hxxp://discord[.]com

Analysis

max time kernel
140s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
31-03-2023 19:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://discord.com

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MinecraftInstaller.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	MinecraftInstaller.exe

Executes dropped EXE 4 IoCs

Processes:

MinecraftInstaller.exeGmingRepair.exegameinputsvc.exegameinputsvc.exe

pid process

6032 MinecraftInstaller.exe
5420 GmingRepair.exe
4388 gameinputsvc.exe
2256 gameinputsvc.exe
Loads dropped DLL 2 IoCs

Processes:

gameinputsvc.exe

pid process

2256 gameinputsvc.exe
380

pid	process
6032	MinecraftInstaller.exe
5420	GmingRepair.exe
4388	gameinputsvc.exe
2256	gameinputsvc.exe

pid	process
2256	gameinputsvc.exe
380

Registers COM server for autorun 1 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

GamingServices.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{25209EC2-1BAD-45AB-AC18-42396DF52294}\InProcServer32\ = "C:\\Windows\\system32\\GamingServicesProxy.dll"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{25209EC2-1BAD-45AB-AC18-42396DF52294}\InProcServer32\ThreadingModel = "Both"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FBA5170-10C4-4185-89E3-2D8389223563}\InProcServer32	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FBA5170-10C4-4185-89E3-2D8389223563}\InProcServer32\ = "C:\\Program Files\\WindowsApps\\Microsoft.GamingServices_10.75.13001.0_x64__8wekyb3d8bbwe\\InstallServicePlugin.dll"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FBA5170-10C4-4185-89E3-2D8389223563}\InProcServer32\ThreadingModel = "Both"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{25209EC2-1BAD-45AB-AC18-42396DF52294}\InProcServer32	GamingServices.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in System32 directory 12 IoCs

Processes:

GamingServices.exegameinputsvc.exe

description	ioc	process
File created	C:\Windows\system32\xgamecontrol.exe	GamingServices.exe
File created	C:\Windows\system32\gamelaunchhelper.dll	GamingServices.exe
File created	C:\Windows\system32\GameInputRedist.dll	gameinputsvc.exe
File created	C:\Windows\system32\xgameruntime.dll	GamingServices.exe
File created	C:\Windows\system32\gamingservicesproxy.dll	GamingServices.exe
File created	C:\Windows\system32\gameplatformservices.dll	GamingServices.exe
File created	C:\Windows\system32\gamingtcuihelpers.dll	GamingServices.exe
File opened for modification	C:\Windows\system32\GameInputRedist.dll	gameinputsvc.exe
File created	C:\Windows\SysWOW64\GameInputRedist.dll	gameinputsvc.exe
File opened for modification	C:\Windows\system32\xgameruntime.dll	GamingServices.exe
File created	C:\Windows\system32\gameconfighelper.dll	GamingServices.exe
File created	C:\Windows\system32\xgamehelper.exe	GamingServices.exe

Drops file in Program Files directory 7 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Program Files (x86)\Windows Kits\10\Catalogs\catbfd5519c2b57eb0ee9fe1d5b706a7b44.cat	msiexec.exe
File created	C:\Program Files (x86)\Microsoft GameInput\x86\gameinput.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft GameInput\x86\gameinputredist.dll	msiexec.exe
File created	C:\Program Files (x86)\Windows Kits\10\Catalogs\catded785c75b3d3adeef26e53fee6beba8.cat	msiexec.exe
File created	C:\Program Files (x86)\Microsoft GameInput\x64\gameinput.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft GameInput\x64\gameinputredist.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft GameInput\x64\gameinputsvc.exe	msiexec.exe

Drops file in Windows directory 9 IoCs

Processes:

msiexec.exeGamingServices.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\e5912f2.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{1F2B6AF3-C260-8666-5950-E3FEDBC851D6}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI167C.tmp	msiexec.exe
File created	C:\Windows\Installer\e5912f5.msi	msiexec.exe
File created	C:\Windows\Installer\e5912f2.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	GamingServices.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

gameinputsvc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	gameinputsvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	gameinputsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	gameinputsvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	gameinputsvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

GmingRepair.exe

description	ioc	process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GmingRepair.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	GmingRepair.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exechrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

chrome.exegameinputsvc.exeGamingServices.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	gameinputsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{BAEE68FB-2B54-4DE3-BECC-4FF62E89ABAF}\ApplicationFlags = "1"	GamingServices.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	gameinputsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	gameinputsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{BAEE68FB-2B54-4DE3-BECC-4FF62E89ABAF}\DeviceId = "0018C00848EB2BF9"	GamingServices.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption"	gameinputsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	gameinputsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	gameinputsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1"	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	gameinputsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	gameinputsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	gameinputsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	gameinputsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	gameinputsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	gameinputsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)"	gameinputsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	gameinputsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	gameinputsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	gameinputsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	gameinputsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	gameinputsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property	GamingServices.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{BAEE68FB-2B54-4DE3-BECC-4FF62E89ABAF}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000328b44abfa378a4c93c268658e86475f0000000002000000000010660000000100002000000039ab35e1d87bbc9adce252b82b8911d8ef209e640915cdb7100fee8612fe4c33000000000e80000000020000200000005c7a8b79f9c85df43a099db71f1ce3498b564ee8e0351b8e4503513e5d6b0ca1b003000028305542b3321ba444f7b6c42596a3d04302b7b4f5d0ea591745ddad6e06bdc8dde3bcf043764e8b2f0699d1f2d1dbac0206fb8cfc5a1aa54b920d53e666a39b67037e1738e3a9c1d3475c926874010e3f8df4d0325fef34e67124f789ad68175b66115f08fca8de3fcc1d7e01ef33d13cfe186fc425c431a69616061fd0b3b51b9964fa2c6a228e74140b9fb228f95d765da9764cb0474cfd3d5f9c3a881d4e0fe9ef0dbf5165e6ea2b4283c5f439fe37f9b207d04548317b99b96401b07a0ad468cff251d15edeb29a27ef21a5fb175f387f1e1cfafc29dc93e21f384fa10b44835a2ba898b6d0de3997f2c6192bb121854efd7ac4fc1c3c58c05aa783fa8ae34a628ba2714856e07442c47b6b3630bea6d2a8eb62069e87176f5ef3f60d464f2a901c02861a25b2fc748f024b70248c27d42ca83dca7ca4f3a80b3597e7f0205f0d5a392d4a7ec47dac59196989fa3665511c8f01a3517669846df4185b29ff754951d4edb3aa5751ebeb7b68d0c76119e1308d8b48a3a454ad5bcc0df1fae78e9cc026ba0a7a4957b990b3fb28f47a2ee09873bf3bb054188efab3521bde2cb695ef53829d8265687ad7399009da98138246e8d2622ba914641c678c416e134e8a3299b79fcf7655cdd83c15f17d816455a1e2d9c2b5f359fabc258fb19037da7c3870474e3237720ebb1160319e7e50c1414d38f20907bbe53967a9ac0b8c4c704bd999a2c52183584c80334a921b51f76a78b51d7502401fd30b67d6d9f82df48306c1346d74172f82a9b04e19ba9ed20857f59cc198431b60a94c6b7af1906b85fbee6eab7262374bb9e94546356ecea3e0aacd8f39708c6de174a2c936fd7d9d829de2f5cd918ef6c8cae1ce188cba7f1c7b0836ecb20ea595232a1dd78b01e6a6fe84e1728bcd5822c5091d73ec4a121791d836d683b46bd710808de0cad289086bacbd6ff9c11fceb24c80028c3c5069eb384a27dc7becdd79324863d0c0364c9f7acfb13b859d99496823a9aaaed875bd2470f2fd5c24537e11e9a5e6b1bcfb2fdf698e0a3824c55fae1ed6429fe687d59846eb57f67277eb365fbe5ecb8db8b3998a4bf26302bebebebf5145fb1ced9ea3a2b40bb521f04946fbf57e82bd66663b52a758fc2850291830f6f689100551af5067f4f2867a43594923b3f748d97b7cf8991993bde6914d116319c0c0df552f7f39bfa18c53c775797ffe81cb74f93b6e79d487ff0511772d210fa20438b9b79f390e2860a693792c9362888d872ef7ad3d067fef5db9c5387150b3a2400acb4441903881c21cf0d79d39abc807bfa7fabe38e5106b8732c540000000bd910605026fc51bd9e51a2ddd601b2ba28a2e79c56c5b1e39fca6582e5f7a5c81ee96b220fbfc17613ff0a44b20cbf4c0369f36ff4d15aff6b9c020c8e1d464	GamingServices.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	gameinputsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	gameinputsvc.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133247735637964942"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption"	gameinputsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	gameinputsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	gameinputsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property\0018C00848EB2BF9 = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000328b44abfa378a4c93c268658e86475f00000000020000000000106600000001000020000000bfe819452190d78029d5d8a86269d5da5c2de98270d6996d44a913b16ef2fae7000000000e8000000002000020000000d42d1e71afffa5b93f2c5e1a81924de6f33f17bd1f9d9f89a915b7da183723e4800000009ffecdb41f4b6fa2ee75af099ac83cb4b8f3947e083a084af1a5eca5884e154db7b69879451633831b75588d868822ca8e57d9d3f431f3be2bb8bf8a7d1deb45a0b34968513b59a6b479caabecb1054503525bf2972393e7f10bca2f279df933603c2778510daf99c5d82444f70dfaff2fb45358e22a76aeaac879e21aa4195140000000c7ff18137e3ba8d67a667cca9563fc0e3fcacbc686cbd0c935f12adda479931b8fc3dab183a7fb47cbdae6cefa0b1a28fcac68ba6cf5448f830963b8a898fcda	GamingServices.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	gameinputsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	gameinputsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	gameinputsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	gameinputsvc.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	gameinputsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	gameinputsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	gameinputsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	gameinputsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	gameinputsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 4bf12f70522b9baa4b8299064b25b80e132bdd8eb6bc008342c179ccb19af70a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	gameinputsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	gameinputsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	gameinputsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	gameinputsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	gameinputsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{BAEE68FB-2B54-4DE3-BECC-4FF62E89ABAF}	GamingServices.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = 2c080000e59000411c64d901	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	gameinputsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update"	gameinputsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	gameinputsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave"	gameinputsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	gameinputsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	gameinputsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	gameinputsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E	gameinputsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	gameinputsvc.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	msiexec.exe

