Analysis
- user interaction
yes - max time kernel
300s - max time network
269s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
29/04/2026, 22:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
faceitclient.exe
Resource
win11-20260130-en
windows11-21h2-x64
5 signatures
300 seconds
General
- Target faceitclient.exe
- Size 2.7MB
- Sample260429-183mlacy5j
- SHA256 87895e5a00a702d2e9ce8358731ea57865efd3ea96127fa7d6e72cc2e0cb8b12
- MD5 83d7affced22d6c79530b5c7bcd68260
- SHA1 ebd2fff72315db4310829330e0418434953881ee
- SHA512 c4ac132f7bff22e007ce7f966ee06aa56557e69b85e63f3bed071d445f05f170760144f0e99b520f204b56122a8e35d84bb42e9128eda3930a5ab34444b5f457
- SSDEEP 49152:VCuMgCH8L5aJdClUU0WDK/mjNYdnLgifeE:dkJujNYdnLgifeE
- TLSH T189D5E78329DB0DE9CED667BC61D75335A774FD318A291F2BAA08C2312D536C4AD1EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 64 IoCs
description ioc Process File created C:\Windows\System32\drivers\it-IT\tcpip_filter_2D3E6117.sys faceitclient.exe File created C:\Windows\System32\drivers\etc\kernel32_ext_6C7D3CD2.db faceitclient.exe File created C:\Windows\System32\drivers\DriverData\config_mgr_608C5D29.sys faceitclient.exe File created C:\Windows\System32\drivers\wdmflt_09FA0A13.cache faceitclient.exe File created C:\Windows\System32\drivers\ja-JP\ntoskrnl_patch_48DB0027.cache faceitclient.exe File created C:\Windows\System32\drivers\ntoskrnl_patch_3BF63214.tmp faceitclient.exe File created C:\Windows\System32\drivers\ja-JP\tcpip_filter_796E0519.tmp faceitclient.exe File created C:\Windows\System32\drivers\fr-FR\integrity_chk_06753A6E.tmp faceitclient.exe File created C:\Windows\System32\drivers\etc\anticheat_core_7F991B2C.bin faceitclient.exe File created C:\Windows\System32\drivers\it-IT\win32k_hook_475C2CAE.dll faceitclient.exe File created C:\Windows\System32\drivers\DriverData\wdmflt_23FE49CE.cache faceitclient.exe File created C:\Windows\System32\drivers\DriverData\vgk_driver_37600D9E.bin faceitclient.exe File created C:\Windows\System32\drivers\es-ES\update_svc_460E2FBC.dll faceitclient.exe File created C:\Windows\System32\drivers\de-DE\tcpip_filter_415849F0.cache faceitclient.exe File created C:\Windows\SysWOW64\drivers\de-DE\win32k_hook_1F1021DE.bin faceitclient.exe File created C:\Windows\SysWOW64\drivers\UMDF\cache_mgr_6E874B66.log faceitclient.exe File created C:\Windows\SysWOW64\drivers\it-IT\system_guard_7A3E258C.dat faceitclient.exe File created C:\Windows\SysWOW64\drivers\UMDF\anticheat_core_49C524D6.sys faceitclient.exe File created C:\Windows\System32\drivers\UMDF\be_service_6A135DF4.dll faceitclient.exe File created C:\Windows\System32\drivers\en-US\update_svc_5E6541A5.dll faceitclient.exe File created C:\Windows\System32\drivers\de-DE\vgk_driver_18CB0868.dll faceitclient.exe File created C:\Windows\SysWOW64\drivers\ja-JP\vgk_driver_3E824293.log faceitclient.exe File created C:\Windows\System32\drivers\es-ES\system_guard_56793AAB.db faceitclient.exe File created C:\Windows\System32\drivers\es-ES\eac_kernel_69F451A2.cache faceitclient.exe File created C:\Windows\System32\drivers\en-US\ntoskrnl_patch_383F620D.db faceitclient.exe File created C:\Windows\System32\drivers\de-DE\config_mgr_6BC6328C.log faceitclient.exe File created C:\Windows\SysWOW64\drivers\es-ES\integrity_chk_09874D96.bin faceitclient.exe File created C:\Windows\SysWOW64\drivers\fr-FR\policy_mgr_46C65F15.db faceitclient.exe File created C:\Windows\System32\drivers\es-ES\faceit_ac_0297680A.cache faceitclient.exe File created C:\Windows\System32\drivers\DriverData\config_mgr_4EB836E9.log faceitclient.exe File created C:\Windows\SysWOW64\drivers\it-IT\be_service_3FD953BE.log faceitclient.exe File created C:\Windows\SysWOW64\drivers\uk-UA\policy_mgr_1C953CAB.sys faceitclient.exe File