Analysis
- geolocation tags
- user interaction
yes - max time kernel
1800s - max time network
1794s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/09/2026, 02:24
General
- Target xyfer..dll
- Size 605KB
- Sample260910-cv2alstfqd
- SHA256 34e932f5cb2a8289ad417fe21daa2e83880b892203b014c31983c36d17217113
Score
9/10
Malware Config
Signatures
- Renames multiple (6111) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Downloads MZ/PE file 5 IoCs
- Checks computer location settings 2 TTPs 23 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- Adds Run key to start application 2 TTPs 3 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 64 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Modifies trusted root certificate store through registry 1 TTPs 2 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
- System Location Discovery: System Language Discovery 1 TTPs 26 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 10 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 28 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 19 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 13 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 11 IoCs
- Opens file in notepad (likely ransom note) 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 26 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\xyfer..dll,#11⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc3eb5c728,0x7ffc3eb5c734,0x7ffc3eb5c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,13215743577726663037,15992838766506939818,262144 --field-trial-handle=1956,i,10789753417894327876,14065525246116683825,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1952 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1620,i,9889155272339276508,17411550945588177540,524288 --field-trial-handle=1956,i,10789753417894327876,14065525246116683825,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2288 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,1356894329148311659,17288821453075999857,524288 --field-trial-handle=1956,i,10789753417894327876,14065525246116683825,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2472 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,13991006060905462050,5544306043169703654,2097152 --field-trial-handle=1956,i,10789753417894327876,14065525246116683825,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3232 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3260,i,18362257613971220841,5045032422845561975,2097152 --field-trial-handle=1956,i,10789753417894327876,14065525246116683825,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3236 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4432,i,10206091053731540475,4554149996804624065,2097152 --field-trial-handle=1956,i,10789753417894327876,14065525246116683825,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4476 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4732,i,11243111536537227319,11219640413324879088,2097152 --field-trial-handle=1956,i,10789753417894327876,14065525246116683825,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4696 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4984,i,842617835579262620,6618647511922913017,2097152 --field-trial-handle=1956,i,10789753417894327876,14065525246116683825,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4996 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5700,i,10584582648496446155,4805990470352927315,524288 --field-trial-handle=1956,i,10789753417894327876,14065525246116683825,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5684 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3684,i,17940115580292645566,3630031707081948899,2097152 --field-trial-handle=1956,i,10789753417894327876,14065525246116683825,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3204 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5744,i,3256606468916815666,4805004594461941074,2097152 --field-trial-handle=1956,i,10789753417894327876,14065525246116683825,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3296 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3604,i,5572820531981660391,10490010466480201481,2097152 --field-trial-handle=1956,i,10789753417894327876,14065525246116683825,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3988 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6124,i,11189010139321765236,9930332676769355801,2097152 --field-trial-handle=1956,i,10789753417894327876,14065525246116683825,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6168 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5072,i,6699997350190103135,6633805579097058610,2097152 --field-trial-handle=1956,i,10789753417894327876,14065525246116683825,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3648 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3340,i,2046082778328930341,1138579937494964972,524288 --field-trial-handle=1956,i,10789753417894327876,14065525246116683825,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5972 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5112,i,12573433732648580426,4849667588289134535,524288 --field-trial-handle=1956,i,10789753417894327876,14065525246116683825,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5012 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3312,i,1025197513330375261,5986714231966086351,524288 --field-trial-handle=1956,i,10789753417894327876,14065525246116683825,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4988 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3600,i,17969406778999691585,17447012710141054917,524288 --field-trial-handle=1956,i,10789753417894327876,14065525246116683825,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5148 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6268,i,669769074822778082,16313799139243913646,2097152 --field-trial-handle=1956,i,10789753417894327876,14065525246116683825,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5700 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4976,i,6112955627059615228,9124813703531924350,524288 --field-trial-handle=1956,i,10789753417894327876,14065525246116683825,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4516 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\SteamSetup.exe"C:\Users\Admin\Downloads\SteamSetup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Steam\bin\steamservice.exe"C:\Program