Modifies registry class 64 IoCs

Processes:

GamingServices.exemsiexec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{59C8ADF3-BBC4-46B2-BD96-E9105D203438}\ProxyStubClsid32\ = "{25209EC2-1BAD-45AB-AC18-42396DF52294}"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{862A26A8-2D87-4D8E-8E6B-17DB48B8234D}	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0415A237-4CC5-48ED-BE61-B04899D7D237}\ProxyStubClsid32	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AE51CF4F-D657-41C0-AC3B-7218A32CA524}	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{115E6AF7-8620-4B0E-A9B1-4CA958B8A24D}	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AD6FF479-E54E-4786-AC2A-10D35C5B93A7}\AsynchronousInterface\ = "{8F48B00E-45A9-435B-B458-2FFC8FC3AF9E}"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{53DA424D-280E-456F-BCD5-F2FD2232198C}	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{25E8B0C8-7B14-4015-B8C7-571BFF442A96}\AppId = "{2964DB41-BAE4-4996-A0A0-D036BFFDC267}"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9AF86CDE-6083-4707-BA4D-829ADE1BD0B7}\AppId = "{2964DB41-BAE4-4996-A0A0-D036BFFDC267}"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D657678E-9088-4EDD-A39F-234AAF6BEBFF}	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BC9DC3BC-6685-4005-B961-A6B53B75A12D}\ProxyStubClsid32\ = "{25209EC2-1BAD-45AB-AC18-42396DF52294}"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7d4ec953-bee1-4b1b-9aa8-c3a12b4e04c6}\ = "ITcuiServer"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1A9D8E03-A524-4FC6-A566-2BC802898DFF}\ProxyStubClsid32	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B5323F02-4DB5-4442-BD09-FD78E0F61CEB}\ProxyStubClsid32	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.Windows.GameInputRedist.x86.10\Version = "10.1.22621.3036"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CD4BEF6-AEB3-41D7-ABBC-61C35CCBD4AD}\AppId = "{2964DB41-BAE4-4996-A0A0-D036BFFDC267}"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3a842a27-fd86-40be-8fa8-483a86ae011c}\ProxyStubClsid32\ = "{25209EC2-1BAD-45AB-AC18-42396DF52294}"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{390f4bd8-3660-409e-8faf-dacdb440a0ee}\ProxyStubClsid32	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4C1344D-55A0-453A-957E-83727B36CAC9}\SynchronousInterface\ = "{1A9D8E03-A524-4FC6-A566-2BC802898DFF}"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C7D3AC89-7D69-4E41-A6C1-09913CE1C8F8}	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{142C8431-D185-4F3E-8886-139BFD3430BB}\ProxyStubClsid32	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8856634F-2E22-481D-B9CA-EE876CBB5D26}\ProxyStubClsid32	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{81a071a8-08cb-59f3-ade7-8ce0499458f4}\ = "Windows.Foundation.IAsyncOperation`1<GameCore.Users.DenyReason>"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C7D04FC0-0721-41BC-B0BA-336A52801B73}\LocalService = "GamingServices"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4FCE4871-593B-44CC-9868-AAA631C5D2D7}	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53996A6D-0B67-4109-B5EE-953D779C8C60}	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{516CF1AD-972B-454E-BAAD-44063CE034B8}	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19BE86F3-3A39-4FB9-9B68-2C51ACB6509F}	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4C8B9BA5-D030-44F8-819E-EA04BE3CC9C8}\ProxyStubClsid32	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7d4ec953-bee1-4b1b-9aa8-c3a12b4e04c6}	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{815211C2-E515-4437-A8CC-E93857DF54F5}\ = "IHidForceFeebackBroker"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FA6B2F1062C666895053EEFBD8C156D\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{05BE69B0-B0CD-4DDF-B3F4-735165435D93}	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AEBF8959-5F3F-408B-9A60-436F5E97A46A}	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AD6FF479-E54E-4786-AC2A-10D35C5B93A7}	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{483DCCC8-BEF4-4268-9F88-82D758F22B62}\SynchronousInterface	GamingServices.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FA6B2F1062C666895053EEFBD8C156D\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9AF86CDE-6083-4707-BA4D-829ADE1BD0B7}\ = "PackageInstallRecipe"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4FF525D5-AC7F-4D25-8CEC-23686C02A7C9}\AppId = "{2964DB41-BAE4-4996-A0A0-D036BFFDC267}"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53996A6D-0B67-4109-B5EE-953D779C8C60}\ProxyStubClsid32\ = "{25209EC2-1BAD-45AB-AC18-42396DF52294}"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{090795DB-989B-4625-B397-083D85066042}	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D4DAB5B8-A025-4A72-84AC-7FE45C6E5456}\ = "AsyncIXGameSaveOperationHandler"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7025B35A-849F-49CB-BBFD-EEA00E5C2A01}\ = "IXGameSaveQueryHandler"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D8C956A7-D22F-461A-857C-89FB1F9C378B}\LocalService = "GamingServices"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CC042A88-E160-44CD-B089-8C9E6F0AB42D}	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53996A6D-0B67-4109-B5EE-953D779C8C60}\ProxyStubClsid32	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{82B0290F-C7F3-466C-BF99-49FD29CA5C92}\ = "IGameCorePackageServiceMonitor_V1"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2F87250D-063D-4871-9399-3A603DFA0E04}\ProxyStubClsid32	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{04A4A9D1-8881-4E18-96CF-184E58A2323C}\ProxyStubClsid32	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E9308F43-3F62-44BF-A5FF-456C8254BF3F}\ProxyStubClsid32	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9291ed54-b88c-556f-b870-49a901ac529d}\ = "Windows.Foundation.AsyncOperationCompletedHandler`1<GameCore.Users.IResolveUserIssueResult>"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{f2746100-46b0-45c1-8403-9bafe4253fa9}\ProxyStubClsid32\ = "{25209EC2-1BAD-45AB-AC18-42396DF52294}"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A2EE83-73B2-416D-88F4-4BC1B1FE996D}\SynchronousInterface\ = "{7685A31F-F733-4246-8547-3DF85BB717A2}"	GamingServices.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FA6B2F1062C666895053EEFBD8C156D\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{05BE69B0-B0CD-4DDF-B3F4-735165435D93}\ = "XboxPackageManager"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0415A237-4CC5-48ED-BE61-B04899D7D237}\ProxyStubClsid32\ = "{25209EC2-1BAD-45AB-AC18-42396DF52294}"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C098804A-9A44-43CB-BE16-3FEAF35BF7DE}\ProxyStubClsid32	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{a88bbde8-607c-507e-8b2f-ff422ef2c8a7}	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FA6B2F1062C666895053EEFBD8C156D\SourceList\Net\1 = "C:\\Program Files\\WindowsApps\\Microsoft.GamingServices_10.75.13001.0_x64__8wekyb3d8bbwe\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6593254-0EA2-4938-8D62-7B353395126A}\LocalService = "GamingServices"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{f2746100-46b0-45c1-8403-9bafe4253fa9}\ProxyStubClsid32	GamingServices.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{671D365D-D1F9-4B8A-BA89-832EB0CFF5F5}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CD4BEF6-AEB3-41D7-ABBC-61C35CCBD4AD}\ = "GameCorePackageIo"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CD4BEF6-AEB3-41D7-ABBC-61C35CCBD4AD}\LocalService = "GamingServices"	GamingServices.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

