6722db26bb76c7b4f3ed4824f792005c8633dda2987f78440bf6be3bdea4807c

Analysis

max time kernel
138s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-11-2024 01:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SHADOW BP + HAX 3.4/SETUP/Clean_Gameloop.bat
Size

7KB
MD5

08e7d6aa12dd9e5326c95d48a39fc78c
SHA1

4cea4dc3fb778210b40ce7dda1f6d40184417155
SHA256

8f10f13dc60a2389ba5777932e9ed8ba746fad54231054cc5c91344c95f4dee2
SHA512

9ef6b53ac16e8f4b743d848b5e99a9f10eb16072569f04799ea69f1d7f20ff634e78b360ada717483a2c458638e3ed78acede7ac6ad87dd7dfd7165d275e17cc
SSDEEP

96:CSZyzyd6fHlzcZRcZocZ3cZOcZEcZVcZ6cZTcZXcZ8cZlcZCcZocZLcZ+cZC:ZcWJ

Score

1^/10

Malware Config

Signatures

Kills process with taskkill 50 IoCs

evasion

pid	Process
228	taskkill.exe
2624	taskkill.exe
2632	taskkill.exe
2480	taskkill.exe
3448	taskkill.exe
596	taskkill.exe
352	taskkill.exe
4900	taskkill.exe
2104	taskkill.exe
3528	taskkill.exe
3640	taskkill.exe
4000	taskkill.exe
1432	taskkill.exe
4840	taskkill.exe
4848	taskkill.exe
2232	taskkill.exe
3852	taskkill.exe
4644	taskkill.exe
2780	taskkill.exe
1388	taskkill.exe
2588	taskkill.exe
2024	taskkill.exe
1284	taskkill.exe
2940	taskkill.exe
3056	taskkill.exe
4812	taskkill.exe
4008	taskkill.exe
780	taskkill.exe
3996	taskkill.exe
5032	taskkill.exe
2724	taskkill.exe
1436	taskkill.exe
1812	taskkill.exe
4956	taskkill.exe
2748	taskkill.exe
4248	taskkill.exe
756	taskkill.exe
2636	taskkill.exe
4132	taskkill.exe
1220	taskkill.exe
2468	taskkill.exe
1808	taskkill.exe
2064	taskkill.exe
4316	taskkill.exe
3148	taskkill.exe
1188	taskkill.exe
628	taskkill.exe
3536	taskkill.exe
2732	taskkill.exe
2116	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	reg.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeDebugPrivilege	2724	taskkill.exe
Token: SeDebugPrivilege	1188	taskkill.exe
Token: SeDebugPrivilege	4840	taskkill.exe
Token: SeDebugPrivilege	1436	taskkill.exe
Token: SeDebugPrivilege	2636	taskkill.exe
Token: SeDebugPrivilege	2624	taskkill.exe
Token: SeDebugPrivilege	2104	taskkill.exe
Token: SeDebugPrivilege	2632	taskkill.exe
Token: SeDebugPrivilege	628	taskkill.exe
Token: SeDebugPrivilege	3056	taskkill.exe
Token: SeDebugPrivilege	2480	taskkill.exe
Token: SeDebugPrivilege	3528	taskkill.exe
Token: SeDebugPrivilege	4812	taskkill.exe
Token: SeDebugPrivilege	3536	taskkill.exe
Token: SeDebugPrivilege	2732	taskkill.exe
Token: SeDebugPrivilege	3640	taskkill.exe
Token: SeDebugPrivilege	3448	taskkill.exe
Token: SeDebugPrivilege	4644	taskkill.exe
Token: SeDebugPrivilege	2780	taskkill.exe
Token: SeDebugPrivilege	4132	taskkill.exe
Token: SeDebugPrivilege	1220	taskkill.exe
Token: SeDebugPrivilege	4000	taskkill.exe
Token: SeDebugPrivilege	4008	taskkill.exe
Token: SeDebugPrivilege	1812	taskkill.exe
Token: SeDebugPrivilege	1388	taskkill.exe
Token: SeDebugPrivilege	780	taskkill.exe
Token: SeDebugPrivilege	1432	taskkill.exe
Token: SeDebugPrivilege	3996	taskkill.exe
Token: SeDebugPrivilege	4848	taskkill.exe
Token: SeDebugPrivilege	2232	taskkill.exe
Token: SeDebugPrivilege	2468	taskkill.exe
Token: SeDebugPrivilege	1808	taskkill.exe
Token: SeDebugPrivilege	2116	taskkill.exe
Token: SeDebugPrivilege	2748	taskkill.exe
Token: SeDebugPrivilege	2064	taskkill.exe
Token: SeDebugPrivilege	3852	taskkill.exe
Token: SeDebugPrivilege	4956	taskkill.exe
Token: SeDebugPrivilege	596	taskkill.exe
Token: SeDebugPrivilege	228	taskkill.exe
Token: SeDebugPrivilege	4900	taskkill.exe
Token: SeDebugPrivilege	4248	taskkill.exe
Token: SeDebugPrivilege	2024	taskkill.exe
