Analysis
- user interaction
yes - max time kernel
1799s - max time network
1805s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
13/08/2026, 16:25
General
- Target Big.Walk.v1.4.8.2608070648-OFME (1).torrent
- Size 65KB
- Sample260813-txecastfld
- SHA256 024668dc7ee406ff65a09aa3cb27748aa99e154a147cc583c1bf86c990c52c95
Score
9/10
Malware Config
Signatures
- Renames multiple (6112) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Contacts a large (1060) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Downloads MZ/PE file 2 IoCs
- Executes dropped EXE 31 IoCs
- Loads dropped DLL 64 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Mark of the Web detected: This indicates that the page was originally saved or cloned. 2 IoCs
- Drops file in System32 directory 12 IoCs
- Drops file in Program Files directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Modifies trusted root certificate store through registry 1 TTPs 2 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
- System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 13 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 17 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 6 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 3 IoCs
- NTFS ADS 2 IoCs
- Suspicious behavior: AddClipboardFormatListener 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 3 IoCs
- Suspicious behavior: LoadsDriver 4 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 62 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Big.Walk.v1.4.8.2608070648-OFME (1).torrent"1⤵
- Executes a command shell one-liner
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffe1dcbc728,0x7ffe1dcbc734,0x7ffe1dcbc7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,9034897269224448771,11127068740338763368,262144 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=1812 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2184,i,16143011312485331149,12279639773757447914,524288 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:112⤵
- Downloads MZ/PE file
- Mark of the Web detected: This indicates that the page was originally saved or cloned.
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2332,i,12533562892254383165,11780346949220322238,524288 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,2138492878997373071,9443886901983342694,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3188,i,17039931442200727557,9189493741542893079,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4676,i,16770098985375245251,4836692739616916914,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4844,i,5119206605470815917,4084917154851301953,524288 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4884,i,18395811427270999378,12621217618768380204,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4684,i,125642933463685794,8088816658275256509,524288 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5532,i,10743310818105489201,17100729541448757229,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5580,i,16486205556233333488,17710647215522998781,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5868,i,11157285016288195804,295136047068409939,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5572,i,14373117672103969599,6302073165070189545,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6044,i,11799786335796253585,15193747834996594317,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6128,i,9434853751760781883,7114396710993919620,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6456,i,8154870098539010639,76330422968894824,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6420,i,726493146204077569,10375563999795503365,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4884,i,6342907913600023688,14294470852452917230,524288 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3556,i,7342788019634928566,13212297192033887166,524288 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6416,i,10154192193911148870,14830233710417124974,524288 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5884,i,1412039335624722203,7562691963462346233,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6404,i,8333610222937053154,18395632830346942583,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=3052 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5904,i,7250090283420444149,6203361739095540161,524288 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=2356,i,17618546126210645553,14096418022058230394,524288 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6420,i,14435430561709817679,5106765011677409465,524288 