Analysis
- user interaction
yes - max time kernel
364s - max time network
356s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-uk - resource tags
- submitted
04/08/2026, 04:41
General
- Target SteamLuaTools-TEST-V4.0.exe
- Size 48.4MB
- Sample260804-fa747sv1ax
- SHA256 1e059ebf9a56b3f38cccfa1160fc666892789249742bc7119632142eb3d04722
Score
8/10
Malware Config
Signatures
- Disables RegEdit via registry modification 1 IoCs
- Disables Task Manager via registry modification
- Downloads MZ/PE file 3 IoCs
- Executes dropped EXE 9 IoCs
- Loads dropped DLL 56 IoCs
- Modifies file permissions 1 TTPs 2 IoCs
- Stops running service(s) 4 TTPs
- Checks for any installed AV software in registry 1 TTPs 12 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in System32 directory 48 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 1 IoCs
- Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Inno Setup is an open-source installation builder for Windows applications. 7 IoCs
Inno Setup installer
- Checks SCSI registry key(s) 3 TTPs 8 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 6 IoCs
- Modifies data under HKEY_USERS 10 IoCs
- Modifies registry class 64 IoCs
- Runs net.exe
- Script User-Agent 3 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 22 IoCs
- Suspicious behavior: LoadsDriver 10 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 35 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 37 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\SteamLuaTools-TEST-V4.0.exe"C:\Users\Admin\AppData\Local\Temp\SteamLuaTools-TEST-V4.0.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SteamLuaTools-TEST-V4.0.exe"C:\Users\Admin\AppData\Local\Temp\SteamLuaTools-TEST-V4.0.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
- Executes a command shell one-liner
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004F81⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc1⤵
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffec4b2c728,0x7ffec4b2c734,0x7ffec4b2c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=uk --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1488,i,13931856243961529741,11998438172967234873,524288 --field-trial-handle=1976,i,6038706106019211429,15425862091841824711,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,2214482426683884552,664275346314962461,262144 --field-trial-handle=1976,i,6038706106019211429,15425862091841824711,262144 --variations-seed-version --mojo-platform-channel-handle=1972 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2308,i,17821742387989954360,447708499200636993,524288 --field-trial-handle=1976,i,6038706106019211429,15425862091841824711,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3300,i,8410060683346773090,14674746148197304249,2097152 --field-trial-handle=1976,i,6038706106019211429,15425862091841824711,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3168,i,3129130457152428274,6080919897734582239,2097152 --field-trial-handle=1976,i,6038706106019211429,15425862091841824711,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4676,i,10919238786455943058,6475232924643578716,2097152 --field-trial-handle=1976,i,6038706106019211429,15425862091841824711,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4884,i,10755320527987024725,2147521462196237863,524288 --field-trial-handle=1976,i,6038706106019211429,15425862091841824711,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=uk --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5396,i,10671623861098266429,18350042151119464452,524288 --field-trial-handle=1976,i,6038706106019211429,15425862091841824711,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5492,i,6479333298941381881,13242214705016505332,2097152 --field-trial-handle=1976,i,6038706106019211429,15425862091841824711,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5504,i,7000768261122663686,11181915938303725032,2097152 --field-trial-handle=1976,i,6038706106019211429,15425862091841824711,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5812,i,5858603268693583096,17946965994411908523,2097152 --field-trial-handle=1976,i,6038706106019211429,15425862091841824711,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5688,i,18052983417476588746,10956110220850470323,524288 --field-trial-handle=1976,i,6038706106019211429,15425862091841824711,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6048,i,14648670282457566323,8287475522268920166,2097152 --field-trial-handle=1976,i,6038706106019211429,15425862091841824711,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5796,i,12030918276138109604,3422764576168978985,524288 --field-trial-handle=1976,i,6038706106019211429,15425862091841824711,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5824,i,2481774726240651355,1821042966317233440,2097152 --field-trial-handle=1976,i,6038706106019211429,15425862091841824711,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5788,i,4616304599769814462,11889421022550489805,2097152 --field-trial-handle=1976,i,6038706106019211429,15425862091841824711,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5648,i,3734511003032055621,2712879950872458001,2097152 --field-trial-handle=1976,i,6038706106019211429,15425862091841824711,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6056,i,8413659156728691992,8772292230747048545,2097152 --field-trial-handle=1976,i,6038706106019211429,15425862091841824711,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5644,i,4131494826246080763,5352877373627243103,524288 --field-trial-handle=1976,i,6038706106019211429,15425862091841824711,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6392,i,7270063244887245646,14541058842958986548,2097152 --field-trial-handle=1976,i,6038706106019211429,15425862091841824711,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5792,i,8299412535128621230,7491843420973763340,2097152 --field-trial-handle=1976,i,6038706106019211429,15425862091841824711,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6184,i,3986059693594986707,14306109364384276200,2097152 --field-trial-handle=1976,i,6038706106019211429,15425862091841824711,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6192,i,16547062435334672869,13163281424966272408,2097152 --field-trial-handle=1976,i,6038706106019211429,15425862091841824711,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=5676,i,3254466443116296675,8338941173789757547,2097152 --field-trial-handle=1976,i,6038706106019211429,15425862091841824711,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6256,i,4396929520395155576,8785203609740566013,2097152 --field-trial-handle=1976,i,6038706106019211429,15425862091841824711,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6556,i,3156331274270574064,6017344586816734725,2097152 --field-trial-handle=1976,i,6038706106019211429,15425862091841824711,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6820,i,12420458494399720973,6953632786007183680,2097152 --field-trial-handle=1976,i,6038706106019211429,15425862091841824711,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6352,i,3511466081528555919,17423937170989016622,2097152 --field-trial-handle=1976,i,6038706106019211429,15425862091841824711,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6956,i,18140251134684906337,2434168800902854806,2097152 --field-trial-handle=1976,i,6038706106019211429,15425862091841824711,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=256,i,5485115241949733721,5733216831236879777,524288 --field-trial-handle=1976,i,6038706106019211429,15425862091841824711,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6184,i,5056389451003764686,14645468644006149112,524288 --field-trial-handle=1976,i,6038706106019211429,15425862091841824711,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6480,i,3426133068973353847,3191902311916698850,524288 --field-trial-handle=1976,i,6038706106019211429,15425862091841824711,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=uk --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5924,i,2274660406784008234,3003556107563598431,524288 --field-trial-handle=1976,i,6038706106019211429,15425862091841824711,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=6148,i,4771116089590611395,4350820917255736868,2097152 --field-trial-handle=1976,i,6038706106019211429,15425862091841824711,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=7132,i,14324010934489946486,3670254663070958174,2097152 --field-trial-handle=1976,i,6038706106019211429,15425862091841824711,262144 --variations-seed-version --mojo-platform-channel-handle=7124 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=6132,i,4271323343847273662,4392224844338693341,2097152 --field-trial-handle=1976,i,6038706106019211429,15425862091841824711,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=6424,i,5969611735788587913,11210160999416826292,2097152 --field-trial-handle=1976,i,6038706106019211429,15425862091841824711,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=6484,i,13281202526380033053,3414248266394305279,2097152 --field-trial-handle=1976,i,6038706106019211429,15425862091841824711,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=6832,i,15627623830352488527,4627498948973378309,2097152 --field-trial-handle=1976,i,6038706106019211429,15425862091841824711,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3780,i,8473554367881091508,474412635377901394,524288 --field-trial-handle=1976,i,6038706106019211429,15425862091841824711,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:142⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6880,i,6370115181831231342,17226432653149568039,524288 --field-trial-handle=1976,i,6038706106019211429,15425862091841824711,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=6888,i,3854619420638312572,17651584756294974705,2097152 --field-trial-handle=1976,i,6038706106019211429,15425862091841824711,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:12⤵
-
-
C:\Users\Admin\Downloads\cdm.exe"C:\Users\Admin\Downloads\cdm.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-6IVLWZENQ2.tmp\cdm.tmp"C:\Users\Admin\AppData\Local\Temp\is-6IVLWZENQ2.tmp\cdm.tmp" /SL5="$E00F6,5592098,893952,C:\Users\Admin\Downloads\cdm.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-2TL8RUCDXK.tmp\CheatEngine77.exe"C:\Users\Admin\AppData\Local\Temp\is-2TL8RUCDXK.tmp\CheatEngine77.exe" /VERYSILENT /ZBDIST4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-A49QI.tmp\CheatEngine77.tmp"C:\Users\Admin\AppData\Local\Temp\is-A49QI.tmp\CheatEngine77.tmp" /SL5="$600F4,32420729,869888,C:\Users\Admin\AppData\Local\Temp\is-2TL8RUCDXK.tmp\CheatEngine77.exe" /VERYSILENT /ZBDIST5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SYSTEM32\net.exe"net" stop BadlionAntic6⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BadlionAntic7⤵
-
-
-
C:\Windows\SYSTEM32\net.exe"net" stop BadlionAnticheat6⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BadlionAnticheat7⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc" delete BadlionAntic6⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc" delete BadlionAnticheat6⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exe"net" stop vgk6⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop vgk7⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc" delete vgk6⤵
- Launches sc.exe
-
-
C:\Users\Admin\AppData\Local\Temp\is-VS4DU.tmp\_isetup\_setup64.tmphelper 105 0x3B86⤵
- Executes dropped EXE
-
-
C:\Windows\system32\icacls.exe"icacls" "C:\Program Files\Cheat Engine" /grant *S-1-15-2-1:(OI)(CI)(RX)6⤵
- Modifies file permissions
-
-
C:\Program Files\Cheat Engine\Kernelmoduleunloader.exe"C:\Program Files\Cheat Engine\Kernelmoduleunloader.exe" /SETUP6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Cheat Engine\windowsrepair.exe"C:\Program Files\Cheat Engine\windowsrepair.exe" /s6⤵
- Executes dropped EXE
-
-
C:\Windows\system32\icacls.exe"icacls" "C:\Program Files\Cheat Engine" /grant *S-1-15-2-1:(OI)(CI)(RX)6⤵
- Modifies file permissions
-
-
-
-
C:\Program Files\Cheat Engine\Cheat Engine.exe"C:\Program Files\Cheat Engine\Cheat Engine.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files\Cheat Engine\cheatengine-x86_64-SSE4-AVX2.exe"C:\Program Files\Cheat Engine\cheatengine-x86_64-SSE4-AVX2.