9c00e8dd5a6c9a8d22a4ae2e5a8bdeecf73b7ba6dbe12e787e5e8bf9bbb0c1c9

Analysis

max time kernel
1489s
max time network
1451s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
03/05/2024, 06:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MinecraftInstaller.exe
Size

32.3MB
MD5

cfd9316537bf9aebd4c98e4939085948
SHA1

2b2e14d098308c0204ab57f4c6abfb230ae19762
SHA256

9c00e8dd5a6c9a8d22a4ae2e5a8bdeecf73b7ba6dbe12e787e5e8bf9bbb0c1c9
SHA512

cb9fd36106b915811bcfaaa4359ac2cdd8caad562f4954b9cc21b09b60111c0fb3d2ce06714d0de5339ca7fd62cc658c494b873f4a7062e309746e6a92552975
SSDEEP

393216:kbekuyo9nMK50UGRXLePuq2ZWy/c5zFviMKe2OHmwv9CsTmsueFFza9y5:/Zn/G4Gqk1cWe2iTVCMue3X

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
736	GamingRepair.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	GamingRepair.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	GamingRepair.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	GamingRepair.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	GamingRepair.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	GamingRepair.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	GamingRepair.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GamingRepair.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	GamingRepair.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GamingRepair.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	GamingRepair.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	GamingRepair.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	GamingRepair.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4720	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	3768	MinecraftInstaller.exe
Token: SeSecurityPrivilege	1488	wevtutil.exe
Token: SeBackupPrivilege	1488	wevtutil.exe
Token: SeSecurityPrivilege	1152	wevtutil.exe
Token: SeBackupPrivilege	1152	wevtutil.exe
Token: SeSecurityPrivilege	772	wevtutil.exe
Token: SeBackupPrivilege	772	wevtutil.exe
Token: SeSecurityPrivilege	4996	wevtutil.exe
Token: SeBackupPrivilege	4996	wevtutil.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
4524	MiniSearchHost.exe
4720	OpenWith.exe
4720	OpenWith.exe
4720	OpenWith.exe
4720	OpenWith.exe
4720	OpenWith.exe
4720	OpenWith.exe
4720	OpenWith.exe
4720	OpenWith.exe
4720	OpenWith.exe
1592	AcroRd32.exe
1592	AcroRd32.exe
1592	AcroRd32.exe
1592	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3768 wrote to memory of 736	3768	MinecraftInstaller.exe	82
PID 3768 wrote to memory of 736	3768	MinecraftInstaller.exe	82
PID 736 wrote to memory of 1488	736	GamingRepair.exe	85
PID 736 wrote to memory of 1488	736	GamingRepair.exe	85
PID 736 wrote to memory of 1152	736	GamingRepair.exe	87
PID 736 wrote to memory of 1152	736	GamingRepair.exe	87
PID 736 wrote to memory of 772	736	GamingRepair.exe	89
PID 736 wrote to memory of 772	736	GamingRepair.exe	89
PID 736 wrote to memory of 4996	736	GamingRepair.exe	91
PID 736 wrote to memory of 4996	736	GamingRepair.exe	91