Files (x86)\Steam\bin\steamservice.exe" /Install3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6448,i,4963825323510217477,12717803052026583019,524288 --field-trial-handle=1956,i,10789753417894327876,14065525246116683825,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6472 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5932,i,12029337602866332100,15384431298731727640,262144 --field-trial-handle=1956,i,10789753417894327876,14065525246116683825,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5908 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5584,i,10916727807800664468,18114431194360924469,524288 --field-trial-handle=1956,i,10789753417894327876,14065525246116683825,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1132 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=4120,i,18326532627961944689,734751340661552796,2097152 --field-trial-handle=1956,i,10789753417894327876,14065525246116683825,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6572 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6608,i,18315825350190510509,2945486749739609439,2097152 --field-trial-handle=1956,i,10789753417894327876,14065525246116683825,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6644 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6856,i,3443938567347431637,17370823964273238989,2097152 --field-trial-handle=1956,i,10789753417894327876,14065525246116683825,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6836 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6580,i,13587275772844543120,9420873010090181690,2097152 --field-trial-handle=1956,i,10789753417894327876,14065525246116683825,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6964 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6436,i,16008901773217957699,7917311751627172794,524288 --field-trial-handle=1956,i,10789753417894327876,14065525246116683825,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6452 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\dotnet-runtime-8.0.31-win-x86.exe"C:\Users\Admin\Downloads\dotnet-runtime-8.0.31-win-x86.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- System Time Discovery
-
C:\Windows\Temp\{E6F87034-D5A0-4A5E-B559-B7809459D8B0}\.cr\dotnet-runtime-8.0.31-win-x86.exe"C:\Windows\Temp\{E6F87034-D5A0-4A5E-B559-B7809459D8B0}\.cr\dotnet-runtime-8.0.31-win-x86.exe" -burn.clean.room="C:\Users\Admin\Downloads\dotnet-runtime-8.0.31-win-x86.exe" -burn.filehandle.attached=716 -burn.filehandle.self=7203⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- System Time Discovery
-
C:\Windows\Temp\{B091793D-6C4D-4EFA-9B57-39C483CD01E7}\.be\dotnet-runtime-8.0.31-win-x86.exe"C:\Windows\Temp\{B091793D-6C4D-4EFA-9B57-39C483CD01E7}\.be\dotnet-runtime-8.0.31-win-x86.exe" -q -burn.elevated BurnPipe.{27672ACD-762C-4F49-AB0B-6A58F480604C} {E8578545-07B1-4A8A-BC14-A3B907649EBB} 91244⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- System Time Discovery
- Modifies registry class
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7096,i,9106306488801329194,74860529576163759,524288 --field-trial-handle=1956,i,10789753417894327876,14065525246116683825,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6776 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6468,i,1557288753446400213,529313574482593879,2097152 --field-trial-handle=1956,i,10789753417894327876,14065525246116683825,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4820 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=1536,i,7988283927233400419,17357536303116383389,2097152 --field-trial-handle=1956,i,10789753417894327876,14065525246116683825,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6344 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6696,i,12631726467723484901,13972102335954772918,2097152 --field-trial-handle=1956,i,10789753417894327876,14065525246116683825,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6736 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5700,i,9413290998357933928,3753092924382070042,524288 --field-trial-handle=1956,i,10789753417894327876,14065525246116683825,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5100 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Downloads\SteamSetup.exe"C:\Users\Admin\Downloads\SteamSetup.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Steam\Steam.exe"C:\Program Files (x86)\Steam\steam.exe" -silent1⤵
- Executes dropped EXE
- Modifies trusted root certificate store through registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies system certificate store
-
C:\Program Files (x86)\Common Files\Steam\steamservice.exe"C:\Program Files (x86)\Common Files\Steam\steamservice.exe" /RunAsService1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Steam\steam.exe"C:\Program Files (x86)\Steam\steam.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Steam\Steam.exe"C:\Program Files (x86)\Steam\Steam.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Steam\Steam.exe"C:\Program Files (x86)\Steam\Steam.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Steam\Steam.exe"C:\Program Files (x86)\Steam\Steam.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Steam\steamsysinfo.exe"C:\Program Files (x86)\Steam\steamsysinfo.exe" -steamid 0 -buildid 1788652215 -logdir "C:\Program Files (x86)\Steam\logs" -nocrashdialog -query 1 -out-file C:\Users\Admin\AppData\Local\Temp\A89C.tmp4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" -nocrashdialog "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=16464" "-buildid=1788652215" "-steamid=0" "-logdir=C:\Program Files (x86)\Steam\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Program Files (x86)\Steam\clientui" "-steampath=C:\Program Files (x86)\Steam\Steam.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling "--log-file=C:\Program Files (x86)\Steam\logs\cef_log.txt" --disable-quick-menu --disable-component-update "--gaia-url=http://disabled.invalid" "--enable-features=PlatformHEVCDecoderSupport" "--disable-features=WinRetrieveSuggestionsOnlyOnDemand,SpareRendererForSitePerProcess,DcheckIsFatal,BlockPromptsIfIgnoredOften,WebUsbDeviceDetection,ValveFFmpegAllowLowDelayHEVC"4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=gpu-process --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1788652215 --steamid=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1952,i,18169831173901166346,11344870933470777531,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=1900 --mojo-platform-channel-handle=1948 /prefetch:25⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1788652215 --steamid=0 --field-trial-handle=2200,i,18169831173901166346,11344870933470777531,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2256 --mojo-platform-channel-handle=2252 /prefetch:35⤵