chrome.exechrome.exemsiexec.exegameinputsvc.exe

pid process

1436 chrome.exe
1436 chrome.exe
3868 chrome.exe
3868 chrome.exe
2092 msiexec.exe
2092 msiexec.exe
2256 gameinputsvc.exe
2256 gameinputsvc.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

chrome.exe

pid process

1436 chrome.exe
1436 chrome.exe
1436 chrome.exe
1436 chrome.exe
1436 chrome.exe
1436 chrome.exe
1436 chrome.exe
1436 chrome.exe
1436 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exechrome.exe

description	pid	process
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	3968	chrome.exe
Token: SeCreatePagefilePrivilege	3968	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	3968	chrome.exe
Token: SeCreatePagefilePrivilege	3968	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	3968	chrome.exe
Token: SeCreatePagefilePrivilege	3968	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	3968	chrome.exe
Token: SeCreatePagefilePrivilege	3968	chrome.exe
Token: SeShutdownPrivilege	3968	chrome.exe
Token: SeCreatePagefilePrivilege	3968	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	3968	chrome.exe
Token: SeCreatePagefilePrivilege	3968	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	3968	chrome.exe
Token: SeCreatePagefilePrivilege	3968	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	3968	chrome.exe
Token: SeCreatePagefilePrivilege	3968	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	3968	chrome.exe
Token: SeCreatePagefilePrivilege	3968	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exe

pid	process
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe

Suspicious use of SendNotifyMessage 48 IoCs

Processes:

chrome.exe

pid	process
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exechrome.exe

description	pid	process	target process
PID 1436 wrote to memory of 4664	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 4664	1436	chrome.exe	chrome.exe
PID 3968 wrote to memory of 2276	3968	chrome.exe	chrome.exe
PID 3968 wrote to memory of 2276	3968	chrome.exe	chrome.exe
PID 3968 wrote to memory of 4496	3968	chrome.exe	chrome.exe
PID 3968 wrote to memory of 4496	3968	chrome.exe	chrome.exe
PID 3968 wrote to memory of 4496	3968	chrome.exe	chrome.exe
PID 3968 wrote to memory of 4496	3968	chrome.exe	chrome.exe
PID 3968 wrote to memory of 4496	3968	chrome.exe	chrome.exe
PID 3968 wrote to memory of 4496	3968	chrome.exe	chrome.exe
PID 3968 wrote to memory of 4496	3968	chrome.exe	chrome.exe
PID 3968 wrote to memory of 4496	3968	chrome.exe	chrome.exe
PID 3968 wrote to memory of 4496	3968	chrome.exe	chrome.exe
PID 3968 wrote to memory of 4496	3968	chrome.exe	chrome.exe
PID 3968 wrote to memory of 4496	3968	chrome.exe	chrome.exe
PID 3968 wrote to memory of 4496	3968	chrome.exe	chrome.exe
PID 3968 wrote to memory of 4496	3968	chrome.exe	chrome.exe
PID 3968 wrote to memory of 4496	3968	chrome.exe	chrome.exe
PID 3968 wrote to memory of 4496	3968	chrome.exe	chrome.exe
PID 3968 wrote to memory of 4496	3968	chrome.exe	chrome.exe
PID 3968 wrote to memory of 4496	3968	chrome.exe	chrome.exe
PID 3968 wrote to memory of 4496	3968	chrome.exe	chrome.exe
PID 3968 wrote to memory of 4496	3968	chrome.exe	chrome.exe
PID 3968 wrote to memory of 4496	3968	chrome.exe	chrome.exe
PID 3968 wrote to memory of 4496	3968	chrome.exe	chrome.exe
PID 3968 wrote to memory of 4496	3968	chrome.exe	chrome.exe
PID 3968 wrote to memory of 4496	3968	chrome.exe	chrome.exe
PID 3968 wrote to memory of 4496	3968	chrome.exe	chrome.exe
PID 3968 wrote to memory of 4496	3968	chrome.exe	chrome.exe
PID 3968 wrote to memory of 4496	3968	chrome.exe	chrome.exe
PID 3968 wrote to memory of 4496	3968	chrome.exe	chrome.exe
PID 3968 wrote to memory of 4496	3968	chrome.exe	chrome.exe
PID 3968 wrote to memory of 4496	3968	chrome.exe	chrome.exe
PID 3968 wrote to memory of 4496	3968	chrome.exe	chrome.exe
PID 3968 wrote to memory of 4496	3968	chrome.exe	chrome.exe
PID 3968 wrote to memory of 4496	3968	chrome.exe	chrome.exe
PID 3968 wrote to memory of 4496	3968	chrome.exe	chrome.exe
PID 3968 wrote to memory of 4496	3968	chrome.exe	chrome.exe
PID 3968 wrote to memory of 4496	3968	chrome.exe	chrome.exe
PID 3968 wrote to memory of 4496	3968	chrome.exe	chrome.exe
PID 3968 wrote to memory of 4496	3968	chrome.exe	chrome.exe
PID 3968 wrote to memory of 4496	3968	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1308	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1308	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1308	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1308	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1308	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1308	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1308	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1308	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1308	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1308	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1308	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1308	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1308	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1308	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1308	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1308	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1308	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1308	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1308	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1308	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1308	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1308	1436	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://discord.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1436

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad1eb9758,0x7ffad1eb9768,0x7ffad1eb9778
2⤵
PID:4664

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 --field-trial-handle=1796,i,5101972196468535899,16204696149934654899,131072 /prefetch:2
2⤵
PID:1308

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=1796,i,5101972196468535899,16204696149934654899,131072 /prefetch:8
2⤵
PID:3912

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2160 --field-trial-handle=1796,i,5101972196468535899,16204696149934654899,131072 /prefetch:8
2⤵
PID:3152

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2904 --field-trial-handle=1796,i,5101972196468535899,16204696149934654899,131072 /prefetch:1
2⤵
PID:2892

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2928 --field-trial-handle=1796,i,5101972196468535899,16204696149934654899,131072 /prefetch:1
2⤵
PID:2764

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3760 --field-trial-handle=1796,i,5101972196468535899,16204696149934654899,131072 /prefetch:1
2⤵
PID:732

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4468 --field-trial-handle=1796,i,5101972196468535899,16204696149934654899,131072 /prefetch:1
2⤵
PID:2492

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3544 --field-trial-handle=1796,i,5101972196468535899,16204696149934654899,131072 /prefetch:1
2⤵
PID:4468

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4784 --field-trial-handle=1796,i,5101972196468535899,16204696149934654899,131072 /prefetch:8
2⤵
PID:3888

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4944 --field-trial-handle=1796,i,5101972196468535899,16204696149934654899,131072 /prefetch:8
2⤵
PID:4712

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3188 --field-trial-handle=1796,i,5101972196468535899,16204696149934654899,131072 /prefetch:1
2⤵
PID:4784

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3528 --field-trial-handle=1796,i,5101972196468535899,16204696149934654899,131072 /prefetch:1
2⤵
PID:5296

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4928 --field-trial-handle=1796,i,5101972196468535899,16204696149934654899,131072 /prefetch:1
2⤵
PID:5140

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=6100 --field-trial-handle=1796,i,5101972196468535899,16204696149934654899,131072 /prefetch:1
2⤵
PID:224

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6664 --field-trial-handle=1796,i,5101972196468535899,16204696149934654899,131072 /prefetch:8
2⤵
PID:5520

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6500 --field-trial-handle=1796,i,5101972196468535899,16204696149934654899,131072 /prefetch:8
2⤵
PID:5516

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4468 --field-trial-handle=1796,i,5101972196468535899,16204696149934654899,131072 /prefetch:8
2⤵
PID:5724

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5744 --field-trial-handle=1796,i,5101972196468535899,16204696149934654899,131072 /prefetch:8
2⤵
PID:3628

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4464 --field-trial-handle=1796,i,5101972196468535899,16204696149934654899,131072 /prefetch:8
2⤵
PID:5872

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5864 --field-trial-handle=1796,i,5101972196468535899,16204696149934654899,131072 /prefetch:8
2⤵
PID:5888

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4604 --field-trial-handle=1796,i,5101972196468535899,16204696149934654899,131072 /prefetch:8
2⤵
PID:3620

C:\Users\Admin\Downloads\MinecraftInstaller.exe
"C:\Users\Admin\Downloads\MinecraftInstaller.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:6032

C:\Users\Admin\AppData\Local\Temp\GmingRepair.exe
"C:\Users\Admin\AppData\Local\Temp\GmingRepair.exe" scenarioMinecraft
3⤵
- Executes dropped EXE
- Checks processor information in registry
PID:5420

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5936 --field-trial-handle=1796,i,5101972196468535899,16204696149934654899,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3868

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=5336 --field-trial-handle=1796,i,5101972196468535899,16204696149934654899,131072 /prefetch:1
2⤵
PID:4532

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=4980 --field-trial-handle=1796,i,5101972196468535899,16204696149934654899,131072 /prefetch:1
2⤵
PID:5080

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5676 --field-trial-handle=1796,i,5101972196468535899,16204696149934654899,131072 /prefetch:8
2⤵
PID:1536

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5072 --field-trial-handle=1796,i,5101972196468535899,16204696149934654899,131072 /prefetch:8
2⤵
PID:5924

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3968

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad1eb9758,0x7ffad1eb9768,0x7ffad1eb9778
2⤵
PID:2276

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1796 --field-trial-handle=1804,i,4376336366150377840,9152317023941578005,131072 /prefetch:2
2⤵
PID:4496

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1804,i,4376336366150377840,9152317023941578005,131072 /prefetch:8
2⤵
PID:3888

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4348

C:\Windows\system32\svchost.exe
"svchost.exe"
1⤵
PID:888

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:1276

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
PID:4812

C:\Program Files\WindowsApps\Microsoft.GamingServices_10.75.13001.0_x64__8wekyb3d8bbwe\GamingServices.exe
"C:\Program Files\WindowsApps\Microsoft.GamingServices_10.75.13001.0_x64__8wekyb3d8bbwe\GamingServices.exe"
1⤵
- Registers COM server for autorun
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
PID:6072

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /i "C:\Program Files\WindowsApps\Microsoft.GamingServices_10.75.13001.0_x64__8wekyb3d8bbwe\gameinputredist.msi" /quiet /l*v "C:\Windows\TEMP\gameinputredist.log"
2⤵
PID:5388

C:\Program Files\WindowsApps\Microsoft.GamingServices_10.75.13001.0_x64__8wekyb3d8bbwe\GamingServicesNet.exe
"C:\Program Files\WindowsApps\Microsoft.GamingServices_10.75.13001.0_x64__8wekyb3d8bbwe\GamingServicesNet.exe"
1⤵
PID:3424

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2092

C:\Program Files (x86)\Microsoft GameInput\x64\gameinputsvc.exe
"C:\Program Files (x86)\Microsoft GameInput\x64\gameinputsvc.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4388

C:\Program Files (x86)\Microsoft GameInput\x64\gameinputsvc.exe
"C:\Program Files (x86)\Microsoft GameInput\x64\gameinputsvc.exe" Global\GameInputSession_1
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
PID:4296

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Windows\TEMP\{31814bef-c661-8742-895a-0df82d8b7c96}\xvdd.inf" "9" "47a6d594f" "0000000000000154" "Service-0x0-3e7$\Default" "000000000000013C" "208" "C:\Program Files\WindowsApps\Microsoft.GamingServices_10.75.13001.0_x64__8wekyb3d8bbwe\drivers"
2⤵
PID:5956

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "0" "SWD\XvddEnum\XvddRootDevice_Instance" "" "" "48fe919b3" "0000000000000000"
2⤵
PID:5188

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Windows\TEMP\{a5d51446-2840-d64d-a93e-e82e380ee0d4}\gameflt.inf" "9" "472bc408b" "0000000000000164" "Service-0x0-3e7$\Default" "0000000000000174" "208" "C:\Program Files\WindowsApps\Microsoft.GamingServices_10.75.13001.0_x64__8wekyb3d8bbwe\drivers"
2⤵
PID:5176

C:\Windows\system32\DrvInst.exe
DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_efd4ff0f2481f72b\gameflt.inf" "0" "472bc408b" "0000000000000174" "Service-0x0-3e7$\Default"
2⤵
PID:6056

C:\Windows\system32\DrvInst.exe
DrvInst.exe "5" "2" "C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_efd4ff0f2481f72b\gameflt.inf" "0" "4feba5173" "0000000000000174" "Service-0x0-3e7$\Default"
2⤵
PID:5864

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5912f4.rbs
Filesize
12KB

MD5
aa658a0c5b41b750b88f9f6860415442

SHA1
599df695e9999100299d45f5abeadcdde9573f4d

SHA256
e5dbce9a3cb825fedfb370434064012f5367b7ef38eed20b5f5280ed3b970cc9

SHA512
102e868d0640f64b041b65052ade93282f4a2e6f676535db7a83e01d03f676382f051d9cf62c2e807b58d5aba99e573a66ee36eb74a17dc56e953cb3fd2a33ee

Download Submit
C:\Program Files (x86)\Microsoft GameInput\x64\GameInputRedist.dll
Filesize
361KB

MD5
ac7817f3bb39f7a1ecd79b22e55c7814

SHA1
6044b28135a7969959e601403aabd353bcfdb960

SHA256
68cd6170402ffc688e90e7e2ba81afe4c37fa8ca344763d3bfe7831ceb15cea7

SHA512
f464161c245c876400d286697eec7c268902249d202490be59f15aeaab1b1a9ba7cb7158695e0653b6505e8583365b0c61615570a979dae04d1f374ab12490f0

Download Submit
C:\Program Files (x86)\Microsoft GameInput\x64\gameinputsvc.exe
Filesize
89KB

MD5
efbb63a705d505ffbd154cc443054574

SHA1
ec0ce2f04e3288a2f1e43f5ce2fb2195ea5b7ffd

SHA256
858ecbeda0f6ed2722435c7f4847a323f872982ce6f1ab7fe861738344062d3e

SHA512
b2675772157766d68c0dcfab31bb7bba7a68da840f37cd36afe3309588f46b4ef4f8d1da322097c9a053f6133d7397b1aac80dfcb6a6693e0e070c87e7503d03

Download Submit
C:\Program Files (x86)\Microsoft GameInput\x64\gameinputsvc.exe
Filesize
89KB

MD5
efbb63a705d505ffbd154cc443054574

SHA1
ec0ce2f04e3288a2f1e43f5ce2fb2195ea5b7ffd

SHA256
858ecbeda0f6ed2722435c7f4847a323f872982ce6f1ab7fe861738344062d3e

SHA512
b2675772157766d68c0dcfab31bb7bba7a68da840f37cd36afe3309588f46b4ef4f8d1da322097c9a053f6133d7397b1aac80dfcb6a6693e0e070c87e7503d03

Download Submit
C:\Program Files (x86)\Microsoft GameInput\x86\GameInputRedist.dll
Filesize
236KB

MD5
c6b900b9dca17d44dca701a65a96dda0

SHA1
d4a6f237fe61a6558e0c9ce9af069f479794389d

SHA256
dad5d0a672bd9a217efb1be8c6c3acf342ebd82e0f7b403359944aed8e624475

SHA512
35413114afea11e4675b1f68c4f0485b65038f64457d7bc9e6b1883a030e94b275dc96abdbdf0b9f8736299998e719c1d15d41d78f65fb33b9cb505679de57a3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Filesize
40B

MD5
bab948aab646d615b0fbbb90b55433ab

SHA1
0ee46cc7db939e55dcc3a5cd17e2fb893ece7a34

SHA256
e02daa351bf7a75dc1b7e9b11c5d716b89f108058e70326f0a8b7b8ba489ce0e

SHA512
a1f82c1aba6d15216d2313673a200d1fd24f99577b06245f4e326df99ab0bd4c3c509b2ddab14753225b47f4c973ce5ac0e08c90c75430bc65c61c48a5969fed

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Filesize
40B

MD5
bab948aab646d615b0fbbb90b55433ab

SHA1
0ee46cc7db939e55dcc3a5cd17e2fb893ece7a34

SHA256
e02daa351bf7a75dc1b7e9b11c5d716b89f108058e70326f0a8b7b8ba489ce0e

SHA512
a1f82c1aba6d15216d2313673a200d1fd24f99577b06245f4e326df99ab0bd4c3c509b2ddab14753225b47f4c973ce5ac0e08c90c75430bc65c61c48a5969fed

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Filesize
40B

MD5
bab948aab646d615b0fbbb90b55433ab

SHA1
0ee46cc7db939e55dcc3a5cd17e2fb893ece7a34

SHA256
e02daa351bf7a75dc1b7e9b11c5d716b89f108058e70326f0a8b7b8ba489ce0e

SHA512
a1f82c1aba6d15216d2313673a200d1fd24f99577b06245f4e326df99ab0bd4c3c509b2ddab14753225b47f4c973ce5ac0e08c90c75430bc65c61c48a5969fed

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3be801cc-9413-479b-8b0e-0f928f572d27.tmp
Filesize
5KB

MD5
60ea7a450e3536d78b76ceef1daf75ae

SHA1
fd38a9d9ff15ec5771f2c5f58d4d8f1817d51ee3

SHA256
25982429c27a44ff802a3e6fcc84de0a0b314ad271cc983c336d0411c1827e95

SHA512
20882b5993ce0753711501bba9f9804bc1ed3003d4413bdf987d99707043a1543391069220892a87e31bfba785600aa191807fb32cec91c3449d9b1e0030f06d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000037
Filesize
18KB

MD5
d98f6933949ebc124cc652c76b4523eb

SHA1
b5cb19f3a4924d02e67b3a41c6474a741a6a6f73

SHA256
9e3f1271c142e7da1cde822650f2c087db51c39a38db21cbfbad503e882116d5

SHA512
b6eb511bbd0a32ecaed2c24fd4b9638b5b81f322dbaed7b48647ab3e8c2b1c06e23c12ad10acb24da0cf18843104395e14bafc1cdc4f8af1d104fcce3cbdb638

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003b
Filesize
27KB

MD5
7716e124e19760049484d1bcde4a8af2

SHA1
51d50c9e9b7fc658c1316d1844418cee0baffa2a

SHA256
fa7968a9a888e1a6dc6ac6126b8edd6e73974c2b0629f669bfb74916f0e7d534

SHA512
1ed454872f7b74892c20843446f914a6b0b985d6bc7579130188a07aca8c5fbf0a8759fa63ae33649b06001191e2637f55c22661a5c55a259971b409662be00a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003c
Filesize
108KB

MD5
467c9ce42bbd6f96469ec69fa136e85b

SHA1
592c61bd1f2618d3aaf33a92e593675928a093d4

SHA256
e17afbcfe3c0694a504359e872586aa9c54f40804410e0138e8824fee980ae7f

SHA512
9df41fb0ce8b11e524c2496b830c33e93c9b9e8bc0c88a4a73d4100a3e2ba37d193d32402585090a4c3649fc0ec6cfb920bad63af9f073257d140c2499e2ebe3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
f081d319db641b772a44a3ca7e233964

SHA1
b1ef0eddbb5afcb756047b2c54481f1b2480e1b9

SHA256
385b81ae18cbe9b04850073995a8d0d0480f2a3a42d1268d69fb35b6dac96c3d

SHA512
f8a5757b277b50a33218045e9b0aaf9b83ee8eab8e2df32b480641ee19b2222266308473044af6b45e80ec0551af062afe90bb6131f1d0634951055975dffc5e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
6KB

MD5
e07cfde7369359f7eaf67ac1811fb187

SHA1
f21860c8eeb734c4bf97f4a13c29d57777c0b9e3

SHA256
63ba33d717b75dcb8af1bc941a58cb69a429dc8c699d258ee14dee1f0f3bda5b

SHA512
7af3738e66d107c7d712932d05e3a0a3595b6fdbe618d9c1485b3ebcd3b4639bf506715be61313f92b0eadbd588d0c5a58f189d06f08a7e46a3631674fcff32b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
3KB

MD5
b96f338e38b71f339f876fcff42e111f

SHA1
445f26aa01d5e0dcbbe5402cbea9e71a83263d46

SHA256
83d79a1ac7fd9f5f02c99ac3e6955f6169f9a14251327ef7e2c0dc9197259774

SHA512
a8370cf7fb6da45867050ccfbd50561598e681afb1b816c39cb04a1458abaf1428a1e82e85a68ece174bfde883a42d8bd6f3f32a501786aae733d03544826595

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
16324c7c01c65523f50ea9bb883ab54c

SHA1
be19fd644ea629f04e45d6cac7413458736b13c1

SHA256
3b85910de3f09c0d3ab3510f5054a1fe948d6dc48323a3b1ecc0b0c9e77f7051

SHA512
2dda9295deaa55c152b3a31fd5ccace383b6c2a51466aadad7bcd8f2fd55a9945275e56e1317439e35499f4b0c492c14a578339833edb94cec83ff2d04a9983b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
2KB

MD5
951e9cd27b37fe956bcdea64d659d43c

SHA1
bddf3ead2b425469c25f9c988b3b970fd43d4717

SHA256
7afa482b30ae0d1da27e8caca40ad77ee199ce860b6b81884e0eca4c113a56eb

SHA512
7fe61d0f99712d71a426df2baedf6077e75f593c31bfc6a02714480ca5968e44c23d0b6c943073a1eb3717639f64e51fe587ac33833e86db34b19c77d146a354

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
3KB

MD5
85f34252cb90c71f5677b6af46558223

SHA1
e2afa0346a67377a4324bb4de02c88863123aba3

SHA256
7ef9e675054996f521d19222a21c34a7e39982143974c501fadde7744c0e07cc

SHA512
986560ce5de7252ed4aeb773be9e007075b1c0766ca3eb098f714d7f054e28510adf5f3146d89b5540d22c1d4610a8400272179ef8430c25dbf08f6f110391cb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
4KB

MD5
fcc883de80adca7e6e9ae5808cf0e4af

SHA1
fdcdaaa5a4092cb4fdc2bbc09878596e7c64ff43

SHA256
92070fc17f65b84a3a95a10ead499dc83e4addb2b59923d022a1f2d463c2d758

SHA512
d0bbc71166030f351729c32d8a049f41ef29eb8e0bfc00d24b7b7549b04c2aeaa7955da6ea7597b84e1a2ec6f9c3670f63e0ba28aa9c9dd72b9a01c3e783c04e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
4KB