created C:\Windows\SysWOW64\drivers\vgk_driver_713D41AA.cache faceitclient.exe File created C:\Windows\System32\drivers\it-IT\ntoskrnl_patch_4A4344B2.dll faceitclient.exe File created C:\Windows\System32\drivers\ja-JP\update_svc_5AEA2C07.dat faceitclient.exe File created C:\Windows\System32\drivers\etc\hal_driver_3B975796.bin faceitclient.exe File created C:\Windows\System32\drivers\en-US\be_service_34732CD4.db faceitclient.exe File created C:\Windows\SysWOW64\drivers\en-US\vgk_driver_5F056993.dat faceitclient.exe File created C:\Windows\System32\drivers\fr-FR\win32k_hook_46232BA6.sys faceitclient.exe File created C:\Windows\System32\drivers\fr-FR\cache_mgr_160203F2.db faceitclient.exe File created C:\Windows\System32\drivers\etc\hal_driver_527212D6.cache faceitclient.exe File created C:\Windows\System32\drivers\fr-FR\win32k_hook_331438A4.bin faceitclient.exe File created C:\Windows\SysWOW64\drivers\uk-UA\config_mgr_05656CA1.cache faceitclient.exe File created C:\Windows\System32\drivers\DriverData\integrity_chk_4A645CCE.dll faceitclient.exe File created C:\Windows\SysWOW64\drivers\be_service_44582D06.bin faceitclient.exe File created C:\Windows\System32\drivers\it-IT\faceit_ac_6C2B2455.dat faceitclient.exe File created C:\Windows\System32\drivers\fr-FR\vgk_driver_06C65DF7.db faceitclient.exe File created C:\Windows\SysWOW64\drivers\fr-FR\tcpip_filter_13696FD1.log faceitclient.exe File created C:\Windows\System32\drivers\UMDF\integrity_chk_76884764.bin faceitclient.exe File created C:\Windows\System32\drivers\fr-FR\drv_loader_32CF4434.dll faceitclient.exe File created C:\Windows\System32\drivers\etc\faceit_ac_1B6226BD.sys faceitclient.exe File created C:\Windows\SysWOW64\drivers\es-ES\svc_host_ac_6E4675E2.sys faceitclient.exe File created C:\Windows\SysWOW64\drivers\UMDF\hal_driver_5D0435AA.dat faceitclient.exe File created C:\Windows\SysWOW64\drivers\de-DE\win32k_hook_6D560447.tmp faceitclient.exe File created C:\Windows\SysWOW64\drivers\UMDF\faceit_module_517D6AC0.db faceitclient.exe File created C:\Windows\System32\drivers\config_mgr_71902A08.dll faceitclient.exe File created C:\Windows\SysWOW64\drivers\de-DE\wdmflt_03BA6109.dll faceitclient.exe File created C:\Windows\System32\drivers\fr-FR\tcpip_filter_3EE22D00.db faceitclient.exe File created C:\Windows\SysWOW64\drivers\be_service_169330EE.bin faceitclient.exe File created C:\Windows\System32\drivers\ja-JP\kernel32_ext_719B5145.bin faceitclient.exe File created C:\Windows\System32\drivers\UMDF\faceit_ac_39D003C7.log faceitclient.exe File created C:\Windows\System32\drivers\en-US\be_service_3B3252E6.dll faceitclient.exe File created C:\Windows\System32\drivers\de-DE\kernel32_ext_489F01E0.cache faceitclient.exe File created C:\Windows\SysWOW64\drivers\fr-FR\cache_mgr_3188713C.dat faceitclient.exe - Executes dropped EXE 1 IoCs
pid Process 852 faceitclient.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\DriverStore\be_service_5ECB6799.dll faceitclient.exe File created C:\Windows\System32\SMI\win32k_hook_06AD1012.dat faceitclient.exe File created C:\Windows\System32\WinBioPlugIns\de-DE\hal_driver_18823523.log faceitclient.exe File created C:\Windows\System32\Com\es-ES\be_service_4F144206.cache faceitclient.exe File created C:\Windows\SysWOW64\id-ID\faceit_ac_37DC2B63.dll faceitclient.exe File created C:\Windows\System32\migration\kernel32_ext_70695BB3.sys faceitclient.exe File created C:\Windows\System32\sppui\svc_host_ac_4A9268EF.dll faceitclient.exe File created C:\Windows\System32\ras\vgk_driver_3AED1C51.cache faceitclient.exe File created C:\Windows\SysWOW64\Com\it-IT\wdmflt_08E66915.cache faceitclient.exe File created C:\Windows\SysWOW64\ru-RU\svc_host_ac_755910DE.sys faceitclient.exe File created