hxxps://aka[.]ms/minecraftClientGameCoreWindows

Analysis

max time kernel
1733s
max time network
1174s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 16:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://aka.ms/minecraftClientGameCoreWindows
Sample240404-t9tyhsdd79

Score

8^/10

persistence

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	MinecraftInstaller.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	GamingRepair.exe

Executes dropped EXE 2 IoCs

pid	Process
1992	MinecraftInstaller.exe
3756	GamingRepair.exe

Loads dropped DLL 2 IoCs

pid	Process
4276	Process not Found
4276	Process not Found

Registers COM server for autorun 1 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FBA5170-10C4-4185-89E3-2D8389223563}\InProcServer32\ = "C:\\Program Files\\WindowsApps\\Microsoft.GamingServices_19.87.13001.0_x64__8wekyb3d8bbwe\\InstallServicePlugin.dll"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FBA5170-10C4-4185-89E3-2D8389223563}\InProcServer32\ThreadingModel = "Both"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0ACBC224-E08F-4B42-8723-B451584D6969}\InProcServer32	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0ACBC224-E08F-4B42-8723-B451584D6969}\InProcServer32	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0ACBC224-E08F-4B42-8723-B451584D6969}\InProcServer32\ = "C:\\Windows\\system32\\gamingservicesproxy_4.dll"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FBA5170-10C4-4185-89E3-2D8389223563}\InProcServer32	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FBA5170-10C4-4185-89E3-2D8389223563}\InProcServer32\ = "C:\\Program Files\\WindowsApps\\Microsoft.GamingServices_19.87.13001.0_x64__8wekyb3d8bbwe\\InstallServicePlugin.dll"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FBA5170-10C4-4185-89E3-2D8389223563}\InProcServer32\ = "C:\\Program Files\\WindowsApps\\Microsoft.GamingServices_19.87.13001.0_x64__8wekyb3d8bbwe\\InstallServicePlugin.dll"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FBA5170-10C4-4185-89E3-2D8389223563}\InProcServer32\ = "C:\\Program Files\\WindowsApps\\Microsoft.GamingServices_19.87.13001.0_x64__8wekyb3d8bbwe\\InstallServicePlugin.dll"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0ACBC224-E08F-4B42-8723-B451584D6969}\InProcServer32	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FBA5170-10C4-4185-89E3-2D8389223563}\InProcServer32	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FBA5170-10C4-4185-89E3-2D8389223563}\InProcServer32	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FBA5170-10C4-4185-89E3-2D8389223563}\InProcServer32	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FBA5170-10C4-4185-89E3-2D8389223563}\InProcServer32\ThreadingModel = "Both"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FBA5170-10C4-4185-89E3-2D8389223563}\InProcServer32\ThreadingModel = "Both"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0ACBC224-E08F-4B42-8723-B451584D6969}\InProcServer32\ThreadingModel = "Both"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FBA5170-10C4-4185-89E3-2D8389223563}\InProcServer32\ = "C:\\Program Files\\WindowsApps\\Microsoft.GamingServices_19.87.13001.0_x64__8wekyb3d8bbwe\\InstallServicePlugin.dll"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FBA5170-10C4-4185-89E3-2D8389223563}\InProcServer32	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FBA5170-10C4-4185-89E3-2D8389223563}\InProcServer32\ThreadingModel = "Both"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FBA5170-10C4-4185-89E3-2D8389223563}\InProcServer32\ = "C:\\Program Files\\WindowsApps\\Microsoft.GamingServices_19.87.13001.0_x64__8wekyb3d8bbwe\\InstallServicePlugin.dll"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0ACBC224-E08F-4B42-8723-B451584D6969}\InProcServer32\ThreadingModel = "Both"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FBA5170-10C4-4185-89E3-2D8389223563}\InProcServer32\ThreadingModel = "Both"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FBA5170-10C4-4185-89E3-2D8389223563}\InProcServer32\ThreadingModel = "Both"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0ACBC224-E08F-4B42-8723-B451584D6969}\InProcServer32\ = "C:\\Windows\\system32\\gamingservicesproxy_4.dll"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FBA5170-10C4-4185-89E3-2D8389223563}\InProcServer32	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0ACBC224-E08F-4B42-8723-B451584D6969}\InProcServer32	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FBA5170-10C4-4185-89E3-2D8389223563}\InProcServer32\ = "C:\\Program Files\\WindowsApps\\Microsoft.GamingServices_19.87.13001.0_x64__8wekyb3d8bbwe\\InstallServicePlugin.dll"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FBA5170-10C4-4185-89E3-2D8389223563}\InProcServer32\ = "C:\\Program Files\\WindowsApps\\Microsoft.GamingServices_19.87.13001.0_x64__8wekyb3d8bbwe\\InstallServicePlugin.dll"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FBA5170-10C4-4185-89E3-2D8389223563}\InProcServer32\ThreadingModel = "Both"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0ACBC224-E08F-4B42-8723-B451584D6969}\InProcServer32\ = "C:\\Windows\\system32\\gamingservicesproxy_4.dll"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FBA5170-10C4-4185-89E3-2D8389223563}\InProcServer32\ThreadingModel = "Both"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0ACBC224-E08F-4B42-8723-B451584D6969}\InProcServer32	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0ACBC224-E08F-4B42-8723-B451584D6969}\InProcServer32\ThreadingModel = "Both"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FBA5170-10C4-4185-89E3-2D8389223563}\InProcServer32	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0ACBC224-E08F-4B42-8723-B451584D6969}\InProcServer32\ThreadingModel = "Both"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FBA5170-10C4-4185-89E3-2D8389223563}\InProcServer32\ThreadingModel = "Both"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FBA5170-10C4-4185-89E3-2D8389223563}\InProcServer32	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0ACBC224-E08F-4B42-8723-B451584D6969}\InProcServer32\ = "C:\\Windows\\system32\\gamingservicesproxy_4.dll"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0ACBC224-E08F-4B42-8723-B451584D6969}\InProcServer32\ThreadingModel = "Both"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0ACBC224-E08F-4B42-8723-B451584D6969}\InProcServer32\ThreadingModel = "Both"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FBA5170-10C4-4185-89E3-2D8389223563}\InProcServer32	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0ACBC224-E08F-4B42-8723-B451584D6969}\InProcServer32\ = "C:\\Windows\\system32\\gamingservicesproxy_4.dll"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0ACBC224-E08F-4B42-8723-B451584D6969}\InProcServer32	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FBA5170-10C4-4185-89E3-2D8389223563}\InProcServer32	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FBA5170-10C4-4185-89E3-2D8389223563}\InProcServer32\ = "C:\\Program Files\\WindowsApps\\Microsoft.GamingServices_19.87.13001.0_x64__8wekyb3d8bbwe\\InstallServicePlugin.dll"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FBA5170-10C4-4185-89E3-2D8389223563}\InProcServer32\ = "C:\\Program Files\\WindowsApps\\Microsoft.GamingServices_19.87.13001.0_x64__8wekyb3d8bbwe\\InstallServicePlugin.dll"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0ACBC224-E08F-4B42-8723-B451584D6969}\InProcServer32\ = "C:\\Windows\\system32\\gamingservicesproxy_4.dll"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0ACBC224-E08F-4B42-8723-B451584D6969}\InProcServer32\ThreadingModel = "Both"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0ACBC224-E08F-4B42-8723-B451584D6969}\InProcServer32\ThreadingModel = "Both"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0ACBC224-E08F-4B42-8723-B451584D6969}\InProcServer32	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0ACBC224-E08F-4B42-8723-B451584D6969}\InProcServer32\ = "C:\\Windows\\system32\\gamingservicesproxy_4.dll"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0ACBC224-E08F-4B42-8723-B451584D6969}\InProcServer32	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0ACBC224-E08F-4B42-8723-B451584D6969}\InProcServer32	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0ACBC224-E08F-4B42-8723-B451584D6969}\InProcServer32\ = "C:\\Windows\\system32\\gamingservicesproxy_4.dll"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FBA5170-10C4-4185-89E3-2D8389223563}\InProcServer32	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0ACBC224-E08F-4B42-8723-B451584D6969}\InProcServer32	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FBA5170-10C4-4185-89E3-2D8389223563}\InProcServer32\ThreadingModel = "Both"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0ACBC224-E08F-4B42-8723-B451584D6969}\InProcServer32\ = "C:\\Windows\\system32\\gamingservicesproxy_4.dll"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FBA5170-10C4-4185-89E3-2D8389223563}\InProcServer32\ThreadingModel = "Both"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FBA5170-10C4-4185-89E3-2D8389223563}\InProcServer32\ThreadingModel = "Both"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0ACBC224-E08F-4B42-8723-B451584D6969}\InProcServer32\ = "C:\\Windows\\system32\\gamingservicesproxy_4.dll"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0ACBC224-E08F-4B42-8723-B451584D6969}\InProcServer32	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0ACBC224-E08F-4B42-8723-B451584D6969}\InProcServer32\ThreadingModel = "Both"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0ACBC224-E08F-4B42-8723-B451584D6969}\InProcServer32	GamingServices.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	GamingRepair.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	GamingRepair.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\gamingservicesproxy_4.dll	GamingServices.exe
File created	C:\Windows\System32\DriverStore\Temp\{d42000a9-68bc-824c-900e-844fe3c19569}\SET50.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_7a99b6d694df393c\gameflt.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{f18f1be9-1ec5-b042-88d9-783212652b22}\SETABD8.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_7a99b6d694df393c\gameflt.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{0bdc4a22-d3a5-414b-a65c-abbb7352e479}\SET56A0.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{d7fb35a0-b5a2-134b-934d-3bd24b770519}\gameflt.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_7a99b6d694df393c\gameflt.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b2cfde8c-0002-4942-8571-e8ae598d9b4a}\xvdd.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{2f0ed4d7-092d-0a4f-85c9-830ef161774c}\SET5A3F.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{2f0ed4d7-092d-0a4f-85c9-830ef161774c}\gameflt.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_7a99b6d694df393c\gameflt.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_7a99b6d694df393c\gameflt.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_7a99b6d694df393c	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_7a99b6d694df393c\gameflt.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{dd1f1ec0-dd3b-454a-90dc-419b619141e3}	DrvInst.exe
File opened for modification	C:\Windows\system32\xgameruntime.dll	GamingServices.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{f18f1be9-1ec5-b042-88d9-783212652b22}\SETABD7.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{f18f1be9-1ec5-b042-88d9-783212652b22}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_7a99b6d694df393c	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0bdc4a22-d3a5-414b-a65c-abbb7352e479}\gameflt.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_7a99b6d694df393c\gameflt.sys	DrvInst.exe
File created	C:\Windows\system32\gamelaunchhelper.dll	GamingServices.exe
File opened for modification	C:\Windows\system32\gamelaunchhelper.dll	GamingServices.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{dfe3d484-cd72-164c-8af1-3e3c5d11bb9b}\gameflt.cat	DrvInst.exe
File opened for modification	C:\Windows\system32\xgamehelper.exe	GamingServices.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0a9ba797-56f8-2642-a484-25e368c6e7e6}\gameflt.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\xgamehelper.exe	GamingServices.exe
File created	C:\Windows\system32\xgamecontrol.exe	GamingServices.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{fa9dc799-2081-0a48-a190-5f01a468398c}\SETD708.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\xgameruntime.dll	GamingServices.exe
File opened for modification	C:\Windows\system32\gamingtcuihelpers.dll	GamingServices.exe
File opened for modification	C:\Windows\system32\xgamecontrol.exe	GamingServices.exe
File opened for modification	C:\Windows\system32\xgamehelper.exe	GamingServices.exe
File opened for modification	C:\Windows\system32\xgameruntime.dll	GamingServices.exe
File opened for modification	C:\Windows\system32\gamingtcuihelpers.dll	GamingServices.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{dfe3d484-cd72-164c-8af1-3e3c5d11bb9b}\SET2D4A.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\xgameruntime.dll	GamingServices.exe
File opened for modification	C:\Windows\system32\gameconfighelper.dll	GamingServices.exe
File opened for modification	C:\Windows\system32\xgamehelper.exe	GamingServices.exe
File opened for modification	C:\Windows\system32\gameconfighelper.dll	GamingServices.exe
File opened for modification	C:\Windows\system32\gameplatformservices.dll	GamingServices.exe