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6664,i,9432072430840531580,2551307623383298522,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6552,i,2590178623111882882,8465976286614639708,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6612,i,7304305975650632946,416503648368353725,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6644,i,2507414908429689300,1105588156494271649,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=3564,i,11380385002790520620,2465820003986872680,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6048,i,6174858724207801521,2204688747908118578,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=3604,i,8695774327102392108,7174053829907331162,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=6676,i,16946223231149007557,685910135932818153,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=5532,i,13277770374179643865,5032635831201787005,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=6076,i,12416381756522135455,6572040440169269369,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=5768,i,7749017538669097112,10086105477036901836,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=5144,i,18002248417568267086,4098303403279161839,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=6272,i,15674816812880376944,2306122754319517624,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6516,i,1503270101040867278,13765656168472707154,524288 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=7120 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5992,i,323299294837783485,8292030739944592515,524288 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:142⤵
-
-
C:\Users\Admin\Downloads\SteamSetup.exe"C:\Users\Admin\Downloads\SteamSetup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Steam\bin\steamservice.exe"C:\Program Files (x86)\Steam\bin\steamservice.exe" /Install3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
C:\Users\Admin\Downloads\qbittorrent_5.2.3_x64_setup.exe"C:\Users\Admin\Downloads\qbittorrent_5.2.3_x64_setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\qBittorrent\qbittorrent.exe"C:\Program Files\qBittorrent\qbittorrent.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6976,i,3272771622892324870,17924099490379870418,262144 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=4652,i,8419825391545274545,285181667205371541,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=7252,i,16388639074450871050,5579582990978638104,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=7232 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=7364,i,3294877772896482988,17228243597061277456,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=7340 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=7224,i,3589553851209134719,11787166674111620318,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=7500 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=6272,i,10202308561893500432,16775442728402051977,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=7736,i,1512684018880877567,11194261646899904302,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=7756 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=7776,i,5380307067281293113,17618278221804599127,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=7912 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=5548,i,9480886396339385689,6117258123421820247,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7232,i,1016588050299696781,14598523414554387475,524288 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=7212,i,13436529484665466784,15267717139690640051,524288 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=7312 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --metrics-shmem-handle=8172,i,13973494685129799744,2334418319675704285,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=8052 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=7988,i,3919343785227558597,11836038097091054371,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --metrics-shmem-handle=6124,i,4254312805192000778,6183183697533723629,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6396,i,8263887511786263216,15236352992363808061,524288 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=7120 /prefetch:142⤵
- Modifies registry class
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=8092,i,9507922776012680178,12733794728765036075,524288 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:122⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --metrics-shmem-handle=5908,i,15938606257396662904,7320334798926184308,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=7964 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --metrics-shmem-handle=8288,i,12896558361497766976,10586969952057849616,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=8264 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --metrics-shmem-handle=8388,i,13528074094110457699,16564341512275768165,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=8532 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --metrics-shmem-handle=8664,i,2399567667660343406,7894481133547600472,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=8684 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --metrics-shmem-handle=8428,i,317333993003645648,11680766452942135886,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=8472 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --metrics-shmem-handle=8368,i,15130311928886152643,1105222906962149907,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=8872 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --metrics-shmem-handle=8800,i,14665024590763176570,17344575811928412272,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=9044 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --metrics-shmem-handle=8908,i,18282024151364213142,10276912374575909105,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=9004 