C:\Windows\SysWOW64\slmgr\040C\faceit_module_2A4D31EC.tmp faceitclient.exe File created C:\Windows\System32\Dism\de-DE\anticheat_core_44463295.bin faceitclient.exe File created C:\Windows\System32\migration\es-ES\hal_driver_57CD2462.dat faceitclient.exe File created C:\Windows\SysWOW64\it\cache_mgr_280211A5.bin faceitclient.exe File created C:\Windows\System32\MUI\0409\win32k_hook_3E452CE5.dat faceitclient.exe File created C:\Windows\System32\oobe\en-US\tcpip_filter_44CF20E0.db faceitclient.exe File created C:\Windows\SysWOW64\InputMethod\CHS\wdmflt_0FDB70E8.tmp faceitclient.exe File created C:\Windows\System32\oobe\it-IT\update_svc_34AA3B76.bin faceitclient.exe File created C:\Windows\SysWOW64\slmgr\0409\update_svc_655B5EC9.sys faceitclient.exe File created C:\Windows\SysWOW64\lt-LT\svc_host_ac_262E46F0.db faceitclient.exe File created C:\Windows\System32\slmgr\0407\tcpip_filter_0FA563A9.tmp faceitclient.exe File created C:\Windows\System32\WCN\policy_mgr_4C5E4FB7.cache faceitclient.exe File created C:\Windows\SysWOW64\es\kernel32_ext_4CA934E1.log faceitclient.exe File created C:\Windows\SysWOW64\icsxml\config_mgr_3A472852.sys faceitclient.exe File created C:\Windows\System32\DriverStore\es-ES\cache_mgr_24F616B0.bin faceitclient.exe File created C:\Windows\System32\Boot\de-DE\update_svc_64DB024E.log faceitclient.exe File created C:\Windows\System32\es\faceit_module_76B014FA.sys faceitclient.exe File created C:\Windows\System32\config\Journal\eac_kernel_4BB31293.dat faceitclient.exe File created C:\Windows\System32\DriverStore\it-IT\integrity_chk_4F3A0F18.dll faceitclient.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\en-US\anticheat_core_3380079B.cache faceitclient.exe File created C:\Windows\System32\SMI\Manifests\config_mgr_39920E57.db faceitclient.exe File created C:\Windows\SysWOW64\DriverStore\en-US\win32k_hook_05DB28BB.tmp faceitclient.exe File created C:\Windows\System32\Speech\hal_driver_70B8231D.sys faceitclient.exe File created C:\Windows\SysWOW64\WCN\svc_host_ac_7F772CA8.cache faceitclient.exe File created C:\Windows\System32\Pbr\ActionFiles\update_svc_6E2467DA.sys faceitclient.exe File created C:\Windows\SysWOW64\da-DK\policy_mgr_6DB4319D.sys faceitclient.exe File created C:\Windows\System32\wbem\fr-FR\config_mgr_101743D0.cache faceitclient.exe File created C:\Windows\System32\SMI\Schema\cache_mgr_37733F21.db faceitclient.exe File created C:\Windows\System32\wbem\uk-UA\svc_host_ac_3A8E4BB0.dat faceitclient.exe File created C:\Windows\System32\InputMethod\eac_kernel_125738E4.tmp faceitclient.exe File created C:\Windows\SysWOW64\sr-Latn-RS\integrity_chk_6F6F17B7.db faceitclient.exe File created C:\Windows\SysWOW64\fr-FR\ntoskrnl_patch_750C6B90.log faceitclient.exe File created C:\Windows\System32\sv-SE\faceit_ac_6A4B060C.sys faceitclient.exe File created C:\Windows\SysWOW64\Com\en-US\config_mgr_680E0023.db faceitclient.exe File created C:\Windows\System32\networklist\eac_kernel_28823157.bin faceitclient.exe File created C:\Windows\System32\Pbr\ActionFiles\eac_kernel_3F8F1D6D.dll faceitclient.exe File created C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\win32k_hook_29CD7EAA.cache faceitclient.exe File created C:\Windows\SysWOW64\IME\SHARED\win32k_hook_23577CD3.cache faceitclient.exe File created C:\Windows\System32\PerceptionSimulation\fr-FR\svc_host_ac_36CC742F.log faceitclient.exe File created C:\Windows\SysWOW64\icsxml\cache_mgr_06B734BE.log faceitclient.exe File created C:\Windows\System32\WCN\ja-JP\integrity_chk_40C45809.db faceitclient.exe File created C:\Windows\System32\Com\en-US\anticheat_core_3AEA25EB.cache faceitclient.exe File created C:\Windows\System32\SMI\faceit_ac_117D3DCF.bin faceitclient.exe File created C:\Windows\System32\LogFiles\Fax\svc_host_ac_32CE7F6D.dll