Thread by @falsneg

Some #lolbins [likely hw-related] call igc64.dll (Intel Graphics Shader Compiler for Intel(R) Graphics Accelerator), which then tries to LoadLibraryA on rasty_jitter64.dll (obviously from either CWD or %PATH%). Just export JitCreateCompilerData & run phoneactivate.exe toloadurdll

same with filehistory

And to avoid showing up any UI, call ExitProcess when done.

Same goes with Magnify.exe, in this case it's even auto-elevated so we get a so-called "uac bypass" with this #lolbin:

and no it's not supposed to be privesc -_-

and SlideToShutDown.exe

systemreset is auto-elevated as well, similar behavior - loads rasty_jitter64.dll from %path%

lol taskmgr too #lolbin #lolbas

cmd when trying to launch something very specific for some reason o_O -____- and TID went beyond leet fr

Ok we can blame Intel(R) HD Graphics 620, as the library name suggested. This behavior doesn't reproduce when disabling that driver on devmgmt.msc, and igc64.dll won't be loaded into your processes. Is that even a fair workaround? :)