Analysis
- user interaction
yes - max time kernel
898s - max time network
867s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
27/07/2026, 03:59
General
- Target index.html
- Size 25KB
- Sample260727-ekbcjsvxgt
- SHA256 9f8b6ef3282b63b2849ef7e4f9c2d8740ecd90d9597f3d2b6cdefb6dbe694d4e
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 3 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 7 IoCs
- Loads dropped DLL 4 IoCs
- Modifies file permissions 1 TTPs 2 IoCs
- Stops running service(s) 4 TTPs
- Checks for any installed AV software in registry 1 TTPs 9 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in System32 directory 43 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 1 IoCs
- Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 3 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Inno Setup is an open-source installation builder for Windows applications. 6 IoCs
Inno Setup installer
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 9 IoCs
- Modifies data under HKEY_USERS 3 IoCs
- Modifies registry class 21 IoCs
- Runs net.exe
- Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\index.html1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x290,0x7fff738cc188,0x7fff738cc194,0x7fff738cc1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,17740400117379273821,7517254589461997333,524288 --field-trial-handle=2308,i,6566928570914938870,8337430033604066542,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,3381150779062837524,8183544017156306509,262144 --field-trial-handle=2308,i,6566928570914938870,8337430033604066542,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,10477979459778613984,6326824719416562508,524288 --field-trial-handle=2308,i,6566928570914938870,8337430033604066542,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,10794501777431598716,9247567312738926292,2097152 --field-trial-handle=2308,i,6566928570914938870,8337430033604066542,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,17858911293059139836,4938922389267822526,2097152 --field-trial-handle=2308,i,6566928570914938870,8337430033604066542,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window2⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7fff738cc188,0x7fff738cc194,0x7fff738cc1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,11296410212760604643,4114148049609521594,524288 --field-trial-handle=2288,i,356959268530938594,13422663680320739413,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1756,i,11169246370554870596,5840362736212698931,262144 --field-trial-handle=2288,i,356959268530938594,13422663680320739413,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,13723789489402190341,5500356932737312233,524288 --field-trial-handle=2288,i,356959268530938594,13422663680320739413,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4200,i,14948770747457308685,11839714692710896070,524288 --field-trial-handle=2288,i,356959268530938594,13422663680320739413,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,14120611738280454325,3738383675662702932,524288 --field-trial-handle=2288,i,356959268530938594,13422663680320739413,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4200,i,14948770747457308685,11839714692710896070,524288 --field-trial-handle=2288,i,356959268530938594,13422663680320739413,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,2113888821445102194,3749222267499639942,524288 --field-trial-handle=2288,i,356959268530938594,13422663680320739413,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,1789440251485120655,1493349969859298925,524288 --field-trial-handle=2288,i,356959268530938594,13422663680320739413,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,13410534307077703473,16225858290820171252,524288 --field-trial-handle=2288,i,356959268530938594,13422663680320739413,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,700861141601178509,11054864823769454957,524288 --field-trial-handle=2288,i,356959268530938594,13422663680320739413,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4604,i,8236685822795826380,1449549400179807290,524288 --field-trial-handle=2288,i,356959268530938594,13422663680320739413,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,2785312420577168042,1753102432979229330,524288 --field-trial-handle=2288,i,356959268530938594,13422663680320739413,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,14518455909460529287,7901560062353361653,524288 --field-trial-handle=2288,i,356959268530938594,13422663680320739413,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,8514675645160698550,1569425843086896440,524288 --field-trial-handle=2288,i,356959268530938594,13422663680320739413,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,4341093147278339371,5839557645504486192,524288 --field-trial-handle=2288,i,356959268530938594,13422663680320739413,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4836,i,3314240013915572933,18016562369685472817,524288 --field-trial-handle=2288,i,356959268530938594,13422663680320739413,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4584,i,16968656523885323536,17093248020543828179,524288 --field-trial-handle=2288,i,356959268530938594,13422663680320739413,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4264,i,10960676992371832796,11893999195948726221,262144 --field-trial-handle=2288,i,356959268530938594,13422663680320739413,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2724,i,7179026107636930832,1133275772154721840,524288 --field-trial-handle=2288,i,356959268530938594,13422663680320739413,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3848,i,2222323220734841540,4836713242351771471,524288 --field-trial-handle=2288,i,356959268530938594,13422663680320739413,262144 --variations-seed-version --mojo-platform-channel-handle=1036 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,12070061565259100901,4047279520669557766,524288 --field-trial-handle=2288,i,356959268530938594,13422663680320739413,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,393298204671992814,14308399614914667026,524288 --field-trial-handle=2288,i,356959268530938594,13422663680320739413,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,16413754005493020841,2268212083497495832,524288 --field-trial-handle=2288,i,356959268530938594,13422663680320739413,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3836,i,11908983542920126185,14799072027225661808,524288 --field-trial-handle=2288,i,356959268530938594,13422663680320739413,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3836,i,12155633043704580456,9072112330654895223,524288 --field-trial-handle=2288,i,356959268530938594,13422663680320739413,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,17356648368582199547,16972817538303574427,524288 --field-trial-handle=2288,i,356959268530938594,13422663680320739413,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff73f2c728,0x7fff73f2c734,0x7fff73f2c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1712,i,7226699402011313385,8679008926569248742,262144 --field-trial-handle=1948,i,9328729099524706049,11747289869225191541,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1852 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,13883698704757387934,8276308035828933917,524288 --field-trial-handle=1948,i,9328729099524706049,11747289869225191541,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2256 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,6635278986108255893,16254674192443063056,524288 --field-trial-handle=1948,i,9328729099524706049,11747289869225191541,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2476 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3268,i,4399525351784171844,1660975209314612196,2097152 --field-trial-handle=1948,i,9328729099524706049,11747289869225191541,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3280 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3480,i,14865535895874741869,13140658043996823365,2097152 --field-trial-handle=1948,i,9328729099524706049,11747289869225191541,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3508 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4544,i,14937001824977359338,13321906995150608452,2097152 --field-trial-handle=1948,i,9328729099524706049,11747289869225191541,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4528 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4768,i,11064332756210139553,16382738862718007447,2097152 --field-trial-handle=1948,i,9328729099524706049,11747289869225191541,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4732 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5536,i,8758785936350854783,13754215804115332855,524288 --field-trial-handle=1948,i,9328729099524706049,11747289869225191541,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5540 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5948,i,17937907200429317215,15004458866355145956,524288 --field-trial-handle=1948,i,9328729099524706049,11747289869225191541,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5944 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5916,i,17877226394196104951,17250976476109166242,524288 --field-trial-handle=1948,i,9328729099524706049,11747289869225191541,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5824 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5536,i,3189921574717287501,13040399661387232128,524288 --field-trial-handle=1948,i,9328729099524706049,11747289869225191541,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5928 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4652,i,3130091175330001137,14711590913743134113,2097152 --field-trial-handle=1948,i,9328729099524706049,11747289869225191541,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4676 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3480,i,7969403972215615940,14081491473473147889,2097152 --field-trial-handle=1948,i,9328729099524706049,11747289869225191541,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3500 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3572,i,4783859173822137085,10356060729014129871,2097152 --field-trial-handle=1948,i,9328729099524706049,11747289869225191541,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3524 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3136,i,13605917391836579376,11914692421225525553,2097152 --field-trial-handle=1948,i,9328729099524706049,11747289869225191541,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4620 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5544,i,4299170571764853104,11687499564330205867,2097152 --field-trial-handle=1948,i,9328729099524706049,11747289869225191541,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5968 