File opened for modification	C:\Windows\system32\gamingservicesproxy_4.dll	GamingServices.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_7a99b6d694df393c	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0bdc4a22-d3a5-414b-a65c-abbb7352e479}\gameflt.sys	DrvInst.exe
File opened for modification	C:\Windows\system32\gameconfighelper.dll	GamingServices.exe
File created	C:\Windows\system32\gameplatformservices.dll	GamingServices.exe
File created	C:\Windows\System32\DriverStore\Temp\{f18f1be9-1ec5-b042-88d9-783212652b22}\SETABD9.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{5b378d6a-6991-b941-980a-8d0456136a1b}\SET8116.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0bdc4a22-d3a5-414b-a65c-abbb7352e479}\SET56B1.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0a9ba797-56f8-2642-a484-25e368c6e7e6}\SET2B02.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_7a99b6d694df393c\gameflt.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\xvdd.inf_amd64_6668e54a926cbca6\xvdd.cat	DrvInst.exe
File opened for modification	C:\Windows\system32\gameplatformservices.dll	GamingServices.exe
File opened for modification	C:\Windows\system32\gamelaunchhelper.dll	GamingServices.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_7a99b6d694df393c\gameflt.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0a9ba797-56f8-2642-a484-25e368c6e7e6}\gameflt.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_7a99b6d694df393c\gameflt.sys	DrvInst.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\inf\oem4.pnf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem4.pnf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File created	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	GamingServices.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	pnputil.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	GamingServices.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	pnputil.exe
File created	C:\Windows\inf\oem4.inf	DrvInst.exe
File created	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	GamingServices.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File created	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\inf\oem4.pnf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	pnputil.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	GamingServices.exe
File created	C:\Windows\inf\oem4.inf	DrvInst.exe
File created	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\inf\oem4.pnf	DrvInst.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	pnputil.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	pnputil.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\inf\oem4.pnf	DrvInst.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	GamingServices.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\inf\oem4.inf	DrvInst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	GamingServices.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0014	pnputil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\	pnputil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	pnputil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0014	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	GamingServices.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	GamingServices.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0014	pnputil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	pnputil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0014	pnputil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0014	pnputil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom	GamingServices.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	GamingServices.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	GamingServices.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	GamingServices.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	GamingServices.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	pnputil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	pnputil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0014	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom	GamingServices.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	GamingServices.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005	pnputil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0014	pnputil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0014	pnputil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	GamingServices.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	GamingServices.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	GamingServices.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	GamingServices.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GamingRepair.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	GamingRepair.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	GamingRepair.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GamingRepair.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	GamingRepair.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	GamingRepair.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2A4E4539-C38C-4C64-A9CE-DF3BFF410AD2}\ProxyStubClsid32\ = "{0ACBC224-E08F-4B42-8723-B451584D6969}"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDF97431-ACD1-43E4-87C1-DCDA640F42F3}\ = "IGamePlatformGameFolderService"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ad73eafe-c034-418b-89c0-231a66c8de26}\ProxyStubClsid32\ = "{0ACBC224-E08F-4B42-8723-B451584D6969}"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{390f4bd8-3660-409e-8faf-dacdb440a0ee}\ProxyStubClsid32	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4CDEE6B-7333-4CD1-BB77-8F2E520C36FB}\ = "IGameCorePackageIo_V3"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F688F2BD-1AD7-49EB-A902-7F890E0138E4}\ProxyStubClsid32\ = "{0ACBC224-E08F-4B42-8723-B451584D6969}"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{efe11087-73c4-4916-aede-3090618123b9}\ProxyStubClsid32	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4E3252D1-8C69-4595-B1B8-B20B48DD1812}\AppId = "{2964DB41-BAE4-4996-A0A0-D036BFFDC267}"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{e67d6fbc-a1cf-56c1-b374-9043bc3c5c58}	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{947D8A77-6D79-4DCE-A6D4-EDAC394FE6C3}\ProxyStubClsid32\ = "{0ACBC224-E08F-4B42-8723-B451584D6969}"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{29EF372A-D438-4FAF-A173-8E109B0F675E}\ProxyStubClsid32\ = "{0ACBC224-E08F-4B42-8723-B451584D6969}"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D529741A-1BF1-4D1E-9976-35089622E758}\LocalService = "GamingServices"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E652A68A-88A2-45BF-8D2E-7404278C7F8A}\ProxyStubClsid32\ = "{0ACBC224-E08F-4B42-8723-B451584D6969}"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A54D7505-C0B4-4B6C-9060-41D7D67B40EB}\ProxyStubClsid32\ = "{0ACBC224-E08F-4B42-8723-B451584D6969}"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D772E61A-E176-43B8-8AC8-33C1CF4C31EA}\ = "GamePlatformStorageService"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B5323F02-4DB5-4442-BD09-FD78E0F61CEB}\ = "ILicenseService"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{276d243c-db6c-47e9-8e21-ae51d4c3dfd4}	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{268d0fdf-ac77-4a6f-a524-eddea6cae1e9}\AppId = "{2964DB41-BAE4-4996-A0A0-D036BFFDC267}"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{483DCCC8-BEF4-4268-9F88-82D758F22B62}\ = "AsyncIXGameSaveQueryHandler"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{a88bbde8-607c-507e-8b2f-ff422ef2c8a7}\ProxyStubClsid32\ = "{0ACBC224-E08F-4B42-8723-B451584D6969}"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3E8C9ABE-9226-4609-BF5B-60288A391DEE}	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AD6FF479-E54E-4786-AC2A-10D35C5B93A7}\AsynchronousInterface	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{276d243c-db6c-47e9-8e21-ae51d4c3dfd4}\ProxyStubClsid32\ = "{0ACBC224-E08F-4B42-8723-B451584D6969}"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{01958D59-8ABB-4DB9-B8B7-17345BE2E9FF}\ProxyStubClsid32\ = "{0ACBC224-E08F-4B42-8723-B451584D6969}"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{44564d39-2e0e-46c5-acd4-c24260c440f6}\ProxyStubClsid32\ = "{0ACBC224-E08F-4B42-8723-B451584D6969}"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F29BCE54-1E43-48E0-AC77-382337B080C7}\ = "IEnumGamePlatformRunningGames"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0E7BBE8F-722F-4B8D-A207-60F906BBE00A}\ProxyStubClsid32	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9040DF33-5862-4B1F-872A-2FB54951A60E}	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{465caef2-e60a-575a-9169-39a55c281d75}\ProxyStubClsid32	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2bee07d0-da2e-459e-b30c-0399c285e809}\ProxyStubClsid32\ = "{0ACBC224-E08F-4B42-8723-B451584D6969}"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7025B35A-849F-49CB-BBFD-EEA00E5C2A01}\ = "IXGameSaveQueryHandler"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CB48C4B7-2ADA-438F-A9CA-E6ACC3838C4B}\ProxyStubClsid32	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{846A35A8-E4C9-4C4D-AC26-1B425AA218C6}\ = "IGamePlatformCustomizationService"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B7A9F597-904F-42D6-9E3B-7684D049B04E}\AppId = "{2964DB41-BAE4-4996-A0A0-D036BFFDC267}"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{87044ed6-fa31-4be8-b8d5-b181c7210351}\ = "IUsersSkuSpecificServerConnection5"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{903de535-e51b-48d3-b30c-33f95f2bf1bc}\ProxyStubClsid32	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5d3910a4-74e0-4cf1-bfad-50b1c6522cfa}\ProxyStubClsid32\ = "{0ACBC224-E08F-4B42-8723-B451584D6969}"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9CE3E855-E7D0-4B3A-8C65-867C37739E45}\ProxyStubClsid32\ = "{0ACBC224-E08F-4B42-8723-B451584D6969}"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D529741A-1BF1-4D1E-9976-35089622E758}	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8F48B00E-45A9-435B-B458-2FFC8FC3AF9E}	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{244E7CF2-E51D-4548-8C47-B118642A4D0A}\ = "XboxDesktopDevelopmentPackageManager"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53996A6D-0B67-4109-B5EE-953D779C8C60}	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1D9DE7D3-6ABD-4EA5-BB47-D78E1C22DC91}\ProxyStubClsid32	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6f070d63-df98-4865-ad33-809b89dcf0ef}	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{80E6F60D-CDEB-4A5E-86FF-C45DFFA775DC}\ = "IGameCorePackageService_V8"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2F87250D-063D-4871-9399-3A603DFA0E04}\ProxyStubClsid32	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{63b4e0e5-78f0-4621-bb03-3f773906b2fd}\ProxyStubClsid32\ = "{0ACBC224-E08F-4B42-8723-B451584D6969}"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2fefca8f-a720-4b55-8f61-29295da1c93a}\ProxyStubClsid32	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F688F2BD-1AD7-49EB-A902-7F890E0138E4}\ProxyStubClsid32\ = "{0ACBC224-E08F-4B42-8723-B451584D6969}"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8A27D3CE-19F3-4CE7-8E51-CBBDC8DEE291}\LocalService = "GamingServices"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E652A68A-88A2-45BF-8D2E-7404278C7F8A}\ProxyStubClsid32	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5FB9AC1-AD68-45C5-B7EB-6F2498AEFAA7}\AppId = "{2964DB41-BAE4-4996-A0A0-D036BFFDC267}"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B7B40E4A-FB25-4648-85CF-8873178D7DA4}	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DEA131F9-B1B5-4CCD-A75C-B9072A4FAF9E}\ProxyStubClsid32	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D772E61A-E176-43B8-8AC8-33C1CF4C31EA}\LocalService = "GamingServices"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ddacfd60-1b49-4657-bafc-e062b6e1e7a2}\ProxyStubClsid32	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E4B5CFBF-8BBE-4F20-ACC8-9840410FA851}\ = "GameAppExtensions"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D271B28B-505C-406F-BCC8-46CABB249E2E}	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C30D27D6-20E1-4E42-87E1-6BE72E5F1388}\ProxyStubClsid32	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{13A35C28-08C9-4805-9E85-D7ED759314F9}\ProxyStubClsid32\ = "{0ACBC224-E08F-4B42-8723-B451584D6969}"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{710318A4-861A-4599-9DA2-50C84EE59ED8}\ = "XGameSaveService"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{22372F89-F1F5-49B3-9FA5-42DFFC914D1F}\AppId = "{2964DB41-BAE4-4996-A0A0-D036BFFDC267}"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41EFFFA0-7356-4247-A84D-E54DEBC5DCEF}\ProxyStubClsid32	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F6A5D79E-AE9D-4CAC-BBCC-7F145E07EC2A}	GamingServices.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
1996	chrome.exe
1996	chrome.exe
3240	GamingServices.exe
3240	GamingServices.exe
1648	GamingServices.exe
1648	GamingServices.exe
2168	GamingServices.exe
2168	GamingServices.exe
2940	GamingServices.exe
2940	GamingServices.exe
4148	GamingServices.exe
4148	GamingServices.exe
3184	GamingServices.exe
3184	GamingServices.exe
5088	GamingServices.exe
5088	GamingServices.exe
2576	GamingServices.exe
2576	GamingServices.exe
4932	GamingServices.exe
4932	GamingServices.exe
4084	GamingServices.exe
4084	GamingServices.exe
1492	GamingServices.exe
1492	GamingServices.exe
2168	GamingServices.exe
2168	GamingServices.exe