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --metrics-shmem-handle=7336,i,15241220920663305050,17501734304368896525,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=8384 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --metrics-shmem-handle=7872,i,233797300594895162,17251519345344835820,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=9000 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --metrics-shmem-handle=7832,i,12268731104915696643,15675587739888369505,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=9012 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --metrics-shmem-handle=8456,i,2644843650776114359,8676559921183407769,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=8984 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --metrics-shmem-handle=8448,i,13978726550342559349,1585894614907960676,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=8512 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --metrics-shmem-handle=8064,i,6794006964420656478,3352186298877726898,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=8980 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --metrics-shmem-handle=7872,i,3711444942501014573,4144184459829601907,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=8576 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --metrics-shmem-handle=1544,i,14519089185156852995,8948163595116565019,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=8992 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --metrics-shmem-handle=4800,i,18189329514648752504,3091468798450722746,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=8944 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --metrics-shmem-handle=8960,i,8318744580357393873,15032797487285122697,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=9188 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --metrics-shmem-handle=7336,i,4918870361541057290,2979983255783177499,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=8812 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=8944,i,11861034144141627210,18064121614356896528,524288 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=8548,i,2011362253661184229,2954948981505444406,524288 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=8852 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=9084,i,8180411345893599999,17494368422614215587,524288 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=8460 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=8648,i,17351461776000547897,9451651073366313760,524288 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3792,i,11850438874544154074,1554316296334536594,524288 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --metrics-shmem-handle=3188,i,5984705926762149053,12652109596725006588,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --metrics-shmem-handle=5576,i,384359480241994121,9030899952532810802,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=9060 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --metrics-shmem-handle=8632,i,14825378448344707105,5875362129094773215,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=7336 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --metrics-shmem-handle=8300,i,2252974156781421622,1830919073329476232,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=8812 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=8568,i,5747740285316919391,2760696505141851176,524288 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=8824 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --metrics-shmem-handle=3792,i,3847132196826497586,1478651552891647872,2097152 --field-trial-handle=1816,i,6188966257468530200,4053864115699418693,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Program Files (x86)\Steam\Steam.exe"C:\Program Files (x86)\Steam\steam.exe" -silent1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies trusted root certificate store through registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies system certificate store
-
C:\Program Files (x86)\Steam\Steam.exe"C:\Program Files (x86)\Steam\Steam.exe" -silent2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
C:\Program Files (x86)\Steam\Steam.exe"C:\Program Files (x86)\Steam\Steam.exe" -silent3⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Steam\steamsysinfo.exe"C:\Program Files (x86)\Steam\steamsysinfo.exe" -steamid 0 -buildid 1785799196 -logdir "C:\Program Files (x86)\Steam\logs" -nocrashdialog -query 1 -out-file C:\Users\Admin\AppData\Local\Temp\7041.tmp4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" -nocrashdialog "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=8304" "-buildid=1785799196" "-steamid=0" "-logdir=C:\Program Files (x86)\Steam\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Program Files (x86)\Steam\clientui" "-steampath=C:\Program Files (x86)\Steam\Steam.