Token: SeDebugPrivilege	2588	taskkill.exe
Token: SeDebugPrivilege	1284	taskkill.exe
Token: SeDebugPrivilege	4316	taskkill.exe
Token: SeDebugPrivilege	2940	taskkill.exe
Token: SeDebugPrivilege	3148	taskkill.exe
Token: SeDebugPrivilege	5032	taskkill.exe
Token: SeDebugPrivilege	756	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 2724	1772	cmd.exe	87
PID 1772 wrote to memory of 2724	1772	cmd.exe	87
PID 1772 wrote to memory of 1188	1772	cmd.exe	89
PID 1772 wrote to memory of 1188	1772	cmd.exe	89
PID 1772 wrote to memory of 4840	1772	cmd.exe	90
PID 1772 wrote to memory of 4840	1772	cmd.exe	90
PID 1772 wrote to memory of 1436	1772	cmd.exe	91
PID 1772 wrote to memory of 1436	1772	cmd.exe	91
PID 1772 wrote to memory of 2636	1772	cmd.exe	93
PID 1772 wrote to memory of 2636	1772	cmd.exe	93
PID 1772 wrote to memory of 2624	1772	cmd.exe	94
PID 1772 wrote to memory of 2624	1772	cmd.exe	94
PID 1772 wrote to memory of 2104	1772	cmd.exe	95
PID 1772 wrote to memory of 2104	1772	cmd.exe	95
PID 1772 wrote to memory of 2632	1772	cmd.exe	97
PID 1772 wrote to memory of 2632	1772	cmd.exe	97
PID 1772 wrote to memory of 628	1772	cmd.exe	98
PID 1772 wrote to memory of 628	1772	cmd.exe	98
PID 1772 wrote to memory of 3056	1772	cmd.exe	99
PID 1772 wrote to memory of 3056	1772	cmd.exe	99
PID 1772 wrote to memory of 2480	1772	cmd.exe	100
PID 1772 wrote to memory of 2480	1772	cmd.exe	100
PID 1772 wrote to memory of 3528	1772	cmd.exe	101
PID 1772 wrote to memory of 3528	1772	cmd.exe	101
PID 1772 wrote to memory of 4812	1772	cmd.exe	102
PID 1772 wrote to memory of 4812	1772	cmd.exe	102
PID 1772 wrote to memory of 3536	1772	cmd.exe	103
PID 1772 wrote to memory of 3536	1772	cmd.exe	103
PID 1772 wrote to memory of 636	1772	cmd.exe	104
PID 1772 wrote to memory of 636	1772	cmd.exe	104
PID 636 wrote to memory of 4012	636	net.exe	105
PID 636 wrote to memory of 4012	636	net.exe	105
PID 1772 wrote to memory of 4044	1772	cmd.exe	107
PID 1772 wrote to memory of 4044	1772	cmd.exe	107
PID 4044 wrote to memory of 3836	4044	net.exe	108
PID 4044 wrote to memory of 3836	4044	net.exe	108
PID 1772 wrote to memory of 2732	1772	cmd.exe	109
PID 1772 wrote to memory of 2732	1772	cmd.exe	109
PID 1772 wrote to memory of 3640	1772	cmd.exe	110
PID 1772 wrote to memory of 3640	1772	cmd.exe	110
PID 1772 wrote to memory of 3448	1772	cmd.exe	111
PID 1772 wrote to memory of 3448	1772	cmd.exe	111
PID 1772 wrote to memory of 4644	1772	cmd.exe	112
PID 1772 wrote to memory of 4644	1772	cmd.exe	112
PID 1772 wrote to memory of 2780	1772	cmd.exe	113
PID 1772 wrote to memory of 2780	1772	cmd.exe	113
PID 1772 wrote to memory of 4132	1772	cmd.exe	114
PID 1772 wrote to memory of 4132	1772	cmd.exe	114
PID 1772 wrote to memory of 1220	1772	cmd.exe	115
PID 1772 wrote to memory of 1220	1772	cmd.exe	115
PID 1772 wrote to memory of 4000	1772	cmd.exe	116
PID 1772 wrote to memory of 4000	1772	cmd.exe	116
PID 1772 wrote to memory of 4008	1772	cmd.exe	117
PID 1772 wrote to memory of 4008	1772	cmd.exe	117
PID 1772 wrote to memory of 1812	1772	cmd.exe	118
PID 1772 wrote to memory of 1812	1772	cmd.exe	118
PID 1772 wrote to memory of 1388	1772	cmd.exe	119
PID 1772 wrote to memory of 1388	1772	cmd.exe	119
PID 1772 wrote to memory of 780	1772	cmd.exe	120
PID 1772 wrote to memory of 780	1772	cmd.exe	120
PID 1772 wrote to memory of 1432	1772	cmd.exe	121
PID 1772 wrote to memory of 1432	1772	cmd.exe	121
PID 1772 wrote to memory of 3996	1772	cmd.exe	122
PID 1772 wrote to memory of 3996	1772	cmd.exe	122