MD5
cf7bd96f331839cf0799fba2b3aee6a0

SHA1
9528fbf329300dfc52df8336d8e5b1c52f1f4f20

SHA256
ea1c86d3de623a14307c9baff09433eab7e1aa58f29544b227a10f233e3c6927

SHA512
59223754d76b89a51f6f090b361f19173576dffb8453b65931ec0a2b0ccbcca48ba3386646421640b29751906459e85fe112b4e7e72fe171d3f553ca17e1f43e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
5KB

MD5
d593a4da1dbbb484b5bbca0f1a3b4078

SHA1
e9316290effffa2cdff339245a79691243da6e35

SHA256
72edf71eff380f4f9a09865313cf46405bb9ac58bd67ce6b45b2a54fec1dc22d

SHA512
22bc56b65ea5f7b98d709abf9f4662e108dc7e1628040d5f32881b57f0ed8187b9b56fa45ad962e3e79358d5e320a8772bc779ab90c106a440faa83ae86ab203

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
5KB

MD5
5a7ab02028515a3575e3d7c8774febed

SHA1
b7885c69249f5878b52ca2b95dfc185e3268f6a8

SHA256
6334b9c39f6bc4a7a3453dc9aacb10539f10deed6e9873b061879ce41dab690a

SHA512
28d4c771dbb9e81e5ede58a9372bf8e021d59ba6f25cc2e893df84b690b4986e26ce7783c90573d8280419bec3f0ff16d12f8b12776dcb9724a4b30e1d554726

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
4KB

MD5
7e675f8fa0d34c3e41333b3bb0c48d25

SHA1
faaff58cece0279a606e108fd9e14e4bd9add06a

SHA256
359b27879d2f5155a4d76b576ae23a5cd5872280028bb04f1860197d56e52969

SHA512
b7bdbfc5d2d64bcf46b87462c9945722b5785831195af14520a7e15d5e711cb1d069a4272d617aa9a502e99a449d974098ac7b158792dd35186a29c220c6a0ed

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
173KB

MD5
4c20b31f1d3f0f1518ea93ac75451eec

SHA1
251a2104728bcdf1ac12b81c8e3eb5030cf1de86

SHA256
1c9edaea92bdbdea5a49aafb9c6b5a57139ccc11a771772fb4b42807d98905c5

SHA512
cd8c0f8495108f62db45818595d64d1836a93357d4005558fe29e5208ced94da505db845f7a655c9d6ad5b00ec2d5eb25dd1e81ce71da75fdcea776be4af009d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
71KB

MD5
7f748dae5c44c11e9e1401be68346625

SHA1
6fb116fa0c5c5b347d3bb683728deb29bebd065a

SHA256
3fbb44eaccd04780c7475230812a30555562a455bdef44af4282a0ac260ec230

SHA512
15dc1b0183d30e9da173ed2b81d4901bcecd55f27883b6fc725edce41dd618c57984d7e39ca3a0ed4f795c030b9dfdf9d32f03293675ddc397392e18d688216c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
71KB

MD5
7f748dae5c44c11e9e1401be68346625

SHA1
6fb116fa0c5c5b347d3bb683728deb29bebd065a

SHA256
3fbb44eaccd04780c7475230812a30555562a455bdef44af4282a0ac260ec230

SHA512
15dc1b0183d30e9da173ed2b81d4901bcecd55f27883b6fc725edce41dd618c57984d7e39ca3a0ed4f795c030b9dfdf9d32f03293675ddc397392e18d688216c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
71KB

MD5
d94f7cba6fbf6f5ba065bcd24e8a3f3c

SHA1
4b1227f41ad2dce48ff4b29b412f17d945bd247d

SHA256
04646a61ceca87a37bc1b94680379312bae5214b71b9518972c4d7ced8d844b7

SHA512
c541982374eb1eb6651d4e93be7f17d68e9e0acdf2f93732dd3de36b246a8d668b1f2bb8328599a1aefc3f4ead3fc5c8b696028bdc98fe6abe89cd8cb6d2fb37

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Filesize
86B

MD5
f732dbed9289177d15e236d0f8f2ddd3

SHA1
53f822af51b014bc3d4b575865d9c3ef0e4debde

SHA256
2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93

SHA512
b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\GmingRepair.exe
Filesize
209KB

MD5
8c8880c0842997e7e6f4288dce2c7eb7

SHA1
c2aa3ee4cf7a0fa96bcb6c31e8b178c94edb3e14

SHA256
38597aca8d2b9e3e6bda6f45826f558ea3add74442e2335b0dd49951c5a93c42

SHA512
f022c9588b0fe6712557767cd09d6bab777f99c0eba92f70649a42f0e036e2e3ffe4a1679b6527ea47d09e774a3c9fb2f9c4d7656fa0790cc4988745b94ba276

Download Submit
C:\Users\Admin\AppData\Local\Temp\GmingRepair.exe
Filesize
209KB

MD5
8c8880c0842997e7e6f4288dce2c7eb7

SHA1
c2aa3ee4cf7a0fa96bcb6c31e8b178c94edb3e14

SHA256
38597aca8d2b9e3e6bda6f45826f558ea3add74442e2335b0dd49951c5a93c42

SHA512
f022c9588b0fe6712557767cd09d6bab777f99c0eba92f70649a42f0e036e2e3ffe4a1679b6527ea47d09e774a3c9fb2f9c4d7656fa0790cc4988745b94ba276

Download Submit
C:\Users\Admin\AppData\Local\Temp\GmingRepair.exe
Filesize
209KB

MD5
8c8880c0842997e7e6f4288dce2c7eb7

SHA1
c2aa3ee4cf7a0fa96bcb6c31e8b178c94edb3e14

SHA256
38597aca8d2b9e3e6bda6f45826f558ea3add74442e2335b0dd49951c5a93c42

SHA512
f022c9588b0fe6712557767cd09d6bab777f99c0eba92f70649a42f0e036e2e3ffe4a1679b6527ea47d09e774a3c9fb2f9c4d7656fa0790cc4988745b94ba276

Download Submit
C:\Users\Admin\Downloads\MinecraftInstaller.exe
Filesize
32.0MB

MD5
7b681d2a775f0505b4fa4e6899730ec0

SHA1
285e9a0f1c3a5aef9b63c1089c4e9847bb176d3e

SHA256
1369e029a6b0da91db5e735b2942b1a5549dfb909ab1e98b919481a04b7cf5e6

SHA512
4746fbd6b7094e07e82a9720b1243cb43663408a5c581a274508e8bf44fcb4e254ae24bec6951761ae488c6f64eeb938bf4d613587f93f3378174f7eea2f1016

Download Submit
C:\Users\Admin\Downloads\MinecraftInstaller.exe
Filesize
32.0MB

MD5
7b681d2a775f0505b4fa4e6899730ec0

SHA1
285e9a0f1c3a5aef9b63c1089c4e9847bb176d3e

SHA256
1369e029a6b0da91db5e735b2942b1a5549dfb909ab1e98b919481a04b7cf5e6

SHA512
4746fbd6b7094e07e82a9720b1243cb43663408a5c581a274508e8bf44fcb4e254ae24bec6951761ae488c6f64eeb938bf4d613587f93f3378174f7eea2f1016

Download Submit
C:\Users\Admin\Downloads\MinecraftInstaller.exe
Filesize
32.0MB

MD5
7b681d2a775f0505b4fa4e6899730ec0

SHA1
285e9a0f1c3a5aef9b63c1089c4e9847bb176d3e

SHA256
1369e029a6b0da91db5e735b2942b1a5549dfb909ab1e98b919481a04b7cf5e6

SHA512
4746fbd6b7094e07e82a9720b1243cb43663408a5c581a274508e8bf44fcb4e254ae24bec6951761ae488c6f64eeb938bf4d613587f93f3378174f7eea2f1016

Download Submit
C:\Windows\Installer\e5912f2.msi
Filesize
828KB

MD5
29b6790dfdba0a2513c331363ba8289f

SHA1
150c5fdadc4d8c02989e20f627c90628cbdbf23c

SHA256
7a8270f0cd3e03a7ee2fe37b26b769cbdf3c66e2e923e9dfb8715b817629744d

SHA512
54ae7bcd53f9fdcb34ceee99245540b459f215b303f53ad7356d4f91de601634eb1d7f23a928c414f10227cbb66e1dd4f42e35333e85e23ce267452030eab8d4

Download Submit
C:\Windows\System32\CatRoot2\dberr.txt
Filesize
146KB

MD5
e9725fe96e4b30e27e60c1b7edf3b475

SHA1
276927d093d70308d1422e43876d138df7add518

SHA256
602997f488145d33d709bb1178c8686fa34067befe70cb71d27740c6b00e231b

SHA512
506d542bb6f2b781b57f418b21cd7a4ceaaaaddb1ab0bcfb6a390653a98243f519f3befcdbcd235798f76c51fb61e0cadd8475342041dd5047995b21901c504f

Download Submit
C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_efd4ff0f2481f72b\gameflt.cat
Filesize
11KB

MD5
5cc15dd48fcd80244ada09bdf598930a

SHA1
70095c02cbc7d2448c0676453b0915517afc198e

SHA256
fa413bc01e3685901fc8cf9c0834fc52fc75ba20fa2493649c385806b8cfc479

SHA512
9e7a755086687363130ec97a21c9696b8cf81fc205c743c6f12a38e99e990bfcd911a41c18ca7bbd22e04009eb4a82dca2c755ec3b151cac363112b2091dca60

Download Submit
C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_efd4ff0f2481f72b\gameflt.inf
Filesize
2KB

MD5
ce6fe0b58bfd85afedd3493a7f865e96

SHA1
09c88d13da4f3816c9fc4974961c812de3684df0

SHA256
f438d5936484b20f68eb14feed510eb5b0a46d59ca18394854a0397f3e055f3f

SHA512
a42893197967885a609e84b4ee7259af4fa669749cdb1675c4e51808791b5dc886e2f29e3445676fc9b0a366b4449ed6a11a672f16a3614f6cb451d756f55603

Download Submit
C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_efd4ff0f2481f72b\gameflt.sys
Filesize
147KB

MD5
4f3cdfb7602baec0e79795c429a2175d

SHA1
71077b1266f982b76c8e161ca8a411ef7afe6a52

SHA256
511a1efd4c6423bdd21e708a4b89fa255e7ec3424ca6e2b702a7670586ba4482

SHA512
fdd52318a20ec94edfc000f6dc9c714ecccdc1054a39a9dacdfe092fba692b90ae4f96881ddf3492af0bbedf6b40ce746fbea86da054a6c4ffc5c748065e3191

Download Submit
C:\Windows\System32\DriverStore\FileRepository\xvdd.inf_amd64_6931cffa1f5f9fc9\xvdd.inf
Filesize
1KB

MD5
4c4cee49cca1c769dbf557a605de27b3

SHA1
3e57a87cf82a44eb72f6409e9db0ea5fa58736f0

SHA256
fd1a86e7908fcc9f3157ff90cf7a1b56fe6d79e7943dbdbd8a3d2411a2e4389b

SHA512
e467ff1200a8d0eb94a8aae802c7cb535cb108faedf71cd33e07dc0c97923b3011e18d18a2b4cf46df784ee41fc4cca45b9a1e98fff001ae82e9e3797404f4c1

Download Submit
C:\Windows\System32\DriverStore\Temp\{3d722a8a-e23f-7043-a01a-5483f07d4dad}\SET2522.tmp
Filesize
11KB

MD5
61c88dca8c4c5dcd81d1030f07c86fc0

SHA1
8dc6f880dc42b95bf5662e3fe92a45461e7e4849

SHA256
1d0c17c2d0e8f8c6b5c5dee185222e7cdfb22b07a9f45f2f1e8a915daa784c93

SHA512
c54e2f5096cb5109b73f1da2edd0fb54cba7fb73015b6e67d9047a70e202b9891088b308d02572129c5a9f184ec4c3c9422eacdf655da9452920b01e141c4982

Download Submit
C:\Windows\System32\DriverStore\Temp\{3d722a8a-e23f-7043-a01a-5483f07d4dad}\SET2533.tmp
Filesize
1KB

MD5
4c4cee49cca1c769dbf557a605de27b3

SHA1
3e57a87cf82a44eb72f6409e9db0ea5fa58736f0

SHA256
fd1a86e7908fcc9f3157ff90cf7a1b56fe6d79e7943dbdbd8a3d2411a2e4389b

SHA512
e467ff1200a8d0eb94a8aae802c7cb535cb108faedf71cd33e07dc0c97923b3011e18d18a2b4cf46df784ee41fc4cca45b9a1e98fff001ae82e9e3797404f4c1

Download Submit
C:\Windows\System32\DriverStore\Temp\{3d722a8a-e23f-7043-a01a-5483f07d4dad}\SET2543.tmp
Filesize
667KB

MD5
d79bf46de8c6e78ae449be1d308daf9e

SHA1
bb55d21842106732db618a7d5bbe274c9370a06a

SHA256
c07639e81061086ad062cdfbdb3a5edf125a61c46edd45767c4dd71694afe430

SHA512
0f6f6a4e26589136fd14f35f3ce0419d6de3ff63c52d64cff7f695cf82d198de02e3da120e20c45b9d441c4d2df59a14932b5d77a3015601b26c46ba1409fb53

Download Submit
C:\Windows\System32\DriverStore\Temp\{ecdfe0ee-23fa-3043-9f0b-d3ebc834d624}\SET2A71.tmp
Filesize
11KB

MD5
5cc15dd48fcd80244ada09bdf598930a

SHA1
70095c02cbc7d2448c0676453b0915517afc198e

SHA256
fa413bc01e3685901fc8cf9c0834fc52fc75ba20fa2493649c385806b8cfc479

SHA512
9e7a755086687363130ec97a21c9696b8cf81fc205c743c6f12a38e99e990bfcd911a41c18ca7bbd22e04009eb4a82dca2c755ec3b151cac363112b2091dca60

Download Submit
C:\Windows\System32\DriverStore\Temp\{ecdfe0ee-23fa-3043-9f0b-d3ebc834d624}\SET2A72.tmp
Filesize
2KB

MD5
ce6fe0b58bfd85afedd3493a7f865e96

SHA1
09c88d13da4f3816c9fc4974961c812de3684df0

SHA256
f438d5936484b20f68eb14feed510eb5b0a46d59ca18394854a0397f3e055f3f

SHA512
a42893197967885a609e84b4ee7259af4fa669749cdb1675c4e51808791b5dc886e2f29e3445676fc9b0a366b4449ed6a11a672f16a3614f6cb451d756f55603

Download Submit
C:\Windows\System32\DriverStore\Temp\{ecdfe0ee-23fa-3043-9f0b-d3ebc834d624}\SET2A83.tmp
Filesize
147KB

MD5
4f3cdfb7602baec0e79795c429a2175d

SHA1
71077b1266f982b76c8e161ca8a411ef7afe6a52

SHA256
511a1efd4c6423bdd21e708a4b89fa255e7ec3424ca6e2b702a7670586ba4482

SHA512
fdd52318a20ec94edfc000f6dc9c714ecccdc1054a39a9dacdfe092fba692b90ae4f96881ddf3492af0bbedf6b40ce746fbea86da054a6c4ffc5c748065e3191

Download Submit
C:\Windows\System32\GameInputRedist.dll
Filesize
361KB

MD5
ac7817f3bb39f7a1ecd79b22e55c7814

SHA1
6044b28135a7969959e601403aabd353bcfdb960

SHA256
68cd6170402ffc688e90e7e2ba81afe4c37fa8ca344763d3bfe7831ceb15cea7

SHA512
f464161c245c876400d286697eec7c268902249d202490be59f15aeaab1b1a9ba7cb7158695e0653b6505e8583365b0c61615570a979dae04d1f374ab12490f0

