Analysis
- user interaction
yes - max time kernel
85s - max time network
87s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
27/07/2026, 19:53
General
- Target PlayniteInstaller.exe
- Size 250KB
- Sample260727-ymgrwsdk4t
- SHA256 6ca62bacfa234f2b2c2b26341d5c5292d7f6ad99cb816418af58302647548d65
Malware Config
Signatures
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Downloads MZ/PE file 1 IoCs
- Network Service Discovery 1 TTPs 4 IoCs
Attempt to gather information on host's network.
- Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Executes dropped EXE 7 IoCs
- Loads dropped DLL 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies registry class 21 IoCs
- Suspicious behavior: EnumeratesProcesses 13 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PlayniteInstaller.exe"C:\Users\Admin\AppData\Local\Temp\PlayniteInstaller.exe"1⤵
- Downloads MZ/PE file
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PlayniteInstaller\installer.exe"C:\Users\Admin\AppData\Local\Temp\PlayniteInstaller\installer.exe" /VERYSILENT /NOCANCEL /DIR="C:\Users\Admin\AppData\Local\Playnite"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-EAH6T.tmp\installer.tmp"C:\Users\Admin\AppData\Local\Temp\is-EAH6T.tmp\installer.tmp" /SL5="$C0064,145956474,420352,C:\Users\Admin\AppData\Local\Temp\PlayniteInstaller\installer.exe" /VERYSILENT /NOCANCEL /DIR="C:\Users\Admin\AppData\Local\Playnite"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Playnite\Playnite.DesktopApp.exe"C:\Users\Admin\AppData\Local\Playnite\Playnite.DesktopApp.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Playnite\CefSharp.BrowserSubprocess.exeC:\Users\Admin\AppData\Local\Playnite\CefSharp.BrowserSubprocess.exe --type=crashpad-handler --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Playnite\User Data\Crashpad" --annotation=platform=win32 --annotation=product=Playnite --annotation=version=1.0.0 --initial-client-data=0x888,0x88c,0x890,0x884,0x894,0x6deb523c,0x6deb5248,0x6deb52545⤵
- Network Service Discovery
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Playnite\CefSharp.BrowserSubprocess.exe"C:\Users\Admin\AppData\Local\Playnite\CefSharp.BrowserSubprocess.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Roaming\Playnite\browsercache" --log-severity=info --cefsharpexitsub --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=d3d11-warp-webgl --metrics-shmem-handle=2972,i,2734987820151575291,13372915123285649238,262144 --field-trial-handle=3132,i,11672418775355491504,3077394786680976287,262144 --disable-features=AutofillActorMode,EnableHangWatcher,GlicActorUi,LensOverlay --variations-seed-version --pseudonymization-salt-handle=3136,i,3998611845176970915,15148868567320042262,4 --trace-process-track-uuid=1653604857 --enable-logging=handle --log-file=3080 --mojo-platform-channel-handle=3128 /prefetch:2 --host-process-id=21765⤵
- Network Service Discovery
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Playnite\CefSharp.BrowserSubprocess.exe"C:\Users\Admin\AppData\Local\Playnite\CefSharp.BrowserSubprocess.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Roaming\Playnite\browsercache" --log-severity=info --cefsharpexitsub --metrics-shmem-handle=3204,i,470566961601757441,3057629786126136637,524288 --field-trial-handle=3132,i,11672418775355491504,3077394786680976287,262144 --disable-features=AutofillActorMode,EnableHangWatcher,GlicActorUi,LensOverlay --variations-seed-version --pseudonymization-salt-handle=3136,i,3998611845176970915,15148868567320042262,4 --trace-process-track-uuid=521694016 --enable-logging=handle --log-file=3228 --mojo-platform-channel-handle=3224 /prefetch:3 --host-process-id=21765⤵
- Network Service Discovery
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Playnite\CefSharp.BrowserSubprocess.exe"C:\Users\Admin\AppData\Local\Playnite\CefSharp.BrowserSubprocess.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Roaming\Playnite\browsercache" --log-severity=info --cefsharpexitsub --metrics-shmem-handle=3420,i,18006524963396581481,1976013743896749345,524288 --field-trial-handle=3132,i,11672418775355491504,3077394786680976287,262144 --disable-features=AutofillActorMode,EnableHangWatcher,GlicActorUi,LensOverlay --variations-seed-version --pseudonymization-salt-handle=3136,i,3998611845176970915,15148868567320042262,4 --trace-process-track-uuid=3684750470 --enable-logging=handle --log-file=3436 --mojo-platform-channel-handle=3432 /prefetch:8 --host-process-id=21765⤵
- Network Service Discovery
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CommandLine.dll
Common.config
is-3DDK5.tmp
is-7C2IN.tmp
is-A7HQD.tmp
is-E888E.tmp
is-HQH7R.tmp
NLog.dll
Newtonsoft.Json.dll
Playnite.DesktopApp.exe