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\SHADOW BP + HAX 3.4\SETUP\Clean_Gameloop.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Windows\system32\taskkill.exe
  taskkill /f /im cef_frame_demo.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2724
- C:\Windows\system32\taskkill.exe
  taskkill /f /im cef_frame_render.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1188
- C:\Windows\system32\taskkill.exe
  taskkill /f /im appmarket.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4840
- C:\Windows\system32\taskkill.exe
  taskkill /f /im androidemulator.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1436
- C:\Windows\system32\taskkill.exe
  taskkill /f /im aow_exe.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2636
- C:\Windows\system32\taskkill.exe
  taskkill /f /im QMEmulatorService.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2624
- C:\Windows\system32\taskkill.exe
  taskkill /f /im RuntimeBroker.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2104
- C:\Windows\system32\taskkill.exe
  taskkill /f /im adb.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2632
- C:\Windows\system32\taskkill.exe
  taskkill /f /im GameLoader.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:628
- C:\Windows\system32\taskkill.exe
  taskkill /f /im TSettingCenter.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3056
- C:\Windows\system32\taskkill.exe
  taskkill /f /im AndroidEmulatorEn.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2480
- C:\Windows\system32\taskkill.exe
  taskkill /f /im AndroidEmulatorEx.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3528
- C:\Windows\system32\taskkill.exe
  taskkill /f /im AndroidRenderer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4812
- C:\Windows\system32\taskkill.exe
  taskkill /f /im syzs_dl_svr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3536
- C:\Windows\system32\net.exe
  net stop aow_drv
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:636
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop aow_drv
    3⤵
    PID:4012
- C:\Windows\system32\net.exe
  net stop Tensafe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4044
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop Tensafe
    3⤵
    PID:3836
- C:\Windows\system32\taskkill.exe
  taskkill /IM "Synaptics.exe" /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2732
- C:\Windows\system32\taskkill.exe
  taskkill /f /im dnf.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3640
- C:\Windows\system32\taskkill.exe
  taskkill /f /im tensafe_1.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3448
- C:\Windows\system32\taskkill.exe
  taskkill /f /im tensafe_2.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4644
- C:\Windows\system32\taskkill.exe
  taskkill /f /im tencentdl.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2780
- C:\Windows\system32\taskkill.exe
  taskkill /f /im conime.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4132
- C:\Windows\system32\taskkill.exe
  taskkill /f /im TBSWebRenderer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1220
- C:\Windows\system32\taskkill.exe
  taskkill /f /im qqlogin.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4000
- C:\Windows\system32\taskkill.exe
  taskkill /f /im dnfchina.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4008
- C:\Windows\system32\taskkill.exe
  taskkill /f /im dnfchinatest.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1812
- C:\Windows\system32\taskkill.exe
  taskkill /f /im txplatform.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1388
- C:\Windows\system32\taskkill.exe
  taskkill /f /im aow_exe.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:780
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM TitanService.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1432
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM ProjectTitan.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3996
