Some #lolbins [likely hw-related] call igc64.dll (Intel Graphics Shader Compiler for Intel(R) Graphics Accelerator), which then tries to LoadLibraryA on rasty_jitter64.dll (obviously from either CWD or %PATH%). Just export JitCreateCompilerData & run phoneactivate.exe toloadurdll 
same with filehistory
And to avoid showing up any UI, call ExitProcess when done.
Same goes with Magnify.exe, in this case it's even auto-elevated so we get a so-called "uac bypass" with this #lolbin:
and no it's not supposed to be privesc -_-
and SlideToShutDown.exe
systemreset is auto-elevated as well, similar behavior - loads rasty_jitter64.dll from %path%
cmd when trying to launch something very specific for some reason o_O -____- and TID went beyond leet fr
Ok we can blame Intel(R) HD Graphics 620, as the library name suggested. This behavior doesn't reproduce when disabling that driver on devmgmt.msc, and igc64.dll won't be loaded into your processes. Is that even a fair workaround? :)
• • •
Missing some Tweet in this thread? You can try to
force a refresh