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6352,i,16763613049181378058,7443858207309126122,2097152 --field-trial-handle=1948,i,9328729099524706049,11747289869225191541,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6356 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6252,i,1108663659054669814,4228628688687222204,2097152 --field-trial-handle=1948,i,9328729099524706049,11747289869225191541,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6244 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6284,i,12820849756327546995,6291272005173232033,2097152 --field-trial-handle=1948,i,9328729099524706049,11747289869225191541,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6556 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6736,i,3866191477016653518,4493880074079545282,524288 --field-trial-handle=1948,i,9328729099524706049,11747289869225191541,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6724 /prefetch:82⤵
- Modifies registry class
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3136,i,15847068518145106005,9097837096093043087,524288 --field-trial-handle=1948,i,9328729099524706049,11747289869225191541,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6740 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=4792,i,11270471735561735533,1170887252169450707,2097152 --field-trial-handle=1948,i,9328729099524706049,11747289869225191541,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4780 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=4800,i,5887923519277862276,4380284441254291444,2097152 --field-trial-handle=1948,i,9328729099524706049,11747289869225191541,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4824 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6340,i,11265701110914796387,18296917758096642147,2097152 --field-trial-handle=1948,i,9328729099524706049,11747289869225191541,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5976 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6424,i,15979859845689196485,2805425213200911801,2097152 --field-trial-handle=1948,i,9328729099524706049,11747289869225191541,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6568 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=4644,i,15760573011309977962,11296774162772808537,2097152 --field-trial-handle=1948,i,9328729099524706049,11747289869225191541,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6460 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6304,i,2513273725186428899,12797703740871205267,2097152 --field-trial-handle=1948,i,9328729099524706049,11747289869225191541,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6520 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6336,i,16112275315071046798,9613120412031461739,2097152 --field-trial-handle=1948,i,9328729099524706049,11747289869225191541,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6212 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6216,i,8712219323000632996,15669022001737184378,2097152 --field-trial-handle=1948,i,9328729099524706049,11747289869225191541,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3584 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6352,i,9079803075895522551,4530746322744141039,2097152 --field-trial-handle=1948,i,9328729099524706049,11747289869225191541,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6348 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=7100,i,2298291427758371121,4826156575630609327,2097152 --field-trial-handle=1948,i,9328729099524706049,11747289869225191541,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7140 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7892,i,15592545956759951095,11808581862790136253,524288 --field-trial-handle=1948,i,9328729099524706049,11747289869225191541,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4616 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\RuntimeModifier.exe"C:\Users\Admin\Downloads\RuntimeModifier.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-N4UPWOU93D.tmp\RuntimeModifier.tmp"C:\Users\Admin\AppData\Local\Temp\is-N4UPWOU93D.tmp\RuntimeModifier.tmp" /SL5="$B017A,32221467,893952,C:\Users\Admin\Downloads\RuntimeModifier.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\is-8V8LHW669W.tmp\RuntimeModifier77.exe"C:\Users\Admin\AppData\Local\Temp\is-8V8LHW669W.tmp\RuntimeModifier77.exe" /VERYSILENT /ZBDIST4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-V221U.tmp\RuntimeModifier77.tmp"C:\Users\Admin\AppData\Local\Temp\is-V221U.tmp\RuntimeModifier77.tmp" /SL5="$401D6,28223426,869888,C:\Users\Admin\AppData\Local\Temp\is-8V8LHW669W.tmp\RuntimeModifier77.exe" /VERYSILENT /ZBDIST5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SYSTEM32\net.exe"net" stop BadlionAntic6⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BadlionAntic7⤵
-
-
-
C:\Windows\SYSTEM32\net.exe"net" stop BadlionAnticheat6⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BadlionAnticheat7⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc" delete BadlionAntic6⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc" delete BadlionAnticheat6⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exe"net" stop vgk6⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop vgk7⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc" delete vgk6⤵