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling "--log-file=C:\Program Files (x86)\Steam\logs\cef_log.txt" --disable-quick-menu --disable-component-update "--gaia-url=http://disabled.invalid" "--enable-features=PlatformHEVCDecoderSupport" "--disable-features=WinRetrieveSuggestionsOnlyOnDemand,SpareRendererForSitePerProcess,DcheckIsFatal,BlockPromptsIfIgnoredOften,WebUsbDeviceDetection,ValveFFmpegAllowLowDelayHEVC"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files (x86)\Steam\dumps" "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1785799196 --initial-client-data=0x2b4,0x2b8,0x2bc,0x2b0,0x2c0,0x7ffe0d6aaea0,0x7ffe0d6aaeac,0x7ffe0d6aaeb85⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=gpu-process --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1785799196 --steamid=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1840,i,14151867225282047640,14149701025594793494,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=1848 --mojo-platform-channel-handle=1800 /prefetch:25⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1785799196 --steamid=0 --field-trial-handle=2060,i,14151867225282047640,14149701025594793494,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2172 --mojo-platform-channel-handle=2168 /prefetch:115⤵
- Executes dropped EXE
- Loads dropped DLL
- System Time Discovery
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1785799196 --steamid=0 --field-trial-handle=2232,i,14151867225282047640,14149701025594793494,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2296 --mojo-platform-channel-handle=2240 /prefetch:135⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1785799196 --steamid=0 --gaia-url=http://disabled.invalid --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=4152,i,14151867225282047640,14149701025594793494,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4176 --mojo-platform-channel-handle=4172 /prefetch:15⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1785799196 --steamid=0 --field-trial-handle=5152,i,14151867225282047640,14149701025594793494,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5184 --mojo-platform-channel-handle=5172 /prefetch:145⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1785799196 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4780,i,14151867225282047640,14149701025594793494,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4804 --mojo-platform-channel-handle=4812 /prefetch:15⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1785799196 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=5480,i,14151867225282047640,14149701025594793494,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5580 --mojo-platform-channel-handle=5848 /prefetch:15⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1785799196 --steamid=0 --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5168,i,14151867225282047640,14149701025594793494,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5904 --mojo-platform-channel-handle=5892 /prefetch:105⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Program Files (x86)\Steam\bin\gldriverquery64.exe.\bin\gldriverquery64.exe4⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\gldriverquery.exe.\bin\gldriverquery.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Steam\bin\vulkandriverquery64.exe.\bin\vulkandriverquery64.exe4⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\vulkandriverquery.exe.\bin\vulkandriverquery.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Steam\bin\hardwareupdater\hardwareupdater.exe"C:\Program Files (x86)\Steam\bin\hardwareupdater\hardwareupdater.exe" --check-for-updates4⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Steam\bin\hardwareupdater\hardwareupdater.exe"C:\Program Files (x86)\Steam\bin\hardwareupdater\hardwareupdater.exe" --check-for-updates5⤵
- Executes dropped EXE
-
-
-
-
-
C:\Program Files (x86)\Common Files\Steam\steamservice.exe"C:\Program Files (x86)\Common Files\Steam\steamservice.exe" /RunAsService1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files (x86)\Common Files\Steam\steamservice.exe"C:\Program Files (x86)\Common Files\Steam\steamservice.exe" /RunAsService1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Common Files\Steam\SteamServiceTmp.exe"C:\Program Files (x86)\Common Files\Steam\SteamServiceTmp.exe" /Update2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Common Files\Steam\steamservice.exe"C:\Program Files (x86)\Common Files\Steam\steamservice.exe" /RunAsService1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004BC 0x00000000000004CC1⤵
-
C:\Program Files (x86)\Steam\steam.exe"C:\Program Files (x86)\Steam\steam.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\qBittorrent\qbittorrent.exe"C:\Program Files\qBittorrent\qbittorrent.exe" "C:\Users\Admin\Downloads\Big.Walk.v1.4.8.2608070648-OFME.torrent"2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
-
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\0e1b32220deb46a4a871652c59ca488b /t 4356 /p 29001⤵
-
C:\Program Files\qBittorrent\qbittorrent.exe"C:\Program Files\qBittorrent\qbittorrent.exe" "C:\Users\Admin\Downloads\Big.Walk.v1.4.8.2608070648-OFME.torrent"1⤵
- Executes dropped EXE
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe"C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe" -ServerName:SecHealthUI.AppX8tam42xc7v2czs3s1nt0nkxvfjtepzp9.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k WbioSvcGroup -s WbioSrvc1⤵
- Drops file in System32 directory
- Checks processor information in registry
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
2Subvert Trust Controls
2Install Root Certificate
2Replay Monitor
Loading Replay Monitor...
Downloads
service_default_Public_versions.vdf
service_log.txt
service_minimum_versions.vdf