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffec4b2c728,0x7ffec4b2c734,0x7ffec4b2c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=uk --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1908,i,5124575493345700692,16375973749182779657,524288 --field-trial-handle=1988,i,8758890556259837919,8420990959449454613,262144 --variations-seed-version=20260803-170100.258000-production --mojo-platform-channel-handle=2024 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,12764713984125124256,12324869917207690691,262144 --field-trial-handle=1988,i,8758890556259837919,8420990959449454613,262144 --variations-seed-version=20260803-170100.258000-production --mojo-platform-channel-handle=1984 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=1864,i,12138583801983367348,14471042470341975369,524288 --field-trial-handle=1988,i,8758890556259837919,8420990959449454613,262144 --variations-seed-version=20260803-170100.258000-production --mojo-platform-channel-handle=2464 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3272,i,10396633550970152477,8963299504076947597,2097152 --field-trial-handle=1988,i,8758890556259837919,8420990959449454613,262144 --variations-seed-version=20260803-170100.258000-production --mojo-platform-channel-handle=3312 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3320,i,3166655057693841540,17704677151177714448,2097152 --field-trial-handle=1988,i,8758890556259837919,8420990959449454613,262144 --variations-seed-version=20260803-170100.258000-production --mojo-platform-channel-handle=3412 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4756,i,7050741842541789690,10593910699707373674,2097152 --field-trial-handle=1988,i,8758890556259837919,8420990959449454613,262144 --variations-seed-version=20260803-170100.258000-production --mojo-platform-channel-handle=4772 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=uk --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5448,i,10905843950373537926,7078152824761806455,524288 --field-trial-handle=1988,i,8758890556259837919,8420990959449454613,262144 --variations-seed-version=20260803-170100.258000-production --mojo-platform-channel-handle=5444 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5472,i,9547804596025717914,9479673426053244763,2097152 --field-trial-handle=1988,i,8758890556259837919,8420990959449454613,262144 --variations-seed-version=20260803-170100.258000-production --mojo-platform-channel-handle=5808 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3640,i,7520129567866576726,6178182185344992782,2097152 --field-trial-handle=1988,i,8758890556259837919,8420990959449454613,262144 --variations-seed-version=20260803-170100.258000-production --mojo-platform-channel-handle=3612 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3600,i,8920133078540274930,405645380666983718,524288 --field-trial-handle=1988,i,8758890556259837919,8420990959449454613,262144 --variations-seed-version=20260803-170100.258000-production --mojo-platform-channel-handle=3592 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3608,i,2132448216117961581,2633041252908030664,524288 --field-trial-handle=1988,i,8758890556259837919,8420990959449454613,262144 --variations-seed-version=20260803-170100.258000-production --mojo-platform-channel-handle=5516 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3668,i,17479413259301816847,8453344224399922335,524288 --field-trial-handle=1988,i,8758890556259837919,8420990959449454613,262144 --variations-seed-version=20260803-170100.258000-production --mojo-platform-channel-handle=5824 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=256,i,1729576258801437462,171079556864051253,2097152 --field-trial-handle=1988,i,8758890556259837919,8420990959449454613,262144 --variations-seed-version=20260803-170100.258000-production --mojo-platform-channel-handle=5924 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5580,i,5327443536684156727,10552468130902987210,2097152 --field-trial-handle=1988,i,8758890556259837919,8420990959449454613,262144 --variations-seed-version=20260803-170100.258000-production --mojo-platform-channel-handle=6128 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=uk --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3248,i,12301069309957275437,14319058945901805700,524288 --field-trial-handle=1988,i,8758890556259837919,8420990959449454613,262144 --variations-seed-version=20260803-170100.258000-production --mojo-platform-channel-handle=5880 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Downloads\salinewin1.5\salinewin1.5.exe"C:\Users\Admin\Downloads\salinewin1.5\salinewin1.5.exe"1⤵
- Disables RegEdit via registry modification
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1System Services
1Service Execution