faceitclient.exe File created C:\Windows\System32\LogFiles\CloudFiles\system_guard_348D6C4A.dat faceitclient.exe File created C:\Windows\System32\migwiz\uk-UA\ntoskrnl_patch_385F2216.tmp faceitclient.exe File created C:\Windows\SysWOW64\oobe\fr-FR\vgk_driver_40C80B38.log faceitclient.exe File created C:\Windows\SysWOW64\Dism\it-IT\drv_loader_599C1BD8.cache faceitclient.exe File created C:\Windows\System32\setup\win32k_hook_67D50426.tmp faceitclient.exe File created C:\Windows\System32\MsDtc\win32k_hook_68BF667B.cache faceitclient.exe File created C:\Windows\SysWOW64\WCN\en-US\cache_mgr_6C1B4FAE.log faceitclient.exe File created C:\Windows\SysWOW64\winrm\0407\policy_mgr_6A5C1347.sys faceitclient.exe File created C:\Windows\SysWOW64\PerceptionSimulation\be_service_1EB10D5E.dll faceitclient.exe File created C:\Windows\SysWOW64\Speech_OneCore\VoiceActivation\drv_loader_32452F4A.cache faceitclient.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Mozilla Firefox\fonts\faceit_ac_5B0159B1.bin faceitclient.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\kernel32_ext_0BCC6EA0.bin faceitclient.exe File created C:\Program Files\Common Files\System\hal_driver_2B714A2C.dll faceitclient.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\kernel32_ext_2B092133.dll faceitclient.exe File created C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.50.24002.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\eac_kernel_73B07E91.dat faceitclient.exe File created C:\Program Files\Reference Assemblies\eac_kernel_2DD82EBD.sys faceitclient.exe File created C:\Program Files (x86)\Common Files\System\msadc\update_svc_1ABD7DB8.sys faceitclient.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\AppxMetadata\hal_driver_303A2BCC.cache faceitclient.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\AppCS\eac_kernel_1B0D76FA.dll faceitclient.exe File created C:\Program Files\ModifiableWindowsApps\config_mgr_3EE93273.db faceitclient.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_1.0.22.0_neutral_split.scale-125_8wekyb3d8bbwe\config_mgr_29357BC2.db faceitclient.exe File created C:\Program Files\Microsoft Office\Updates\ntoskrnl_patch_599A5923.log faceitclient.exe File created C:\Program Files\Windows Photo Viewer\uk-UA\eac_kernel_7C904FEF.sys faceitclient.exe File created C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\faceit_module_319C3BC5.tmp faceitclient.exe File created C:\Program Files (x86)\Windows Media Player\Media Renderer\kernel32_ext_3EE43448.log faceitclient.exe File created C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_12008.1001.113.0_neutral_~_8wekyb3d8bbwe\anticheat_core_466D4A5A.dll faceitclient.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GetHelp_10.2008.32311.0_neutral_split.scale-125_8wekyb3d8bbwe\win32k_hook_17281BBA.dat faceitclient.exe File created C:\Program Files\WindowsApps\Microsoft.GamingApp_2105.900.24.0_x64__8wekyb3d8bbwe\integrity_chk_535A79D7.cache faceitclient.exe File created C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_neutral_split.scale-100_8wekyb3d8bbwe\Images\kernel32_ext_5B057CDA.dat faceitclient.exe File created C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\ro-RO\anticheat_core_19151C58.db faceitclient.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\AppxMetadata\integrity_chk_27FF2084.dll faceitclient.exe File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\update_svc_0353569F.cache faceitclient.exe File created C:\Program Files\Windows Photo Viewer\en-US\be_service_4AA504ED.dat faceitclient.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Win10\drv_loader_0024601E.tmp faceitclient.exe File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\AppxMetadata\faceit_ac_652E4135.bin faceitclient.