Suspicious behavior: LoadsDriver 12 IoCs

pid	Process
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeDebugPrivilege	1992	MinecraftInstaller.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe

Suspicious use of FindShellTrayWindow 62 IoCs

pid	Process
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1992	MinecraftInstaller.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 1532	1996	chrome.exe	84
PID 1996 wrote to memory of 1532	1996	chrome.exe	84
PID 1996 wrote to memory of 4320	1996	chrome.exe	86
PID 1996 wrote to memory of 4320	1996	chrome.exe	86
PID 1996 wrote to memory of 4320	1996	chrome.exe	86
PID 1996 wrote to memory of 4320	1996	chrome.exe	86
PID 1996 wrote to memory of 4320	1996	chrome.exe	86
PID 1996 wrote to memory of 4320	1996	chrome.exe	86
PID 1996 wrote to memory of 4320	1996	chrome.exe	86
PID 1996 wrote to memory of 4320	1996	chrome.exe	86
PID 1996 wrote to memory of 4320	1996	chrome.exe	86
PID 1996 wrote to memory of 4320	1996	chrome.exe	86
PID 1996 wrote to memory of 4320	1996	chrome.exe	86
PID 1996 wrote to memory of 4320	1996	chrome.exe	86
PID 1996 wrote to memory of 4320	1996	chrome.exe	86
PID 1996 wrote to memory of 4320	1996	chrome.exe	86
PID 1996 wrote to memory of 4320	1996	chrome.exe	86
PID 1996 wrote to memory of 4320	1996	chrome.exe	86
PID 1996 wrote to memory of 4320	1996	chrome.exe	86
PID 1996 wrote to memory of 4320	1996	chrome.exe	86
PID 1996 wrote to memory of 4320	1996	chrome.exe	86
PID 1996 wrote to memory of 4320	1996	chrome.exe	86
PID 1996 wrote to memory of 4320	1996	chrome.exe	86
PID 1996 wrote to memory of 4320	1996	chrome.exe	86
PID 1996 wrote to memory of 4320	1996	chrome.exe	86
PID 1996 wrote to memory of 4320	1996	chrome.exe	86
PID 1996 wrote to memory of 4320	1996	chrome.exe	86
PID 1996 wrote to memory of 4320	1996	chrome.exe	86
PID 1996 wrote to memory of 4320	1996	chrome.exe	86
PID 1996 wrote to memory of 4320	1996	chrome.exe	86
PID 1996 wrote to memory of 4320	1996	chrome.exe	86
PID 1996 wrote to memory of 4320	1996	chrome.exe	86
PID 1996 wrote to memory of 4320	1996	chrome.exe	86
PID 1996 wrote to memory of 4320	1996	chrome.exe	86
PID 1996 wrote to memory of 4320	1996	chrome.exe	86
PID 1996 wrote to memory of 4320	1996	chrome.exe	86
PID 1996 wrote to memory of 4320	1996	chrome.exe	86
PID 1996 wrote to memory of 4320	1996	chrome.exe	86
PID 1996 wrote to memory of 4320	1996	chrome.exe	86
PID 1996 wrote to memory of 4320	1996	chrome.exe	86
PID 1996 wrote to memory of 812	1996	chrome.exe	87
PID 1996 wrote to memory of 812	1996	chrome.exe	87
PID 1996 wrote to memory of 2480	1996	chrome.exe	88
PID 1996 wrote to memory of 2480	1996	chrome.exe	88
PID 1996 wrote to memory of 2480	1996	chrome.exe	88
PID 1996 wrote to memory of 2480	1996	chrome.exe	88
PID 1996 wrote to memory of 2480	1996	chrome.exe	88
PID 1996 wrote to memory of 2480	1996	chrome.exe	88
PID 1996 wrote to memory of 2480	1996	chrome.exe	88
PID 1996 wrote to memory of 2480	1996	chrome.exe	88
PID 1996 wrote to memory of 2480	1996	chrome.exe	88
PID 1996 wrote to memory of 2480	1996	chrome.exe	88
PID 1996 wrote to memory of 2480	1996	chrome.exe	88
PID 1996 wrote to memory of 2480	1996	chrome.exe	88
PID 1996 wrote to memory of 2480	1996	chrome.exe	88
PID 1996 wrote to memory of 2480	1996	chrome.exe	88
PID 1996 wrote to memory of 2480	1996	chrome.exe	88
PID 1996 wrote to memory of 2480	1996	chrome.exe	88
PID 1996 wrote to memory of 2480	1996	chrome.exe	88
PID 1996 wrote to memory of 2480	1996	chrome.exe	88
PID 1996 wrote to memory of 2480	1996	chrome.exe	88
PID 1996 wrote to memory of 2480	1996	chrome.exe	88
PID 1996 wrote to memory of 2480	1996	chrome.exe	88
PID 1996 wrote to memory of 2480	1996	chrome.exe	88

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://aka.ms/minecraftClientGameCoreWindows
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff967bc9758,0x7ff967bc9768,0x7ff967bc9778
  2⤵
  PID:1532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1672 --field-trial-handle=1884,i,14194347549236231915,2632334763263188050,131072 /prefetch:2
  2⤵
  PID:4320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1884,i,14194347549236231915,2632334763263188050,131072 /prefetch:8
  2⤵
  PID:812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2228 --field-trial-handle=1884,i,14194347549236231915,2632334763263188050,131072 /prefetch:8
  2⤵
  PID:2480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2880 --field-trial-handle=1884,i,14194347549236231915,2632334763263188050,131072 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2892 --field-trial-handle=1884,i,14194347549236231915,2632334763263188050,131072 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5016 --field-trial-handle=1884,i,14194347549236231915,2632334763263188050,131072 /prefetch:8
  2⤵
  PID:1040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5068 --field-trial-handle=1884,i,14194347549236231915,2632334763263188050,131072 /prefetch:8
  2⤵
  PID:4080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 --field-trial-handle=1884,i,14194347549236231915,2632334763263188050,131072 /prefetch:8
  2⤵
  PID:2372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 --field-trial-handle=1884,i,14194347549236231915,2632334763263188050,131072 /prefetch:8
  2⤵
  PID:2884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 --field-trial-handle=1884,i,14194347549236231915,2632334763263188050,131072 /prefetch:8
  2⤵
  PID:3908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5384 --field-trial-handle=1884,i,14194347549236231915,2632334763263188050,131072 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5224 --field-trial-handle=1884,i,14194347549236231915,2632334763263188050,131072 /prefetch:8
  2⤵
  PID:2512
- C:\Users\Admin\Downloads\MinecraftInstaller.exe
  "C:\Users\Admin\Downloads\MinecraftInstaller.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1992
- - C:\Users\Admin\AppData\Local\Temp\GamingRepair.exe
    "C:\Users\Admin\AppData\Local\Temp\GamingRepair.exe" scenarioMinecraft
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Checks system information in the registry
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:3756
  - - C:\Windows\system32\wevtutil.exe
      "C:\Windows\system32\wevtutil.exe" epl Microsoft-Windows-AppXDeploymentServer/Operational C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\Microsoft-Windows-AppXDeploymentServer_Operational.evtx /ow:true
      4⤵
      PID:1588
  - - C:\Windows\system32\wevtutil.exe
      "C:\Windows\system32\wevtutil.exe" epl Microsoft-Windows-AppXDeployment/Operational C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\Microsoft-Windows-AppXDeployment_Operational.evtx /ow:true
      4⤵
      PID:4148
  - - C:\Windows\system32\wevtutil.exe
      "C:\Windows\system32\wevtutil.exe" epl Microsoft-Windows-AppxPackaging/Operational C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\Microsoft-Windows-AppxPackaging_Operational.evtx /ow:true
      4⤵
      PID:1644
  - - C:\Windows\system32\wevtutil.exe
      "C:\Windows\system32\wevtutil.exe" epl Microsoft-Windows-AppModel-Runtime/Admin C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\Microsoft-Windows-AppModel-Runtime_Admin.evtx /ow:true
      4⤵
      PID:1184
  - - C:\Windows\system32\wscollect.exe
      "C:\Windows\system32\wscollect.exe" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\wscollect_gr.cab
      4⤵
      PID:4164
    - - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SIH" "C:\Users\Admin\AppData\Local\Temp\registry_SIH.txt" /y
        5⤵
        
        PID:2832
    - - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe export "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters\DnsPolicyConfig" "C:\Users\Admin\AppData\Local\Temp\registry_DNSPolicy.txt" /y
        5⤵
        
        PID:3792
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" export "HKLM\Software\Microsoft\GamingServices" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\HKLM_GRTS.reg /y
      4⤵
      PID:3628
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" export "HKCU\Software\Microsoft\GamingServices" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\HKCU_GRTS.reg /y
      4⤵
      PID:4280
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" export "HKLM\SYSTEM\CurrentControlSet\Services\GamingServices" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\GS_Service.reg /y
      4⤵
      PID:3768
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" export "HKLM\SYSTEM\CurrentControlSet\Services\GamingServicesNet" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\GSNet_Service.reg /y
      4⤵
      PID:3704
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" export "HKLM\SYSTEM\CurrentControlSet\Services\GameFlt" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\GameFlt_Service.reg /y
      4⤵
      PID:4900
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" export "HKLM\SYSTEM\CurrentControlSet\Services\Xvdd" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\Xvdd_Service.reg /y
      4⤵
      PID:1672
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" export "HKLM\SYSTEM\CurrentControlSet\Services\XblAuthManager" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\XblAuthManager_Service.reg /y
      4⤵
      PID:4332
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" export "HKLM\SYSTEM\CurrentControlSet\Services\XblGameSave" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\XblGameSave_Service.reg /y
      4⤵
      PID:1068
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" export "HKLM\SYSTEM\CurrentControlSet\Services\GameInput Service" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\GameInput_Service.reg /y
      4⤵
      PID:4580
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" export "HKCU\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\HKCU_AppModel.reg /y
      4⤵
      PID:380
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\HKLM_AppModel.reg /y
      4⤵
      PID:2960
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\HKLM_Appx.reg /y
      4⤵
      PID:2152
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" export "HKCU\SOFTWARE\Classes\ActivatableClasses\Package" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\HKCU_Package.reg /y
      4⤵
      PID:2264
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" export "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\HKLM_WuPolicy.reg /y
      4⤵
      PID:4724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=1612 --field-trial-handle=1884,i,14194347549236231915,2632334763263188050,131072 /prefetch:1
  2⤵
  PID:4164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5708 --field-trial-handle=1884,i,14194347549236231915,2632334763263188050,131072 /prefetch:1
  2⤵
  PID:3896

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1836

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4396

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:3508

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
PID:8

C:\Windows\system32\svchost.exe
"svchost.exe"
1⤵
PID:4216

C:\Program Files\WindowsApps\Microsoft.GamingServices_19.87.13001.0_x64__8wekyb3d8bbwe\GamingServices.exe
"C:\Program Files\WindowsApps\Microsoft.GamingServices_19.87.13001.0_x64__8wekyb3d8bbwe\GamingServices.exe"
1⤵
- Registers COM server for autorun
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3240
- C:\Windows\System32\pnputil.exe
  C:\Windows\System32\pnputil.exe /enum-drivers
  2⤵
  PID:2536
- C:\Windows\System32\pnputil.exe
  C:\Windows\System32\pnputil.exe /delete-driver oem4.inf /force
  2⤵
  - Checks SCSI registry key(s)
  PID:5096

C:\Program Files\WindowsApps\Microsoft.GamingServices_19.87.13001.0_x64__8wekyb3d8bbwe\GamingServicesNet.exe
"C:\Program Files\WindowsApps\Microsoft.GamingServices_19.87.13001.0_x64__8wekyb3d8bbwe\GamingServicesNet.exe"
1⤵
PID:2472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
PID:1096
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Windows\TEMP\{285d254b-6cda-f141-8d26-3366fe0034ed}\xvdd.inf" "9" "4dd3ffde7" "0000000000000144" "Service-0x0-3e7$\Default" "0000000000000158" "208" "C:\Program Files\WindowsApps\Microsoft.GamingServices_19.87.13001.0_x64__8wekyb3d8bbwe\drivers"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:4296
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "1" "0" "SWD\XvddEnum\XvddRootDevice_Instance" "" "" "48fe919b3" "0000000000000000"
  2⤵
  PID:1916
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Windows\TEMP\{480dd0ba-08e5-9a49-a188-36d3822a49e1}\gameflt.inf" "9" "429d51133" "0000000000000144" "Service-0x0-3e7$\Default" "0000000000000100" "208" "C:\Program Files\WindowsApps\Microsoft.GamingServices_19.87.13001.0_x64__8wekyb3d8bbwe\drivers"
  2⤵
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:3316
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_7a99b6d694df393c\gameflt.inf" "0" "429d51133" "000000000000017C" "Service-0x0-3e7$\Default"
  2⤵
  - Drops file in Windows directory
  PID:484
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "5" "2" "C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_7a99b6d694df393c\gameflt.inf" "0" "4b9547ee7" "0000000000000144" "Service-0x0-3e7$\Default"
  2⤵
  PID:2128

C:\Program Files\WindowsApps\Microsoft.GamingServices_19.87.13001.0_x64__8wekyb3d8bbwe\GamingServices.exe
"C:\Program Files\WindowsApps\Microsoft.GamingServices_19.87.13001.0_x64__8wekyb3d8bbwe\GamingServices.exe"
1⤵
- Registers COM server for autorun
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1648
- C:\Windows\System32\pnputil.exe
  C:\Windows\System32\pnputil.exe /enum-drivers
  2⤵
  PID:4504
- C:\Windows\System32\pnputil.exe
  C:\Windows\System32\pnputil.exe /delete-driver oem4.inf /force
  2⤵
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  PID:4976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Checks SCSI registry key(s)
PID:4736
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Windows\TEMP\{73b2d493-3af1-124f-a8d4-1a1f504c8c7a}\gameflt.inf" "9" "429d51133" "000000000000014C" "Service-0x0-3e7$\Default" "0000000000000150" "208" "C:\Program Files\WindowsApps\Microsoft.GamingServices_19.87.13001.0_x64__8wekyb3d8bbwe\drivers"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:3472
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_7a99b6d694df393c\gameflt.inf" "0" "429d51133" "0000000000000150" "Service-0x0-3e7$\Default"
  2⤵
  PID:3728
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "5" "2" "C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_7a99b6d694df393c\gameflt.inf" "0" "4b9547ee7" "000000000000014C" "Service-0x0-3e7$\Default"
  2⤵
  - Drops file in Windows directory
  PID:2308
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Windows\TEMP\{59bb6303-22b4-8f42-b761-96a14d366890}\gameflt.inf" "9" "429d51133" "000000000000014C" "Service-0x0-3e7$\Default" "000000000000017C" "208" "C:\Program Files\WindowsApps\Microsoft.GamingServices_19.87.13001.0_x64__8wekyb3d8bbwe\drivers"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:1464
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_7a99b6d694df393c\gameflt.inf" "0" "429d51133" "0000000000000160" "Service-0x0-3e7$\Default"
  2⤵
  - Drops file in Windows directory
  PID:4372
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "5" "2" "C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_7a99b6d694df393c\gameflt.inf" "0" "4b9547ee7" "0000000000000164" "Service-0x0-3e7$\Default"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:1700
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Windows\TEMP\{140c832a-b271-7549-8faf-ee02db682f02}\gameflt.inf" "9" "429d51133" "000000000000014C" "Service-0x0-3e7$\Default" "0000000000000170" "208" "C:\Program Files\WindowsApps\Microsoft.GamingServices_19.87.13001.0_x64__8wekyb3d8bbwe\drivers"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:4304
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_7a99b6d694df393c\gameflt.inf" "0" "429d51133" "0000000000000170" "Service-0x0-3e7$\Default"
  2⤵
  PID:4760
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "5" "2" "C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_7a99b6d694df393c\gameflt.inf" "0" "4b9547ee7" "000000000000014C" "Service-0x0-3e7$\Default"
  2⤵
  - Drops file in System32 directory
  PID:876
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Windows\TEMP\{abaceb65-1514-dc46-933b-c9dc7be366c3}\gameflt.inf" "9" "429d51133" "000000000000015C" "Service-0x0-3e7$\Default" "000000000000017C" "208" "C:\Program Files\WindowsApps\Microsoft.GamingServices_19.87.13001.0_x64__8wekyb3d8bbwe\drivers"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:2484
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_7a99b6d694df393c\gameflt.inf" "0" "429d51133" "000000000000017C" "Service-0x0-3e7$\Default"
  2⤵
  - Drops file in Windows directory
  PID:5040
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "5" "2" "C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_7a99b6d694df393c\gameflt.inf" "0" "4b9547ee7" "000000000000015C" "Service-0x0-3e7$\Default"
  2⤵
  - Drops file in Windows directory
  PID:2108
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Windows\TEMP\{9e97d0da-d2a6-c549-a06d-cbf894456bf9}\gameflt.inf" "9" "429d51133" "0000000000000174" "Service-0x0-3e7$\Default" "0000000000000164" "208" "C:\Program Files\WindowsApps\Microsoft.GamingServices_19.87.13001.0_x64__8wekyb3d8bbwe\drivers"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:2476
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_7a99b6d694df393c\gameflt.inf" "0" "429d51133" "0000000000000164" "Service-0x0-3e7$\Default"
  2⤵
  - Drops file in Windows directory
  PID:3256
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "5" "2" "C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_7a99b6d694df393c\gameflt.inf" "0" "4b9547ee7" "0000000000000174" "Service-0x0-3e7$\Default"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:2928
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Windows\TEMP\{7bf1426e-8831-6a43-bc70-31c781607785}\gameflt.inf" "9" "429d51133" "000000000000014C" "Service-0x0-3e7$\Default" "0000000000000144" "208" "C:\Program Files\WindowsApps\Microsoft.GamingServices_19.87.13001.0_x64__8wekyb3d8bbwe\drivers"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:3392
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_7a99b6d694df393c\gameflt.inf" "0" "429d51133" "0000000000000144" "Service-0x0-3e7$\Default"
  2⤵
  PID:2260
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "5" "2" "C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_7a99b6d694df393c\gameflt.inf" "0" "4b9547ee7" "000000000000014C" "Service-0x0-3e7$\Default"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:4880
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Windows\TEMP\{71ebf1c0-e9a5-8d4b-86fe-277c7d1a9ade}\gameflt.inf" "9" "429d51133" "0000000000000178" "Service-0x0-3e7$\Default" "0000000000000184" "208" "C:\Program Files\WindowsApps\Microsoft.GamingServices_19.87.13001.0_x64__8wekyb3d8bbwe\drivers"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:2264
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_7a99b6d694df393c\gameflt.inf" "0" "429d51133" "0000000000000184" "Service-0x0-3e7$\Default"
  2⤵
  - Drops file in Windows directory
  PID:184
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "5" "2" "C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_7a99b6d694df393c\gameflt.inf" "0" "4b9547ee7" "0000000000000178" "Service-0x0-3e7$\Default"
  2⤵
  - Drops file in Windows directory
  PID:3808
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Windows\TEMP\{16cdea12-b9d3-8c44-9f81-a587ba482441}\gameflt.inf" "9" "429d51133" "000000000000018C" "Service-0x0-3e7$\Default" "0000000000000178" "208" "C:\Program Files\WindowsApps\Microsoft.GamingServices_19.87.13001.0_x64__8wekyb3d8bbwe\drivers"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:696
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_7a99b6d694df393c\gameflt.inf" "0" "429d51133" "0000000000000178" "Service-0x0-3e7$\Default"
  2⤵
  - Drops file in Windows directory
  PID:408
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "5" "2" "C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_7a99b6d694df393c\gameflt.inf" "0" "4b9547ee7" "000000000000018C" "Service-0x0-3e7$\Default"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:3336
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Windows\TEMP\{9f1c9eaa-821c-ac41-b660-0a1ee4385bc6}\gameflt.inf" "9" "429d51133" "000000000000014C" "Service-0x0-3e7$\Default" "0000000000000144" "208" "C:\Program Files\WindowsApps\Microsoft.GamingServices_19.87.13001.0_x64__8wekyb3d8bbwe\drivers"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:836
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_7a99b6d694df393c\gameflt.inf" "0" "429d51133" "0000000000000144" "Service-0x0-3e7$\Default"
  2⤵
  PID:3708
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "5" "2" "C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_7a99b6d694df393c\gameflt.inf" "0" "4b9547ee7" "000000000000014C" "Service-0x0-3e7$\Default"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:1748
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Windows\TEMP\{d0db9b2f-f80f-7f4d-b5eb-104aca0e9a75}\gameflt.inf" "9" "429d51133" "000000000000018C" "Service-0x0-3e7$\Default" "0000000000000174" "208" "C:\Program Files\WindowsApps\Microsoft.GamingServices_19.87.13001.0_x64__8wekyb3d8bbwe\drivers"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:2460
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_7a99b6d694df393c\gameflt.inf" "0" "429d51133" "0000000000000174" "Service-0x0-3e7$\Default"
  2⤵
  - Drops file in Windows directory
  PID:1376
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "5" "2" "C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_7a99b6d694df393c\gameflt.inf" "0" "4b9547ee7" "000000000000018C" "Service-0x0-3e7$\Default"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:1020
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Windows\TEMP\{74e38022-13e9-bc47-83a0-8a1df90434cb}\gameflt.inf" "9" "429d51133" "0000000000000164" "Service-0x0-3e7$\Default" "0000000000000160" "208" "C:\Program Files\WindowsApps\Microsoft.GamingServices_19.87.13001.0_x64__8wekyb3d8bbwe\drivers"
  2⤵
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:5068
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_7a99b6d694df393c\gameflt.inf" "0" "429d51133" "0000000000000160" "Service-0x0-3e7$\Default"
  2⤵
  PID:3300
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "5" "2" "C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_7a99b6d694df393c\gameflt.inf" "0" "4b9547ee7" "0000000000000164" "Service-0x0-3e7$\Default"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:4808

C:\Program Files\WindowsApps\Microsoft.GamingServices_19.87.13001.0_x64__8wekyb3d8bbwe\GamingServices.exe
"C:\Program Files\WindowsApps\Microsoft.GamingServices_19.87.13001.0_x64__8wekyb3d8bbwe\GamingServices.exe"
1⤵
- Registers COM server for autorun
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2168
- C:\Windows\System32\pnputil.exe
  C:\Windows\System32\pnputil.exe /enum-drivers
  2⤵
  PID:1256
- C:\Windows\System32\pnputil.exe
  C:\Windows\System32\pnputil.exe /delete-driver oem4.inf /force
  2⤵
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  PID:856

C:\Program Files\WindowsApps\Microsoft.GamingServices_19.87.13001.0_x64__8wekyb3d8bbwe\GamingServices.exe
"C:\Program Files\WindowsApps\Microsoft.GamingServices_19.87.13001.0_x64__8wekyb3d8bbwe\GamingServices.exe"
1⤵
- Registers COM server for autorun
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2940
- C:\Windows\System32\pnputil.exe
  C:\Windows\System32\pnputil.exe /enum-drivers
  2⤵
  PID:4748
- C:\Windows\System32\pnputil.exe
  C:\Windows\System32\pnputil.exe /delete-driver oem4.inf /force
  2⤵
  - Checks SCSI registry key(s)
  PID:4732

C:\Program Files\WindowsApps\Microsoft.GamingServices_19.87.13001.0_x64__8wekyb3d8bbwe\GamingServices.exe
"C:\Program Files\WindowsApps\Microsoft.GamingServices_19.87.13001.0_x64__8wekyb3d8bbwe\GamingServices.exe"
1⤵
- Registers COM server for autorun
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4148
- C:\Windows\System32\pnputil.exe
  C:\Windows\System32\pnputil.exe /enum-drivers
  2⤵
  PID:4460
- C:\Windows\System32\pnputil.exe
  C:\Windows\System32\pnputil.exe /delete-driver oem4.inf /force
  2⤵
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  PID:1688

C:\Program Files\WindowsApps\Microsoft.GamingServices_19.87.13001.0_x64__8wekyb3d8bbwe\GamingServices.exe
"C:\Program Files\WindowsApps\Microsoft.GamingServices_19.87.13001.0_x64__8wekyb3d8bbwe\GamingServices.exe"
1⤵
- Registers COM server for autorun
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3184
- C:\Windows\System32\pnputil.exe
  C:\Windows\System32\pnputil.exe /enum-drivers
  2⤵
  PID:4068
- C:\Windows\System32\pnputil.exe
  C:\Windows\System32\pnputil.exe /delete-driver oem4.inf /force
  2⤵
  - Checks SCSI registry key(s)
  PID:4220

C:\Program Files\WindowsApps\Microsoft.GamingServices_19.87.13001.0_x64__8wekyb3d8bbwe\GamingServices.exe
"C:\Program Files\WindowsApps\Microsoft.GamingServices_19.87.13001.0_x64__8wekyb3d8bbwe\GamingServices.exe"
1⤵
- Registers COM server for autorun
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5088
- C:\Windows\System32\pnputil.exe
  C:\Windows\System32\pnputil.exe /enum-drivers
  2⤵
  PID:2168
- C:\Windows\System32\pnputil.exe
  C:\Windows\System32\pnputil.exe /delete-driver oem4.inf /force
  2⤵
  - Checks SCSI registry key(s)
  PID:4460

C:\Program Files\WindowsApps\Microsoft.GamingServices_19.87.13001.0_x64__8wekyb3d8bbwe\GamingServices.exe
"C:\Program Files\WindowsApps\Microsoft.GamingServices_19.87.13001.0_x64__8wekyb3d8bbwe\GamingServices.exe"
1⤵
- Registers COM server for autorun
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2576
- C:\Windows\System32\pnputil.exe
  C:\Windows\System32\pnputil.exe /enum-drivers
  2⤵
  PID:3696
- C:\Windows\System32\pnputil.exe
  C:\Windows\System32\pnputil.exe /delete-driver oem4.inf /force
  2⤵
  PID:4940

C:\Program Files\WindowsApps\Microsoft.GamingServices_19.87.13001.0_x64__8wekyb3d8bbwe\GamingServices.exe
"C:\Program Files\WindowsApps\Microsoft.GamingServices_19.87.13001.0_x64__8wekyb3d8bbwe\GamingServices.exe"
1⤵
- Registers COM server for autorun
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4932
- C:\Windows\System32\pnputil.exe
  C:\Windows\System32\pnputil.exe /enum-drivers
  2⤵
  PID:3984
- C:\Windows\System32\pnputil.exe
  C:\Windows\System32\pnputil.exe /delete-driver oem4.inf /force
  2⤵
  - Checks SCSI registry key(s)
  PID:1732

C:\Program Files\WindowsApps\Microsoft.GamingServices_19.87.13001.0_x64__8wekyb3d8bbwe\GamingServices.exe
"C:\Program Files\WindowsApps\Microsoft.GamingServices_19.87.13001.0_x64__8wekyb3d8bbwe\GamingServices.exe"
1⤵
- Registers COM server for autorun
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4084
- C:\Windows\System32\pnputil.exe
  C:\Windows\System32\pnputil.exe /enum-drivers
  2⤵
  PID:4984
- C:\Windows\System32\pnputil.exe
  C:\Windows\System32\pnputil.exe /delete-driver oem4.inf /force
  2⤵
  - Checks SCSI registry key(s)
  PID:5096

C:\Program Files\WindowsApps\Microsoft.GamingServices_19.87.13001.0_x64__8wekyb3d8bbwe\GamingServices.exe
"C:\Program Files\WindowsApps\Microsoft.GamingServices_19.87.13001.0_x64__8wekyb3d8bbwe\GamingServices.exe"
1⤵
- Registers COM server for autorun
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1492
- C:\Windows\System32\pnputil.exe
  C:\Windows\System32\pnputil.exe /enum-drivers
  2⤵
  PID:1448
- C:\Windows\System32\pnputil.exe
  C:\Windows\System32\pnputil.exe /delete-driver oem4.inf /force
  2⤵
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  PID:2196

C:\Program Files\WindowsApps\Microsoft.GamingServices_19.87.13001.0_x64__8wekyb3d8bbwe\GamingServices.exe
"C:\Program Files\WindowsApps\Microsoft.GamingServices_19.87.13001.0_x64__8wekyb3d8bbwe\GamingServices.exe"
1⤵
- Registers COM server for autorun
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2168
- C:\Windows\System32\pnputil.exe
  C:\Windows\System32\pnputil.exe /enum-drivers
  2⤵
  PID:3312
- C:\Windows\System32\pnputil.exe
  C:\Windows\System32\pnputil.exe /delete-driver oem4.inf /force
  2⤵
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  PID:2140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 755B
SHA256 d99f4e473092ba999c31b17d655b8619a0f732442e80ce65daaa1b51ceb8f60c
MD5 aac1f9dea2b1a341fa13ab13fe7643ef
SHA1 24e990ef527db280a97033ac0b65d587d754f7a8
SHA512 2dbfffb090688ee8960fc67b72bb83e06e5ae229a969aa375575d7d486b749e2493d0dd6d1c6cb90eb1d1f6ceae7a2d00f6642d060ab1537e9dfc996890a3cef
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 904B
SHA256 46ccca2aaa1ed8ed12dae9f56064ae918cda6e33f36f29de4aa23dc8a1bedf6a
MD5 9051043a369d84de082e16df8b425876
SHA1 5cdbad844ee0e130c88b10ac95ef692edc3042ae
SHA512 d41a9079c6c7155e0388e6549d52a1a97e6ad3756ed3704d062910bdcdef5226ba6ec02453b73e505b8792625f7fd9b343bc8313c2f6922393ba32e8d6e6b571
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 371B
SHA256 ec911490eea66d377e692c610b77c41944f4c833a5b83255c6346e56c3b6dba3
MD5 61c11ac149a87879759ae5cb0f6ab804
SHA1 868f5b2769c4cd1188236d33fa1e4320ba8496f1
SHA512 8adef6ef0076b236481fe804447ec5269d9b119d6213bcef5a539a412f7cd4cbebf609b87337a7d6fe14134a92e1fa0dcb4c2a39192fe00a26e4cc9831a526c3
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 371B
SHA256 279b8d5f24698b60b0a35b86b6fdcf9d09e433c5b43763b9c0e2ebe6e017a3b7
MD5 453f0fcb6d90aed92a955af005cd951d
SHA1 ad1285ef4a07b23acd8a414c88e52ceec26455f8
SHA512 07b217557b1248c2e7ca1b87e7c2fba439202e212a6c287d31e2ef47dea5574e03fa0d140873772b474bb931f9653bfffe6da6a29b81285643fcfdd25fb0c2c2
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 a02573fec20e68cd26b005a4f825ca25a21d8b556c721f6ecf80351bc504a5df
MD5 d330991abad966cabd57f4d31f0c8a20
SHA1 6569cb9ccd7bed87c73e5e7c01fb13e174f91fcc
SHA512 fcc2f6163b666dcd67b43f265b0dbeec12998d26701380d84671b9247d61ab7ef3ce7a13d1bf967331ac097542b769aa377bdd803e2e87db506a9cb00a407adc
SSDEEP 96:fmNwrXbgnLU2KKIoYl88iZRy7Di+6Msmde2IO5oL/jVhYtjEsXt0/cg2Vup:fjrMnLUXf88syy+FjCotjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 e919ef3c6563d0103a54f162db8738bab3aff62cd8b2a4fd94293209e4bdc949
MD5 b78d1c9d14a1d87187a6d8bc8d34c470
SHA1 16f7b51de90d3efe27392694a96c53bde0c73c2a
SHA512 278357cf17c286a1a46c73fff8925f1367982b2e09189634ee6efdd9b195721e18ef7a9ecafd35a1681e250fc620d7c9099891152accaad94e1daf96bb9b0ec4
SSDEEP 96:fBNfwrXbgnLU2KKIoYl88iZRy7Di+6Msmde2IO5oL/jVhYtjEsXt0/cg2Vup:fErMnLUXf88syy+FjCotjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 0e890fe2b4f363197e06922afbd072e550cfa99a73c790bdc1f3f1db57cc7c42
MD5 05813bb175489844fbcc200563d36644
SHA1 7c2b0f47ab03d1d52b39099b5eab47fad7a29ea3
SHA512 649b3b6ab879154e8d3254a3952781d91bbdf339df93657e368cdb9d05a21e7c3e7487720b1efcb5d3ee5685d950ab8d250639a9a9d52d5f2fa52aabe52d6d6c
SSDEEP 96:J8mNfwrXbgnLU2KKIoYl88iZRy7Di+6Msmde2O5oLuuhfVhYtjEsXt0/cg2Vup:J83rMnLUXf88syy+FH2tjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 128KB
SHA256 005c4fb511dfcff3bee98daf856018982a7d2cbe931cfbeb4a1f2bf72bed9c15
MD5 b7c1de2a6346233bd1bae6c42d65f673
SHA1 cb39a0223dbd18f37d5ca93a8ce1e3ea57cded38
SHA512 3526f166699e5f62405be06a283fb37aae8115bc822402c94471e9245eed96865ae99e14df007220d19996aebd664ef280f8adec90d3ab33fea36e0fdbd5dae1
SSDEEP 3072:XK+4Yb3E/NdvXCNpbMhZGBo4DL0penxA5akNbef2+ZY:XKlASNdvXCNpbMHtCMpS4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 128KB
SHA256 4e574d6d709e0fc77b5c7e2c41938259ec3b236dd484a5ab7b3c69485414794f
MD5 eaa0a0530f82e4d26ab766e2567e1252
SHA1 1b22c702a0afdffa01c6c3148ead4091f3397b84
SHA512 f6129eaf59cd7d6469a47a38b27d9a51b0d82f3c00a521b6fd655a512e5f78fa6f44913e4779ec293ccde61b29f622e7619f12c315ec1682b220581bf4b3b6d3
SSDEEP 3072:XKt4Yb3E/NdvXCNpbMhZGBo4DL0penxA5akNbef2+ZY:XK6ASNdvXCNpbMHtCMpS4
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 8d48e4e53cc72529750c56ebae2e71fd64f1216bfaf3fe74d78a27853f6f7f8f
MD5 d2e7fa849a764875811a60e11d8be5e5
SHA1 5b5d363685211efd4921ea432837d0a35a9ed747
SHA512 4fd99813e04a1c332a01ed5cb1f7c0fb996e7b45eb3b28668e5b84c0aaa1b7dde68eada3294527536014261c909ea41916610989a11ee95e9d2f5a5b3f84b859
SSDEEP 3:MsEllllkEthXllkl2zE/l+t:/M/xT02zVt
MD5 SHA1 SHA512 SSDEEP