- Launches sc.exe
-
-
C:\Users\Admin\AppData\Local\Temp\is-67HD9.tmp\_isetup\_setup64.tmphelper 105 0x3F46⤵
- Executes dropped EXE
-
-
C:\Windows\system32\icacls.exe"icacls" "C:\Users\Admin\AppData\Local\Programs\Runtime Modifier" /grant *S-1-15-2-1:(OI)(CI)(RX)6⤵
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exe"icacls" "C:\Users\Admin\AppData\Local\Programs\Runtime Modifier" /grant *S-1-15-2-1:(OI)(CI)(RX)6⤵
- Modifies file permissions
-
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=7892,i,14266903750674478483,10718839663550826076,262144 --field-trial-handle=1948,i,9328729099524706049,11747289869225191541,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6968 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5732,i,5717852616101516997,6416527185880879682,524288 --field-trial-handle=1948,i,9328729099524706049,11747289869225191541,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1540 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Programs\Runtime Modifier\rt-mod-i386.exe"C:\Users\Admin\AppData\Local\Programs\Runtime Modifier\rt-mod-i386.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Local\Programs\Runtime Modifier\rtmtutorial-i386.exe"C:\Users\Admin\AppData\Local\Programs\Runtime Modifier\rtmtutorial-i386.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
manifest.json
notification_fast.bundle.js.LICENSE.txt
tokenized-card.bundle.js.LICENSE.txt
strings.json
manifest.json
edge_checkout_page_validator.js
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
BrowsingTopicsState
f_00000b
f_000010
f_00001a
f_00001d
the-real-index
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe594c90.TMP
Local State
Local State
Local State
Local State
Local State
Local State
settings.dat
settings.dat
settings.dat
LOG.old
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
data_0
data_1
data_2
data_3
the-real-index
data_1
SiteList-Enterprise.json
LOG
000003.log
LOG
000003.log
LOG
verified_contents.json
manifest.json
History
LOG
Cookies
Network Persistent State
Network Persistent State
Reporting and NEL
SCT Auditing Pending Reports
Sdch Dictionaries
TransportSecurity
Preferences
Preferences
Secure Preferences
LOG
LOG
LOG
sync_diagnostic.log
CURRENT
MANIFEST-000001
Web Data
default_cloud_config.json
000003.log
LOG
000003.log
LOG
data.txt
office_endpoints_list.json
wallet-checkout-eligible-sites.json
wallet-notification-config.json
wallet-stable.json
wallet-tokenization-config.json
data_1
Last Version
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
data_1
Filtering Rules
LICENSE
typosquatting_list.pb
Variations
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
first_party_sets.db
first_party_sets.db-journal
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
RTMTutorial-x86_64.exe
_mingw.h
assert.h
celib.h
celog.h
cepipelib.c
cesocket.h
conio.h
ctype.h
dir.h
direct.h
dirent.h
dos.h
errno.h
excpt.h
fcntl.h
fenv.h
float.h
inttypes.h
io.h
jni.h
limits.h
linux-x86_64-ExceptionHandler.c
locale.h
lauxlib.h
lua.h
lua.hpp
luaconf.h
lualib.h
luaclient.c
macspeedhack.c
malloc.h
math.h
mem.h
memory.h
process.h
conio_s.h
crtdbg_s.h
io_s.h
mbstring_s.h
search_s.h
stdio_s.h
stdlib_s.h
stralign_s.h
string_s.h
timeb_s.h
tchar_s.h
time_s.h
wchar_s.h
setjmp.h
share.h
signal.h
stdalign.h
stdarg.h
stdatomic.h
stdbool.h
stddef.h
stdint.h
stdio.h
stdlib.h
stdnoreturn.h
string.h
fcntl.h
file.h
locking.h
stat.h
time.h
timeb.h
types.h
unistd.h
utime.h
tcc_libm.h
tccdefs.h
tchar.h
tgmath.h
time.h
vadefs.h
values.h
varargs.h
wchar.h
wctype.h
basetsd.h
basetyps.h
guiddef.h
poppack.h
pshpack1.h
pshpack2.h
pshpack4.h
pshpack8.h
winbase.h
wincon.h
windef.h
windows.h
winerror.h
wingdi.h
winnt.h
winreg.h
winuser.h
winver.h
windowslite.h
files here are in the lua searchpath.txt
forEachForm.lua
json.lua
7e958025-b85f-4498-8537-c5a11c3e8ecd.tmp
80da41c8-70b5-4a1c-9735-6d71e2178b3c.tmp
ADDRESSES.TMP
ADDRESSES.TMP
ADDRESSES.TMP
MEMORY.First
MEMORY.TMP
ADDRESSES.First
ADDRESSES.TMP
ADDRESSES.TMP
ADDRESSES.TMP
ADDRESSES.TMP
ADDRESSES.TMP
MEMORY.First
ADDRESSES.TMP
ADDRESSES.TMP
MEMORY.TMP
inuse.lock
ADDRESSES-5560.TMP
ADDRESSES.TMP
ADDRESSES.TMP
ADDRESSES.TMP
ADDRESSES.TMP
ADDRESSES.TMP
ADDRESSES.TMP
ADDRESSES.TMP
MEMORY.TMP
MEMORY.TMP
MEMORY.TMP
MEMORY.TMP
MEMORY.TMP
MEMORY.TMP
MEMORY.UNDO
MEMORY.UNDO
MEMORY.UNDO
MEMORY.UNDO
MEMORY.UNDO
MEMORY.UNDO
WebAdvisor.png
finish.png
logo.png
zbShieldUtils.dll
content_new.js
24670775-0fec-46a8-96f5-7e9379b4f8ef.tmp
RuntimeModifier.exe
memory/1572-1359-0x0000000000B50000-0x0000000000F9B000-memory.dmp
memory/1572-1358-0x0000000003970000-0x0000000003AB0000-memory.dmp
memory/1572-2272-0x0000000003970000-0x0000000003AB0000-memory.dmp
memory/1572-1352-0x0000000003970000-0x0000000003AB0000-memory.dmp
memory/1572-2274-0x0000000000B50000-0x0000000000F9B000-memory.dmp
memory/1572-2286-0x0000000000B50000-0x0000000000F9B000-memory.dmp
memory/4612-1353-0x00000000009B0000-0x0000000000A99000-memory.dmp
memory/4612-2287-0x00000000009B0000-0x0000000000A99000-memory.dmp
memory/4612-1314-0x00000000009B0000-0x0000000000A99000-memory.dmp
memory/4940-2268-0x00000000002D0000-0x00000000003B4000-memory.dmp
memory/4940-1369-0x00000000002D0000-0x00000000003B4000-memory.dmp
memory/5776-2267-0x0000000000E40000-0x00000000011C8000-memory.dmp