS
sharedassets91.assets.resS
sharedassets92.assets.resS
sharedassets93.assets.resS
sharedassets97.assets
sharedassets98.assets
libraryfolders.vdf
libraryfolders.vdf
libraryfolders.vdf
sharedconfig.vdf
sharedconfig.vdf
228980.json
471710.json
localconfig.vdf
localconfig.vdf
localconfig.vdf
localconfig.vdf
localconfig.vdf
localconfig.vdf~RFe5fb7b0.TMP
gamerecording.pb~RFe6b0e37.TMP
Library
Library
1.data
2.data
3.data
4.data
5.data
6.data
7.data
8.data
c
e
anrTime
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
the-real-index
data_1
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe58b755.TMP
Local State
Local State
Local State
Local State
Local State
settings.dat
settings.dat
settings.dat
settings.dat
settings.dat
LOG.old
BrowsingTopicsState
SiteList-Enterprise.json
HubApps
Network Persistent State
Network Persistent State
Sdch Dictionaries
TransportSecurity
Preferences
Secure Preferences
sync_diagnostic.log
wallet-checkout-eligible-sites.json
wallet-notification-config.json
wallet-stable.json
wallet-tokenization-config.json
Local State
Local State
Local State
Local State
Local State
typosquatting_list.pb
metadata.json
metadata.json
metadata.json
metadata.json
d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
metadata.json
SearchHoverUnifiedTileModelCache.dat
f_000007
f_00000a
f_00000b
f_00000d
f_00000f
f_000011
f_000013
f_000021
f_000053
the-real-index
the-real-index
the-real-index
the-real-index~RFe5aca27.TMP
index
MANIFEST-000001
data_0
data_2
data_3
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State~RFe5b87da.TMP
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity~RFe5b11b0.TMP
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences~RFe5acf28.TMP
CURRENT
c3990bfa-d29f-4f6a-b443-7810e4fb774d.tmp
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State~RFe5a61a9.TMP
Variations
StdUtils.dll
System.dll
modern-wizard.bmp
nsDialogs.dll
nsExec.dll
nsProcess.dll
default.dic
d356105fac5527ef.customDestinations-ms
d356105fac5527ef.customDestinations-ms
d356105fac5527ef.customDestinations-ms
d356105fac5527ef.customDestinations-ms
d356105fac5527ef.customDestinations-ms
d356105fac5527ef.customDestinations-ms
d356105fac5527ef.customDestinations-ms
d356105fac5527ef.customDestinations-ms
d356105fac5527ef.customDestinations-ms
d356105fac5527ef.customDestinations-ms
d356105fac5527ef.customDestinations-ms
d356105fac5527ef.customDestinations-ms
d356105fac5527ef.customDestinations-ms
Rec Room.url
SteamSetup.exe:Zone.Identifier
Unconfirmed 369159.crdownload
desktop.ini
notification_fast.bundle.js.LICENSE.txt
tokenized-card.bundle.js.LICENSE.txt
strings.json
manifest.json
data.txt
manifest.json
manifest.json
manifest.json
logo.png
wixstdba.dll
memory/900-17590-0x0000026171B00000-0x0000026171BEA000-memory.dmp
memory/1120-17617-0x000002239A450000-0x000002239A53A000-memory.dmp
memory/1176-7231-0x0000000000EB0000-0x0000000001362000-memory.dmp
memory/1752-17739-0x000001B5A7B00000-0x000001B5A7BEA000-memory.dmp
memory/4488-17824-0x000002035AC60000-0x000002035AD4A000-memory.dmp
memory/4488-24637-0x000002035AC60000-0x000002035AD4A000-memory.dmp
memory/5108-17815-0x00000253618A0000-0x00000253618A1000-memory.dmp
memory/5108-17796-0x00000253618A0000-0x00000253618A1000-memory.dmp
memory/5108-17795-0x00000253618A0000-0x00000253618A1000-memory.dmp
memory/5108-17797-0x00000253618A0000-0x00000253618A1000-memory.dmp
memory/5108-17816-0x00000253618A0000-0x00000253618A1000-memory.dmp
memory/5108-17817-0x00000253618A0000-0x00000253618A1000-memory.dmp
memory/5108-17818-0x00000253618A0000-0x00000253618A1000-memory.dmp
memory/5108-17819-0x00000253618A0000-0x00000253618A1000-memory.dmp
memory/5108-17820-0x00000253618A0000-0x00000253618A1000-memory.dmp
memory/5220-14171-0x0000000000960000-0x0000000000E69000-memory.dmp
memory/13532-14227-0x00007FFCCEC80000-0x00007FFCCEC81000-memory.dmp
memory/13532-14226-0x00007FFCCE800000-0x00007FFCCE801000-memory.dmp
memory/13532-16143-0x0000017E0EE60000-0x0000017E0EF4A000-memory.dmp
memory/13532-14557-0x0000017E0EE60000-0x0000017E0EF4A000-memory.dmp
memory/16520-30737-0x000001D12FD40000-0x000001D12FD54000-memory.dmp
memory/16520-30731-0x000001D115700000-0x000001D11572C000-memory.dmp
memory/16520-30736-0x000001D12FD60000-0x000001D12FD82000-memory.dmp
memory/16520-30735-0x000001D1310B0000-0x000001D131158000-memory.dmp
memory/16520-30733-0x000001D12FCE0000-0x000001D12FCE8000-memory.dmp
memory/16520-30732-0x000001D12FCB0000-0x000001D12FCBA000-memory.dmp
memory/16576-14803-0x00000228B0AC0000-0x00000228B0BAA000-memory.dmp
memory/18500-15861-0x0000022CD1880000-0x0000022CD1881000-memory.dmp
memory/18500-15871-0x0000022CD1880000-0x0000022CD1881000-memory.dmp
memory/18500-15866-0x0000022CD1880000-0x0000022CD1881000-memory.dmp
memory/18500-15872-0x0000022CD1880000-0x0000022CD1881000-memory.dmp
memory/18500-15862-0x0000022CD1880000-0x0000022CD1881000-memory.dmp
memory/18500-15868-0x0000022CD1880000-0x0000022CD1881000-memory.dmp
memory/18500-15860-0x0000022CD1880000-0x0000022CD1881000-memory.dmp
memory/18500-15869-0x0000022CD1880000-0x0000022CD1881000-memory.dmp
memory/18500-15867-0x0000022CD1880000-0x0000022CD1881000-memory.dmp
memory/18500-15870-0x0000022CD1880000-0x0000022CD1881000-memory.dmp
memory/21480-16288-0x0000022DF5180000-0x0000022DF526A000-memory.dmp
memory/21872-20190-0x0000026A04810000-0x0000026A048FA000-memory.dmp
memory/21872-28857-0x0000026A04810000-0x0000026A048FA000-memory.dmp
memory/21872-16289-0x0000026A04810000-0x0000026A048FA000-memory.dmp
memory/24048-28799-0x0000023A88690000-0x0000023A8877A000-memory.dmp
memory/24736-28991-0x0000000140000000-0x0000000140A93000-memory.dmp
memory/24736-28997-0x0000000140000000-0x0000000140A93000-memory.dmp
memory/24736-17035-0x000001A6A49E0000-0x000001A6A4ACA000-memory.dmp
memory/24736-28940-0x0000000140000000-0x0000000140A93000-memory.dmp
memory/24736-28993-0x0000000140000000-0x0000000140A93000-memory.dmp
memory/24736-28992-0x0000000140000000-0x0000000140A93000-memory.dmp
memory/24736-28990-0x0000000140000000-0x0000000140A93000-memory.dmp
memory/25492-17530-0x000002B3BA190000-0x000002B3BA27A000-memory.dmp
memory/26024-29008-0x000001A1A0770000-0x000001A1A0771000-memory.dmp
memory/26024-29011-0x00007FFCCC560000-0x00007FFCCC566000-memory.dmp
memory/26024-29009-0x000001A1A0780000-0x000001A1A0781000-memory.dmp
memory/26120-29021-0x0000000140000000-0x0000000140A93000-memory.dmp
memory/26120-29096-0x0000000001970000-0x00000000023C0000-memory.dmp
memory/26120-29044-0x0000000140000000-0x0000000140A93000-memory.dmp
memory/26120-29738-0x0000000140000000-0x0000000140A93000-memory.dmp
memory/26120-29045-0x0000000140000000-0x0000000140A93000-memory.dmp
memory/26120-29043-0x0000000140000000-0x0000000140A93000-memory.dmp
memory/26120-29042-0x0000000140000000-0x0000000140A93000-memory.dmp
memory/26120-29102-0x0000000001970000-0x00000000023C0000-memory.dmp
memory/26120-29103-0x0000000001970000-0x00000000023C0000-memory.dmp
memory/26120-30603-0x0000000140000000-0x0000000140A93000-memory.dmp
memory/26120-29106-0x0000000001970000-0x00000000023C0000-memory.dmp
memory/26120-29105-0x0000000001970000-0x00000000023C0000-memory.dmp
memory/26120-29093-0x0000000001970000-0x00000000023C0000-memory.dmp
memory/26120-29079-0x0000000001970000-0x00000000023C0000-memory.dmp
memory/26120-29101-0x0000000001970000-0x00000000023C0000-memory.dmp
memory/26120-29099-0x0000000001970000-0x00000000023C0000-memory.dmp
memory/26120-29094-0x0000000001970000-0x00000000023C0000-memory.dmp
memory/26120-29095-0x0000000001970000-0x00000000023C0000-memory.dmp
memory/26120-29097-0x0000000001970000-0x00000000023C0000-memory.dmp
memory/26120-29100-0x0000000001970000-0x00000000023C0000-memory.dmp
memory/26120-29098-0x0000000001970000-0x00000000023C0000-memory.dmp
memory/26120-29092-0x0000000001970000-0x00000000023C0000-memory.dmp
memory/26708-30495-0x00007FF720FC0000-0x00007FF721066000-memory.dmp
memory/26708-30569-0x00007FFC787D0000-0x00007FFC7A81A000-memory.dmp
memory/26708-29128-0x00007FF720FC0000-0x00007FF721066000-memory.dmp
memory/26708-29139-0x00007FFC787D0000-0x00007FFC7A81A000-memory.dmp
memory/26708-30499-0x00007FFC787D0000-0x00007FFC7A81A000-memory.dmp