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\WinMetadata\policy_mgr_6C45404A.tmp faceitclient.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsNotepad_10.2102.13.0_neutral_split.scale-125_8wekyb3d8bbwe\vgk_driver_13C23299.tmp faceitclient.exe File created C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_12008.1001.113.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\svc_host_ac_3CD568A3.log faceitclient.exe File created C:\Program Files\Windows Photo Viewer\anticheat_core_006A3C1C.bin faceitclient.exe File created C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\GameBarWidgetUI\vgk_driver_616576C5.log faceitclient.exe File created C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\zh-TW\config_mgr_192E67C0.dll faceitclient.exe File created C:\Program Files (x86)\Common Files\Oracle\ntoskrnl_patch_603B2385.dat faceitclient.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GamingApp_2105.900.24.0_neutral_split.scale-125_8wekyb3d8bbwe\integrity_chk_0FFB36F1.db faceitclient.exe File created C:\Program Files (x86)\Windows Defender\es-ES\hal_driver_50005413.cache faceitclient.exe File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\x64\config_mgr_4F3A5C79.tmp faceitclient.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_2021.2101.27.0_neutral_~_8wekyb3d8bbwe\update_svc_70C448D1.tmp faceitclient.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\update_svc_51D76B23.sys faceitclient.exe File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\x64\ntoskrnl_patch_3F5E3774.db faceitclient.exe File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_neutral_~_8wekyb3d8bbwe\tcpip_filter_41166114.cache faceitclient.exe File opened for modification C:\Program Files (x86)\Microsoft\Temp\policy_mgr_61C52CEE.cache faceitclient.exe File created C:\Program Files\Java\jre-1.8\bin\faceit_ac_10CD0345.tmp faceitclient.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_21.21030.25003.0_neutral_split.scale-125_8wekyb3d8bbwe\ntoskrnl_patch_31643312.cache faceitclient.exe File created C:\Program Files\WindowsApps\Microsoft.People_2020.901.1724.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\update_svc_3DE12AFE.db faceitclient.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\update_svc_764555E3.bin faceitclient.exe File created C:\Program Files\Mozilla Firefox\defaults\be_service_132E14CF.dat faceitclient.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.1.2.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\faceit_ac_48E978A7.dll faceitclient.exe File created C:\Program Files (x86)\Common Files\System\es-ES\vgk_driver_7F497F98.sys faceitclient.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\vgk_driver_44A81BAC.dll faceitclient.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\system_guard_62F164DC.dll faceitclient.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_2020.2012.21.0_neutral_~_8wekyb3d8bbwe\wdmflt_11DD1A4B.tmp faceitclient.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_neutral_~_8wekyb3d8bbwe\svc_host_ac_5CB451EB.bin faceitclient.exe File created C:\Program Files\WindowsApps\Microsoft.GamingApp_2105.900.24.0_x64__8wekyb3d8bbwe\Assets\system_guard_5AF57B5A.dat faceitclient.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\anticheat_core_6F872597.sys faceitclient.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\ntoskrnl_patch_5B0D3DA2.bin faceitclient.exe File created C:\Program Files\Windows Media Player\ja-JP\drv_loader_459E564C.db faceitclient.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_21.21030.25003.0_neutral_split.scale-125_8wekyb3d8bbwe\svc_host_ac_2E8B2864.bin faceitclient.