- Executes dropped EXE
- Loads dropped DLL
- System Time Discovery
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1788652215 --steamid=0 --field-trial-handle=2348,i,18169831173901166346,11344870933470777531,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2364 --mojo-platform-channel-handle=2360 /prefetch:85⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1788652215 --steamid=0 --gaia-url=http://disabled.invalid --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3424,i,18169831173901166346,11344870933470777531,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4100 --mojo-platform-channel-handle=4092 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1788652215 --steamid=0 --field-trial-handle=4776,i,18169831173901166346,11344870933470777531,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4784 --mojo-platform-channel-handle=4780 /prefetch:85⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1788652215 --steamid=0 --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4868,i,18169831173901166346,11344870933470777531,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4884 --mojo-platform-channel-handle=4524 /prefetch:85⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1788652215 --steamid=0 --field-trial-handle=4524,i,18169831173901166346,11344870933470777531,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4888 --mojo-platform-channel-handle=4900 /prefetch:85⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1788652215 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=5368,i,18169831173901166346,11344870933470777531,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5348 --mojo-platform-channel-handle=5012 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1788652215 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=6008,i,18169831173901166346,11344870933470777531,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=6012 --mojo-platform-channel-handle=5776 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1788652215 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4568,i,18169831173901166346,11344870933470777531,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=684 --mojo-platform-channel-handle=5008 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1788652215 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5520,i,18169831173901166346,11344870933470777531,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5624 --mojo-platform-channel-handle=5348 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1788652215 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=6052,i,18169831173901166346,11344870933470777531,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5516 --mojo-platform-channel-handle=5660 /prefetch:15⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1788652215 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5464,i,18169831173901166346,11344870933470777531,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5812 --mojo-platform-channel-handle=5860 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1788652215 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=800,i,18169831173901166346,11344870933470777531,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5832 --mojo-platform-channel-handle=5508 /prefetch:15⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1788652215 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5524,i,18169831173901166346,11344870933470777531,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=6048 --mojo-platform-channel-handle=5444 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1788652215 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5448,i,18169831173901166346,11344870933470777531,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=6012 --mojo-platform-channel-handle=5384 /prefetch:15⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1788652215 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5856,i,18169831173901166346,11344870933470777531,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5476 --mojo-platform-channel-handle=5996 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1788652215 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=1140,i,18169831173901166346,11344870933470777531,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5116 --mojo-platform-channel-handle=5584 /prefetch:15⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1788652215 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=6064,i,18169831173901166346,11344870933470777531,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5512 --mojo-platform-channel-handle=4844 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1788652215 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=5948,i,18169831173901166346,11344870933470777531,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5476 --mojo-platform-channel-handle=5884 /prefetch:15⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1788652215 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=6068,i,18169831173901166346,11344870933470777531,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5860 --mojo-platform-channel-handle=5996 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1788652215 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=4116,i,18169831173901166346,11344870933470777531,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4264 --mojo-platform-channel-handle=4260 /prefetch:15⤵
- Checks computer location settings
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1788652215 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=6376,i,18169831173901166346,11344870933470777531,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=6440 --mojo-platform-channel-handle=6420 /prefetch:15⤵
- Checks computer location settings