1Persistence
Create or Modify System Process
1Windows Service
1Pre-OS Boot
1Bootkit
1Defense Evasion
File and Directory Permissions Modification
1Impair Defenses
1Pre-OS Boot
1Bootkit
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
1Query Registry
5Software Discovery
1Security Software Discovery
1System Information Discovery
4System Location Discovery
1System Language Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
Cheat Engine.exe
Kernelmoduleunloader.exe
scoreboard.png
_mingw.h
assert.h
celib.h
celog.h
cepipelib.c
cesocket.h
conio.h
ctype.h
dir.h
direct.h
dirent.h
dos.h
errno.h
excpt.h
fcntl.h
fenv.h
float.h
inttypes.h
io.h
jni.h
limits.h
linux-x86_64-ExceptionHandler.c
locale.h
lauxlib.h
lua.h
lua.hpp
luaconf.h
lualib.h
luaclient.c
macspeedhack.c
malloc.h
math.h
mem.h
memory.h
process.h
conio_s.h
crtdbg_s.h
io_s.h
mbstring_s.h
search_s.h
stdio_s.h
stdlib_s.h
stralign_s.h
string_s.h
timeb_s.h
tchar_s.h
time_s.h
wchar_s.h
setjmp.h
share.h
signal.h
stdalign.h
stdarg.h
stdatomic.h
stdbool.h
stddef.h
stdint.h
stdio.h
stdlib.h
stdnoreturn.h
string.h
fcntl.h
file.h
locking.h
stat.h
time.h
timeb.h
types.h
unistd.h
utime.h
tcc_libm.h
tccdefs.h
tchar.h
tgmath.h
time.h
vadefs.h
values.h
varargs.h
wchar.h
wctype.h
basetsd.h
basetyps.h
guiddef.h
poppack.h
pshpack1.h
pshpack2.h
pshpack4.h
pshpack8.h
winbase.h
wincon.h
windef.h
windows.h
winerror.h
wingdi.h
winnt.h
winreg.h
winuser.h
winver.h
windowslite.h
files here are in the lua searchpath.txt
forEachForm.lua
json.lua
unins000.exe
settings.dat
BookmarkMergedSurfaceOrdering
f_000011
f_000045
f_000062
f_000064
f_000065
the-real-index
the-real-index
the-real-index
messages.json
craw_background.js
CURRENT
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
data_0
data_1
data_2
data_3
MANIFEST-000001
Network Persistent State
Network Persistent State~RFe5afaad.TMP
b67b79a6-2da4-492e-b027-dac4522efbd8.tmp
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
OpenSteamTools.zip
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_asyncio.pyd
_bz2.pyd
_ctypes.pyd
_decimal.pyd
ada92cb5d92a588d1b93__mypyc.cp310-win_amd64.pyd
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-fibers-l1-1-0.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
base_library.zip
libcrypto-1_1.dll
libffi-7.dll
libssl-1_1.dll
pyexpat.pyd
python3.DLL
python310.dll
select.pyd
ucrtbase.dll
unicodedata.pyd
CheatEngine77.exe
WebAdvisor.png
finish.png
logo.png
messages.json
salinewin1.5.zip.crdownload
memory/4452-2576-0x00000000002D0000-0x0000000000658000-memory.dmp
memory/4572-1504-0x0000000000800000-0x00000000008E4000-memory.dmp
memory/4572-2577-0x0000000000800000-0x00000000008E4000-memory.dmp
memory/5452-1513-0x0000000000B00000-0x0000000000F4B000-memory.dmp
memory/5452-1496-0x0000000000B00000-0x0000000000F4B000-memory.dmp
memory/5452-1494-0x0000000003AB0000-0x0000000003BF0000-memory.dmp
memory/5452-1471-0x0000000000B00000-0x0000000000F4B000-memory.dmp
memory/5452-2581-0x0000000003AB0000-0x0000000003BF0000-memory.dmp
memory/5452-2584-0x0000000000B00000-0x0000000000F4B000-memory.dmp
memory/5452-1488-0x0000000003AB0000-0x0000000003BF0000-memory.dmp
memory/5848-289-0x000002BBB8BF0000-0x000002BBB8C00000-memory.dmp
memory/5848-288-0x00007FFEC76E0000-0x00007FFEC7A9B000-memory.dmp
memory/5848-290-0x000002BBB77E0000-0x000002BBB81E6000-memory.dmp
memory/5848-1489-0x000002BBB77E0000-0x000002BBB81E6000-memory.dmp
memory/5848-3111-0x000002BBB77E0000-0x000002BBB81E6000-memory.dmp
memory/5848-3108-0x000002BBB77E0000-0x000002BBB81E6000-memory.dmp
memory/5848-991-0x000002BBB77E0000-0x000002BBB81E6000-memory.dmp
memory/5848-301-0x000002BBB77E0000-0x000002BBB81E6000-memory.dmp
memory/5848-287-0x00007FFEC8A30000-0x00007FFEC8EE9000-memory.dmp
memory/5848-286-0x00007FFECA730000-0x00007FFECAA63000-memory.dmp
memory/5848-1314-0x000002BBB77E0000-0x000002BBB81E6000-memory.dmp
memory/5848-1292-0x000002BBB77E0000-0x000002BBB81E6000-memory.dmp
memory/5848-750-0x000002BBB77E0000-0x000002BBB81E6000-memory.dmp
memory/6528-1329-0x0000000000D50000-0x0000000000E39000-memory.dmp
memory/6528-1470-0x0000000000D50000-0x0000000000E39000-memory.dmp
memory/6528-1495-0x0000000000D50000-0x0000000000E39000-memory.dmp
memory/6528-2585-0x0000000000D50000-0x0000000000E39000-memory.dmp