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM Auxillary.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4848
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM TP3Helper.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2232
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM tp3helper.dat
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2468
- C:\Windows\system32\taskkill.exe
  TaskKill /F /IM androidemulator.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1808
- C:\Windows\system32\taskkill.exe
  TaskKill /F /IM aow_exe.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2116
- C:\Windows\system32\taskkill.exe
  TaskKill /F /IM QMEmulatorService.exe
  2⤵
  - Kills process with taskkill
  PID:352
- C:\Windows\system32\taskkill.exe
  TaskKill /F /IM RuntimeBroker.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2748
- C:\Windows\system32\taskkill.exe
  taskkill /F /im adb.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2064
- C:\Windows\system32\taskkill.exe
  taskkill /F /im GameLoader.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3852
- C:\Windows\system32\taskkill.exe
  taskkill /F /im TBSWebRenderer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4956
- C:\Windows\system32\taskkill.exe
  taskkill /F /im AppMarket.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:596
- C:\Windows\system32\taskkill.exe
  taskkill /F /im AndroidEmulator.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:228
- C:\Windows\system32\taskkill.exe
  taskkill /F /im syzs_dl_svr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4900
- C:\Windows\system32\taskkill.exe
  taskkill /F /im QMEmulatorService.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4248
- C:\Windows\system32\taskkill.exe
  TaskKill /F /IM appmarket.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2024
- C:\Windows\system32\taskkill.exe
  TaskKill /F /IM androidemulator.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2588
- C:\Windows\system32\taskkill.exe
  TaskKill /F /IM aow_exe.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1284
- C:\Windows\system32\taskkill.exe
  TaskKill /F /IM QMEmulatorService.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4316
- C:\Windows\system32\taskkill.exe
  TaskKill /F /IM RuntimeBroker.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2940
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM adb.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3148
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM GameLoader.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5032
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM TSettingCenter.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:756
- C:\Windows\system32\net.exe
  net stop aow_drv
  2⤵
  PID:4228
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop aow_drv
    3⤵
    PID:1232
- C:\Windows\system32\net.exe
  net stop Tensafe
  2⤵
  PID:5036
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop Tensafe
    3⤵
    PID:3076
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Tencent" /f
  2⤵
  PID:3836
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Tencent" /f
  2⤵
  PID:4044
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache" /f
  2⤵
  - Modifies registry class
  PID:4668
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TencentMobileGameAssistant" /f
  2⤵
  PID:2732
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileGamePC" /f
  2⤵
  PID:3340
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\MobileGamePC" /f
  2⤵
  PID:3640
- C:\Windows\system32\reg.exe
  reg delete "HKEY_USERS\S-1-5-21-1684716338-1731825245-2802686541-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.apk\OpenWithList" /f
  2⤵
  PID:1892
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\QMEmulatorService" /f
  2⤵
  PID:3448
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\aow_drv" /f
  2⤵
  PID:2056
- C:\Windows\system32\reg.exe