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1788652215 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=6284,i,18169831173901166346,11344870933470777531,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=6228 --mojo-platform-channel-handle=5584 /prefetch:15⤵
- Checks computer location settings
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1788652215 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=4188,i,18169831173901166346,11344870933470777531,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5676 --mojo-platform-channel-handle=6116 /prefetch:15⤵
- Checks computer location settings
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1788652215 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=6104,i,18169831173901166346,11344870933470777531,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4452 --mojo-platform-channel-handle=4100 /prefetch:15⤵
- Checks computer location settings
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1788652215 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=6804,i,18169831173901166346,11344870933470777531,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=6616 --mojo-platform-channel-handle=6624 /prefetch:15⤵
- Checks computer location settings
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1788652215 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=6812,i,18169831173901166346,11344870933470777531,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4092 --mojo-platform-channel-handle=5444 /prefetch:15⤵
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1788652215 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=6892,i,18169831173901166346,11344870933470777531,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=6932 --mojo-platform-channel-handle=6880 /prefetch:15⤵
- Checks computer location settings
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1788652215 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --field-trial-handle=6636,i,18169831173901166346,11344870933470777531,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5384 --mojo-platform-channel-handle=6096 /prefetch:15⤵
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1788652215 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --field-trial-handle=7048,i,18169831173901166346,11344870933470777531,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=6720 --mojo-platform-channel-handle=5992 /prefetch:15⤵
- Checks computer location settings
-
-
-
C:\Program Files (x86)\Steam\bin\gldriverquery64.exe.\bin\gldriverquery64.exe4⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\gldriverquery.exe.\bin\gldriverquery.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Steam\bin\vulkandriverquery64.exe.\bin\vulkandriverquery64.exe4⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Steam\bin\vulkandriverquery.exe.\bin\vulkandriverquery.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Steam\steamerrorreporter64.exeC:\Program Files (x86)\Steam\steamerrorreporter64.exe -pid=164644⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Steam\bin\hardwareupdater\hardwareupdater.exe"C:\Program Files (x86)\Steam\bin\hardwareupdater\hardwareupdater.exe" --check-for-updates4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Steam\bin\hardwareupdater\hardwareupdater.exe"C:\Program Files (x86)\Steam\bin\hardwareupdater\hardwareupdater.exe" --check-for-updates5⤵
- Executes dropped EXE
-
-
-
C:\Program Files (x86)\Steam\bin\hardwareupdater\hardwareupdater.exe"C:\Program Files (x86)\Steam\bin\hardwareupdater\hardwareupdater.exe" --check-for-updates4⤵
-
C:\Program Files (x86)\Steam\bin\hardwareupdater\hardwareupdater.exe"C:\Program Files (x86)\Steam\bin\hardwareupdater\hardwareupdater.exe" --check-for-updates5⤵
-
-
-
C:\Program Files (x86)\Steam\bin\hardwareupdater\hardwareupdater.exe"C:\Program Files (x86)\Steam\bin\hardwareupdater\hardwareupdater.exe" --check-for-updates4⤵
-
C:\Program Files (x86)\Steam\bin\hardwareupdater\hardwareupdater.exe"C:\Program Files (x86)\Steam\bin\hardwareupdater\hardwareupdater.exe" --check-for-updates5⤵
-
-
-
C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\Gorilla Tag.exe"C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\Gorilla Tag.exe" -vrmode openvr4⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\UnityCrashHandler64.exe"C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\UnityCrashHandler64.exe" --attach 23876 18323855810565⤵
-
-
-
C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\Gorilla Tag.exe"C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\Gorilla Tag.exe" -vrmode openvr4⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\UnityCrashHandler64.exe"C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\UnityCrashHandler64.exe" --attach 27248 14574982963205⤵
-
-
-
-
-
C:\Program Files (x86)\Common Files\Steam\steamservice.exe"C:\Program Files (x86)\Common Files\Steam\steamservice.exe" /RunAsService1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Common Files\Steam\SteamServiceTmp.exe"C:\Program Files (x86)\Common Files\Steam\SteamServiceTmp.exe" /Update2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Common Files\Steam\steamservice.exe"C:\Program Files (x86)\Common Files\Steam\steamservice.exe" /RunAsService1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x508 0x4f01⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Users\Admin\Downloads\Banana.exe"C:\Users\Admin\Downloads\Banana.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Downloads\Banana.exe"C:\Users\Admin\Downloads\Banana.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\Banana.exe"C:\Users\Admin\Downloads\Banana.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\Banana.exe"C:\Users\Admin\Downloads\Banana.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\Banana.exe"C:\Users\Admin\Downloads\Banana.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\Banana.exe"C:\Users\Admin\Downloads\Banana.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\Banana.exe"C:\Users\Admin\Downloads\Banana.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"1⤵
-
C:\Users\Admin\Downloads\Banana.exeBanana.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B57BE5C5E4F75E13B2A3BA63847F19AB2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F8C0606B4AC57ED796D238B2CA2D75712⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D26769D05E1AE16D93BE62E04AEB9D2D2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 258CD889FC92DCF4E5CF8C2962277ED42⤵
- System Location Discovery: System Language Discovery
-
-
C:\ProgramData\Package Cache\{3ff3aefd-d60a-4032-bcad-8998d3643a1d}\dotnet-runtime-8.0.31-win-x86.exe"C:\ProgramData\Package Cache\{3ff3aefd-d60a-4032-bcad-8998d3643a1d}\dotnet-runtime-8.0.31-win-x86.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- System Time Discovery
-
C:\ProgramData\Package Cache\{3ff3aefd-d60a-4032-bcad-8998d3643a1d}\dotnet-runtime-8.0.31-win-x86.exe"C:\ProgramData\Package Cache\{3ff3aefd-d60a-4032-bcad-8998d3643a1d}\dotnet-runtime-8.0.31-win-x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_.NET_Runtime_-_8.0.31_(x86)_20260910080402.log"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- System Time Discovery
-
C:\ProgramData\Package Cache\{3ff3aefd-d60a-4032-bcad-8998d3643a1d}\dotnet-runtime-8.0.31-win-x86.exe"C:\ProgramData\Package Cache\{3ff3aefd-d60a-4032-bcad-8998d3643a1d}\dotnet-runtime-8.0.31-win-x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{3ff3aefd-d60a-4032-bcad-8998d3643a1d}\dotnet-runtime-8.0.31-win-x86.exe" -burn.filehandle.attached=520 -burn.filehandle.self=552 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_.NET_Runtime_-_8.0.31_(x86)_20260910080402.log"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- System Time Discovery
-
C:\ProgramData\Package Cache\{3ff3aefd-d60a-4032-bcad-8998d3643a1d}\dotnet-runtime-8.0.31-win-x86.exe"C:\ProgramData\Package Cache\{3ff3aefd-d60a-4032-bcad-8998d3643a1d}\dotnet-runtime-8.0.31-win-x86.exe" -q -burn.elevated BurnPipe.{30C5D6B9-EFF2-4CFC-A36A-900FEDC67418} {8852261D-A43F-4E63-A8C8-D8DEEE41EA82} 84564⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- System Time Discovery
- Modifies registry class
-
-
-
-
C:\Users\Admin\Downloads\Banana.exe"C:\Users\Admin\Downloads\Banana.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\Banana.exe"C:\Users\Admin\Downloads\Banana.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\BananaRunner.bat" "1⤵
- Executes a command shell one-liner
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c curl -s -L -o nul -w "%{url_effective}" https://github.com/ShibaGT/Banana/releases/1.0.02⤵
- Executes a command shell one-liner
-
C:\Windows\system32\curl.execurl -s -L -o nul -w "%{url_effective}" https://github.com/ShibaGT/Banana/releases/1.0.03⤵
-
-
-
C:\Windows\system32\curl.execurl -L -o Banana.exe https://github.com/ShibaGT/Banana/releases/download/1.0.0/Banana.exe2⤵
- Downloads MZ/PE file
-
-
C:\Users\Admin\Downloads\Banana.exeBanana.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Downloads\Banana.exe"C:\Users\Admin\Downloads\Banana.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\Gorilla Tag_Data\Banana\banana.exe"C:\\Program Files (x86)\\Steam\steamapps\common\Gorilla Tag/Gorilla Tag_Data/Banana/banana.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.WindowsDesktop.App&framework_version=8.0.0&arch=x86&rid=win-x86&os=win10&gui=true3⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d4,0x7ffc23b7c188,0x7ffc23b7c194,0x7ffc23b7c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1896,i,144891624914477012,6347394342174399645,262144 --field-trial-handle=1988,i,3857000908338823669,7431395288296920118,262144 --variations-seed-version --mojo-platform-channel-handle=1904 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,12966245966963664127,8785721843657191930,524288 --field-trial-handle=1988,i,3857000908338823669,7431395288296920118,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:34⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,16206039750184314743,16130217093861077934,524288 --field-trial-handle=1988,i,3857000908338823669,7431395288296920118,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,16906730170986566677,15353641562849672373,2097152 --field-trial-handle=1988,i,3857000908338823669,7431395288296920118,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,1080983352807407091,15668019689439302584,2097152 --field-trial-handle=1988,i,3857000908338823669,7431395288296920118,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4412,i,15677846119593827085,8605473327613923683,2097152 --field-trial-handle=1988,i,3857000908338823669,7431395288296920118,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4628,i,5756405111189757793,9055610914549515700,2097152 --field-trial-handle=1988,i,3857000908338823669,7431395288296920118,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,11526957930028865910,939098070455509789,524288 --field-trial-handle=1988,i,3857000908338823669,7431395288296920118,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3844,i,7564031931758570624,520215369874822962,524288 --field-trial-handle=1988,i,3857000908338823669,7431395288296920118,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3844,i,7237708005488212804,15688245091422779521,524288 --field-trial-handle=1988,i,3857000908338823669,7431395288296920118,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,13556564743008770139,5146852336273427844,524288 --field-trial-handle=1988,i,3857000908338823669,7431395288296920118,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,9628057572189804994,5266037673247178809,524288 --field-trial-handle=1988,i,3857000908338823669,7431395288296920118,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,9628057572189804994,5266037673247178809,524288 --field-trial-handle=1988,i,3857000908338823669,7431395288296920118,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,14693546707883271663,9513592684565607181,524288 --field-trial-handle=1988,i,3857000908338823669,7431395288296920118,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,9571946342547349247,17987874572906440010,524288 --field-trial-handle=1988,i,3857000908338823669,7431395288296920118,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,4346646024625952968,1792692842713036199,524288 --field-trial-handle=1988,i,3857000908338823669,7431395288296920118,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,8495612564371205967,3122115860015127835,524288 --field-trial-handle=1988,i,3857000908338823669,7431395288296920118,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,16198871539154822292,8962542216583605138,524288 --field-trial-handle=1988,i,3857000908338823669,7431395288296920118,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4688,i,13019015006136248525,17360444390908303892,2097152 --field-trial-handle=1988,i,3857000908338823669,7431395288296920118,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6580,i,8381035863960515748,5448866222379665121,2097152 --field-trial-handle=1988,i,3857000908338823669,7431395288296920118,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6608,i,16743451598558771938,7758864528213482580,524288 --field-trial-handle=1988,i,3857000908338823669,7431395288296920118,262144 --variations-seed-version --mojo-platform-channel-handle=3932 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6848,i,8367943393540287084,3497532010570847419,524288 --field-trial-handle=1988,i,3857000908338823669,7431395288296920118,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,10418863267169503073,8764857216179585291,524288 --field-trial-handle=1988,i,3857000908338823669,7431395288296920118,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6856,i,11246326167555433304,13109219327490172516,524288 --field-trial-handle=1988,i,3857000908338823669,7431395288296920118,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,16586107867432229543,9297598836472562410,524288 --field-trial-handle=1988,i,3857000908338823669,7431395288296920118,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6716,i,2230687180608251568,14813238324239126429,2097152 --field-trial-handle=1988,i,3857000908338823669,7431395288296920118,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6604,i,6587017827166834905,5137891047660492352,524288 --field-trial-handle=1988,i,3857000908338823669,7431395288296920118,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,8989314829102441574,6582123954733598441,524288 --field-trial-handle=1988,i,3857000908338823669,7431395288296920118,262144 --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,3637493715177893872,15164926263558149882,524288 --field-trial-handle=1988,i,3857000908338823669,7431395288296920118,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3668,i,8039050074420004732,17333982282288103359,524288 --field-trial-handle=1988,i,3857000908338823669,7431395288296920118,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1232,i,15223728017208024397,4011496370322852610,524288 --field-trial-handle=1988,i,3857000908338823669,7431395288296920118,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,405339883977017282,5985394680405552727,524288 --field-trial-handle=1988,i,3857000908338823669,7431395288296920118,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,9539302632740741093,12271970265933635108,524288 --field-trial-handle=1988,i,3857000908338823669,7431395288296920118,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5344,i,2331778280037053784,8815710214961061227,262144 --field-trial-handle=1988,i,3857000908338823669,7431395288296920118,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:84⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,13311178392910166291,8544147034859218264,524288 --field-trial-handle=1988,i,3857000908338823669,7431395288296920118,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,14054193288356666739,1381869974524201309,524288 --field-trial-handle=1988,i,3857000908338823669,7431395288296920118,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3900,i,3033787522524242082,1708876686376858663,524288 --field-trial-handle=1988,i,3857000908338823669,7431395288296920118,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,5620505736825739890,538289928694629981,524288 --field-trial-handle=1988,i,3857000908338823669,7431395288296920118,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2496,i,14655097040053892817,12579647323548711450,524288 --field-trial-handle=1988,i,3857000908338823669,7431395288296920118,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2560,i,3623842154192074201,6308345278961952800,524288 --field-trial-handle=1988,i,3857000908338823669,7431395288296920118,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6884,i,852072407908823763,11323807137283245185,524288 --field-trial-handle=1988,i,3857000908338823669,7431395288296920118,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3568,i,1821219021793245815,1318196919269738163,524288 --field-trial-handle=1988,i,3857000908338823669,7431395288296920118,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2844,i,1565981096279661466,2486902538536163471,524288 --field-trial-handle=1988,i,3857000908338823669,7431395288296920118,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,8566246052124632911,342081991233490736,524288 --field-trial-handle=1988,i,3857000908338823669,7431395288296920118,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4696,i,10917752369147873532,8633165858438789911,524288 --field-trial-handle=1988,i,3857000908338823669,7431395288296920118,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6984,i,5881200851253017088,18435070968114288727,524288 --field-trial-handle=1988,i,3857000908338823669,7431395288296920118,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3124,i,11232997615695808783,10585855856327448670,524288 --field-trial-handle=1988,i,3857000908338823669,7431395288296920118,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3844,i,4358931038080028129,6917155957234771280,524288 --field-trial-handle=1988,i,3857000908338823669,7431395288296920118,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3812,i,2512999745455965706,12822875417329236335,524288 --field-trial-handle=1988,i,3857000908338823669,7431395288296920118,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2844,i,12058579850029899181,2522428599147959464,524288 --field-trial-handle=1988,i,3857000908338823669,7431395288296920118,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3124,i,10261151929598402200,12263108076745519082,524288 --field-trial-handle=1988,i,3857000908338823669,7431395288296920118,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3212,i,11132100979471824002,9477432311667239436,524288 --field-trial-handle=1988,i,3857000908338823669,7431395288296920118,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,1562549274788626741,5256033462346148374,524288 --field-trial-handle=1988,i,3857000908338823669,7431395288296920118,262144 --variations-seed-version --mojo-platform-channel-handle=7004 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,13489697167914019018,14214708545246863283,524288 --field-trial-handle=1988,i,3857000908338823669,7431395288296920118,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:84⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\Gorilla Tag.exe"C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\Gorilla Tag.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\UnityCrashHandler64.exe"C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\UnityCrashHandler64.exe" --attach 8508 14216903434242⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\Gorilla Tag.exe"C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\Gorilla Tag.exe"1⤵
-
C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\UnityCrashHandler64.exe"C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\UnityCrashHandler64.exe" --attach 8396 19069936640002⤵
-
C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\UnityCrashHandler64.exe"C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\UnityCrashHandler64.exe" "8396" "1906993664000" "cbmUrl=" "cbmFile="3⤵
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x508 0x4f01⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\webhook.txt1⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
2Subvert Trust Controls
2Install Root Certificate
2Replay Monitor
Loading Replay Monitor...
Downloads
e601cf5.rbs
e601cfa.rbs
e601cff.rbs
e601d03.rbs
SteamService.dll
SteamServiceTmp.exe
cpuidsdk.dll
crashhandler.dll
drivers.exe
secure_desktop_capture.exe
service_default_Public_versions.vdf
service_minimum_versions.vdf
steamerrorreporter.exe
steamxboxutil64.exe
Steam.exe
bd2b709a08caf7286f73c51d3b3937667f7aa053.jpg
SteamService.exe
config.vdf
config.vdf
config.vdf
config.vdf
config.vdf
config.vdf~RFe5cc4fd.TMP
libraryfolders.vdf
cef_log.txt
cef_log.txt
btnOvrOffBottom.tga_
cloud_localfiles.tga_
icon_button_news_mousedown.tga_
tabStdBottom.tga_
steam_cloudsync.ico_
steam_cloudsync_posix.tga_
steam_tray.tga_
filter_clean_bulgarian.txt.gz_
filter_clean_schinese.txt.gz_
game_details_header_green.tga_
steambootstrapper_brazilian.txt
steambootstrapper_bulgarian.txt
steambootstrapper_czech.txt
steambootstrapper_danish.txt
steambootstrapper_dutch.txt
steambootstrapper_english.txt
steambootstrapper_finnish.txt
steambootstrapper_french.txt
steambootstrapper_german.txt
steambootstrapper_greek.txt
steambootstrapper_hungarian.txt
steambootstrapper_indonesian.txt
steambootstrapper_italian.txt
steambootstrapper_japanese.txt
steambootstrapper_koreana.txt
steambootstrapper_latam.txt
steambootstrapper_norwegian.txt
steambootstrapper_polish.txt
steambootstrapper_portuguese.txt
steambootstrapper_romanian.txt
steambootstrapper_russian.txt
steambootstrapper_schinese.txt
steambootstrapper_spanish.txt
steambootstrapper_swedish.txt
steambootstrapper_tchinese.txt
steambootstrapper_thai.txt
steambootstrapper_turkish.txt
steambootstrapper_ukrainian.txt
steambootstrapper_vietnamese.txt
filter_banned_english_cached.txt
filter_profanity_english_cached.txt
filter_profanity_english_cached_timestamp.txt
appmanifest_1533390.acf
appmanifest_1533390.acf
appmanifest_1533390.acf
appmanifest_1533390.acf
appmanifest_1533390.acf
appmanifest_1533390.acf
appmanifest_1533390.acf
appmanifest_1533390.acf~RFe615cc5.TMP
BepInEx.cfg
BepInEx.cfg
Unity.XR.Interaction.Toolkit.dll
UnityEngine.CoreModule.dll
MetaXRAudioUnity.dll
lib_burst_generated.dll
viveport_api64.dll
bindings_oculus_touch.json
level13.resS
level16
level17.resS
level2.resS
level3.resS
level4
level8.resS
level9.resS
sharedassets16.assets.resS
sharedassets2.assets
sharedassets23.resource
sharedassets3.assets.resS
sharedassets9.assets
UnityCrashHandler64.exe
System.Xml.dll
UnityEngine.UIElementsModule.dll
mrutilitykitshared.dll
level14
level8
level8.resS
level9
resources.assets.resS
sharedassets1.resource
sharedassets14.assets
sharedassets15.assets
sharedassets18.assets.resS
sharedassets18.resource
sharedassets19.resource
sharedassets2.assets.resS
sharedassets22.assets
sharedassets8.assets
sharedassets8.assets.resS
sharedassets9.resource
Compat.browser
DefaultWsdlHelpGenerator.aspx
web.config
settings.map
RuntimeActionBindings.json
libraryfolders.vdf
sharedconfig.vdf
sharedconfig.vdf
1533390.json
1533390.json
1533390.json
localconfig.vdf
localconfig.vdf
localconfig.vdf
localconfig.vdf
localconfig.vdf
localconfig.vdf
localconfig.vdf
localconfig.vdf
localconfig.vdf~RFe5ec8eb.TMP
gamerecording.pb
gamerecording.pb~RFe69622d.TMP
LICENSE.txt
ThirdPartyNotices.txt
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
LICENSE
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
Other
manifest.json
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
65e6d9ed-5a7c-4527-aba5-3ba888e8d182.tmp
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
f_000005
f_000008
f_000009
f_00000a
f_00000b
f_00000d
f_00000e
f_00000f
f_000011
the-real-index
the-real-index
the-real-index
000003.log
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe58b726.TMP
the-real-index
Local State
Local State
Local State
Local State
Local State
Local State
Local State
protocols.json
autofill_bypass_cache_forms.json
edge_autofill_global_block_list.json
v1FieldTypes.json
crl-set
settings.dat
settings.dat
6e5811bd-3fd8-4073-8639-db58cc0a6e1c.tmp
7818e90d-14d7-4e25-a561-1a0a311db053.tmp
LOG.old
LOG.old
LOG.old
LOG.old
the-real-index
the-real-index~RFe668786.TMP
Edge Profile.ico
Network Persistent State
Network Persistent State
Preferences
Preferences
Preferences
Preferences
Preferences
index.txt
domain_actions.dll
data.txt
OperationConfig
OperationConfig~RFe66c3c4.TMP
office_endpoints_list.json
Local State
Local State
Local State
Local State
Local State
Local State
crs.pb
ct_config.pb
kp_pinslist.pb
safety_tips.pb
typosquatting_list.pb
Advertising
Analytics
CompatExceptions
Content
Cryptomining
Entities
Fingerprinting
LICENSE
Social
Staging
TransparentAdvertisers
Advertising
Analytics
Content
Cryptomining
Entities
Fingerprinting
LICENSE
Social
Staging
keys.json
well_known_domains.dll
nav_config.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
faa8ac8c-3f1a-4c5c-a4dc-eb3a9bbb6573.tmp
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
f_000003
f_000004
f_000005
f_000006
f_000007
f_000008
f_000009
f_00000a
f_00000b
f_00000c
f_00000d
f_00000e
f_00000f
f_000010
f_000011
f_000012
f_000013
f_000014