Download Submit
C:\Windows\System32\GameInputRedist.dll
Filesize
361KB

MD5
ac7817f3bb39f7a1ecd79b22e55c7814

SHA1
6044b28135a7969959e601403aabd353bcfdb960

SHA256
68cd6170402ffc688e90e7e2ba81afe4c37fa8ca344763d3bfe7831ceb15cea7

SHA512
f464161c245c876400d286697eec7c268902249d202490be59f15aeaab1b1a9ba7cb7158695e0653b6505e8583365b0c61615570a979dae04d1f374ab12490f0

Download Submit
C:\Windows\TEMP\gameinputredist.log
Filesize
1KB

MD5
84d0b88882ec9f69fa3f0088c6af355f

SHA1
cc882b1985e75009c4386544e8490c2b331b8261

SHA256
5e0a73f0f9d7fd418b7bfbaf888e670c44687d2c6e1a4e4c2184a9f9ce2ff3c0

SHA512
1a467dd018559b991d543fd299c307bf0b5a1d622be5674949521a3c944d0fcbde448f2a2796d14008ea0db757c994b7a2c65a03795daf8080d26ff7b004b23d

Download Submit
C:\Windows\TEMP\{31814bef-c661-8742-895a-0df82d8b7c96}\xvdd.inf
Filesize
1KB

MD5
4c4cee49cca1c769dbf557a605de27b3

SHA1
3e57a87cf82a44eb72f6409e9db0ea5fa58736f0

SHA256
fd1a86e7908fcc9f3157ff90cf7a1b56fe6d79e7943dbdbd8a3d2411a2e4389b

SHA512
e467ff1200a8d0eb94a8aae802c7cb535cb108faedf71cd33e07dc0c97923b3011e18d18a2b4cf46df784ee41fc4cca45b9a1e98fff001ae82e9e3797404f4c1

Download Submit
C:\Windows\TEMP\{31814~1\xvdd.cat
Filesize
11KB

MD5
61c88dca8c4c5dcd81d1030f07c86fc0

SHA1
8dc6f880dc42b95bf5662e3fe92a45461e7e4849

SHA256
1d0c17c2d0e8f8c6b5c5dee185222e7cdfb22b07a9f45f2f1e8a915daa784c93

SHA512
c54e2f5096cb5109b73f1da2edd0fb54cba7fb73015b6e67d9047a70e202b9891088b308d02572129c5a9f184ec4c3c9422eacdf655da9452920b01e141c4982

Download Submit
C:\Windows\TEMP\{31814~1\xvdd.sys
Filesize
667KB

MD5
d79bf46de8c6e78ae449be1d308daf9e

SHA1
bb55d21842106732db618a7d5bbe274c9370a06a

SHA256
c07639e81061086ad062cdfbdb3a5edf125a61c46edd45767c4dd71694afe430

SHA512
0f6f6a4e26589136fd14f35f3ce0419d6de3ff63c52d64cff7f695cf82d198de02e3da120e20c45b9d441c4d2df59a14932b5d77a3015601b26c46ba1409fb53

Download Submit
C:\Windows\TEMP\{A5D51~1\gameflt.cat
Filesize
11KB

MD5
5cc15dd48fcd80244ada09bdf598930a

SHA1
70095c02cbc7d2448c0676453b0915517afc198e

SHA256
fa413bc01e3685901fc8cf9c0834fc52fc75ba20fa2493649c385806b8cfc479

SHA512
9e7a755086687363130ec97a21c9696b8cf81fc205c743c6f12a38e99e990bfcd911a41c18ca7bbd22e04009eb4a82dca2c755ec3b151cac363112b2091dca60

Download Submit
C:\Windows\TEMP\{A5D51~1\gameflt.sys
Filesize
147KB

MD5
4f3cdfb7602baec0e79795c429a2175d

SHA1
71077b1266f982b76c8e161ca8a411ef7afe6a52

SHA256
511a1efd4c6423bdd21e708a4b89fa255e7ec3424ca6e2b702a7670586ba4482

SHA512
fdd52318a20ec94edfc000f6dc9c714ecccdc1054a39a9dacdfe092fba692b90ae4f96881ddf3492af0bbedf6b40ce746fbea86da054a6c4ffc5c748065e3191

Download Submit
C:\Windows\TEMP\{a5d51446-2840-d64d-a93e-e82e380ee0d4}\gameflt.inf
Filesize
2KB

MD5
ce6fe0b58bfd85afedd3493a7f865e96

SHA1
09c88d13da4f3816c9fc4974961c812de3684df0

SHA256
f438d5936484b20f68eb14feed510eb5b0a46d59ca18394854a0397f3e055f3f

SHA512
a42893197967885a609e84b4ee7259af4fa669749cdb1675c4e51808791b5dc886e2f29e3445676fc9b0a366b4449ed6a11a672f16a3614f6cb451d756f55603

Download Submit
C:\Windows\inf\oem4.inf
Filesize
2KB

MD5
ce6fe0b58bfd85afedd3493a7f865e96

SHA1
09c88d13da4f3816c9fc4974961c812de3684df0

SHA256
f438d5936484b20f68eb14feed510eb5b0a46d59ca18394854a0397f3e055f3f

SHA512
a42893197967885a609e84b4ee7259af4fa669749cdb1675c4e51808791b5dc886e2f29e3445676fc9b0a366b4449ed6a11a672f16a3614f6cb451d756f55603

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\c:\windows\system32\gameinputredist.dll
Filesize
361KB

MD5
ac7817f3bb39f7a1ecd79b22e55c7814

SHA1
6044b28135a7969959e601403aabd353bcfdb960

SHA256
68cd6170402ffc688e90e7e2ba81afe4c37fa8ca344763d3bfe7831ceb15cea7

SHA512
f464161c245c876400d286697eec7c268902249d202490be59f15aeaab1b1a9ba7cb7158695e0653b6505e8583365b0c61615570a979dae04d1f374ab12490f0

Download Submit
\??\pipe\crashpad_1436_JJGKJLJWMBVGNGOB
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\crashpad_3968_BOMHXPCDZLEODSBW
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/4812-729-0x0000015FC8840000-0x0000015FC8850000-memory.dmp

Filesize
64KB

Download
memory/4812-761-0x0000015FD0C30000-0x0000015FD0C31000-memory.dmp

Filesize
4KB

Download
memory/4812-745-0x0000015FC8940000-0x0000015FC8950000-memory.dmp

Filesize
64KB

Download
memory/4812-765-0x0000015FD0D70000-0x0000015FD0D71000-memory.dmp

Filesize
4KB

Download
memory/4812-764-0x0000015FD0C60000-0x0000015FD0C61000-memory.dmp

Filesize
4KB

Download
memory/4812-763-0x0000015FD0C60000-0x0000015FD0C61000-memory.dmp

Filesize
4KB

Download
memory/6032-673-0x000000000DAC0000-0x000000000DAE6000-memory.dmp

Filesize
152KB

Download
memory/6032-672-0x00000000076B0000-0x00000000076C0000-memory.dmp

Filesize
64KB

Download
memory/6032-645-0x00000000076B0000-0x00000000076C0000-memory.dmp

Filesize
64KB

Download
memory/6032-635-0x0000000000B50000-0x0000000002B4E000-memory.dmp

Filesize
32.0MB

Download
memory/6032-660-0x000000000BB10000-0x000000000BB18000-memory.dmp

Filesize
32KB

Download
memory/6032-657-0x00000000076B0000-0x00000000076C0000-memory.dmp

Filesize
64KB

Download
memory/6032-699-0x00000000076B0000-0x00000000076C0000-memory.dmp

Filesize
64KB

Download
memory/6032-659-0x00000000076B0000-0x00000000076C0000-memory.dmp

Filesize
64KB

Download
memory/6032-661-0x000000000B3D0000-0x000000000B408000-memory.dmp

Filesize
224KB

Download
memory/6032-662-0x000000000B370000-0x000000000B37E000-memory.dmp

Filesize
56KB

Download
memory/6032-671-0x000000000BAF0000-0x000000000BAFA000-memory.dmp

Filesize
40KB

Download
memory/6032-676-0x00000000076B0000-0x00000000076C0000-memory.dmp

Filesize
64KB

Download
memory/6032-647-0x0000000008530000-0x0000000008538000-memory.dmp

Filesize
32KB

Download