  reg delete "HKEY_USERS\S-1-5-21-1684716338-1731825245-2802686541-500\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store" /v "C:\Program Files\txgameassistant\appmarket\AppMarket.exe" /f
  2⤵
  PID:4156
- C:\Windows\system32\reg.exe
  reg delete "HKEY_USERS\S-1-5-21-1684716338-1731825245-2802686541-500\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store" /v "D:\Program Files\txgameassistant\appmarket\AppMarket.exe" /f
  2⤵
  PID:4988
- C:\Windows\system32\reg.exe
  reg delete "HKEY_USERS\S-1-5-21-1684716338-1731825245-2802686541-500\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store" /v "E:\Program Files\txgameassistant\appmarket\AppMarket.exe" /f
  2⤵
  PID:4256
- C:\Windows\system32\reg.exe
  reg delete "HKEY_USERS\S-1-5-21-1684716338-1731825245-2802686541-500\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store" /v "F:\Program Files\txgameassistant\appmarket\AppMarket.exe" /f
  2⤵
  PID:3540
- C:\Windows\system32\reg.exe
  reg delete "HKEY_USERS\S-1-5-21-1684716338-1731825245-2802686541-500\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store" /v "C:\Program Files\program files\txgameassistant\appmarket\AppMarket.exe" /f
  2⤵
  PID:1656
- C:\Windows\system32\reg.exe
  reg delete "HKEY_USERS\S-1-5-21-1684716338-1731825245-2802686541-500\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store" /v "D:\Program Files\program files\txgameassistant\appmarket\AppMarket.exe" /f
  2⤵
  PID:5100
- C:\Windows\system32\reg.exe
  reg delete "HKEY_USERS\S-1-5-21-1684716338-1731825245-2802686541-500\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store" /v "E:\Program Files\program files\txgameassistant\appmarket\AppMarket.exe" /f
  2⤵
  PID:3476
- C:\Windows\system32\reg.exe
  reg delete "HKEY_USERS\S-1-5-21-1684716338-1731825245-2802686541-500\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store" /v "F:\Program Files\program files\txgameassistant\appmarket\AppMarket.exe" /f
  2⤵
  PID:4000
- C:\Windows\system32\reg.exe
  reg delete "HKEY_USERS\S-1-5-21-1684716338-1731825245-2802686541-500\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store" /v "C:\Program Files\txgameassistant\ui\AndroidEmulator.exe" /f
  2⤵
  PID:3320
- C:\Windows\system32\reg.exe
  reg delete "HKEY_USERS\S-1-5-21-1684716338-1731825245-2802686541-500\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store" /v "D:\Program Files\txgameassistant\ui\AndroidEmulator.exe" /f
  2⤵
  PID:4008
- C:\Windows\system32\reg.exe
  reg delete "HKEY_USERS\S-1-5-21-1684716338-1731825245-2802686541-500\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store" /v "E:\Program Files\txgameassistant\ui\AndroidEmulator.exe" /f
  2⤵
  PID:5080
- C:\Windows\system32\reg.exe
  reg delete "HKEY_USERS\S-1-5-21-1684716338-1731825245-2802686541-500\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store" /v "F:\Program Files\txgameassistant\ui\AndroidEmulator.exe" /f
  2⤵
  PID:4432
- C:\Windows\system32\reg.exe
  reg delete "HKEY_USERS\S-1-5-21-1684716338-1731825245-2802686541-500\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store" /v "C:\Program Files\program files\txgameassistant\ui\AndroidEmulator.exe" /f
  2⤵
  PID:4872
- C:\Windows\system32\reg.exe
  reg delete "HKEY_USERS\S-1-5-21-1684716338-1731825245-2802686541-500\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store" /v "D:\Program Files\program files\txgameassistant\ui\AndroidEmulator.exe" /f
  2⤵
  PID:4884
- C:\Windows\system32\reg.exe
  reg delete "HKEY_USERS\S-1-5-21-1684716338-1731825245-2802686541-500\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store" /v "E:\Program Files\program files\txgameassistant\ui\AndroidEmulator.exe" /f
  2⤵
  PID:3980
- C:\Windows\system32\reg.exe
  reg delete "HKEY_USERS\S-1-5-21-1684716338-1731825245-2802686541-500\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store" /v "F:\Program Files\program files\txgameassistant\ui\AndroidEmulator.exe" /f
  2⤵
  PID:1776

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads