b49d8694a2a5f04d2b505e77be54fd88990d26fc85a00cb3ea835debccc01353

Analysis

max time kernel
273s
max time network
272s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2022, 21:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Setup.exe
Size

43.5MB
MD5

a14c3f0dcded72374ca1d57b724ccdb3
SHA1

940f77301ba37e4aedd054f23114a146cd481f5c
SHA256

b49d8694a2a5f04d2b505e77be54fd88990d26fc85a00cb3ea835debccc01353
SHA512

da5fefb3b9fcaad236ab8a5702f1aa07d38d10d36c0c00521b737180543ee88fcc0c0efe37761b44b521abdee355b12b382769040667702282898888dbd8985b
SSDEEP

786432:4W75K9iIfLI1JzBH9q9H8HPculH4rdlQWxR0XWF1OplrWKqKIwqqIxYBMEg/+3Z:t75uvI11BlHPcuV4rnJUGXOplFSwiaMm

Score

8^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4004	loader.exe
2300	dxwebsetup.exe
3640	dxwsetup.exe
392	ChromeRecovery.exe
4776	infinst.exe
4684	infinst.exe
4840	infinst.exe
3784	infinst.exe
4700	infinst.exe
3740	infinst.exe
1020	infinst.exe
1164	infinst.exe
2792	infinst.exe
4884	infinst.exe
4364	infinst.exe
1668	infinst.exe
2496	infinst.exe
5024	infinst.exe
5080	infinst.exe
3528	infinst.exe
3068	infinst.exe
1068	infinst.exe
380	infinst.exe
2936	infinst.exe
3132	infinst.exe
4072	infinst.exe
3140	infinst.exe
3456	infinst.exe
3664	infinst.exe
3104	infinst.exe
2248	infinst.exe
4008	infinst.exe
600	infinst.exe
4276	infinst.exe
4888	infinst.exe
696	infinst.exe
2348	infinst.exe
1868	infinst.exe
3000	infinst.exe
4764	infinst.exe
4216	infinst.exe
3464	infinst.exe
2788	infinst.exe
1484	infinst.exe
4172	infinst.exe
3244	infinst.exe
4956	infinst.exe
2828	infinst.exe
2328	infinst.exe
2412	infinst.exe
4700	infinst.exe
2700	infinst.exe
1888	infinst.exe
868	infinst.exe
4896	infinst.exe
4816	infinst.exe
4880	infinst.exe
4592	infinst.exe
1232	infinst.exe
1432	infinst.exe
32	infinst.exe
3008	infinst.exe
1632	infinst.exe
392	infinst.exe

Registers COM server for autorun 1 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3b80ee2a-b0f5-4780-9e30-90cb39685b03}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{b802058a-464a-42db-bc10-b650d6f2586a}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9cab402c-1d37-44b4-886d-fa4f36170a4c}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{074b110f-7f58-4743-aea5-12f15b5074ed}\InProcServer32\ = "C:\\Windows\\system32\\xactengine3_5.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3eda9b49-2085-498b-9bb2-39a6778493de}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{b802058a-464a-42db-bc10-b650d6f2586a}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_2.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cecec95a-d894-491a-bee3-5e106fb59f2d}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c0c56f46-29b1-44e9-9939-a32ce86867e2}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_0.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{94c1affa-66e7-4961-9521-cfdef3128d4f}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03219e78-5bc3-44d1-b92e-f63d89cc6526}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8bb7778b-645b-4475-9a73-1de3170bd3af}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_4.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3eda9b49-2085-498b-9bb2-39a6778493de}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_6.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f1b577e-5e5a-4e8a-ba73-c657ea8e8598}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{54b68bc7-3a45-416b-a8c9-19bf19ec1df5}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_5.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f5ca7b34-8055-42c0-b836-216129eb7e30}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e180344b-ac83-4483-959e-18a5c56a5e19}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cecec95a-d894-491a-bee3-5e106fb59f2d}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_6.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3332f02-3dd0-4de9-9aec-20d85c4111b6}\InProcServer32\ = "C:\\Windows\\system32\\xactengine3_2.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f5ca7b34-8055-42c0-b836-216129eb7e30}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_2.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4c9b6dde-6809-46e6-a278-9b6a97588670}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_5.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c60fae90-4183-4a3f-b2f7-ac1dc49b0e5c}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cd0d66ec-8057-43f5-acbd-66dfb36fd78c}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{65d822a4-4799-42c6-9b18-d26cf66dd320}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3b80ee2a-b0f5-4780-9e30-90cb39685b03}\InProcServer32\ = "C:\\Windows\\system32\\xactengine3_0.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c1e3f122-a2ea-442c-854f-20d98f8357a1}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f1b577e-5e5a-4e8a-ba73-c657ea8e8598}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c60fae90-4183-4a3f-b2f7-ac1dc49b0e5c}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{343e68e6-8f82-4a8d-a2da-6e9a944b378c}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_9.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8bb7778b-645b-4475-9a73-1de3170bd3af}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{074b110f-7f58-4743-aea5-12f15b5074ed}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cac1105f-619b-4d04-831a-44e1cbf12d57}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0aa000aa-f404-11d9-bd7a-0010dc4f8f81}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77c56bf4-18a1-42b0-88af-5072ce814949}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6f6ea3a9-2cf5-41cf-91c1-2170b1540063}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{962f5027-99be-4692-a468-85802cf8de61}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e48c5a3f-93ef-43bb-a092-2c7ceb946f27}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_6.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f4769300-b949-4df9-b333-00d33932e9a6}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f4769300-b949-4df9-b333-00d33932e9a6}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_1.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f5ca7b34-8055-42c0-b836-216129eb7e30}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0aa000aa-f404-11d9-bd7a-0010dc4f8f81}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{b802058a-464a-42db-bc10-b650d6f2586a}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03219e78-5bc3-44d1-b92e-f63d89cc6526}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3eda9b49-2085-498b-9bb2-39a6778493de}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3b80ee2a-b0f5-4780-9e30-90cb39685b03}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0977d092-2d95-4e43-8d42-9ddcc2545ed5}\InProcServer32\ = "C:\\Windows\\system32\\xactengine3_4.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{074b110f-7f58-4743-aea5-12f15b5074ed}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2139e6da-c341-4774-9ac3-b4e026347f64}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f1b577e-5e5a-4e8a-ba73-c657ea8e8598}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_1.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1138472b-d187-44e9-81f2-ae1b0e7785f1}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cd0d66ec-8057-43f5-acbd-66dfb36fd78c}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e21a7345-eb21-468e-be50-804db97cf708}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_1.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6f6ea3a9-2cf5-41cf-91c1-2170b1540063}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{94c1affa-66e7-4961-9521-cfdef3128d4f}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2139e6da-c341-4774-9ac3-b4e026347f64}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{94c1affa-66e7-4961-9521-cfdef3128d4f}\InProcServer32\ = "C:\\Windows\\system32\\xactengine3_3.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4c9b6dde-6809-46e6-a278-9b6a97588670}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e180344b-ac83-4483-959e-18a5c56a5e19}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cecec95a-d894-491a-bee3-5e106fb59f2d}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{fac23f48-31f5-45a8-b49b-5225d61401aa}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6f6ea3a9-2cf5-41cf-91c1-2170b1540063}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_0.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{629cf0de-3ecc-41e7-9926-f7e43eebec51}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_2.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4c9b6dde-6809-46e6-a278-9b6a97588670}\InProcServer32	regsvr32.exe

Loads dropped DLL 64 IoCs

pid	Process
4004	loader.exe
4004	loader.exe
3640	dxwsetup.exe
3640	dxwsetup.exe
3640	dxwsetup.exe
3640	dxwsetup.exe
3640	dxwsetup.exe
3640	dxwsetup.exe
3640	dxwsetup.exe
3640	dxwsetup.exe
3640	dxwsetup.exe
3640	dxwsetup.exe
3640	dxwsetup.exe
3640	dxwsetup.exe
3640	dxwsetup.exe
3640	dxwsetup.exe
3640	dxwsetup.exe
3640	dxwsetup.exe
3640	dxwsetup.exe
3640	dxwsetup.exe
3640	dxwsetup.exe
3640	dxwsetup.exe
3640	dxwsetup.exe
3640	dxwsetup.exe
3640	dxwsetup.exe
3640	dxwsetup.exe
3640	dxwsetup.exe
3640	dxwsetup.exe
3640	dxwsetup.exe
2680	regsvr32.exe
2680	regsvr32.exe
3640	dxwsetup.exe
3640	dxwsetup.exe
3640	dxwsetup.exe
3640	dxwsetup.exe
3640	dxwsetup.exe
3640	dxwsetup.exe
3640	dxwsetup.exe
3640	dxwsetup.exe
3640	dxwsetup.exe
3640	dxwsetup.exe
3640	dxwsetup.exe
3640	dxwsetup.exe
3640	dxwsetup.exe
3640	dxwsetup.exe
3640	dxwsetup.exe
3640	dxwsetup.exe
3640	dxwsetup.exe
3640	dxwsetup.exe
3640	dxwsetup.exe
4820	regsvr32.exe
3640	dxwsetup.exe
3412	regsvr32.exe
3412	regsvr32.exe
3640	dxwsetup.exe
5100	regsvr32.exe
5100	regsvr32.exe
3640	dxwsetup.exe
3060	regsvr32.exe
3060	regsvr32.exe
3640	dxwsetup.exe
2380	regsvr32.exe
3640	dxwsetup.exe
1444	regsvr32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	dxwebsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	dxwebsetup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\Desktop.ini	dxwsetup.exe
File created	C:\Windows\assembly\Desktop.ini	dxwsetup.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	dxwsetup.exe
File opened (read-only)	\??\F:	dxwsetup.exe
File opened (read-only)	\??\H:	dxwsetup.exe
File opened (read-only)	\??\J:	dxwsetup.exe
File opened (read-only)	\??\P:	dxwsetup.exe
File opened (read-only)	\??\V:	dxwsetup.exe
File opened (read-only)	\??\W:	dxwsetup.exe
File opened (read-only)	\??\X:	dxwsetup.exe
File opened (read-only)	\??\Z:	dxwsetup.exe
File opened (read-only)	\??\G:	dxwsetup.exe
File opened (read-only)	\??\L:	dxwsetup.exe
File opened (read-only)	\??\O:	dxwsetup.exe
File opened (read-only)	\??\U:	dxwsetup.exe
File opened (read-only)	\??\I:	dxwsetup.exe
File opened (read-only)	\??\K:	dxwsetup.exe
File opened (read-only)	\??\Q:	dxwsetup.exe
File opened (read-only)	\??\T:	dxwsetup.exe
File opened (read-only)	\??\Y:	dxwsetup.exe
File opened (read-only)	\??\B:	dxwsetup.exe
File opened (read-only)	\??\E:	dxwsetup.exe
File opened (read-only)	\??\M:	dxwsetup.exe
File opened (read-only)	\??\N:	dxwsetup.exe
File opened (read-only)	\??\R:	dxwsetup.exe
File opened (read-only)	\??\S:	dxwsetup.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\d3dx9_27.dll	infinst.exe
File created	C:\Windows\SysWOW64\SETEFA2.tmp	dxwsetup.exe
File opened for modification	C:\Windows\system32\d3dx9_32.dll	infinst.exe
File opened for modification	C:\Windows\SysWOW64\xactengine2_9.dll	dxwsetup.exe
File created	C:\Windows\system32\SET2E35.tmp	infinst.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Jun2010_d3dx9_43_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\d3dx9_26.dll	dxwsetup.exe
File opened for modification	C:\Windows\system32\SET1C44.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\SET1D78.tmp	dxwsetup.exe
File created	C:\Windows\system32\SET2329.tmp	infinst.exe
File created	C:\Windows\SysWOW64\SET23E8.tmp	dxwsetup.exe
File created	C:\Windows\SysWOW64\SETF7EA.tmp	dxwsetup.exe
File opened for modification	C:\Windows\system32\D3DCompiler_35.dll	infinst.exe
File opened for modification	C:\Windows\system32\d3dx10_36.dll	infinst.exe
File opened for modification	C:\Windows\system32\X3DAudio1_5.dll	infinst.exe
File created	C:\Windows\SysWOW64\SET1746.tmp	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Jun2007_d3dx9_34_x64.cab	dxwsetup.exe
File created	C:\Windows\system32\SETE862.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\SETF3FC.tmp	dxwsetup.exe
File created	C:\Windows\SysWOW64\SETFC17.tmp	dxwsetup.exe
File opened for modification	C:\Windows\system32\x3daudio1_2.dll	infinst.exe
File opened for modification	C:\Windows\system32\SETFE0E.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\d3dx10_39.dll	dxwsetup.exe
File created	C:\Windows\system32\SET13C9.tmp	infinst.exe
File created	C:\Windows\system32\SET2685.tmp	infinst.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Aug2008_xact_x64.cab	dxwsetup.exe
File created	C:\Windows\system32\SETF63D.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\xactengine3_2.dll	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Apr2006_xinput_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Apr2007_xinput_x64.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Jun2010_D3DCompiler_43_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Jun2010_d3dx10_43_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\d3dx9_27.dll	dxwsetup.exe
File created	C:\Windows\SysWOW64\SETEE1A.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\SET82.tmp	dxwsetup.exe
File created	C:\Windows\SysWOW64\SET15EB.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\D3DCompiler_40.dll	dxwsetup.exe
File opened for modification	C:\Windows\system32\d3dcsx_43.dll	infinst.exe
File created	C:\Windows\system32\SET11B.tmp	infinst.exe
File created	C:\Windows\system32\SET39B.tmp	infinst.exe
File opened for modification	C:\Windows\system32\SET154F.tmp	infinst.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\dxupdate.cab	dxwsetup.exe
File opened for modification	C:\Windows\system32\SETD9E.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\d3dx10_38.dll	dxwsetup.exe
File opened for modification	C:\Windows\system32\SET1781.tmp	infinst.exe
File opened for modification	C:\Windows\system32\SET1EF4.tmp	infinst.exe
File opened for modification	C:\Windows\system32\SET283A.tmp	infinst.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Apr2006_d3dx9_30_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\system32\SETF207.tmp	infinst.exe
File created	C:\Windows\system32\SETFD32.tmp	infinst.exe
File opened for modification	C:\Windows\system32\xactengine2_10.dll	infinst.exe
File created	C:\Windows\system32\SETF24.tmp	infinst.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Aug2009_d3dx10_42_x86.cab	dxwsetup.exe
File created	C:\Windows\system32\SETFC96.tmp	infinst.exe
File opened for modification	C:\Windows\system32\SET1109.tmp	infinst.exe
File created	C:\Windows\SysWOW64\SET199A.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\D3DCompiler_41.dll	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Nov2008_xact_x64.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Mar2009_xact_x64.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\SET5D7.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\SET985.tmp	dxwsetup.exe
File created	C:\Windows\SysWOW64\SETE5B8.tmp	dxwsetup.exe
File opened for modification	C:\Windows\system32\SETF4F5.tmp	infinst.exe
File opened for modification	C:\Windows\system32\SETF63E.tmp	infinst.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1900	loader.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4192_689870889\_metadata\verified_contents.json	elevation_service.exe
File created	C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4192_689870889\ChromeRecoveryCRX.crx	elevation_service.exe
File created	C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4192_689870889\ChromeRecovery.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4192_689870889\ChromeRecovery.exe	elevation_service.exe
File created	C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4192_689870889\manifest.json	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4192_689870889\manifest.json	elevation_service.exe
File created	C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4192_689870889\_metadata\verified_contents.json	elevation_service.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\msdownld.tmp\AS594591.tmp\Nov2008_d3dx10_40_x64.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS58AE43.tmp\Aug2006_xinput_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS58C6FB.tmp\Aug2007_d3dx10_35_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS58E020.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS59080B.tmp\Oct2006_xact_x86.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS590E06.tmp\Feb2007_xact_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5924CA.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS59339F.tmp\Jun2008_xact_x86.cab	dxwsetup.exe
File created	C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2904.0\Microsoft.DirectX.Direct3DX.xml	dxwsetup.exe
File created	C:\Windows\assembly\tmp\CHK3J92E\Microsoft.DirectX.dll	dxwsetup.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File created	C:\Windows\msdownld.tmp\AS58E8BB.tmp\Jun2010_d3dx10_43_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5920E2.tmp\Nov2007_d3dx10_36_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS594B6D.tmp\Mar2009_d3dx10_41_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS595A32.tmp\Aug2009_xaudio_x64.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS58C7F5.tmp\Nov2007_d3dx9_36_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS58C7F5.tmp\Nov2007_d3dx9_36_x86.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS58FF51.tmp\Feb2006_xact_x64.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS590D4B.tmp\Feb2007_xact_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS593D63.tmp\Aug2008_xact_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS593DFF.tmp	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS595A32.tmp\Aug2009_xaudio_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File created	C:\Windows\msdownld.tmp\AS58C9AA.tmp\Nov2007_d3dx10_36_x86.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS58FBC6.tmp\Feb2006_d3dx9_29_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS59223A.tmp\Nov2007_x3daudio_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5926FD.tmp	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS593FD4.tmp\Nov2008_x3daudio_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS595B0D.tmp	dxwsetup.exe
File created	C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.xml	dxwsetup.exe
File opened for modification	C:\Windows\libcrypto-1_1-x64.dll	Setup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS58B16F.tmp\Feb2005_d3dx9_24_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS58C9AA.tmp\Nov2007_d3dx10_36_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS59588C.tmp\Aug2009_xact_x86.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS596F50.tmp\MDX_1.0.2909.0_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\assembly\tmp\EXYEUXLK\__AssemblyInfo__.ini	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS58EA42.tmp\Jun2010_d3dcsx_43_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS590BC4.tmp\Dec2006_xact_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS593AC3.tmp\Aug2008_d3dx10_39_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\libssl-1_1-x64.dll	Setup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS58FFFC.tmp\Apr2006_d3dx9_30_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5951F5.tmp\Aug2009_d3dcsx_42_x64.cab	dxwsetup.exe
File created	C:\Windows\assembly\tmp\1DO6YGQN\Microsoft.DirectX.Direct3DX.dll	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS592353.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5956D7.tmp\Aug2009_D3DCompiler_42_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS595DBC.tmp\Feb2010_xaudio_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5963C7.tmp\Jun2010_D3DCompiler_43_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS596F50.tmp\MDX_1.0.2909.0_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File opened for modification	C:\Windows\msdownld.tmp\AS58E996.tmp\Jun2010_d3dx11_43_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS58FBC6.tmp\Feb2006_d3dx9_29_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS593CB7.tmp\Aug2008_xact_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS595C84.tmp\Feb2010_xact_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File created	C:\Windows\msdownld.tmp\AS58E6D7.tmp\Jun2010_d3dx9_43_x86.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS594E1C.tmp\Mar2009_xact_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File opened for modification	C:\Windows\msdownld.tmp\AS584DE3.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS58C9AA.tmp	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS58F0D9.tmp\Apr2005_d3dx9_25_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS59055B.tmp\Aug2006_xact_x64.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5918D4.tmp\Aug2007_d3dx9_35_x64.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS591D1A.tmp\Aug2007_xact_x86.cab	dxwsetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000789d96067ff55f5b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000789d96060000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff000000000700010000680900789d9606000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000789d960600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000789d960600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{629cf0de-3ecc-41e7-9926-f7e43eebec51}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0aa000aa-f404-11d9-bd7a-0010dc4f8f81}\ = "XACT Engine"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c0c56f46-29b1-44e9-9939-a32ce86867e2}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_0.dll"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{fac23f48-31f5-45a8-b49b-5225d61401aa}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{074b110f-7f58-4743-aea5-12f15b5074ed}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cecec95a-d894-491a-bee3-5e106fb59f2d}\InProcServer32\ThreadingModel = "Both"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{bcc782bc-6492-4c22-8c35-f5d72fe73c6e}	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0aa000aa-f404-11d9-bd7a-0010dc4f8f81}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_0.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{343e68e6-8f82-4a8d-a2da-6e9a944b378c}\InProcServer32\ThreadingModel = "Both"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e21a7345-eb21-468e-be50-804db97cf708}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4c5e637a-16c7-4de3-9c46-5ed22181962d}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9cab402c-1d37-44b4-886d-fa4f36170a4c}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1138472b-d187-44e9-81f2-ae1b0e7785f1}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cd0d66ec-8057-43f5-acbd-66dfb36fd78c}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c0c56f46-29b1-44e9-9939-a32ce86867e2}\InProcServer32\ThreadingModel = "Both"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c0c56f46-29b1-44e9-9939-a32ce86867e2}\ = "AudioVolumeMeter"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f5ca7b34-8055-42c0-b836-216129eb7e30}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94c1affa-66e7-4961-9521-cfdef3128d4f}\ = "XACT Engine"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{248d8a3b-6256-44d3-a018-2ac96c459f47}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_7.dll"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0aa000aa-f404-11d9-bd7a-0010dc4f8f81}\InProcServer32\ = "C:\\Windows\\SysWow64\\xactengine2_0.dll"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{343e68e6-8f82-4a8d-a2da-6e9a944b378c}\ = "XACT Engine"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0977d092-2d95-4e43-8d42-9ddcc2545ed5}\InProcServer32	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{074b110f-7f58-4743-aea5-12f15b5074ed}\InProcServer32\ = "C:\\Windows\\system32\\xactengine3_5.