Submit Download

persisted_first_party_sets.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

deviceId.txt

Path C:\Users\Admin\AppData\Local\MinecraftInstaller\deviceId.txt
Size 36B
SHA256 c3b6bd3fe239b5ea8e65fb98b7d0a40dcfbd958fb9e10881cc8a3b6b17d2aad9
MD5 a6f7b2b2dc67ec55492f4906150b101e
SHA1 ddba8327c72d304a52384d750fe7c7733d83b579
SHA512 ffc13af62e3353b664c603503db33afd108596fceb4f1d0c395bcbdee1fd515af9a21223a00fb1968fac4c427f7cfc7b2618dd86bfe1395dd3fc70ec1bb80e87
MD5 SHA1 SHA512

Submit Download

wscollect_gr.cab

Path C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\wscollect_gr.cab
Size 1.1MB
SHA256 7ede3060bd812b9927ee05f76aa114ec5ae96fd442a312d0ee296be7c09aa35d
MD5 f9840ae11b163b08722f992068443e5f
SHA1 be4cc9564c57873cd155d6bcf045a2aac5b4cce2
SHA512 c3c07075ef882f22d72ccdb05712d10d17c52cc7deb586ec9273a5527328e3998d7691ae9e76aa38f1d114061c13a27049a5c8b80414efdeb2f1338c59747ed8
SSDEEP 24576:W/j+p1GxDoJ/ughrc8Dv7GhSP2cvoprWOKV3+BWK8J2Q6vajYyxRqdPXghaBMnkV:W/j+7GxDoJ/ughrc8Dv7GhIUKgBqgQM7
MD5 SHA1 SHA512 SSDEEP

Submit Download

GamingRepair.exe

Path C:\Users\Admin\AppData\Local\Temp\GamingRepair.exe
Size 573KB
SHA256 2dea72909788e997892e7219f859b3361910291eb3feb156dafa8b1ceee20c86
MD5 0d05a797214e62f36e15d2149e6f4005
SHA1 bf634ecf71e833be051672aebb5367392fee44b2
SHA512 3b5f3bcb1c54c010bcc9e19a5cbec06061fede5a2a56a730fbf920214af02bdec2c2d602bb51a800c543c011368c4eecbc5aa50fd494e719925d2a80a91283b3
SSDEEP 12288:8vRBXaGr2dkAL4s26pFQZ1HnoBw25YO6RiE+n9yu8:nGrGkAv2JO19yu8
MD5 SHA1 SHA512 SSDEEP

Submit Download

REG3496.tmp

Path C:\Users\Admin\AppData\Local\Temp\REG3496.tmp
Size 19KB
SHA256 fe1eaf31e30c93c7badce1ee9edfd533cce962b00968c41031b21eb65041b112
MD5 8d72ae9fa285e9054390ceb73142686c
SHA1 f0625380bcecbeb3d4999b739a497ffa82e297f5
SHA512 0e8afa80dd158fc4d7d5bd4f785fb0dda2df5f239c0bdb48c0cd49a0e02a2a5dffebf6b7796edeec83a1ab2f2069e30e203a8207d6cd5a45e0143d2fec5890dd
SSDEEP 384:KTamfaLoda1t36VTamfaLoda8qU55xg/5SRpHlT9rElyD9KMlfE93lfg9e1lfN96:tt3C/KcRpHBREsDzel6uXljzjljbpa
MD5 SHA1 SHA512 SSDEEP

Submit Download

REG34B5.tmp

Path C:\Users\Admin\AppData\Local\Temp\REG34B5.tmp
Size 270B
SHA256 b9532ca922a984f207d3a82499308fa038e1d78169b534b8d7fc116aefe5a05e
MD5 edcaaed49057b04d804ef38622dcfeca
SHA1 200458ae3a380983860136acca9b18d62c5bac76
SHA512 052065767b3bf96cf1314dd8c42940ace0d256eb7f536de0b642f5816dc0b5e6db3ce9a10450e9564b7c932e9261a9d78ca7929a4537646cbf7d5ee8c363b5fb
MD5 SHA1 SHA512

Submit Download

REG3745.tmp

Path C:\Users\Admin\AppData\Local\Temp\REG3745.tmp
Size 984B
SHA256 30f2ff59845e47a733612305dc4a269dcd6b43f7f73522459f53c156bcfe7bea
MD5 fc661158d7461574321e05f90b28853d
SHA1 fa6a6130b02e6e9608593e396afb926b469c48cb
SHA512 df0534dca78b8f812f9e4e481f2fd87a4c79ff6cd1deae9d045f6e1afed00ef00d0fc15cee22b30e3ea71aa03b9322d87a04335d6c8a9c08b5c19b87e09f4937
MD5 SHA1 SHA512

Submit Download

REG3784.tmp

Path C:\Users\Admin\AppData\Local\Temp\REG3784.tmp
Size 336B
SHA256 6f9fae20e0186b6a5b6946538d57b4ded658ab804f72e6e385e9ee717cfe3fbd
MD5 c3047ec19fe673d02a9d74d9a9d4deba
SHA1 87a9a959f02252fb5226333fe7b197aecc9dabb5
SHA512 3c65a1fe5ac2f3418dd1acc74e671dee1caaef5b44b1843f522670640fc09116db58e968274cdee461f9776bfbd60684628613680d2d71fa9d24fdf99c85d33a
MD5 SHA1 SHA512

Submit Download

REG37B3.tmp

Path C:\Users\Admin\AppData\Local\Temp\REG37B3.tmp
Size 4KB
SHA256 f0ed467bb465598d9721b1d5cd20a0f5eb8f87f832439b3fd28186747a2980a5
MD5 5fb9107ab7b45b21e28eea2b7f702dc3
SHA1 106859308cb986e696826cfa13914a176d81fbb5
SHA512 02469f2a0aa260907db796d62c053e88f43c8506db7d2f7401423a63b1d1fc27f9d7fb1032d26d8aa18246188e3cdd5fdde9185804eb6ed1ec6d9dd793aeb3e4
SSDEEP 96:0A195FI5ikkzxI6M26cGcgzhf6Wa1J6669mTHGvQwAmMny+RX:T525ikkm6Z6ugADGvSVX
MD5 SHA1 SHA512 SSDEEP

Submit Download

REG37F1.tmp

Path C:\Users\Admin\AppData\Local\Temp\REG37F1.tmp
Size 3KB
SHA256 ee54546cbb77fcceafce4512d66959e41e47ec6e3c33783449480ff58d0e983c
MD5 f4ff9d47326e805b9308b7116cc606b4
SHA1 c39441dfb33118040c570d6f500c2ec85a05726a
SHA512 ea30add7c5e02fe59f2e749bd77744c7d0c2359c9cc56044c13efc35b980235d0af9af3d37b9145f527895b5a9a765cb23f76d205be6861d96d15463d11de737
MD5 SHA1 SHA512

Submit Download

REG3810.tmp

Path C:\Users\Admin\AppData\Local\Temp\REG3810.tmp
Size 2KB
SHA256 57f371fd483248168ac42073fd011d5c7e9508424021141392e7744d6a866f9f
MD5 95eb2b67dbdb5a6ca28b7851b9164bab
SHA1 e133970ffc67157cbd5ff5cbb4d84016f5589414
SHA512 09512cf13a561e7f42341a379001ea52b1064b410afa7b20eb701459fbb0dda20e4dd461500c936990a0b9ea7c923f305bf9fc8f2d1e3d852a03a11ee420c3dc
MD5 SHA1 SHA512

Submit Download

REG383F.tmp

Path C:\Users\Admin\AppData\Local\Temp\REG383F.tmp
Size 2KB
SHA256 9d904e9d31f8bc5c8ea110a0d02b4980c8629d0e264ef9f09d5767caf9490db6
MD5 e83d95e7aad67441146d23386a797e6f
SHA1 8e6ec3a85d53c449dd93bd89166a737093021238
SHA512 853fc707ecb96c4cf779939d9fe58156885960fb55176072aed947bb96e446d3f1c2f958dcd450a49cb8d0dc3d2fef0080deb25b9e35e9fd25c650c8f9ffb347
MD5 SHA1 SHA512

Submit Download

REG386E.tmp

Path C:\Users\Admin\AppData\Local\Temp\REG386E.tmp
Size 3KB
SHA256 89eb956a0ac5a7ebd558eaaebe485c87c40c47baf1954b272b26b0b8724a6352
MD5 f90a03d152e8202c3eb57c6e6eb710a8
SHA1 cab5b11304ebbb9a1ca9c191fbc737082bcb49b9
SHA512 2e3e8c359ee1b97e5a01aff6192fd39236f14cd75812fb9ec2488e938c52db294c859062d89b84f6593d3c492d310fe6b514df235b52dec189e7b62e02bd86fb
MD5 SHA1 SHA512

Submit Download

REG389D.tmp

Path C:\Users\Admin\AppData\Local\Temp\REG389D.tmp
Size 3KB
SHA256 8975303228de2bf10d7a55bfbd591bce14e4a124910265eefbeb58229347268c
MD5 cca36a379e81a944c607e4f4d544c565
SHA1 d09aef7d6cf0bd140f121a85ae2b92307119db89
SHA512 8a851c8054c694dcf0b942550de764915f0c860277f910fa0fa6d66962f7e6c7a7c8498a0abd55e51e6725fb585820a957c079351883429242e4c0abf7f79158
MD5 SHA1 SHA512

Submit Download

REG392A.tmp

Path C:\Users\Admin\AppData\Local\Temp\REG392A.tmp
Size 653KB
SHA256 f99f1eacff516d6a07d3ef9c02a482441f2f68f18f838069d4feee667627ffe7
MD5 8d94dc993c0256ac89a318c9a3b5ebaf
SHA1 c1b8dccf9272f228377bc7c8a7e1b1ddc3658268
SHA512 0dc5371c007236e3580473e90eb6cc5b8f080cf5ab1dc5025e12d17d7485001d3b1cfaa1e5b953094e0a3133f0607f174a605f869027928c2e8fd0053fdf8767
SSDEEP 1536:lujCjNQNRN4LNznB/35frFzs3eM3iRG01ofd:ls/M4
MD5 SHA1 SHA512 SSDEEP

Submit Download

REG3B0E.tmp

Path C:\Users\Admin\AppData\Local\Temp\REG3B0E.tmp
Size 4.7MB
SHA256 430b9bfac27720ad317bcb07aa870a22b73d721dca7469642599f8445b48bb7e
MD5 bc33814df38fb092edb9e2e0b82dd6f8
SHA1 4eb2d2c8f71029e10267fa2b9fe38b9ac22853d4
SHA512 c9ad02b2a01443f7a1d64f443242f518f576d5da3268b4e0cd355b95567bbe5c0d1530507104b49c79db6514c41624c3854f386ec0853ad01d96d32549a0d1ba
SSDEEP 6144:e+fBMObjYIfuolMTzKgAuUekScwpqvo6yamg1KSeU:V
MD5 SHA1 SHA512 SSDEEP

Submit Download

REG4C73.tmp

Path C:\Users\Admin\AppData\Local\Temp\REG4C73.tmp
Size 435KB
SHA256 bdaa1f87d20547be372a20c8e77552ec4f283a7a83df82b284ce5bf6221d8130
MD5 527fcc424afdcf06fe860747563aec33
SHA1 177e1fc723fcae79afc13d8bd8b83305c9bbbecd
SHA512 1f4574eebd93bed2b6fb6def45e53ce955e8886e2521c948fbb2d6f4c552342b2968d6274c7a627743ab393aa8905c1a76e50b2d8d41b60489e687a092ad057e
SSDEEP 3072:/UCxQQobA5LQWCVqqTb0TLkfCwXXWb5GLpE:T
MD5 SHA1 SHA512 SSDEEP

Submit Download

REG4E86.tmp

Path C:\Users\Admin\AppData\Local\Temp\REG4E86.tmp
Size 15KB
SHA256 f1e7d778dad3934920124e847292ff56b1685ea82858bbfa2f05c93cec9ac4be
MD5 ed41a4a329887e6d086cf10c6ecbe0bb
SHA1 11c246763c8e491dd7706cf6f7d7d19095c6ba6c
SHA512 175275366c3bed817c2f8eb40494d5596487d8587760f7f05942345c09dda7c71fb8bb557b34b7e5c7d740bd9aed8647000059df1eb8b79dd19259cc38291fe9
SSDEEP 192:pr6GdGsPkVpk68+YXKYX2aG2qqWVQVsVeVCfYs3f9TS8dxIxkvfpr3KX13MuZpnO:oieKmEsZ/
MD5 SHA1 SHA512 SSDEEP

Submit Download

REG4F52.tmp

Path C:\Users\Admin\AppData\Local\Temp\REG4F52.tmp
Size 740B
SHA256 f787f543d052d4000d007bdcd71bb6b7024293f2ad2d543b02b4121b1da3ebf8
MD5 5b20f739acefbfc6237c04f216466883
SHA1 738af05cf8a177e14726ae4c4affc6d9b94da6a1
SHA512 c82cf736af02ffe5e76b88d802e7800787826bbe5cbc59b64b4f77f9ff1168f9ed43a9c68e3a9d13407e38f16822755660d359b42ae339d0d2bac754f192651f
MD5 SHA1 SHA512

Submit Download

MinecraftInstaller.exe

Path C:\Users\Admin\Downloads\MinecraftInstaller.exe
Size 32.3MB
SHA256 9c00e8dd5a6c9a8d22a4ae2e5a8bdeecf73b7ba6dbe12e787e5e8bf9bbb0c1c9
MD5 cfd9316537bf9aebd4c98e4939085948
SHA1 2b2e14d098308c0204ab57f4c6abfb230ae19762
SHA512 cb9fd36106b915811bcfaaa4359ac2cdd8caad562f4954b9cc21b09b60111c0fb3d2ce06714d0de5339ca7fd62cc658c494b873f4a7062e309746e6a92552975
SSDEEP 393216:kbekuyo9nMK50UGRXLePuq2ZWy/c5zFviMKe2OHmwv9CsTmsueFFza9y5:/Zn/G4Gqk1cWe2iTVCMue3X
MD5 SHA1 SHA512 SSDEEP

Submit Download

dberr.txt

Path C:\Windows\System32\CatRoot2\dberr.txt
Size 19KB
SHA256 f58e80325e1e92430791a0eb66b56579ebec92163154adaa46f0d1d733eb52b0
MD5 84dc36e4fe468e65573e18608f15191d
SHA1 30fdc1f8658a364509dd2426048ecbe4ac62c770
SHA512 5f199a946ef6ff4235d3c0c9c0eeedad11f096eb31df37d7107a615fbc06e1231dae3d1da9d7c8dc12942102c02071982df384f49ddef1afee3e8d6f661b15a9
SSDEEP 384:Lq53JDHInepP4+AmAg/lKnUncnvngnAninan+ns:Lq53JDHInepP4+AmAg/lKUcvgAia+s
MD5 SHA1 SHA512 SSDEEP

Submit Download

dberr.txt

Path C:\Windows\System32\CatRoot2\dberr.txt
Size 19KB
SHA256 7480ebb2816ca9dfc23c83c90466679b28f88ae7bd45215efae1c8397d65affb
MD5 3cac61f14b9d360c9a38c45d284d9ec4
SHA1 c73d0a83bd0cd0a95035f2bfa796cb189dd7dc4e
SHA512 94a07f054e2c96b0528a65ff60324ff8634a3b3cc2ec86a03dcb8f0845eade6590f05c311de46e9f16b86a2bd0e8fcaee841f6a5b3f4b288ddeb83a297e62757
SSDEEP 384:Lq53JDHInepP4+AmAg/lKnUncnvngnAninan+n9:Lq53JDHInepP4+AmAg/lKUcvgAia+9
MD5 SHA1 SHA512 SSDEEP

Submit Download

dberr.txt

Path C:\Windows\System32\catroot2\dberr.txt
Size 19KB
SHA256 ef44d670209b47625f7928598e4810486977c166bf657ffff854487d076d0cdb
MD5 023f0a4cd19c24b94db7f8ad5b9f617c
SHA1 d53d80909d5b97f93073c07f11c93847a2200c65
SHA512 5f2a930f122e7dee78effef6ee136a141566a68527e15272da3c92180378a4a5f4368b04cdce9a33db4f36618a2f7e5b4bcb9e310971f8b199d8f7ee26a27824
SSDEEP 384:Lq53JDHInepP4+AmAg/lKnUncnvngnAninan+nu:Lq53JDHInepP4+AmAg/lKUcvgAia+u
MD5 SHA1 SHA512 SSDEEP

Submit Download

gamingservicesproxy_4.dll

Path C:\Windows\System32\gamingservicesproxy_4.dll
Size 257KB
SHA256 2d213bdec6e2302383f8b9a34b7285a8c3442f2aa9366925d3c1d32f260f8d46
MD5 f8dd59aa7409cb3adcef54f2ef4e5d29
SHA1 b1d74baadeddbc8552cc0b6ca8d85a744f2d3a63
SHA512 995a8db3e2ec91618731e1b2caf17a723af34a76e02ca9951a68af205632c81127758108e9bb444e5080fa5424cec47fa4e10ab89821e1302ec52aa8639b2ca4
SSDEEP 3072:oKupn+7MTjsoGFcqSkAkwYMIkhMe3szyEr8do7q5i/CblAx56B:ygHr8doxh
MD5 SHA1 SHA512 SSDEEP

Submit Download

xgamecontrol.exe

Path C:\Windows\System32\xgamecontrol.exe
Size 73KB
SHA256 4856fa531e8b55ead74fcf675d9434a4cb561d57ecdc3bf4137fe090613088b8
MD5 286ca9b9f0bbb0725fe24ecf4ec82648
SHA1 e72cd9b138d56411fd39d9aee26ca175b52fdbd8
SHA512 214fd3ebc99cb0bc0bd4f30654f5c73dbcf8d1f3490588e4390de4ed2dbe34a75992faccafcd482c7e11ecef51c2cc079c0054ff22ed1e038bf837e322b88f23
SSDEEP 1536:gdDPvsRExNNB7Rrfl803W9I+e0tQiw3sF93zn:gdDuOw0udtQiw3sL3L
MD5 SHA1 SHA512 SSDEEP

Submit Download

xvdd.cat

Path C:\Windows\TEMP\{285D2~1\xvdd.cat
Size 11KB
SHA256 53efbc86e332e032acb4aba6313e0a77014f3c7a2b7344967c73dde30553fa0b
MD5 ca50f20dc7773195451eeedf0a407241
SHA1 28c59745bc26132f4dbb909e2e59fe257d1c0ab3
SHA512 018a905381e8b08991b71dd44d28723be9246e5ae67d8a800fea0aec85ceae9825e05f4f02365d1c5842e5cf0ef66315290dace0c37c2f2b6254a55937ca9d18
SSDEEP 192:L070d090LunEwKUNhYCmmwKUWX01k9z3Akj:vUNh3mn2R9zzj
MD5 SHA1 SHA512 SSDEEP

Submit Download

xvdd.sys

Path C:\Windows\TEMP\{285D2~1\xvdd.sys
Size 631KB
SHA256 7a06e38a169e7d21931bc079678d794f279cf12e30dc684f1353cf46c1c96db8
MD5 f576b88f3eb7be5744d688a8cd68a81a
SHA1 6680c70bae39762f9ed527408b29d96a132f77d7
SHA512 cf328a75b6aaa608fba2ac67218b55ea524241a29e82cbd6f45a372898390fd6cdffb73214e63f085ca589760ad865721f9390a9b164289d926ec95c8c97c99c
SSDEEP 12288:wykKgErovCOGHkshrzwR8Ql5yG22xeN5exg/91voIqmeHgE5YBCC:wykKgErVOUThHw35v7xgEe19oI5eHgEc
MD5 SHA1 SHA512 SSDEEP

Submit Download

xvdd.inf

Path C:\Windows\TEMP\{285d254b-6cda-f141-8d26-3366fe0034ed}\xvdd.inf
Size 1KB
SHA256 c5a51d2e482b771aff6583f216f13a89e09a821a5ca999ac9ae5f797b3f18f6c
MD5 1691b1971cdaf80ccb96a7a21bb9f163
SHA1 d0d8a8ae5a9a2000db9036c5e5b210bb5174a258
SHA512 e5024c358415cbd100ba075aa726380d2eb812e98dac1900a0d8116af932de0f3bee531b4332272c31916b8633a63ca2b866059092cff882f049102a779d3b53
MD5 SHA1 SHA512

Submit Download

gameflt.cat

Path C:\Windows\TEMP\{480DD~1\gameflt.cat
Size 11KB
SHA256 deae4d1cdb21f903d647e829b954bc377ea0e8a1091284fadb260840040c001d
MD5 a154584de06337d66ba81acfb5ca536c
SHA1 73ca8490d085647cc893ac7929413fbc8417e4e3
SHA512 5232c7328827c0a47f3082ec2361df18436952fb706fab7ddfe7f84fa0421e19d13daf0a58fe0622dad594274e57bcf5924f0a17a5dbfe87b969eb80cca6056a
SSDEEP 192:ZEdVmpJCnnEwKUNhYCOd8TTwbTseUfX01k9z3Af9dRaI:Q+PUNh3a8TM/6fR9zQ9GI
MD5 SHA1 SHA512 SSDEEP

Submit Download

gameflt.sys

Path C:\Windows\TEMP\{480DD~1\gameflt.sys
Size 163KB
SHA256 831945a8ba5dbd549b4f7bd77cedf12067bf681236617c78806e4bc028a55817
MD5 0d250e8c78c5d69e8e27e5e405255ff9
SHA1 17699e809cb57569a36c60ea83c419f8f94df173
SHA512 955634aaffb52d516b372801d4564a63020f7cf15241860dd7106f013c0a1f8ece40062221e2d6aeb0a153a5280cf8fa9cbb1cb87b614fdff9227ec8fc394654
SSDEEP 3072:gaxBadyEYQ+mUtjQLdu1lc/wrec7PLZTSdPDZ4pFtdOauLHYKe5/GTxGcEeRvsEQ:g2Uv7cKe5/uxhEeOXQk
MD5 SHA1 SHA512 SSDEEP

Submit Download

gameflt.inf

Path C:\Windows\TEMP\{480dd0ba-08e5-9a49-a188-36d3822a49e1}\gameflt.inf
Size 2KB
SHA256 123e5bb3d295695376fa8e8853e569d224e37d4233bb6498acddf9ee10ac2a9c
MD5 1948952bfc631e3a7d38a264e025bd2f
SHA1 076b1622eadf10a42cd291ab5ddabcf10c8a66cd
SHA512 cf59794afe7b9b6ae397a16d6134eec3b23b15b770491603ec1ec5e88291eb28caf7800205c5d243385b02992c6c9f59b87faa2375d5571e901e00da625e4b00
MD5 SHA1 SHA512

Submit Download

gameconfighelper.dll

Path C:\Windows\system32\gameconfighelper.dll
Size 213KB
SHA256 fe1f6b2bfccc4046504fc331513ddac7e1ee2a32fb5b345c30e763b34c7b9167
MD5 5bac2ec1b1dc5545982bfaa196aaf6b9
SHA1 f780cceea71510688e12ecd318189b60ee0e9ee4
SHA512 4ecc9c4d9a8bccf1b6822fd1d81c5b37ef27576abac38a2e20456a2e6b7a913344b0e49536327476f71f96e2106c6502ce158791462bf6c7563b3e0d9e45d0fa
SSDEEP 6144:Y9wGkP6His1ZzIf7zw8ueB9cODUZcY0QYqQIACZ:ywGkY3Ef7zUeB9cOe
MD5 SHA1 SHA512 SSDEEP

Submit Download

gamelaunchhelper.dll

Path C:\Windows\system32\gamelaunchhelper.dll
Size 201KB
SHA256 278b8c797e8be1281ede8cce906c9b3b42b67781ab2b47d6899858c6a70944a0
MD5 b579daa381750044403a6ef4364cdec0
SHA1 793baf456300afc7d9994215715a2700ab2c5704
SHA512 eff2f2d9ea7c4d15ce21a24d8021c38b8619789f665e52206cafd50ac253b79b5ed1a8908b324a939e6ab0dfad9c42124488a56d812b230a73867507b9be039d
SSDEEP 3072:gQLOr004SKYqAHDOmLs1YDO7KKr4hUtIAKvfRO4dvNiko3LKFTU9YUz2w/3bOhXq:RLk00EyHV+YKdr4ytanw4dAk2Jia
MD5 SHA1 SHA512 SSDEEP

Submit Download

gameplatformservices.dll

Path C:\Windows\system32\gameplatformservices.dll
Size 689KB
SHA256 4fb00347b233f384c873af647a6dd422392406effff29924ee6dd6ecb6fc2dd4
MD5 0d60221c66317a5a0f15c09bce5234bf
SHA1 dc970dddc2ee6d95f96bc7eecdc82f6ebaab4cd9
SHA512 dc7cb0a24b3f7c83a60bf0ed53f71310045b4d07c07adf05202a2820dad23b55b7ca21b24cbbd49fd5ed2c58c27277358bc08e6353758441368500aa1f81d684
SSDEEP 6144:syqbCohnVIWwTFM0W7/bY8c3rxE+QV+XWLL5puwuoh9b+RM92O4uW/dSpWnF0hv/:s3CohLwJ38TdqrxE+QViWLNQuhcAtll
MD5 SHA1 SHA512 SSDEEP

Submit Download

gamingtcuihelpers.dll

Path C:\Windows\system32\gamingtcuihelpers.dll
Size 141KB
SHA256 2e17f2545917395fa8bc37ddd530e6e12274f01001ab8d6c3409d6e24176f8ad
MD5 0cac1cb0d4a46665a3d32b4046b1c72d
SHA1 6095eaf9a8400f4d02aab786813f00500d18c1c6
SHA512 bcc6f562d65eda85e9f1fe854f7e54af171c5ba41a00a431bf84931cdbf0eee0d23e9fd131ed51edef63bac19651e3e5fc35de17af61cbf5a25087b3b3c16a85
SSDEEP 3072:S+uzN/4lMrMdxhGRPvgpqpsiu/HMH+R7x4ES7LJENKIR/RdTRalpJv9aWN0/PTh6:S54qQdORXgpqqiufavxUPT8
MD5 SHA1 SHA512 SSDEEP

Submit Download

xgamehelper.exe

Path C:\Windows\system32\xgamehelper.exe
Size 105KB
SHA256 bbde98ae75e1b632e40a71bf4ceb47b0a15cfb14f73a0d47da0ab86c9c0106ac
MD5 e8dca163e84b8b4747c76229cf11afe3
SHA1 a5a69695cea6adaf5cfc958841d05e118738c6f5
SHA512 4e11813bc233c6b64fd53c103976765e11801538d2ba69bc3163eb135e105fb174d9ea8e41c37e1ad3d7459bcb049b9b56a25040f400fdb77947ddd698336df8
SSDEEP 1536:JYLbr10u2KRc8Ktgvt8GCCvRu7zPxDhW4gK3qtb1u02lqbzU:JYLaKDKqCFxDrguq51MlAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

xgameruntime.dll

Path C:\Windows\system32\xgameruntime.dll
Size 2.6MB
SHA256 a6d44c687a58b31dc1a73cfafd47a5812237966fbc0bc7a738b55572c0a98c9a
MD5 ab0cbcafabaa513601c10999a1d7f470
SHA1 3d8c796faa4896f4caff28dd4d3f20529f24f544
SHA512 23f463ee066ae647e8d17e2e57d67bd9c71dd9c3f279a360ed61452dc7aed97b6086d2848c328fa3765503563188308c2495fc019c62248d7ced02f693b63bf7
SSDEEP 49152:7gy+4pcoDe39BZvzBJJRMCXoIuz5+jRZstV:C4pszvTw
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/8-271-0x00000265144F0000-0x00000265144F1000-memory.dmp

Download

memory/8-295-0x0000026514740000-0x0000026514741000-memory.dmp

Download

memory/8-294-0x0000026514630000-0x0000026514631000-memory.dmp

Download

memory/8-293-0x0000026514630000-0x0000026514631000-memory.dmp

Download

memory/8-291-0x0000026514620000-0x0000026514621000-memory.dmp

Download

memory/8-279-0x000002650BBE0000-0x000002650BBE1000-memory.dmp

Download

memory/8-276-0x00000265144F0000-0x00000265144F1000-memory.dmp

Download

memory/8-273-0x0000026514500000-0x0000026514501000-memory.dmp

Download

memory/8-270-0x0000026514500000-0x0000026514501000-memory.dmp

Download

memory/8-269-0x00000265148D0000-0x00000265148D1000-memory.dmp

Download

memory/8-268-0x00000265148D0000-0x00000265148D1000-memory.dmp

Download

memory/8-267-0x00000265148D0000-0x00000265148D1000-memory.dmp

Download

memory/8-266-0x00000265148D0000-0x00000265148D1000-memory.dmp

Download

memory/8-265-0x00000265148D0000-0x00000265148D1000-memory.dmp

Download

memory/8-264-0x00000265148D0000-0x00000265148D1000-memory.dmp

Download

memory/8-263-0x00000265148D0000-0x00000265148D1000-memory.dmp

Download

memory/8-262-0x00000265148D0000-0x00000265148D1000-memory.dmp

Download

memory/8-261-0x00000265148D0000-0x00000265148D1000-memory.dmp

Download

memory/8-260-0x00000265148D0000-0x00000265148D1000-memory.dmp

Download

memory/8-259-0x00000265148A0000-0x00000265148A1000-memory.dmp

Download

memory/8-243-0x000002650C340000-0x000002650C350000-memory.dmp

Download

memory/8-227-0x000002650C240000-0x000002650C250000-memory.dmp

Download

memory/1992-112-0x0000000006FB0000-0x0000000006FC0000-memory.dmp

Download

memory/1992-111-0x0000000006FB0000-0x0000000006FC0000-memory.dmp

Download

memory/1992-110-0x00000000753B0000-0x0000000075B60000-memory.dmp

Download

memory/1992-88-0x000000000B7D0000-0x000000000B7F6000-memory.dmp

Download

memory/1992-87-0x000000000B790000-0x000000000B79A000-memory.dmp

Download

memory/1992-85-0x000000000B050000-0x000000000B05E000-memory.dmp

Download

memory/1992-84-0x000000000B4A0000-0x000000000B4D8000-memory.dmp

Download

memory/1992-83-0x000000000AF80000-0x000000000AF88000-memory.dmp

Download

memory/1992-81-0x0000000006FB0000-0x0000000006FC0000-memory.dmp

Download

memory/1992-80-0x00000000080C0000-0x00000000080C8000-memory.dmp

Download

memory/1992-67-0x0000000006FB0000-0x0000000006FC0000-memory.dmp

Download

memory/1992-66-0x0000000007330000-0x00000000074F2000-memory.dmp

Download

memory/1992-63-0x0000000000570000-0x00000000025CA000-memory.dmp

Download

memory/1992-62-0x00000000753B0000-0x0000000075B60000-memory.dmp

Download