PID 736 wrote to memory of 420	736	GamingRepair.exe	93
PID 736 wrote to memory of 420	736	GamingRepair.exe	93
PID 420 wrote to memory of 1528	420	wscollect.exe	95
PID 420 wrote to memory of 1528	420	wscollect.exe	95
PID 420 wrote to memory of 980	420	wscollect.exe	96
PID 420 wrote to memory of 980	420	wscollect.exe	96
PID 736 wrote to memory of 1368	736	GamingRepair.exe	97
PID 736 wrote to memory of 1368	736	GamingRepair.exe	97
PID 736 wrote to memory of 2180	736	GamingRepair.exe	99
PID 736 wrote to memory of 2180	736	GamingRepair.exe	99
PID 736 wrote to memory of 1532	736	GamingRepair.exe	101
PID 736 wrote to memory of 1532	736	GamingRepair.exe	101
PID 736 wrote to memory of 2020	736	GamingRepair.exe	103
PID 736 wrote to memory of 2020	736	GamingRepair.exe	103
PID 736 wrote to memory of 2668	736	GamingRepair.exe	105
PID 736 wrote to memory of 2668	736	GamingRepair.exe	105
PID 736 wrote to memory of 2988	736	GamingRepair.exe	107
PID 736 wrote to memory of 2988	736	GamingRepair.exe	107
PID 736 wrote to memory of 3932	736	GamingRepair.exe	109
PID 736 wrote to memory of 3932	736	GamingRepair.exe	109
PID 736 wrote to memory of 3488	736	GamingRepair.exe	111
PID 736 wrote to memory of 3488	736	GamingRepair.exe	111
PID 736 wrote to memory of 4660	736	GamingRepair.exe	113
PID 736 wrote to memory of 4660	736	GamingRepair.exe	113
PID 736 wrote to memory of 2072	736	GamingRepair.exe	115
PID 736 wrote to memory of 2072	736	GamingRepair.exe	115
PID 736 wrote to memory of 3208	736	GamingRepair.exe	117
PID 736 wrote to memory of 3208	736	GamingRepair.exe	117
PID 736 wrote to memory of 3876	736	GamingRepair.exe	119
PID 736 wrote to memory of 3876	736	GamingRepair.exe	119
PID 736 wrote to memory of 3948	736	GamingRepair.exe	121
PID 736 wrote to memory of 3948	736	GamingRepair.exe	121
PID 736 wrote to memory of 4396	736	GamingRepair.exe	123
PID 736 wrote to memory of 4396	736	GamingRepair.exe	123
PID 4720 wrote to memory of 1592	4720	OpenWith.exe	130
PID 4720 wrote to memory of 1592	4720	OpenWith.exe	130
PID 4720 wrote to memory of 1592	4720	OpenWith.exe	130
PID 1592 wrote to memory of 3608	1592	AcroRd32.exe	133
PID 1592 wrote to memory of 3608	1592	AcroRd32.exe	133
PID 1592 wrote to memory of 3608	1592	AcroRd32.exe	133
PID 3608 wrote to memory of 4876	3608	RdrCEF.exe	134
PID 3608 wrote to memory of 4876	3608	RdrCEF.exe	134
PID 3608 wrote to memory of 4876	3608	RdrCEF.exe	134
PID 3608 wrote to memory of 4876	3608	RdrCEF.exe	134
PID 3608 wrote to memory of 4876	3608	RdrCEF.exe	134
PID 3608 wrote to memory of 4876	3608	RdrCEF.exe	134
PID 3608 wrote to memory of 4876	3608	RdrCEF.exe	134
PID 3608 wrote to memory of 4876	3608	RdrCEF.exe	134
PID 3608 wrote to memory of 4876	3608	RdrCEF.exe	134
PID 3608 wrote to memory of 4876	3608	RdrCEF.exe	134
PID 3608 wrote to memory of 4876	3608	RdrCEF.exe	134
PID 3608 wrote to memory of 4876	3608	RdrCEF.exe	134
PID 3608 wrote to memory of 4876	3608	RdrCEF.exe	134
PID 3608 wrote to memory of 4876	3608	RdrCEF.exe	134