Playnite.DesktopApp.exe.config
Playnite.SDK.dll
Playnite.dll
Polly.dll
System.Net.Http.dll
System.ValueTuple.dll
System.Windows.Interactivity.dll
Common.xaml
Constants.xaml
Border.xaml
Button.xaml
CheckBox.xaml
ComboBox.xaml
ContextMenu.xaml
DatePicker.xaml
Expander.xaml
GridSplitter.xaml
GroupBox.xaml
Hyperlink.xaml
Label.xaml
ListBox.xaml
ListView.xaml
Menu.xaml
PasswordBox.xaml
Popup.xaml
TextBlock.xaml
TextBox.xaml
applogo.ico
applogo_black.ico
applogo_dark.png
applogo_white.ico
csharp.ico
custom_cover_background.png
powershell.ico
Media.xaml
is-HL4JM.tmp
is-KM47F.tmp
IGDBMetadata_Builtin.pext
installer.tmp
71274134f7e337d6.customDestinations-ms
IGDBMetadata.dll
hr_HR.xaml
extension.yaml
MANIFEST-000001
SCT Auditing Pending Reports
CURRENT
Local State
Local State~RFe592ddc.TMP
memory/1768-3-0x00000000081B0000-0x00000000081B8000-memory.dmp
memory/1768-2-0x0000000005780000-0x0000000005790000-memory.dmp
memory/1768-0-0x0000000000DB0000-0x0000000000DF0000-memory.dmp
memory/1768-7-0x0000000005780000-0x0000000005790000-memory.dmp
memory/1768-4-0x0000000008AD0000-0x0000000008B08000-memory.dmp
memory/1768-1-0x0000000005780000-0x0000000005790000-memory.dmp
memory/1768-6-0x0000000005780000-0x0000000005790000-memory.dmp
memory/1768-5-0x0000000008170000-0x000000000817E000-memory.dmp
memory/2176-1810-0x0000000006380000-0x000000000645C000-memory.dmp
memory/2176-1811-0x0000000006460000-0x00000000067B4000-memory.dmp
memory/2176-1845-0x00000000080F0000-0x0000000008122000-memory.dmp
memory/2176-1837-0x0000000008060000-0x0000000008082000-memory.dmp
memory/2176-1832-0x00000000077A0000-0x0000000007806000-memory.dmp
memory/2176-2170-0x00000000060F0000-0x00000000060FC000-memory.dmp
memory/2176-2169-0x0000000005690000-0x00000000056A2000-memory.dmp
memory/2176-1827-0x0000000007400000-0x000000000750A000-memory.dmp
memory/2176-1826-0x0000000006BA0000-0x0000000006BEC000-memory.dmp
memory/2176-1825-0x0000000006B60000-0x0000000006B9C000-memory.dmp
memory/2176-1824-0x0000000006A40000-0x0000000006A52000-memory.dmp
memory/2176-1797-0x0000000004FA0000-0x0000000004FDC000-memory.dmp
memory/2176-1814-0x0000000006920000-0x00000000069B2000-memory.dmp
memory/2176-1818-0x00000000068C0000-0x00000000068FE000-memory.dmp
memory/2176-1823-0x00000000079B0000-0x0000000007F54000-memory.dmp
memory/2176-1822-0x0000000006A70000-0x0000000006B16000-memory.dmp
memory/2176-1812-0x0000000006DE0000-0x00000000073F8000-memory.dmp
memory/2176-1880-0x0000000008B10000-0x0000000008B32000-memory.dmp
memory/2176-1885-0x0000000009330000-0x000000000937C000-memory.dmp
memory/2176-1884-0x0000000009400000-0x000000000951E000-memory.dmp
memory/2176-1886-0x0000000009520000-0x0000000009634000-memory.dmp
memory/2176-1883-0x0000000009260000-0x000000000928A000-memory.dmp
memory/2176-1882-0x00000000092A0000-0x00000000092DE000-memory.dmp
memory/2176-2168-0x00000000055E0000-0x00000000055E8000-memory.dmp
memory/2176-2167-0x00000000055F0000-0x0000000005604000-memory.dmp
memory/2176-1911-0x0000000014100000-0x000000001415E000-memory.dmp
memory/2176-1852-0x0000000008260000-0x0000000008270000-memory.dmp
memory/2176-1801-0x0000000002910000-0x0000000002926000-memory.dmp
memory/2176-1946-0x0000000014450000-0x0000000014484000-memory.dmp
memory/2176-1985-0x00000000149A0000-0x00000000149A8000-memory.dmp
memory/2176-1805-0x0000000005130000-0x000000000515E000-memory.dmp
memory/2176-1793-0x0000000005200000-0x00000000053C4000-memory.dmp
memory/2176-1789-0x0000000000390000-0x00000000005F6000-memory.dmp
memory/2176-2021-0x0000000018620000-0x0000000018B4C000-memory.dmp
memory/2176-2027-0x0000000017FC0000-0x0000000017FCA000-memory.dmp
memory/2176-2029-0x00000000181F0000-0x000000001820E000-memory.dmp
memory/2176-2031-0x00000000182A0000-0x000000001832A000-memory.dmp
memory/2176-2032-0x0000000018240000-0x0000000018266000-memory.dmp
memory/2176-2033-0x0000000017FE0000-0x0000000017FE8000-memory.dmp
memory/2176-2163-0x0000000018330000-0x0000000018342000-memory.dmp
memory/2176-2150-0x0000000017E80000-0x0000000017ED4000-memory.dmp
memory/2176-2137-0x0000000018370000-0x00000000183A6000-memory.dmp
memory/2176-2148-0x00000000178A0000-0x00000000178C8000-memory.dmp
memory/2364-18-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2364-376-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2364-1829-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4356-1889-0x0000000005600000-0x0000000005781000-memory.dmp
memory/4356-1888-0x0000000000E20000-0x0000000000E28000-memory.dmp
memory/4528-24-0x0000000000750000-0x0000000000751000-memory.dmp
memory/4528-382-0x0000000000400000-0x0000000000576000-memory.dmp
memory/4528-393-0x0000000000750000-0x0000000000751000-memory.dmp
memory/4528-1828-0x0000000000400000-0x0000000000576000-memory.dmp