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d06df0d0-8518-441e-822f-5451d5c595b8}\InProcServer32\ThreadingModel = "Both"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2139e6da-c341-4774-9ac3-b4e026347f64}\ = "AudioVolumeMeter"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c60fae90-4183-4a3f-b2f7-ac1dc49b0e5c}	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3a2495ce-31d0-435b-8ccf-e9f0843fd960}	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f4769300-b949-4df9-b333-00d33932e9a6}	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8bb7778b-645b-4475-9a73-1de3170bd3af}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8bb7778b-645b-4475-9a73-1de3170bd3af}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{bc3e0fc6-2e0d-4c45-bc61-d9c328319bd8}\ = "XACT Engine"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3b80ee2a-b0f5-4780-9e30-90cb39685b03}\ = "XACT Engine"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{629cf0de-3ecc-41e7-9926-f7e43eebec51}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_2.dll"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{54b68bc7-3a45-416b-a8c9-19bf19ec1df5}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e48c5a3f-93ef-43bb-a092-2c7ceb946f27}	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cac1105f-619b-4d04-831a-44e1cbf12d57}\ = "AudioVolumeMeter"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{343e68e6-8f82-4a8d-a2da-6e9a944b378c}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_9.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c1e3f122-a2ea-442c-854f-20d98f8357a1}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3332f02-3dd0-4de9-9aec-20d85c4111b6}\ = "XACT Engine"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cac1105f-619b-4d04-831a-44e1cbf12d57}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_7.dll"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2139e6da-c341-4774-9ac3-b4e026347f64}\ = "AudioVolumeMeter"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{54b68bc7-3a45-416b-a8c9-19bf19ec1df5}	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3a2495ce-31d0-435b-8ccf-e9f0843fd960}\InProcServer32	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77c56bf4-18a1-42b0-88af-5072ce814949}\InProcServer32	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d06df0d0-8518-441e-822f-5451d5c595b8}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9cab402c-1d37-44b4-886d-fa4f36170a4c}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0977d092-2d95-4e43-8d42-9ddcc2545ed5}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3b80ee2a-b0f5-4780-9e30-90cb39685b03}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248d8a3b-6256-44d3-a018-2ac96c459f47}\ = "XACT Engine"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c60fae90-4183-4a3f-b2f7-ac1dc49b0e5c}\InProcServer32\ThreadingModel = "Both"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3332f02-3dd0-4de9-9aec-20d85c4111b6}\ = "XACT Engine"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94c1affa-66e7-4961-9521-cfdef3128d4f}\InProcServer32\ThreadingModel = "Both"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f4769300-b949-4df9-b333-00d33932e9a6}\InProcServer32\ThreadingModel = "Both"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0977d092-2d95-4e43-8d42-9ddcc2545ed5}	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3a2495ce-31d0-435b-8ccf-e9f0843fd960}\InProcServer32\ = "C:\\Windows\\SysWow64\\xactengine2_6.dll"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c7338b95-52b8-4542-aa79-42eb016c8c1c}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_4.dll"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d06df0d0-8518-441e-822f-5451d5c595b8}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f5ca7b34-8055-42c0-b836-216129eb7e30}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_2.dll"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0977d092-2d95-4e43-8d42-9ddcc2545ed5}\ = "XACT Engine"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0977d092-2d95-4e43-8d42-9ddcc2545ed5}\InProcServer32\ = "C:\\Windows\\SysWow64\\xactengine3_4.dll"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{074b110f-7f58-4743-aea5-12f15b5074ed}\InProcServer32	dxwsetup.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
3488	chrome.exe
3488	chrome.exe
3036	chrome.exe
3036	chrome.exe
3484	chrome.exe
3484	chrome.exe
4948	chrome.exe
4948	chrome.exe
5044	chrome.exe
5044	chrome.exe
1252	chrome.exe
1252	chrome.exe
220	chrome.exe
220	chrome.exe
4952	chrome.exe
4952	chrome.exe
4868	chrome.exe
4868	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
1900	loader.exe
1900	loader.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeBackupPrivilege	2836	vssvc.exe
Token: SeRestorePrivilege	2836	vssvc.exe
Token: SeAuditPrivilege	2836	vssvc.exe
Token: SeBackupPrivilege	2364	srtasks.exe
Token: SeRestorePrivilege	2364	srtasks.exe
Token: SeSecurityPrivilege	2364	srtasks.exe
Token: SeTakeOwnershipPrivilege	2364	srtasks.exe
Token: SeBackupPrivilege	2364	srtasks.exe
Token: SeRestorePrivilege	2364	srtasks.exe
Token: SeSecurityPrivilege	2364	srtasks.exe
Token: SeTakeOwnershipPrivilege	2364	srtasks.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2896	Setup.exe
1900	loader.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 5084	3036	chrome.exe	93
PID 3036 wrote to memory of 5084	3036	chrome.exe	93
PID 3036 wrote to memory of 2832	3036	chrome.exe	96
PID 3036 wrote to memory of 2832	3036	chrome.exe	96
PID 3036 wrote to memory of 2832	3036	chrome.exe	96
PID 3036 wrote to memory of 2832	3036	chrome.exe	96
PID 3036 wrote to memory of 2832	3036	chrome.exe	96
PID 3036 wrote to memory of 2832	3036	chrome.exe	96
PID 3036 wrote to memory of 2832	3036	chrome.exe	96
PID 3036 wrote to memory of 2832	3036	chrome.exe	96
PID 3036 wrote to memory of 2832	3036	chrome.exe	96
PID 3036 wrote to memory of 2832	3036	chrome.exe	96
PID 3036 wrote to memory of 2832	3036	chrome.exe	96
PID 3036 wrote to memory of 2832	3036	chrome.exe	96
PID 3036 wrote to memory of 2832	3036	chrome.exe	96
PID 3036 wrote to memory of 2832	3036	chrome.exe	96
PID 3036 wrote to memory of 2832	3036	chrome.exe	96
PID 3036 wrote to memory of 2832	3036	chrome.exe	96
PID 3036 wrote to memory of 2832	3036	chrome.exe	96
PID 3036 wrote to memory of 2832	3036	chrome.exe	96
PID 3036 wrote to memory of 2832	3036	chrome.exe	96
PID 3036 wrote to memory of 2832	3036	chrome.exe	96
PID 3036 wrote to memory of 2832	3036	chrome.exe	96
PID 3036 wrote to memory of 2832	3036	chrome.exe	96
PID 3036 wrote to memory of 2832	3036	chrome.exe	96
PID 3036 wrote to memory of 2832	3036	chrome.exe	96
PID 3036 wrote to memory of 2832	3036	chrome.exe	96
PID 3036 wrote to memory of 2832	3036	chrome.exe	96
PID 3036 wrote to memory of 2832	3036	chrome.exe	96
PID 3036 wrote to memory of 2832	3036	chrome.exe	96
PID 3036 wrote to memory of 2832	3036	chrome.exe	96
PID 3036 wrote to memory of 2832	3036	chrome.exe	96
PID 3036 wrote to memory of 2832	3036	chrome.exe	96
PID 3036 wrote to memory of 2832	3036	chrome.exe	96
PID 3036 wrote to memory of 2832	3036	chrome.exe	96
PID 3036 wrote to memory of 2832	3036	chrome.exe	96
PID 3036 wrote to memory of 2832	3036	chrome.exe	96
PID 3036 wrote to memory of 2832	3036	chrome.exe	96
PID 3036 wrote to memory of 2832	3036	chrome.exe	96
PID 3036 wrote to memory of 2832	3036	chrome.exe	96
PID 3036 wrote to memory of 2832	3036	chrome.exe	96
PID 3036 wrote to memory of 2832	3036	chrome.exe	96
PID 3036 wrote to memory of 3488	3036	chrome.exe	97
PID 3036 wrote to memory of 3488	3036	chrome.exe	97
PID 3036 wrote to memory of 3916	3036	chrome.exe	98
PID 3036 wrote to memory of 3916	3036	chrome.exe	98
PID 3036 wrote to memory of 3916	3036	chrome.exe	98
PID 3036 wrote to memory of 3916	3036	chrome.exe	98
PID 3036 wrote to memory of 3916	3036	chrome.exe	98
PID 3036 wrote to memory of 3916	3036	chrome.exe	98
PID 3036 wrote to memory of 3916	3036	chrome.exe	98
PID 3036 wrote to memory of 3916	3036	chrome.exe	98
PID 3036 wrote to memory of 3916	3036	chrome.exe	98
PID 3036 wrote to memory of 3916	3036	chrome.exe	98
PID 3036 wrote to memory of 3916	3036	chrome.exe	98
PID 3036 wrote to memory of 3916	3036	chrome.exe	98
PID 3036 wrote to memory of 3916	3036	chrome.exe	98
PID 3036 wrote to memory of 3916	3036	chrome.exe	98
PID 3036 wrote to memory of 3916	3036	chrome.exe	98
PID 3036 wrote to memory of 3916	3036	chrome.exe	98
PID 3036 wrote to memory of 3916	3036	chrome.exe	98
PID 3036 wrote to memory of 3916	3036	chrome.exe	98
PID 3036 wrote to memory of 3916	3036	chrome.exe	98
PID 3036 wrote to memory of 3916	3036	chrome.exe	98

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Drops file in Windows directory
PID:1056

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1708

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2896

C:\Users\Admin\Desktop\loader.exe
"C:\Users\Admin\Desktop\loader.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4004

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa05214f50,0x7ffa05214f60,0x7ffa05214f70
  2⤵
  PID:5084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1648,13355850914150973045,14840946917539212790,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1704 /prefetch:2
  2⤵
  PID:2832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1648,13355850914150973045,14840946917539212790,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2008 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1648,13355850914150973045,14840946917539212790,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2300 /prefetch:8
  2⤵
  PID:3916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,13355850914150973045,14840946917539212790,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2976 /prefetch:1
  2⤵
  PID:400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,13355850914150973045,14840946917539212790,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2964 /prefetch:1
  2⤵
  PID:2596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,13355850914150973045,14840946917539212790,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3776 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1648,13355850914150973045,14840946917539212790,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4520 /prefetch:8
  2⤵
  PID:3952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1648,13355850914150973045,14840946917539212790,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4644 /prefetch:8
  2⤵
  PID:2920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1648,13355850914150973045,14840946917539212790,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4776 /prefetch:8
  2⤵
  PID:3008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1648,13355850914150973045,14840946917539212790,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4680 /prefetch:8
  2⤵
  PID:3132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1648,13355850914150973045,14840946917539212790,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4632 /prefetch:8
  2⤵
  PID:3452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1648,13355850914150973045,14840946917539212790,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4716 /prefetch:8
  2⤵
  PID:4132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1648,13355850914150973045,14840946917539212790,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  PID:596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,13355850914150973045,14840946917539212790,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1648,13355850914150973045,14840946917539212790,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3396 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,13355850914150973045,14840946917539212790,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:3572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1648,13355850914150973045,14840946917539212790,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4664 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1648,13355850914150973045,14840946917539212790,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4868 /prefetch:8
  2⤵
  PID:1780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,13355850914150973045,14840946917539212790,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4900 /prefetch:8
  2⤵
  PID:1508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1648,13355850914150973045,14840946917539212790,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4852 /prefetch:8
  2⤵
  PID:4388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,13355850914150973045,14840946917539212790,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3004 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,13355850914150973045,14840946917539212790,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,13355850914150973045,14840946917539212790,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,13355850914150973045,14840946917539212790,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,13355850914150973045,14840946917539212790,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:3656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,13355850914150973045,14840946917539212790,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,13355850914150973045,14840946917539212790,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:1708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1648,13355850914150973045,14840946917539212790,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3440 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1648,13355850914150973045,14840946917539212790,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  PID:3812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1648,13355850914150973045,14840946917539212790,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4904 /prefetch:8
  2⤵
  PID:3024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1648,13355850914150973045,14840946917539212790,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3880 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1648,13355850914150973045,14840946917539212790,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3972 /prefetch:8
  2⤵
  PID:2296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1648,13355850914150973045,14840946917539212790,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4548 /prefetch:8
  2⤵
  PID:3080
- C:\Users\Admin\Downloads\dxwebsetup.exe
  "C:\Users\Admin\Downloads\dxwebsetup.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2300
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops desktop.ini file(s)
    - Enumerates connected drives
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies registry class
    PID:3640
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe d3dx9_24_x64.inf
      4⤵
      Executes dropped EXE
      PID:4776
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe d3dx9_25_x64.inf
      4⤵
      Executes dropped EXE
      PID:4684
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe d3dx9_26_x64.inf
      4⤵
      Executes dropped EXE
      PID:4840
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe d3dx9_27_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:3784
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe d3dx9_28_x64.inf
      4⤵
      Executes dropped EXE
      PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe d3dx9_29_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:3740
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe XACT_x64.inf
      4⤵
      Executes dropped EXE
      PID:1020
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_0.dll
      4⤵
      Registers COM server for autorun
      Loads dropped DLL
      Modifies registry class
      PID:2680
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe d3dx9_30_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:1164
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe XACT2_1_x64.inf
      4⤵
      Executes dropped EXE
      PID:2792
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_1.dll
      4⤵
      Registers COM server for autorun
      Loads dropped DLL
      PID:4820
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe xinput1_1_x64.inf, Install_Driver
      4⤵
      Executes dropped EXE
      PID:4884
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe XACT2_2_x64.inf
      4⤵
      Executes dropped EXE
      PID:4364
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_2.dll
      4⤵
      Registers COM server for autorun
      Loads dropped DLL
      PID:3412
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe xinput1_2_x64.inf, Install_Driver
      4⤵
      Executes dropped EXE
      PID:1668
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe XACT2_3_x64.inf
      4⤵
      Executes dropped EXE
      PID:2496
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_3.dll
      4⤵
      Registers COM server for autorun
      Loads dropped DLL
      Modifies registry class
      PID:5100
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe d3dx9_31_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:5024
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe XACT2_4_x64.inf
      4⤵
      Executes dropped EXE
      PID:5080
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_4.dll
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:3060
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe d3dx9_32_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:3528
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe d3dx10_00_x64.inf
      4⤵
      Executes dropped EXE
      PID:3068
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe XACT2_5_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:1068
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_5.dll
      4⤵
      Registers COM server for autorun
      Loads dropped DLL
      Modifies registry class
      PID:2380
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe XACT2_6_x64.inf
      4⤵
      Executes dropped EXE
      PID:380
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_6.dll
      4⤵
      Loads dropped DLL
      PID:1444
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe d3dx9_33_x64.inf
      4⤵
      Executes dropped EXE
      PID:2936
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe d3dx10_33_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:3132
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe XACT2_7_x64.inf
      4⤵
      Executes dropped EXE
      PID:4072
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_7.dll
      4⤵
      Registers COM server for autorun
      Modifies registry class
      PID:3128
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe xinput1_3_x64.inf, Install_Driver
      4⤵
      Executes dropped EXE
      PID:3140
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe d3dx9_34_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:3456
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe d3dx10_34_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:3664
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe XACT2_8_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:3104
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_8.dll
      4⤵
      Registers COM server for autorun
      PID:4208
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe d3dx9_35_x64.inf
      4⤵
      Executes dropped EXE
      PID:2248
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe d3dx10_35_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:4008
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe XACT2_9_x64.inf
      4⤵
      Executes dropped EXE
      PID:600
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_9.dll
      4⤵
      Registers COM server for autorun
      Modifies registry class
      PID:2164
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe d3dx9_36_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:4276
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe d3dx10_36_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:4888
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe X3DAudio1_2_x64.inf
      4⤵
      Executes dropped EXE
      PID:696
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe XACT2_10_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:2348
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_10.dll
      4⤵
      Registers COM server for autorun
      PID:2208
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe D3DX9_37_x64.inf
      4⤵
      Executes dropped EXE
      PID:1868
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe d3dx10_37_x64.inf
      4⤵
      Executes dropped EXE
      PID:3000
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe X3DAudio1_3_x64.inf
      4⤵
      Executes dropped EXE
      PID:4764
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe XACT3_0_x64.inf
      4⤵
      Executes dropped EXE
      PID:4216
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_0.dll
      4⤵
      Registers COM server for autorun
      Modifies registry class
      PID:4304
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe XAudio2_0_x64.inf
      4⤵
      Executes dropped EXE
      PID:3464
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_0.dll
      4⤵
      Registers COM server for autorun
      Modifies registry class
      PID:3676
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe D3DX9_38_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:2788
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe d3dx10_38_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:1484
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe X3DAudio1_4_x64.inf
      4⤵
      Executes dropped EXE
      PID:4172
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe XACT3_1_x64.inf
      4⤵
      Executes dropped EXE
      PID:3244
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_1.dll
      4⤵
      Registers COM server for autorun
      PID:2892
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe XAudio2_1_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:4956
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_1.dll
      4⤵
      Registers COM server for autorun
      Modifies registry class
      PID:4776
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe D3DX9_39_x64.inf
      4⤵
      Executes dropped EXE
      PID:2828
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe d3dx10_39_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:2328
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe XACT3_2_x64.inf
      4⤵
      Executes dropped EXE
      PID:2412
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_2.dll
      4⤵
      Registers COM server for autorun
      Modifies registry class
      PID:3784
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe XAudio2_2_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:4700
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_2.dll
      4⤵
      Registers COM server for autorun
      Modifies registry class
      PID:2968
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe X3DAudio1_5_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      PID:2700
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe XACT3_3_x64.inf
      4⤵
      Executes dropped EXE
      PID:1888
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_3.dll
      4⤵
      Registers COM server for autorun
      PID:4928
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe XAudio2_3_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:868
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_3.dll
      4⤵
      Registers COM server for autorun
      Modifies registry class
      PID:4908
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe D3DX9_40_x64.inf
      4⤵
      Executes dropped EXE
      PID:4896
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe d3dx10_40_x64.inf
      4⤵
      Executes dropped EXE
      PID:4816
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe X3DAudio1_6_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:4880
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe XACT3_4_x64.inf
      4⤵
      Executes dropped EXE
      PID:4592
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_4.dll
      4⤵
      Registers COM server for autorun
      Modifies registry class
      PID:4820
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe XAudio2_4_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:1232
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_4.dll
      4⤵
      Registers COM server for autorun
      Modifies registry class
      PID:4796
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe D3DX9_41_x64.inf
      4⤵
      Executes dropped EXE
      PID:1432
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe d3dx10_41_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:32
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe D3DX9_42_x64.inf
      4⤵
      Executes dropped EXE
      PID:3008
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe d3dx10_42_x64.inf
      4⤵
      Executes dropped EXE
      PID:1632
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe d3dx11_42_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:392
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe d3dcsx_42_x64.inf
      4⤵
      Drops file in System32 directory
      PID:3748
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe D3DCompiler_42_x64.inf
      4⤵
      PID:1500
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe XACT3_5_x64.inf
      4⤵
      PID:4756
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_5.dll
      4⤵
      Registers COM server for autorun
      Modifies registry class
      PID:3380
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe XAudio2_5_x64.inf
      4⤵
      PID:5080
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_5.dll
      4⤵
      Registers COM server for autorun
      Modifies registry class
      PID:5104
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe X3DAudio1_7_x64.inf
      4⤵
      Drops file in System32 directory
      PID:3884
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe XACT3_6_x64.inf
      4⤵
      PID:3528
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_6.dll
      4⤵
      Modifies registry class
      PID:4608
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe XAudio2_6_x64.inf
      4⤵
      Drops file in System32 directory
      PID:376
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_6.dll
      4⤵
      Registers COM server for autorun
      PID:3408
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe D3DX9_43_x64.inf
      4⤵
      PID:712
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe d3dx10_43_x64.inf
      4⤵
      PID:3352
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe d3dx11_43_x64.inf
      4⤵
      PID:1444
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe d3dcsx_43_x64.inf
      4⤵
      Drops file in System32 directory
      PID:3460
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe D3DCompiler_43_x64.inf
      4⤵
      Drops file in Windows directory
      PID:4772
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe XACT3_7_x64.inf
      4⤵
      Drops file in System32 directory
      PID:692
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_7.dll
      4⤵
      PID:4176
  - - C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXC04A.tmp\infinst.exe XAudio2_7_x64.inf
      4⤵
      PID:4076
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_7.dll
      4⤵
      Registers COM server for autorun
      Modifies registry class
      PID:4028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1648,13355850914150973045,14840946917539212790,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1648,13355850914150973045,14840946917539212790,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4932 /prefetch:8
  2⤵
  PID:5060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1648,13355850914150973045,14840946917539212790,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5600 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,13355850914150973045,14840946917539212790,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:4956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,13355850914150973045,14840946917539212790,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4004 /prefetch:8
  2⤵
  PID:3008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1648,13355850914150973045,14840946917539212790,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1648,13355850914150973045,14840946917539212790,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5388 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,13355850914150973045,14840946917539212790,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:3912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,13355850914150973045,14840946917539212790,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1504 /prefetch:8
  2⤵
  PID:868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4020

C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"
1⤵
- Drops file in Program Files directory
PID:4192
- C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4192_689870889\ChromeRecovery.exe
  "C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4192_689870889\ChromeRecovery.exe" --appguid={8A69D345-D564-463c-AFF1-A69D9E530F96} --browser-version=89.0.4389.114 --sessionid={7976274a-2c3d-4772-ac89-ab91738a6a28} --system
  2⤵
  - Executes dropped EXE
  PID:392

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2836

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2364

C:\Users\Admin\Desktop\loader.exe
"C:\Users\Admin\Desktop\loader.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1900

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4192_689870889\ChromeRecovery.exe

Filesize
253KB

MD5
49ac3c96d270702a27b4895e4ce1f42a

SHA1
55b90405f1e1b72143c64113e8bc65608dd3fd76

SHA256
82aa3fd6a25cda9e16689cfadea175091be010cecae537e517f392e0bef5ba0f

SHA512
b62f6501cb4c992d42d9097e356805c88ac4ac5a46ead4a8eee9f8cbae197b2305da8aab5b4a61891fe73951588025f2d642c32524b360687993f98c913138a0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\RecoveryImproved\1.3.36.141\Recovery.crx3

Filesize
141KB

MD5
ea1c1ffd3ea54d1fb117bfdbb3569c60

SHA1
10958b0f690ae8f5240e1528b1ccffff28a33272

SHA256
7c3a6a7d16ac44c3200f572a764bce7d8fa84b9572dd028b15c59bdccbc0a77d

SHA512
6c30728cac9eac53f0b27b7dbe2222da83225c3b63617d6b271a6cfedf18e8f0a8dffa1053e1cbc4c5e16625f4bbc0d03aa306a946c9d72faa4ceb779f8ffcaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dsetup.dll

Filesize
93KB

MD5
984cad22fa542a08c5d22941b888d8dc

SHA1
3e3522e7f3af329f2235b0f0850d664d5377b3cd

SHA256
57bc22850bb8e0bcc511a9b54cd3da18eec61f3088940c07d63b9b74e7fe2308

SHA512
8ef171218b331f0591a4b2a5e68dcbae98f5891518ce877f1d8d1769c59c0f4ddae43cc43da6606975078f889c832f0666484db9e047782e7a0ae4a2d41f5bef

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dsetup32.dll

Filesize
1.5MB

MD5
a5412a144f63d639b47fcc1ba68cb029

SHA1
81bd5f1c99b22c0266f3f59959dfb4ea023be47e

SHA256
8a011da043a4b81e2b3d41a332e0ff23a65d546bd7636e8bc74885e8746927d6

SHA512
2679a4cb690e8d709cb5e57b59315d22f69f91efa6c4ee841943751c882b0c0457fd4a3376ac3832c757c6dfaffb7d844909c5665b86a95339af586097ee0405

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxupdate.dll

Filesize
173KB

MD5
7ed554b08e5b69578f9de012822c39c9

SHA1
036d04513e134786b4758def5aff83d19bf50c6e

SHA256
fb4f297e295c802b1377c6684734b7249d55743dfb7c14807bef59a1b5db63a2

SHA512
7af5f9c4a3ad5c120bcdd681b958808ada4d885d21aeb4a009a36a674ad3ece9b51837212a982db6142a6b5580e5b68d46971b802456701391ce40785ae6ebd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxupdate.dll

Filesize
173KB

MD5
7ed554b08e5b69578f9de012822c39c9

SHA1
036d04513e134786b4758def5aff83d19bf50c6e

SHA256
fb4f297e295c802b1377c6684734b7249d55743dfb7c14807bef59a1b5db63a2

SHA512
7af5f9c4a3ad5c120bcdd681b958808ada4d885d21aeb4a009a36a674ad3ece9b51837212a982db6142a6b5580e5b68d46971b802456701391ce40785ae6ebd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.cif

Filesize
56KB

MD5
7b1fbe9f5f43b2261234b78fe115cf8e

SHA1
dd0f256ae38b4c4771e1d1ec001627017b7bb741

SHA256
762ff640013db2bd4109d7df43a867303093815751129bd1e33f16bf02e52cce

SHA512
d21935a9867c0f2f7084917c79fbb1da885a1bfd4793cf669ff4da8c777b3a201857250bfb7c2b616625a8d3573c68395d210446d2c284b41cf09cc7cbb07885

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe

Filesize
515KB

MD5
ac3a5f7be8cd13a863b50ab5fe00b71c

SHA1
eee417cd92e263b84dd3b5dcc2b4b463fe6e84d9

SHA256
8f5e89298e3dc2e22d47515900c37cca4ee121c5ba06a6d962d40ad6e1a595da

SHA512
c8bbe791373dad681f0ac9f5ab538119bde685d4f901f5db085c73163fc2e868972b2de60e72ccd44f745f1fd88fcde2e27f32302d8cbd3c1f43e6e657c79fba

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe

Filesize
515KB

MD5
ac3a5f7be8cd13a863b50ab5fe00b71c

SHA1
eee417cd92e263b84dd3b5dcc2b4b463fe6e84d9

SHA256
8f5e89298e3dc2e22d47515900c37cca4ee121c5ba06a6d962d40ad6e1a595da

SHA512
c8bbe791373dad681f0ac9f5ab538119bde685d4f901f5db085c73163fc2e868972b2de60e72ccd44f745f1fd88fcde2e27f32302d8cbd3c1f43e6e657c79fba

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.inf

Filesize
477B

MD5
ad8982eaa02c7ad4d7cdcbc248caa941

SHA1
4ccd8e038d73a5361d754c7598ed238fc040d16b

SHA256
d63c35e9b43eb0f28ffc28f61c9c9a306da9c9de3386770a7eb19faa44dbfc00

SHA512
5c805d78bafff06c36b5df6286709ddf2d36808280f92e62dc4c285edd9176195a764d5cf0bb000da53ca8bbf66ddd61d852e4259e3113f6529e2d7bdbdd6e28

Download Submit
C:\Users\Admin\Desktop\loader.exe

Filesize
42.7MB

MD5
ea5519203c0329cdf9620eee5085ac5c

SHA1
98ede1462f961c5415a751123e2acdcb6dd5327e

SHA256
d5b69437f81a83e57d7613286a2f7339a577f85bd82c5543096c826f6780fea0

SHA512
fd786bbefe4b117f730ac8b287b02ae60c80063cdc915ee3b5351f6ff3ae855d11562b1a9272d4c726ae5ea53c5833c5bde750d6d5058bbf3bba7601896bbe09

Download Submit
C:\Users\Admin\Desktop\loader.exe

Filesize
42.7MB

MD5
ea5519203c0329cdf9620eee5085ac5c

SHA1
98ede1462f961c5415a751123e2acdcb6dd5327e

SHA256
d5b69437f81a83e57d7613286a2f7339a577f85bd82c5543096c826f6780fea0

SHA512
fd786bbefe4b117f730ac8b287b02ae60c80063cdc915ee3b5351f6ff3ae855d11562b1a9272d4c726ae5ea53c5833c5bde750d6d5058bbf3bba7601896bbe09

Download Submit
C:\Users\Admin\Desktop\loader.exe

Filesize
42.7MB

MD5
ea5519203c0329cdf9620eee5085ac5c

SHA1
98ede1462f961c5415a751123e2acdcb6dd5327e

SHA256
d5b69437f81a83e57d7613286a2f7339a577f85bd82c5543096c826f6780fea0

SHA512
fd786bbefe4b117f730ac8b287b02ae60c80063cdc915ee3b5351f6ff3ae855d11562b1a9272d4c726ae5ea53c5833c5bde750d6d5058bbf3bba7601896bbe09

Download Submit
C:\Users\Admin\Downloads\dxwebsetup.exe

Filesize
288KB

MD5
2cbd6ad183914a0c554f0739069e77d7

SHA1
7bf35f2afca666078db35ca95130beb2e3782212

SHA256
2cf71d098c608c56e07f4655855a886c3102553f648df88458df616b26fd612f

SHA512
ff1af2d2a883865f2412dddcd68006d1907a719fe833319c833f897c93ee750bac494c0991170dc1cf726b3f0406707daa361d06568cd610eeb4ed1d9c0fbb10

Download Submit
C:\Users\Admin\Downloads\dxwebsetup.exe

Filesize
288KB

MD5
2cbd6ad183914a0c554f0739069e77d7

SHA1
7bf35f2afca666078db35ca95130beb2e3782212

SHA256
2cf71d098c608c56e07f4655855a886c3102553f648df88458df616b26fd612f

SHA512
ff1af2d2a883865f2412dddcd68006d1907a719fe833319c833f897c93ee750bac494c0991170dc1cf726b3f0406707daa361d06568cd610eeb4ed1d9c0fbb10