C:\Users\Admin\AppData\Local\Temp\MinecraftInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\MinecraftInstaller.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3768
- C:\Users\Admin\AppData\Local\Temp\GamingRepair.exe
  "C:\Users\Admin\AppData\Local\Temp\GamingRepair.exe" scenarioMinecraft
  2⤵
  - Executes dropped EXE
  - Checks system information in the registry
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of WriteProcessMemory
  PID:736
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" epl Microsoft-Windows-AppXDeploymentServer/Operational C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\Microsoft-Windows-AppXDeploymentServer_Operational.evtx /ow:true
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1488
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" epl Microsoft-Windows-AppXDeployment/Operational C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\Microsoft-Windows-AppXDeployment_Operational.evtx /ow:true
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1152
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" epl Microsoft-Windows-AppxPackaging/Operational C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\Microsoft-Windows-AppxPackaging_Operational.evtx /ow:true
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:772
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" epl Microsoft-Windows-AppModel-Runtime/Admin C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\Microsoft-Windows-AppModel-Runtime_Admin.evtx /ow:true
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4996
- - C:\Windows\system32\wscollect.exe
    "C:\Windows\system32\wscollect.exe" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\wscollect_gr.cab
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:420
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SIH" "C:\Users\Admin\AppData\Local\Temp\registry_SIH.txt" /y
      4⤵
      PID:1528
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe export "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters\DnsPolicyConfig" "C:\Users\Admin\AppData\Local\Temp\registry_DNSPolicy.txt" /y
      4⤵
      PID:980
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" export "HKLM\Software\Microsoft\GamingServices" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\HKLM_GRTS.reg /y
    3⤵
    PID:1368
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" export "HKCU\Software\Microsoft\GamingServices" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\HKCU_GRTS.reg /y
    3⤵
    PID:2180
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" export "HKLM\SYSTEM\CurrentControlSet\Services\GamingServices" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\GS_Service.reg /y
    3⤵
    PID:1532
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" export "HKLM\SYSTEM\CurrentControlSet\Services\GamingServicesNet" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\GSNet_Service.reg /y
    3⤵
    PID:2020
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" export "HKLM\SYSTEM\CurrentControlSet\Services\GameFlt" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\GameFlt_Service.reg /y
    3⤵
    PID:2668
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" export "HKLM\SYSTEM\CurrentControlSet\Services\Xvdd" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\Xvdd_Service.reg /y
    3⤵
    PID:2988
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" export "HKLM\SYSTEM\CurrentControlSet\Services\XblAuthManager" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\XblAuthManager_Service.reg /y
    3⤵
    PID:3932
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" export "HKLM\SYSTEM\CurrentControlSet\Services\XblGameSave" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\XblGameSave_Service.reg /y
    3⤵
    PID:3488
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" export "HKLM\SYSTEM\CurrentControlSet\Services\GameInput Service" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\GameInput_Service.reg /y
    3⤵
    PID:4660
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" export "HKCU\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\HKCU_AppModel.reg /y
    3⤵
    PID:2072
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\HKLM_AppModel.reg /y
    3⤵
    PID:3208
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\HKLM_Appx.reg /y
    3⤵
    PID:3876
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" export "HKCU\SOFTWARE\Classes\ActivatableClasses\Package" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\HKCU_Package.reg /y
    3⤵
    PID:3948
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" export "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\HKLM_WuPolicy.reg /y
    3⤵
    PID:4396

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4524

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:676

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Desktop\RegisterLimit.bin"
  2⤵
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1592
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3608
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0BC15475C8521E277B0EF521213D8007 --mojo-platform-channel-handle=1776 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:4876
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=9525AE15FC3EE95A568595C260749ECE --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=9525AE15FC3EE95A568595C260749ECE --renderer-client-id=2 --mojo-platform-channel-handle=1792 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:1068
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F9F54C28FA3B5EBD2D98A3BCFC3886FC --mojo-platform-channel-handle=2344 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:5012
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1709F4B8ACF591F195A21F060C9DBC66 --mojo-platform-channel-handle=1956 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:3496
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=96E15E4EE744C3B6766EEDED08769B0A --mojo-platform-channel-handle=2464 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\MinecraftInstaller\deviceId.txt

Filesize
36B

MD5
bff0a42662a468ef2a0c3aab50580a42

SHA1
dc42bc2d6a0f3f8429e7ceaa37bd3125894bdef9

SHA256
39c7a0aa395361d0bb7299960080af760746bf9f188e2b4deac6d5d5c6ab9de2

SHA512
2e42e82a22a04e92fb3bd753490d7bd6c7cb84cd0e14c2ddc1ec050c7aae4fc3938309d04358803b3a0dce5ffe7829cf0258689dccde777663c86851c4553b7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\StateRepository-Machine.srd-shm