Steam.exe
bd2b709a08caf7286f73c51d3b3937667f7aa053.jpg
SteamService.exe
config.vdf
config.vdf
config.vdf
config.vdf~RFe5d8928.TMP
btnOvrOffBottom.tga_
cloud_localfiles.tga_
icon_button_news_mousedown.tga_
tabStdBottom.tga_
steam_cloudsync.ico_
steam_cloudsync_posix.tga_
steam_tray.tga_
filter_clean_bulgarian.txt.gz_
filter_clean_schinese.txt.gz_
game_details_header_green.tga_
steambootstrapper_brazilian.txt
steambootstrapper_bulgarian.txt
steambootstrapper_czech.txt
steambootstrapper_danish.txt
steambootstrapper_dutch.txt
steambootstrapper_english.txt
steambootstrapper_finnish.txt
steambootstrapper_french.txt
steambootstrapper_german.txt
steambootstrapper_greek.txt
filter_profanity_english_cached_timestamp.txt
sharedconfig.vdf
cloud-storage-namespace-1.json
localconfig.vdf
localconfig.vdf
localconfig.vdf
localconfig.vdf
localconfig.vdf
localconfig.vdf
localconfig.vdf
localconfig.vdf.async8304.tmp
localconfig.vdf~RFe5e8a7b.TMP
qbittorrent.exe
BookmarkMergedSurfaceOrdering
f_000004
f_000006
f_000008
f_00009f
f_0000a0
f_0000a1
f_0000a2
f_0000a3
f_0000a4
f_0000ba
f_0000bb
f_0000bc
f_0000bd
f_0000be
f_0000bf
f_0000c0
f_0000c1
f_0000c6
f_0000c8
f_0000ca
f_0000cb
f_0000cc
f_0000cd
f_0000ce
f_0000cf
f_0000d0
f_0000d2
f_0000d6
f_0000d7
f_0000d8
f_0000d9
f_0000da
f_0000db
f_0000dc
f_0000dd
f_0000de
f_0000df
f_0000e7
f_0000ea
f_000164
f_000165
f_000166
f_000168
f_00016a
f_00016b
f_00016c
f_00016d
084e15af8c2e6a2c_0
3ba7f59ad0b1449f_0
715aed91e8e8fa2d_0
b737dcb1bb2faeb7_0
ee4e20765e2fd575_0
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
messages.json
craw_background.js
CURRENT
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
Secure Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index
the-real-index~RFe597390.TMP
data_0
data_1
data_2
data_3
MANIFEST-000001
index
the-real-index
the-real-index~RFe5c6d29.TMP
index.txt
index.txt
index.txt
index.txt
index.txt~RFe5c1034.TMP
MANIFEST-000001
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
the-real-index
the-real-index
the-real-index~RFe5df55f.TMP
1d58b169-3d4c-4313-9f4f-5b8ff240913d.tmp
Network Persistent State
Network Persistent State
Network Persistent State
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity~RFe5e3bde.TMP
Preferences
Preferences
Preferences~RFe5dcff5.TMP
Local State
Local State
Local State
Local State
Local State~RFe5d7e7a.TMP
System.dll
modern-wizard.bmp
nsDialogs.dll
nsExec.dll
nsProcess.dll
LangDLL.dll
UAC.dll
modern-wizard.bmp
nsisFirewallW.dll
messages.json
bv.png
mf.png
us.png
easylist.json
easyprivacy.json
pgl.json
ublock-badware.json
ublock-filters.json
urlhaus-full.json
messages.json
5d696d521de238c3.customDestinations-ms
5d696d521de238c3.customDestinations-ms
5d696d521de238c3.customDestinations-ms
5d696d521de238c3.customDestinations-ms
5d696d521de238c3.customDestinations-ms
5d696d521de238c3.customDestinations-ms
5d696d521de238c3.customDestinations-ms
5d696d521de238c3.customDestinations-ms
d356105fac5527ef.customDestinations-ms
d356105fac5527ef.customDestinations-ms
d356105fac5527ef.customDestinations-ms
d356105fac5527ef.customDestinations-ms
d356105fac5527ef.customDestinations-ms
d356105fac5527ef.customDestinations-ms
d356105fac5527ef.customDestinations-ms
qBittorrent-data.ini.lock
Big.Walk.v1.4.8.2608070648-OFME.torrent.crdownload
SteamSetup.exe
qbittorrent_5.2.3_x64_setup.exe
memory/2524-8295-0x00000000002E0000-0x0000000000792000-memory.dmp
memory/3856-15565-0x00000000006A0000-0x0000000000BA9000-memory.dmp
memory/4520-20349-0x000001AA20360000-0x000001AA20361000-memory.dmp
memory/4520-20343-0x000001AA20360000-0x000001AA20361000-memory.dmp
memory/4520-20351-0x000001AA20360000-0x000001AA20361000-memory.dmp
memory/4520-20352-0x000001AA20360000-0x000001AA20361000-memory.dmp
memory/4520-20353-0x000001AA20360000-0x000001AA20361000-memory.dmp
memory/4520-20350-0x000001AA20360000-0x000001AA20361000-memory.dmp
memory/4520-20345-0x000001AA20360000-0x000001AA20361000-memory.dmp
memory/7604-19087-0x000001883D090000-0x000001883D0ED000-memory.dmp
memory/7604-16252-0x000001883D090000-0x000001883D0ED000-memory.dmp
memory/7940-19712-0x000001EB9E4A0000-0x000001EB9E4A1000-memory.dmp
memory/7940-20423-0x000001EB9E2D0000-0x000001EB9E493000-memory.dmp
memory/8048-19742-0x000002584DE40000-0x000002584E003000-memory.dmp
memory/8048-19684-0x000002584E010000-0x000002584E011000-memory.dmp
memory/8096-20236-0x000001CB80770000-0x000001CB80771000-memory.dmp
memory/8096-20237-0x000001CBFF2F0000-0x000001CBFF34D000-memory.dmp
memory/8096-20232-0x000001CB80770000-0x000001CB80771000-memory.dmp
memory/8096-20231-0x000001CB80770000-0x000001CB80771000-memory.dmp
memory/8096-20234-0x000001CB80770000-0x000001CB80771000-memory.dmp
memory/8096-20235-0x000001CB80770000-0x000001CB80771000-memory.dmp
memory/8096-20225-0x000001CB80770000-0x000001CB80771000-memory.dmp
memory/8096-20233-0x000001CB80770000-0x000001CB80771000-memory.dmp
memory/8096-20227-0x000001CB80770000-0x000001CB80771000-memory.dmp
memory/8852-17549-0x000001EBF14C0000-0x000001EBF1683000-memory.dmp
memory/8852-15756-0x000001EBF1690000-0x000001EBF1691000-memory.dmp
memory/8852-15755-0x00007FFE3F8B0000-0x00007FFE3F8B1000-memory.dmp
memory/9564-15821-0x0000023513F10000-0x0000023513F11000-memory.dmp
memory/9564-18285-0x0000023513D40000-0x0000023513F03000-memory.dmp