f_000015
f_000016
f_000017
f_000018
f_000019
f_00002a
f_000044
f_000047
f_000048
f_000049
f_00004b
f_00004c
f_00004d
f_00004f
f_000050
f_000051
f_000052
f_000054
f_000055
f_000056
f_000057
f_000058
f_000059
f_00005a
f_00005b
f_00005e
f_000060
f_000066
f_000067
f_000068
f_000069
f_00006a
f_000099
f_00009b
f_00009c
f_00009d
f_00009e
f_00009f
f_0000a0
f_0000a1
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
data_0
data_1
MANIFEST-000001
data_2
data_3
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State~RFe5dd44a.TMP
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity~RFe5d6fb4.TMP
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences~RFe5cfc2a.TMP
000001.dbtmp
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State~RFe5cab5b.TMP
8b516d01-4c03-42c3-acb7-76173b3e5d20.tmp
UnityCrashHandler.exe
f02f47f3-13e7-471a-8fc4-f4b57a9ac67b.tmp
StdUtils.dll
System.dll
modern-wizard.bmp
nsDialogs.dll
nsExec.dll
nsProcess.dll
f699d792-dcce-4316-842c-c477e43b335d.tmp
content_new.js
default.dic
RRSONQAK02JEKNPQL899.temp
d356105fac5527ef.customDestinations-ms
d356105fac5527ef.customDestinations-ms
d356105fac5527ef.customDestinations-ms
d356105fac5527ef.customDestinations-ms
d356105fac5527ef.customDestinations-ms
d356105fac5527ef.customDestinations-ms
d356105fac5527ef.customDestinations-ms
d356105fac5527ef.customDestinations-ms
d356105fac5527ef.customDestinations-ms
d356105fac5527ef.customDestinations-ms
d356105fac5527ef.customDestinations-ms
d356105fac5527ef.customDestinations-ms
d356105fac5527ef.customDestinations-ms
d356105fac5527ef.customDestinations-ms
d356105fac5527ef.customDestinations-ms
d356105fac5527ef.customDestinations-ms
d356105fac5527ef.customDestinations-ms
Gorilla Tag.url
7f53850f-86f2-4cc0-93d6-e4b21404d14b.tmp
BepInEx_win_x64_5.4.23.5.zip.crdownload
Unconfirmed 304142.crdownload
Unconfirmed 348906.crdownload
Unconfirmed 571132.crdownload
MSI3FC1.tmp
e601cf6.msi
e601cf7.msi
bg.png
dotnet-runtime-8.0.31-win-x86.exe
thm.wxl
wixstdba.dll
memory/424-16581-0x00000152944A0000-0x0000015294641000-memory.dmp
memory/424-16471-0x0000015294650000-0x0000015294651000-memory.dmp
memory/1008-7402-0x0000000000940000-0x0000000000DF2000-memory.dmp
memory/6564-16356-0x0000000006561000-0x0000000006564000-memory.dmp
memory/8508-20027-0x0000014C05710000-0x0000014C05720000-memory.dmp
memory/8508-20022-0x0000014C05700000-0x0000014C05710000-memory.dmp
memory/8508-20036-0x0000014C04590000-0x0000014C045A0000-memory.dmp
memory/8508-20037-0x0000014C04590000-0x0000014C045A0000-memory.dmp
memory/8508-20026-0x0000014C05710000-0x0000014C05720000-memory.dmp
memory/8508-20084-0x0000014C0DB80000-0x0000014C0DB81000-memory.dmp
memory/8508-20025-0x0000014C05710000-0x0000014C05720000-memory.dmp
memory/8508-20030-0x0000014C05720000-0x0000014C05730000-memory.dmp
memory/8508-20066-0x0000014C05800000-0x0000014C05810000-memory.dmp
memory/8508-20067-0x0000014C05800000-0x0000014C05810000-memory.dmp
memory/8508-20063-0x0000014C05800000-0x0000014C05810000-memory.dmp
memory/8508-20024-0x0000014C05710000-0x0000014C05720000-memory.dmp
memory/8508-20062-0x0000014C05800000-0x0000014C05810000-memory.dmp
memory/8508-20055-0x0000014C05800000-0x0000014C05810000-memory.dmp
memory/8508-20054-0x0000014C05800000-0x0000014C05810000-memory.dmp
memory/8508-20034-0x0000014C05720000-0x0000014C05730000-memory.dmp
memory/8508-20050-0x0000014C04420000-0x0000014C04430000-memory.dmp
memory/8508-20051-0x0000014C04420000-0x0000014C04430000-memory.dmp
memory/8508-20047-0x0000014C05800000-0x0000014C05810000-memory.dmp
memory/8508-20046-0x0000014C05800000-0x0000014C05810000-memory.dmp
memory/8508-20042-0x0000014C05340000-0x0000014C05360000-memory.dmp
memory/8508-20043-0x0000014C05340000-0x0000014C05360000-memory.dmp
memory/8508-20035-0x0000014C05720000-0x0000014C05730000-memory.dmp
memory/8508-20023-0x0000014C05700000-0x0000014C05710000-memory.dmp
memory/8508-20031-0x0000014C05720000-0x0000014C05730000-memory.dmp
memory/9816-15032-0x0000026E75260000-0x0000026E75261000-memory.dmp
memory/9816-15466-0x0000026E750B0000-0x0000026E75251000-memory.dmp
memory/10112-15118-0x0000021DCF4A0000-0x0000021DCF641000-memory.dmp
memory/10112-14975-0x0000021DCF650000-0x0000021DCF651000-memory.dmp
memory/12032-14613-0x000001AEAA890000-0x000001AEAA891000-memory.dmp
memory/12032-14602-0x000001AEAA890000-0x000001AEAA891000-memory.dmp
memory/12032-14604-0x000001AEAA890000-0x000001AEAA891000-memory.dmp
memory/12032-14603-0x000001AEAA890000-0x000001AEAA891000-memory.dmp
memory/12032-14610-0x000001AEAA890000-0x000001AEAA891000-memory.dmp
memory/12032-14608-0x000001AEAA890000-0x000001AEAA891000-memory.dmp
memory/12032-14609-0x000001AEAA890000-0x000001AEAA891000-memory.dmp
memory/12032-14614-0x000001AEAA890000-0x000001AEAA891000-memory.dmp
memory/12032-14612-0x000001AEAA890000-0x000001AEAA891000-memory.dmp
memory/12032-14611-0x000001AEAA890000-0x000001AEAA891000-memory.dmp
memory/13964-18827-0x00000000069E1000-0x00000000069E4000-memory.dmp
memory/14260-14296-0x00000173957F0000-0x00000173957F1000-memory.dmp
memory/14260-14386-0x0000017395640000-0x00000173957E1000-memory.dmp
memory/15788-14124-0x0000027BE18C0000-0x0000027BE18C1000-memory.dmp
memory/15788-14362-0x0000027BE1710000-0x0000027BE18B1000-memory.dmp
memory/15788-14123-0x00007FFC4E450000-0x00007FFC4E451000-memory.dmp
memory/19112-16453-0x000001F046EB0000-0x000001F046EB1000-memory.dmp
memory/19112-16474-0x000001F046D00000-0x000001F046EA1000-memory.dmp
memory/19188-14033-0x0000000000C00000-0x0000000001109000-memory.dmp
memory/19336-16413-0x000001FABD2F0000-0x000001FABD2F1000-memory.dmp
memory/19336-16457-0x000001FABD140000-0x000001FABD2E1000-memory.dmp
memory/19444-16421-0x0000016EC8D20000-0x0000016EC8EC1000-memory.dmp
memory/19444-16407-0x0000016EC8ED0000-0x0000016EC8ED1000-memory.dmp
memory/19596-16397-0x0000000006C61000-0x0000000006C64000-memory.dmp
memory/20200-16367-0x0000000006FA1000-0x0000000006FA4000-memory.dmp
memory/21120-19497-0x000001F552410000-0x000001F5525B1000-memory.dmp
memory/21120-19463-0x000001F5525C0000-0x000001F5525C1000-memory.dmp
memory/21344-19536-0x000002A576160000-0x000002A576301000-memory.dmp
memory/21344-19494-0x000002A576310000-0x000002A576311000-memory.dmp
memory/21684-16750-0x0000024352F80000-0x0000024353121000-memory.dmp
memory/21684-16643-0x0000024353130000-0x0000024353131000-memory.dmp