Download Submit
C:\Windows\SysWOW64\directx\websetup\dsetup.dll

Filesize
93KB

MD5
984cad22fa542a08c5d22941b888d8dc

SHA1
3e3522e7f3af329f2235b0f0850d664d5377b3cd

SHA256
57bc22850bb8e0bcc511a9b54cd3da18eec61f3088940c07d63b9b74e7fe2308

SHA512
8ef171218b331f0591a4b2a5e68dcbae98f5891518ce877f1d8d1769c59c0f4ddae43cc43da6606975078f889c832f0666484db9e047782e7a0ae4a2d41f5bef

Download Submit
C:\Windows\SysWOW64\directx\websetup\dsetup32.dll

Filesize
1.5MB

MD5
a5412a144f63d639b47fcc1ba68cb029

SHA1
81bd5f1c99b22c0266f3f59959dfb4ea023be47e

SHA256
8a011da043a4b81e2b3d41a332e0ff23a65d546bd7636e8bc74885e8746927d6

SHA512
2679a4cb690e8d709cb5e57b59315d22f69f91efa6c4ee841943751c882b0c0457fd4a3376ac3832c757c6dfaffb7d844909c5665b86a95339af586097ee0405

Download Submit
C:\Windows\crossplatform.crt

Filesize
214KB

MD5
491c66b02d27c8027db2d66297bc27b8

SHA1
cde762d445e2cc5599944c1f7544885bfe9101a9

SHA256
be668675dc24f64453f11cf5e0c631982bad3709ad0eadc47e9ddb30d3bdb984

SHA512
eefb3c78472b5b8c79b63baff3a2c5d332870991d59de313096cec9d31b0bd47899d49c7b96d688b2474bce42511dd170e51d2ac597cabad1eb578b7e310336c

Download Submit
C:\Windows\libcrypto-1_1-x64.dll

Filesize
2.7MB

MD5
a0c031afb19bc9a2a9f53cb3b5bf7ff8

SHA1
ff8e61895ef976a45ba5b5ebeacbdbf68ab6f8ce

SHA256
7eb3fba2dbc1ea25c95bf6247ad03d769d71bec5498dee218d4c066cc07c3824

SHA512
4f7e988251644bcc4c3ce0fb1148ab9fd4c21496f94076302e6e9582f42540ea6d5d78f896028e92e67af5eac00abbced899419c2aa14497f1db81e2510afd79

Download Submit
C:\Windows\libcrypto-1_1-x64.dll

Filesize
2.7MB

MD5
a0c031afb19bc9a2a9f53cb3b5bf7ff8

SHA1
ff8e61895ef976a45ba5b5ebeacbdbf68ab6f8ce

SHA256
7eb3fba2dbc1ea25c95bf6247ad03d769d71bec5498dee218d4c066cc07c3824

SHA512
4f7e988251644bcc4c3ce0fb1148ab9fd4c21496f94076302e6e9582f42540ea6d5d78f896028e92e67af5eac00abbced899419c2aa14497f1db81e2510afd79

Download Submit
C:\Windows\libcrypto-1_1-x64.dll

Filesize
2.7MB

MD5
a0c031afb19bc9a2a9f53cb3b5bf7ff8

SHA1
ff8e61895ef976a45ba5b5ebeacbdbf68ab6f8ce

SHA256
7eb3fba2dbc1ea25c95bf6247ad03d769d71bec5498dee218d4c066cc07c3824

SHA512
4f7e988251644bcc4c3ce0fb1148ab9fd4c21496f94076302e6e9582f42540ea6d5d78f896028e92e67af5eac00abbced899419c2aa14497f1db81e2510afd79

Download Submit
C:\Windows\libssl-1_1-x64.dll

Filesize
670KB

MD5
04b5bd1135fa4f31cb9c021bb7ff4725

SHA1
62623b7fa42353db63482af4231ec6772bb8444d

SHA256
69f1d1dd8cc363a734972a67ac51538f9bfff990f1298d8d3665fa38ee41a084

SHA512
887ca8412f47d4591984316c147d907344cb0b8630c24765a7f7e0d26d52048a55a7fc3604594c402dbbd1dde58471f374cb810e87b06c05039d269fbfb20246

Download Submit
C:\Windows\libssl-1_1-x64.dll

Filesize
670KB

MD5
04b5bd1135fa4f31cb9c021bb7ff4725

SHA1
62623b7fa42353db63482af4231ec6772bb8444d

SHA256
69f1d1dd8cc363a734972a67ac51538f9bfff990f1298d8d3665fa38ee41a084

SHA512
887ca8412f47d4591984316c147d907344cb0b8630c24765a7f7e0d26d52048a55a7fc3604594c402dbbd1dde58471f374cb810e87b06c05039d269fbfb20246

Download Submit
C:\Windows\libssl-1_1-x64.dll

Filesize
670KB

MD5
04b5bd1135fa4f31cb9c021bb7ff4725

SHA1
62623b7fa42353db63482af4231ec6772bb8444d

SHA256
69f1d1dd8cc363a734972a67ac51538f9bfff990f1298d8d3665fa38ee41a084

SHA512
887ca8412f47d4591984316c147d907344cb0b8630c24765a7f7e0d26d52048a55a7fc3604594c402dbbd1dde58471f374cb810e87b06c05039d269fbfb20246

Download Submit
memory/1900-235-0x00007FF7C0C20000-0x00007FF7C6028000-memory.dmp

Filesize
84.0MB

Download
memory/1900-239-0x000001ACDB0B0000-0x000001ACDB1B0000-memory.dmp

Filesize
1024KB

Download
memory/1900-240-0x00007FF7C0C20000-0x00007FF7C6028000-memory.dmp

Filesize
84.0MB

Download
memory/2208-217-0x0000000000871000-0x00000000008CC000-memory.dmp

Filesize
364KB

Download
memory/2208-216-0x0000000000870000-0x00000000008D9000-memory.dmp

Filesize
420KB

Download
memory/2680-169-0x0000000001F01000-0x0000000001F50000-memory.dmp

Filesize
316KB

Download
memory/2680-168-0x0000000001F00000-0x0000000001F5C000-memory.dmp

Filesize
368KB

Download
memory/3060-187-0x00000000020F1000-0x0000000002142000-memory.dmp

Filesize
324KB

Download
memory/3060-186-0x00000000020F0000-0x000000000214E000-memory.dmp

Filesize
376KB

Download
memory/3128-198-0x0000000002010000-0x0000000002076000-memory.dmp

Filesize
408KB

Download
memory/3128-199-0x0000000002011000-0x000000000206A000-memory.dmp

Filesize
356KB

Download
memory/3412-177-0x0000000001EF1000-0x0000000001F3F000-memory.dmp

Filesize
312KB

Download
memory/3412-176-0x0000000001EF0000-0x0000000001F4A000-memory.dmp

Filesize
360KB

Download
memory/4208-206-0x0000000001FE1000-0x000000000203C000-memory.dmp

Filesize
364KB

Download
memory/4208-205-0x0000000001FE0000-0x0000000002049000-memory.dmp

Filesize
420KB

Download
memory/5100-182-0x0000000002111000-0x0000000002162000-memory.dmp

Filesize
324KB

Download
memory/5100-181-0x0000000002110000-0x000000000216E000-memory.dmp

Filesize
376KB

Download