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\wdmflt_31A632E4.dll faceitclient.exe File created C:\Program Files (x86)\WindowsPowerShell\faceit_ac_4F96592E.bin faceitclient.exe File created C:\Program Files\WindowsPowerShell\Modules\be_service_01C41DE6.bin faceitclient.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\vgk_driver_2F041537.dat faceitclient.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_1.0.22.0_neutral_split.scale-125_8wekyb3d8bbwe\faceit_module_1C233952.bin faceitclient.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\ntoskrnl_patch_24133AC6.dll faceitclient.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_2019.21012.10511.0_neutral_~_8wekyb3d8bbwe\drv_loader_5F61452C.db faceitclient.exe File created C:\Program Files (x86)\Common Files\hal_driver_50BE3EBD.cache faceitclient.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-u..assdriver.resources_31bf3856ad364e35_10.0.22000.1_es-es_e0058c9d9197d291\be_service_1FF62E26.tmp faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..onmanager.resources_31bf3856ad364e35_10.0.22000.1_it-it_7f907d3c144c1be8\integrity_chk_7FFB6790.dll faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-trkwks.resources_31bf3856ad364e35_10.0.22000.1_it-it_c88da21d51735b30\hal_driver_6F4B35FD.db faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..g-jscript.resources_31bf3856ad364e35_11.0.22000.1_ja-jp_0cfbec10b35352bd\eac_kernel_0BD3699F.tmp faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..yn-router.resources_31bf3856ad364e35_10.0.22000.1_ja-jp_d86cb02dbd5a6030\integrity_chk_0D671A81.dll faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-web-app-host.resources_31bf3856ad364e35_10.0.22000.1_tr-tr_7cba7301a2d8319d\anticheat_core_434B5017.log faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.22000.348_de-de_765e072250f48b04\f\ntoskrnl_patch_59155A80.dat faceitclient.exe File created C:\Windows\WinSxS\amd64_system.componentmodel.primitives_b03f5f7f11d50a3a_4.0.15806.0_none_b33511a3bf19c71d\hal_driver_3F087686.bin faceitclient.exe File created C:\Windows\schemas\AvailableNetwork\integrity_chk_4B527242.sys faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.22000.1_cs-cz_f9cf8d36afd8f0ad\be_service_3F53741C.bin faceitclient.exe File created C:\Windows\WinSxS\amd64_c_fscfsmetadataserver.inf.resources_31bf3856ad364e35_10.0.22000.1_ja-jp_73e47344ffac5e28\policy_mgr_497B16AF.dat faceitclient.exe File created C:\Windows\WinSxS\amd64_netfx4-mscordacwks_dll_b03f5f7f11d50a3a_4.0.15806.0_none_e70a1e5bf3bc2cc0\anticheat_core_53276538.dll faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-enrollengine_31bf3856ad364e35_10.0.22000.469_none_9426df2a43e211ce\f\drv_loader_603A261E.dat faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..mmability.resources_31bf3856ad364e35_10.0.22000.1_it-it_d0695906c959e2f3\anticheat_core_10D33509.dll faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-efs-util-library_31bf3856ad364e35_10.0.22000.1_none_9d5cff0da797a7eb\ntoskrnl_patch_450E0AC7.tmp faceitclient.exe File created C:\Windows\WinSxS\amd64_ialpssi_i2c.inf.resources_31bf3856ad364e35_10.0.22000.1_fr-fr_1d4a517f86886208\update_svc_4FF2469A.log faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-bpa.resources_31bf3856ad364e35_10.0.22000.1_fr-fr_90e7699398a5d2e9\vgk_driver_2A53752F.sys faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..erservice.resources_31bf3856ad364e35_10.0.22000.1_it-it_d6defc6a5b215253\be_service_6A5210B1.tmp faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-aclui.resources_31bf3856ad364e35_10.0.22000.1_ja-jp_c6e5ba0b72fac851\update_svc_061467DB.log faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-webauth_31bf3856ad364e35_10.0.22000.1_none_81e69386fbb62c17\svc_host_ac_1578587D.cache faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..actor-adm.resources_31bf3856ad364e35_10.0.22000.1_de-de_0831262495a3cadf\be_service_2D3D0B9D.sys faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft.internal.tasks.dataflow_b77a5c561934e089_4.0.15806.0_none_33c92a7a68aa3f99\eac_kernel_15030C3C.tmp faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..nel.appxmain.deploy_31bf3856ad364e35_10.0.22000.120_none_64d4e4e9c10a4595\wdmflt_09BE014A.cache faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mydocs.resources_31bf3856ad364e35_10.0.22000.1_es-es_9307fbcf5696e53d\policy_mgr_054E1DCC.bin faceitclient.exe File created C:\Windows\WinSxS\amd64_ehstorpwddrv.inf.resources_31bf3856ad364e35_10.0.22000.1_fr-fr_afb93dc47193f9e4\kernel32_ext_287B76A0.log faceitclient.exe File created C:\Windows\WinSxS\amd64_termkbd.inf.resources_31bf3856ad364e35_10.0.22000.1_ja-jp_ff5f356c1edbf034\wdmflt_373264D4.cache faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-directui.resources_31bf3856ad364e35_10.0.22000.184_cs-cz_25fe75d284430434\be_service_237B5622.db faceitclient.exe File created C:\Windows\WinSxS\msil_microsoft.build.tasks.v3.5.resources_b03f5f7f11d50a3a_10.0.22000.1_es-es_54b24a0d5956280c\system_guard_7FF642FE.tmp faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.22000.1_none_271a8fad6a2d1b1e\hal_driver_13AD203B.dat faceitclient.exe File created C:\Windows\WinSxS\msil_system.web.extensions.resources_31bf3856ad364e35_10.0.22000.1_de-de_fd48ebb4de169041\vgk_driver_16EB2BDA.db faceitclient.exe File created C:\Windows\WinSxS\amd64_system.servicemodel.routing.resources_31bf3856ad364e35_4.0.15806.0_it-it_5e395f99b37e8e71\anticheat_core_1D1B5E90.db faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dims.resources_31bf3856ad364e35_10.0.22000.1_ja-jp_9aedf3c4fe622312\ntoskrnl_patch_45227022.bin faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-certprovider_31bf3856ad364e35_10.0.22000.1_none_31eee01333529ebf\faceit_ac_6CBE213C.log faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ager-udwm.resources_31bf3856ad364e35_10.0.22000.1_uk-ua_c927d1dac3101895\ntoskrnl_patch_6ABE4BEA.dll faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..-provider.resources_31bf3856ad364e35_10.0.22000.1_uk-ua_09c58d9c0de4d249\integrity_chk_20B36C22.tmp faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-d..ier-tools.resources_31bf3856ad364e35_10.0.22000.1_fr-fr_c5e05ceff31ecb4c\wdmflt_583A2EC4.log faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..assistant.resources_31bf3856ad364e35_10.0.22000.1_ja-jp_8ee3952c28744bff\win32k_hook_3A4F686B.cache faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.22000.469_none_71e2bda169e58aea\r\hal_driver_5B6E63CA.db faceitclient.exe File created C:\Windows\WinSxS\amd64_mf.inf.resources_31bf3856ad364e35_10.0.22000.1_fr-fr_b997cf8879c6aa77\win32k_hook_216B3346.dat faceitclient.exe File created C:\Windows\WinSxS\amd64_system.runtime.remoting.resources_b77a5c561934e089_4.0.15806.0_ja-jp_b4db82f8fdcb4c6b\wdmflt_70416F0C.sys faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..sisengine.resources_31bf3856ad364e35_10.0.22000.1_en-us_abddc2a37aa38271\integrity_chk_2A542270.log faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ingfolder.resources_31bf3856ad364e35_10.0.22000.1_de-de_582a1fc660014bf0\eac_kernel_021C1C0C.dll faceitclient.exe File created C:\Windows\WinSxS\amd64_net7500-x64-n650f.inf.resources_31bf3856ad364e35_10.0.22000.1_fr-fr_5728e1423ed19e88\system_guard_1F0A1E4B.tmp faceitclient.exe File created C:\Windows\WinSxS\amd64_netfx4-aspnet_webevent_sqlprov_b03f5f7f11d50a3a_4.0.15806.0_none_2def5032af1c31da\wdmflt_42554AFF.dat faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..splay-adm.resources_31bf3856ad364e35_10.0.22000.1_es-es_f272054012d87c1c\win32k_hook_78CD5289.db faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..trolpanel.resources_31bf3856ad364e35_10.0.22000.1_uk-ua_51ff6aaf406237c1\win32k_hook_544046EE.cache faceitclient.exe File created C:\Windows\WinSxS\amd64_unknown.inf.resources_31bf3856ad364e35_10.0.22000.1_it-it_13c9a8edab8be81e\policy_mgr_3EE8687B.sys faceitclient.exe File created C:\Windows\WinSxS\amd64_intelpmt.inf.resources_31bf3856ad364e35_10.0.22000.1_it-it_5121d673b189e29b\tcpip_filter_43395CE4.dat faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ompositor.resources_31bf3856ad364e35_10.0.22000.184_en-us_5ea2b6e6ff2a6744\f\kernel32_ext_48901211.dll faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-driver_31bf3856ad364e35_10.0.22000.282_none_d31ed9823c8af15a\f\wdmflt_16282A14.tmp faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi.resources_31bf3856ad364e35_10.0.22000.1_ja-jp_af8f060eac473d0e\kernel32_ext_27F10338.db faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.22000.348_none_6b5eb3c4c1ffcde9\cache_mgr_0CD30C85.cache faceitclient.exe File created C:\Windows\WinSxS\msil_microsoft.virtualiz..t.wizards.resources_31bf3856ad364e35_10.0.22000.1_es-es_ab0bde3c45d94496\wdmflt_7B5B536C.dll faceitclient.exe File created C:\Windows\WinSxS\amd64_wvkrnlintvsc.inf.resources_31bf3856ad364e35_10.0.22000.1_es-es_98bd09ed46dc8b43\wdmflt_43CE1FC8.dll faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-installer-engine_31bf3856ad364e35_10.0.22000.434_none_fed8e5f838b6b78b\f\drv_loader_5AE45A23.tmp faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..-cryptngc.resources_31bf3856ad364e35_10.0.22000.1_de-de_6610c5d23691d710\svc_host_ac_04CD2EA4.tmp faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ngservice.resources_31bf3856ad364e35_10.0.22000.1_en-us_6d5dd6a1d5a176b6\hal_driver_2A065275.dat faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..untimeapi.resources_31bf3856ad364e35_10.0.22000.1_it-it_732ce5be6f0ad408\win32k_hook_30E56A73.sys faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advapi32_31bf3856ad364e35_10.0.22000.434_none_dea6b9770bb3b13a\f\be_service_6B324840.db faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tetheringmgr.resources_31bf3856ad364e35_10.0.22000.1_es-es_907949d5f8786748\svc_host_ac_3E6C08F1.dll faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.318_none_82292a5c4e657627\lib\win32k_hook_702E750C.cache faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-native-80211_31bf3856ad364e35_10.0.22000.376_none_4a3dcfdb14432415\r\anticheat_core_4E111B20.dll faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ion-mfcaptureengine_31bf3856ad364e35_10.0.22000.348_none_e7d2ea6722f909a3\svc_host_ac_3FE46270.cache faceitclient.exe File created C:\Windows\assembly\GAC_MSIL\System.WorkflowServices.Resources\vgk_driver_56FA567D.db faceitclient.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\faceitclient.exe"C:\Users\Admin\AppData\Local\Temp\faceitclient.exe"1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:3208
-
C:\ProgramData\FaceitAC\faceitclient.exeC:\ProgramData\FaceitAC\faceitclient.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:852
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2312
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\FaceitAC\faceitclient.exe
- Size 2.7MB
- SHA256 87895e5a00a702d2e9ce8358731ea57865efd3ea96127fa7d6e72cc2e0cb8b12
- MD5 83d7affced22d6c79530b5c7bcd68260
- SHA1 ebd2fff72315db4310829330e0418434953881ee
- SHA512 c4ac132f7bff22e007ce7f966ee06aa56557e69b85e63f3bed071d445f05f170760144f0e99b520f204b56122a8e35d84bb42e9128eda3930a5ab34444b5f457
- SSDEEP 49152:VCuMgCH8L5aJdClUU0WDK/mjNYdnLgifeE:dkJujNYdnLgifeE
- TLSH T189D5E78329DB0DE9CED667BC61D75335A774FD318A291F2BAA08C2312D536C4AD1EB10
- MD5 SHA1 SHA512 SSDEEP TLSH