Filesize
32KB

MD5
b7c14ec6110fa820ca6b65f5aec85911

SHA1
608eeb7488042453c9ca40f7e1398fc1a270f3f4

SHA256
fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb

SHA512
d8d75760f29b1e27ac9430bc4f4ffcec39f1590be5aef2bfb5a535850302e067c288ef59cf3b2c5751009a22a6957733f9f80fa18f2b0d33d90c068a3f08f3b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\wscollect_gr.cab

Filesize
518KB

MD5
00422e1b7b107c2fc46029099b871a9c

SHA1
c8372d05ef438d2c6a50c016a12a45b04317a650

SHA256
8b8aebee382184bdcb56f3ff87ea9f41777a4b512a0afdb4132e238347725de1

SHA512
7d4a019542cadbaea57645da21898a0e4abf0fc17a853a4939f3eb199aa71bc05670599a744c216fd275985361aa6faa40bbf6f1d1b2aeb5ef74ad30052811e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\GamingRepair.exe

Filesize
573KB

MD5
0d05a797214e62f36e15d2149e6f4005

SHA1
bf634ecf71e833be051672aebb5367392fee44b2

SHA256
2dea72909788e997892e7219f859b3361910291eb3feb156dafa8b1ceee20c86

SHA512
3b5f3bcb1c54c010bcc9e19a5cbec06061fede5a2a56a730fbf920214af02bdec2c2d602bb51a800c543c011368c4eecbc5aa50fd494e719925d2a80a91283b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\REG9839.tmp

Filesize
270B

MD5
edcaaed49057b04d804ef38622dcfeca

SHA1
200458ae3a380983860136acca9b18d62c5bac76

SHA256
b9532ca922a984f207d3a82499308fa038e1d78169b534b8d7fc116aefe5a05e

SHA512
052065767b3bf96cf1314dd8c42940ace0d256eb7f536de0b642f5816dc0b5e6db3ce9a10450e9564b7c932e9261a9d78ca7929a4537646cbf7d5ee8c363b5fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\REG98D5.tmp

Filesize
336B

MD5
c3047ec19fe673d02a9d74d9a9d4deba

SHA1
87a9a959f02252fb5226333fe7b197aecc9dabb5

SHA256
6f9fae20e0186b6a5b6946538d57b4ded658ab804f72e6e385e9ee717cfe3fbd

SHA512
3c65a1fe5ac2f3418dd1acc74e671dee1caaef5b44b1843f522670640fc09116db58e968274cdee461f9776bfbd60684628613680d2d71fa9d24fdf99c85d33a

Download Submit
C:\Users\Admin\AppData\Local\Temp\REG9942.tmp

Filesize
3KB

MD5
f90a03d152e8202c3eb57c6e6eb710a8

SHA1
cab5b11304ebbb9a1ca9c191fbc737082bcb49b9

SHA256
89eb956a0ac5a7ebd558eaaebe485c87c40c47baf1954b272b26b0b8724a6352

SHA512
2e3e8c359ee1b97e5a01aff6192fd39236f14cd75812fb9ec2488e938c52db294c859062d89b84f6593d3c492d310fe6b514df235b52dec189e7b62e02bd86fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\REG9961.tmp

Filesize
4KB

MD5
69e42af6dd17dd12807346845f3f45b4

SHA1
f4bb8308b1b0cf85d839a5c1a15e66cdfa6b7bed

SHA256
ae73335488645c425abdcc7e75fe9475a86007b1bdf737c203958737aaffd657

SHA512
8f7233ea2cb7bd1fbede375dd3e76493c559ca56ea82c3b2f1a816ea4152dd1b1ddfed49fdde463670f55e02d952f980482b9c90b09cd90efcbe1c64b981d2e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\REG99A0.tmp

Filesize
338KB

MD5
17daae942c227172d14b244cf5993ff9

SHA1
25a66bcdd32b64f829b113539611d8b4fa69d3b9

SHA256
5b27ccd79079505b18a7f09a99183c38d26c1569cdd9d709785f7abdcfeba4c2

SHA512
5687b26833ae32ba82a04992f54aa93bed161514e870469470d2b48b65cab29b3ce9bb4492d14ddc3bcfa561466891ec2ffca72dd491257f74e81048ce2b3a0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\REG99DE.tmp

Filesize
5.1MB

MD5
fadb63a0991e8eeb413522962b67e7f6

SHA1
c3e6e6ad03cbd39dd49f2d1bc82fd43c92c54d2b

SHA256
7dac35dfdea928ad60e9e3723c742c50a7dae04c6f282a0bb06b1e63508e004d

SHA512
c66bdcf7f9c636fe9f64a17f36034377fdd8e6f22633116f5964c3f65aa8079f8a8302d11a81eecb5449c716fe45d8cf78d0f6a0037a17dea90fd60203fbd049

Download Submit
C:\Users\Admin\AppData\Local\Temp\REG9D3A.tmp

Filesize
223KB

MD5
2c08677d2d426900b48cc55751476c05

SHA1
73ee3b0eb6c02aec00e3413db50529cbd341ba00

SHA256
70155927832e8e5db0439bdaa476bc45ffbcf7df0b87375242eb3d693197c017

SHA512
829ae52fada470a5d55f6a201f53b8c43f6f632ec1411d51c03d9bff8ad434706a931ba646f4810f2fb6517a342925c353505f94eea9729e3efba00779a6268a

Download Submit
C:\Users\Admin\AppData\Local\Temp\REG9DE6.tmp

Filesize
11KB

MD5
1074b933cbb7e1bd3307132521016447

SHA1
7afe40a546be08ba4ad72d42a923ec38eadfe3c0

SHA256
f9175d5338a39d156e5cc346e4e48f5a97e89a8dbdf6df182fcf2facdc9fad8a

SHA512
449d19c7ce940dc7fe5c4ea37e6e72938ad2923836fbfc9a82e43b0712694eda9ba7c79a7a7976ee613f1f9acfe8e3f17f5a9f492bd02f90b25775b21cd572ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\REG9E15.tmp

Filesize
1KB

MD5
4c5e9e7a8ef25fb62d96aaf7301debb8

SHA1
627886ad333a5cc194488db08f87f61c0bcd96e0

SHA256
dd53cc58d05fcccf0e070c7724fbf78e1827048124a94cb9684d8865a72e7bea

SHA512
4d8588939fb4e7a6a2b95539ef2493352e33f1dd6781c9f7c50eb717259704ddd44b2b5b72dd67f96517b80b7fdd159991887f778ae6150d4232b3c496c6194a

Download Submit
memory/3768-0-0x00000000751DE000-0x00000000751DF000-memory.dmp

Filesize
4KB

Download
memory/3768-10-0x000000000BAB0000-0x000000000BAE8000-memory.dmp

Filesize
224KB

Download
memory/3768-8-0x000000000B4F0000-0x000000000B4F8000-memory.dmp

Filesize
32KB

Download
memory/3768-7-0x00000000751D0000-0x0000000075981000-memory.dmp

Filesize
7.7MB

Download
memory/3768-5-0x0000000008650000-0x0000000008658000-memory.dmp

Filesize
32KB

Download
memory/3768-13-0x000000000D630000-0x000000000D63A000-memory.dmp

Filesize
40KB

Download
memory/3768-11-0x000000000B550000-0x000000000B55E000-memory.dmp

Filesize
56KB

Download
memory/3768-9-0x00000000751D0000-0x0000000075981000-memory.dmp

Filesize
7.7MB

Download
memory/3768-14-0x000000000D670000-0x000000000D696000-memory.dmp

Filesize
152KB

Download
memory/3768-4-0x00000000751D0000-0x0000000075981000-memory.dmp

Filesize
7.7MB

Download
memory/3768-2-0x00000000079C0000-0x0000000007B82000-memory.dmp

Filesize
1.8MB

Download
memory/3768-1-0x0000000000B20000-0x0000000002B7A000-memory.dmp

Filesize
32.4MB

Download
memory/3768-156-0x00000000751DE000-0x00000000751DF000-memory.dmp

Filesize
4KB

Download
memory/3768-158-0x00000000751D0000-0x0000000075981000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads