Overview

overview

7

Static

static

1

ovisetup.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    153s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-02-2023 20:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ovisetup.exe

  • Size

    4.4MB

  • MD5

    1692aec61ddcdda471defa199c62d25a

  • SHA1

    484af221468ddb534b74e12970de80d5dfee2b28

  • SHA256

    84bde632c5bfd2a7ff84e579e6f7561543ca0aad6d8e7275dae5926ba4f561c1

  • SHA512

    19155d0770fc0931ab8ac1bf35f56b32c8c122379adac6866b07cebec28932f92be124638cd7bb9fdaff5edd091f3af0c1fbd0757a99de44e24f11214f13329a

  • SSDEEP

    49152:9Hox6U/D1LbDxklrSWZAhizWV4yFK73bBxaaNNG0pHSdtDLboHTBWpHg6UvM98IQ:2x6qaAVpchNG0pHA57HgR

Score
7/10
discoveryevasionpersistencetrojan

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Registers COM server for autorun 1 TTPs 64 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Drops desktop.ini file(s) 2 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ovisetup.exe
    "C:\Users\Admin\AppData\Local\Temp\ovisetup.exe"
    1⤵
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4884
    • C:\Users\Admin\AppData\Local\Temp\OpenIV Setup_0E566883\dxwebsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\OpenIV Setup_0E566883\dxwebsetup.exe" /Q
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1612
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe /windowsupdate
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops desktop.ini file(s)
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:3172
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe d3dx9_24_x64.inf
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:2460
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe d3dx9_25_x64.inf
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          PID:3940
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe d3dx9_26_x64.inf
          4⤵
          • Executes dropped EXE
          PID:4912
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe d3dx9_27_x64.inf
          4⤵
          • Executes dropped EXE
          PID:2668
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe d3dx9_28_x64.inf
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          PID:788
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe d3dx9_29_x64.inf
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          PID:2836
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe XACT_x64.inf
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          PID:1824
        • C:\Windows\system32\regsvr32.exe
          C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_0.dll
          4⤵
          • Loads dropped DLL
          • Registers COM server for autorun
          PID:4780
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe d3dx9_30_x64.inf
          4⤵
          • Executes dropped EXE
          PID:3028
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe XACT2_1_x64.inf
          4⤵
          • Executes dropped EXE
          PID:2136
        • C:\Windows\system32\regsvr32.exe
          C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_1.dll
          4⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:3012
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe xinput1_1_x64.inf, Install_Driver
          4⤵
          • Executes dropped EXE
          PID:2032
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe XACT2_2_x64.inf
          4⤵
          • Executes dropped EXE
          PID:1404
        • C:\Windows\system32\regsvr32.exe
          C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_2.dll
          4⤵
          • Loads dropped DLL
          • Registers COM server for autorun
          PID:2160
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe xinput1_2_x64.inf, Install_Driver
          4⤵
          • Executes dropped EXE
          PID:3368
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe XACT2_3_x64.inf
          4⤵
          • Executes dropped EXE
          PID:2704
        • C:\Windows\system32\regsvr32.exe
          C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_3.dll
          4⤵
          • Loads dropped DLL
          • Registers COM server for autorun
          PID:4380
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe d3dx9_31_x64.inf
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          PID:3228
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe XACT2_4_x64.inf
          4⤵
          • Executes dropped EXE
          PID:4124
        • C:\Windows\system32\regsvr32.exe
          C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_4.dll
          4⤵
          • Loads dropped DLL
          • Registers COM server for autorun
          • Modifies registry class
          PID:4960
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe d3dx9_32_x64.inf
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:4572
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe d3dx10_00_x64.inf
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          PID:332
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe XACT2_5_x64.inf
          4⤵
          • Executes dropped EXE
          PID:604
        • C:\Windows\system32\regsvr32.exe
          C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_5.dll
          4⤵
          • Loads dropped DLL
          • Registers COM server for autorun
          • Modifies registry class
          PID:5068
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe XACT2_6_x64.inf
          4⤵
          • Executes dropped EXE
          PID:4192
        • C:\Windows\system32\regsvr32.exe
          C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_6.dll
          4⤵
          • Loads dropped DLL
          • Registers COM server for autorun
          • Modifies registry class
          PID:448
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe d3dx9_33_x64.inf
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          PID:4276
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe d3dx10_33_x64.inf
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          PID:3800
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe XACT2_7_x64.inf
          4⤵
          • Executes dropped EXE
          PID:3504
        • C:\Windows\system32\regsvr32.exe
          C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_7.dll
          4⤵
          • Registers COM server for autorun
          • Modifies registry class
          PID:3360
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe xinput1_3_x64.inf, Install_Driver
          4⤵
          • Executes dropped EXE
          PID:3316
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe d3dx9_34_x64.inf
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          PID:4484
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe d3dx10_34_x64.inf
          4⤵
          • Executes dropped EXE
          PID:4800
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe XACT2_8_x64.inf
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          PID:4552
        • C:\Windows\system32\regsvr32.exe
          C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_8.dll
          4⤵
          • Modifies registry class
          PID:4764
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe d3dx9_35_x64.inf
          4⤵
          • Executes dropped EXE
          PID:1504
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe d3dx10_35_x64.inf
          4⤵
          • Executes dropped EXE
          PID:2268
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe XACT2_9_x64.inf
          4⤵
          • Executes dropped EXE
          PID:4760
        • C:\Windows\system32\regsvr32.exe
          C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_9.dll
          4⤵
          • Registers COM server for autorun
          PID:2992
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe d3dx9_36_x64.inf
          4⤵
          • Executes dropped EXE
          PID:4264
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe d3dx10_36_x64.inf
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          PID:3644
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe X3DAudio1_2_x64.inf
          4⤵
          • Executes dropped EXE
          PID:5008
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe XACT2_10_x64.inf
          4⤵
          • Executes dropped EXE
          PID:4056
        • C:\Windows\system32\regsvr32.exe
          C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_10.dll
          4⤵
          • Registers COM server for autorun
          • Modifies registry class
          PID:3140
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe D3DX9_37_x64.inf
          4⤵
          • Executes dropped EXE
          PID:752
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe d3dx10_37_x64.inf
          4⤵
          • Executes dropped EXE
          PID:4784
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe X3DAudio1_3_x64.inf
          4⤵
          • Executes dropped EXE
          PID:4340
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe XACT3_0_x64.inf
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          PID:4864
        • C:\Windows\system32\regsvr32.exe
          C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_0.dll
          4⤵
          • Registers COM server for autorun
          • Modifies registry class
          PID:3112
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe XAudio2_0_x64.inf
          4⤵
          • Executes dropped EXE
          PID:4248
        • C:\Windows\system32\regsvr32.exe
          C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_0.dll
          4⤵
          • Registers COM server for autorun
          • Modifies registry class
          PID:3404
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe D3DX9_38_x64.inf
          4⤵
          • Executes dropped EXE
          PID:4716
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe d3dx10_38_x64.inf
          4⤵
          • Executes dropped EXE
          PID:3380
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe X3DAudio1_4_x64.inf
          4⤵
          • Executes dropped EXE
          PID:3068
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe XACT3_1_x64.inf
          4⤵
          • Executes dropped EXE
          PID:4448
        • C:\Windows\system32\regsvr32.exe
          C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_1.dll
          4⤵
          • Modifies registry class
          PID:2684
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe XAudio2_1_x64.inf
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          PID:2780
        • C:\Windows\system32\regsvr32.exe
          C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_1.dll
          4⤵
          • Registers COM server for autorun
          PID:1468
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe D3DX9_39_x64.inf
          4⤵
          • Executes dropped EXE
          PID:3288
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe d3dx10_39_x64.inf
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          PID:2828
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe XACT3_2_x64.inf
          4⤵
          • Executes dropped EXE
          PID:2256
        • C:\Windows\system32\regsvr32.exe
          C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_2.dll
          4⤵
          • Registers COM server for autorun
          • Modifies registry class
          PID:916
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe XAudio2_2_x64.inf
          4⤵
          • Executes dropped EXE
          PID:2604
        • C:\Windows\system32\regsvr32.exe
          C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_2.dll
          4⤵
          • Registers COM server for autorun
          • Modifies registry class
          PID:4920
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe X3DAudio1_5_x64.inf
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          PID:2260
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe XACT3_3_x64.inf
          4⤵
          • Executes dropped EXE
          PID:1684
        • C:\Windows\system32\regsvr32.exe
          C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_3.dll
          4⤵
          • Registers COM server for autorun
          PID:4476
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe XAudio2_3_x64.inf
          4⤵
          • Executes dropped EXE
          PID:540
        • C:\Windows\system32\regsvr32.exe
          C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_3.dll
          4⤵
          • Registers COM server for autorun
          • Modifies registry class
          PID:4324
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe D3DX9_40_x64.inf
          4⤵
          • Executes dropped EXE
          PID:444
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe d3dx10_40_x64.inf
          4⤵
          • Executes dropped EXE
          PID:3948
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe X3DAudio1_6_x64.inf
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          PID:3932
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe XACT3_4_x64.inf
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          PID:4804
        • C:\Windows\system32\regsvr32.exe
          C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_4.dll
          4⤵
          • Registers COM server for autorun
          • Modifies registry class
          PID:4836
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe XAudio2_4_x64.inf
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          PID:1536
        • C:\Windows\system32\regsvr32.exe
          C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_4.dll
          4⤵
          • Registers COM server for autorun
          • Modifies registry class
          PID:2072
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe D3DX9_41_x64.inf
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          PID:3616
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe d3dx10_41_x64.inf
          4⤵
          • Executes dropped EXE
          PID:812
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe D3DX9_42_x64.inf
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:4300
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe d3dx10_42_x64.inf
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:1292
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe d3dx11_42_x64.inf
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:5024
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe d3dcsx_42_x64.inf
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          PID:2284
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe D3DCompiler_42_x64.inf
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:1928
        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe XACT3_5_x64.inf
          4⤵
            PID:1776
          • C:\Windows\system32\regsvr32.exe
            C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_5.dll
            4⤵
            • Registers COM server for autorun
            PID:2412
          • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
            C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe XAudio2_5_x64.inf
            4⤵
              PID:628
            • C:\Windows\system32\regsvr32.exe
              C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_5.dll
              4⤵
              • Registers COM server for autorun
              • Modifies registry class
              PID:64
            • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
              C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe X3DAudio1_7_x64.inf
              4⤵
                PID:1056
              • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
                C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe XACT3_6_x64.inf
                4⤵
                  PID:4304
                • C:\Windows\system32\regsvr32.exe
                  C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_6.dll
                  4⤵
                  • Modifies registry class
                  PID:4076
                • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
                  C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe XAudio2_6_x64.inf
                  4⤵
                  • Drops file in System32 directory
                  PID:2136
                • C:\Windows\system32\regsvr32.exe
                  C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_6.dll
                  4⤵
                  • Registers COM server for autorun
                  • Modifies registry class
                  PID:3012
                • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
                  C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe D3DX9_43_x64.inf
                  4⤵
                    PID:4944
                  • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
                    C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe d3dx10_43_x64.inf
                    4⤵
                    • Drops file in System32 directory
                    PID:1700
                  • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
                    C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe d3dx11_43_x64.inf
                    4⤵
                      PID:1404
                    • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
                      C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe d3dcsx_43_x64.inf
                      4⤵
                        PID:4024
                      • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
                        C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe D3DCompiler_43_x64.inf
                        4⤵
                          PID:4512
                        • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
                          C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe XACT3_7_x64.inf
                          4⤵
                            PID:3064
                          • C:\Windows\system32\regsvr32.exe
                            C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_7.dll
                            4⤵
                            • Registers COM server for autorun
                            • Modifies registry class
                            PID:3364
                          • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
                            C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe XAudio2_7_x64.inf
                            4⤵
                            • Drops file in System32 directory
                            PID:1948
                          • C:\Windows\system32\regsvr32.exe
                            C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_7.dll
                            4⤵
                            • Registers COM server for autorun
                            • Modifies registry class
                            PID:5064
                      • C:\Users\Admin\AppData\Local\New Technology Studio\Apps\OpenIV\OpenIV.exe
                        "C:\Users\Admin\AppData\Local\New Technology Studio\Apps\OpenIV\OpenIV.exe"
                        2⤵
                        • Suspicious use of SetWindowsHookEx
                        PID:1332
                    • C:\Windows\system32\vssvc.exe
                      C:\Windows\system32\vssvc.exe
                      1⤵
                      • Checks SCSI registry key(s)
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2248
                    • C:\Windows\system32\srtasks.exe
                      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                      1⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4776

                    Network

                    MITRE ATT&CK Matrix ATT&CK v6

                    Initial Access

                    Execution

                    Persistence

                    Registry Run Keys / Startup Folder

                    2
                    T1060

                    Privilege Escalation

                    Defense Evasion

                    Modify Registry

                    1
                    T1112

                    Credential Access

                    Discovery

                    Query Registry

                    4
                    T1012

                    System Information Discovery

                    5
                    T1082

                    Peripheral Device Discovery

                    2
                    T1120

                    Lateral Movement

                    Collection

                    Exfiltration

                    Command and Control

                    Impact

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\XACT_x64.inf
                      Filesize

                      765B

                      MD5

                      d04068a4eb11d24217a7f24cbb17c1cb

                      SHA1

                      35a12d7abbf3635efb3bd9f5bb4d1bed2d9c13c5

                      SHA256

                      0015e51246d381e426489c733a5d5662cb6db3caafa25fe4d00554b082fc753f

                      SHA512

                      46170920353534fda9d0476aa3c8ae4273beef52dfca70e1dd2251f608e0b57092ef7f5ce16cb67c84bdfc40188429695c1b25054fbbe23374bff4ba77c4ef23

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\d3dx9_24.dll
                      Filesize

                      3.4MB

                      MD5

                      b165df72e13e6af74d47013504319921

                      SHA1

                      c45b192cf8904b7579bbc26c799aa7ffa5cbb1d4

                      SHA256

                      1ec422bd6421c741eef57847260967f215913649901e21dd9c46eb1b3bb10906

                      SHA512

                      859b6cd538735e5cc1c44f63d66b25588ad1ad32202cae606ff95b8c4a80f6a66db9ef7c5d43820010de9334b8bbbfb079939ce89ba0b760f5d651d7fa8268ed

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\d3dx9_24_x64.inf
                      Filesize

                      679B

                      MD5

                      2c4e850789bf9606aa4783cd9c26099a

                      SHA1

                      036ee1c9ce3b8c495b3d155fe83e54c00a2611d4

                      SHA256

                      f02bd6bb0ca1ed41698def1465c05f5b47ca459f886647f2d84f85c5c09dad9c

                      SHA512

                      f09cb85eb7024c89024d12dd40021d1df046bb825a985bee1cb164a5c026693325bc5d64491702731ed5cb71b5af7eef34f8a922bee6d9d5881ff113dce23d21

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\d3dx9_25.dll
                      Filesize

                      3.6MB

                      MD5

                      4c56e7c5b2a61353e534c7d15d05856d

                      SHA1

                      e6e0a59a1e8217ae06cda29942537bc4be25d5a1

                      SHA256

                      10b09474bfe4e2bb395472628646bc5f353fbfbec976575c45eeff49984ebaa6

                      SHA512

                      6f630ea0764b4551d80a96f6c2b9391ed5741f14431eec951699c0e42b9434a45841d71bea5576b285cc20d38fd082b4cfc8062e4aa61f80aed9e57869cdd5d2

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\d3dx9_25_x64.inf
                      Filesize

                      667B

                      MD5

                      fbed164855ae10f4c2d4eb238f414e6a

                      SHA1

                      7c3ec7759a23e77242bdc70c8033c013f2c794d6

                      SHA256

                      9af2752d59fc38dd26d30769132a0887ff4123269c0dc4406f5107295e69c7c1

                      SHA512

                      68e7d441aa0b842329f63ed34bb392d1582b635eee1bd1c8a797e9a59303fc85b0d842de0fd29d88fa3c8ac0bb6d858671101633161487d6353e73c862fb228d

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\d3dx9_26.dll
                      Filesize

                      3.6MB

                      MD5

                      44f5c5e27d6825e4e62420bc29b8b533

                      SHA1

                      046455294e199af99c7c2d9174d25b230e6fd0e6

                      SHA256

                      30b06dbbd202494bae3b87487e7273adcffd17a9d2c29977030fde0570aa841b

                      SHA512

                      0c9adca329c386cb2caf0f36d672ba326929f02c29748b13188bb7ade3fbec9131ce86a6bf1b3064a2fbb8de6b8adc34208f667df31c5db182918e79744a830b

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\d3dx9_26_x64.inf
                      Filesize

                      667B

                      MD5

                      831fb8a4394d256a5d7c15c16757912c

                      SHA1

                      961d7274de32808c4dce971d943ddd79a12e8d49

                      SHA256

                      6c152334efa5b011a44f160a23a5c58b66f3bcebbf6c4bc0722a526d36699a4b

                      SHA512

                      40f3d40cb40bd887ffa15a5fc60468e48f06bb1704d19061f9b51a9e2c15ab363644aac4618276910f6fc8d90f1083931916a9943306dcf736fc72feba2385c8

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\d3dx9_27.dll
                      Filesize

                      3.6MB

                      MD5

                      914c3237e4d145a18dcd1d0d4c8659e1

                      SHA1

                      32503c8f8d80551c896bc2dbf2c8ae3c490f0ec4

                      SHA256

                      f9dd288c9895973f8db1856d172779041c6dee173ad1ef53b1727fc85cb6b75f

                      SHA512

                      c760b5b0b5507da8f2336b2b0625f344f28fac33da16a7d8771a122b0ba54ebf5d2a2f702f4ebb83ded746f38d63abd378a9aa3b3e50579fab7c047fe38e2c02

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\d3dx9_27_x64.inf
                      Filesize

                      667B

                      MD5

                      925202b48a83647982cb0d55ab10668d

                      SHA1

                      b04a29859288545a3f8f9daf6aa39bb7a8b4b59c

                      SHA256

                      6f56c5be97e703584dd832f35ebdc78c6aeb07cc9df155d47ed9903142086488

                      SHA512

                      72b6b4b951d04ecee1c4ea613734113b864a542dcc554e86e8d7b7fa2b0d05a1e7623051ca0809c3e934cf28cadca54acb76ad515f71a263ffd17c3872677b69

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\d3dx9_28.dll
                      Filesize

                      3.6MB

                      MD5

                      88bac8306d4ec79a82b1ffa17dc8cf4a

                      SHA1

                      0a0ab361f04ccba8268418ebff098d3da1ac26a9

                      SHA256

                      a2870f86e2f1b11646ff3f404bdbde10520c481c1400b20d25fdf56e66fb0a17

                      SHA512

                      b664033e270d71ff88139bb3e71fcdfc8417f65d7c80a12f921a60b0d825ebfe26a14bf16f9d23a10af5c866c1715e21c879993f9be1c54261c376a7cbbe511f

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\d3dx9_28_x64.inf
                      Filesize

                      667B

                      MD5

                      2e7a073438fe5ef17d0a7581afc4e37e

                      SHA1

                      adf56255c6f49509c04db26b2594756030df29fd

                      SHA256

                      dae4f2beced67333eb6aade70a4a711581f789d0a442f8fb16ba6db5ab261700

                      SHA512

                      2244afec5dc7a549d2782fe3caf7f825351a3209df70a5ad9f379cc89ec6099a72ef7316f4b96f641cf978b51cd8c1fc143a3d3f504639e24241f66418863749

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\d3dx9_29.dll
                      Filesize

                      3.7MB

                      MD5

                      68b35cbdb4a8cc424718bbcc894feeea

                      SHA1

                      c1874de5c76a55a1c42c5da20d7204201586ca4c

                      SHA256

                      d496c31a6b0f41398ecad7698987c55c2cb88eb6568976ba9b01a197879dd9dc

                      SHA512

                      da3b8251417b63d086e4223219309faea6faf3ed9f70f0345ad77f6843fc8c121ed36403aa50601434962d3089d529baa1faef0bc29602567fa3f91749d8625f

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\d3dx9_29_x64.inf
                      Filesize

                      667B

                      MD5

                      45be046f3bd08c19a5d1d0eecc97ad55

                      SHA1

                      8ce2e16a977e39ef24d9821f9dbf0aefa49472bf

                      SHA256

                      5ce705889566e690bc48e7f3fc41ec12b856e92d52c60aee45e1c223aa44848c

                      SHA512

                      340814dfd9faffd008e3c2eb0065d36f64d4cd418d4f648c4b594539daf45b41bfc641cc53176c2c577f72384b959912e0041b4a02341636941ede39b142bfcc

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\dxupdate.dll
                      Filesize

                      173KB

                      MD5

                      7ed554b08e5b69578f9de012822c39c9

                      SHA1

                      036d04513e134786b4758def5aff83d19bf50c6e

                      SHA256

                      fb4f297e295c802b1377c6684734b7249d55743dfb7c14807bef59a1b5db63a2

                      SHA512

                      7af5f9c4a3ad5c120bcdd681b958808ada4d885d21aeb4a009a36a674ad3ece9b51837212a982db6142a6b5580e5b68d46971b802456701391ce40785ae6ebd9

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\dxupdate.dll
                      Filesize

                      173KB

                      MD5

                      7ed554b08e5b69578f9de012822c39c9

                      SHA1

                      036d04513e134786b4758def5aff83d19bf50c6e

                      SHA256

                      fb4f297e295c802b1377c6684734b7249d55743dfb7c14807bef59a1b5db63a2

                      SHA512

                      7af5f9c4a3ad5c120bcdd681b958808ada4d885d21aeb4a009a36a674ad3ece9b51837212a982db6142a6b5580e5b68d46971b802456701391ce40785ae6ebd9

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
                      Filesize

                      56KB

                      MD5

                      ac36c85030678eb69a498793a36a81e9

                      SHA1

                      a1719053eec7a206bd1d005e1038a1a7ca2eb1a0

                      SHA256

                      85a8b155b066d81efb5d4959f5ea59a9ce43d40663cb2aba05ef0e6d01c22c18

                      SHA512

                      47f26ed02bedc96b504344ac53418f63b1da4844b6db61d334dd9b09d0481584dbddc166a654c5b553d5609fb8fb90c01dee9329c68dd74c24ee6bd8eb136d06

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
                      Filesize

                      56KB

                      MD5

                      ac36c85030678eb69a498793a36a81e9

                      SHA1

                      a1719053eec7a206bd1d005e1038a1a7ca2eb1a0

                      SHA256

                      85a8b155b066d81efb5d4959f5ea59a9ce43d40663cb2aba05ef0e6d01c22c18

                      SHA512

                      47f26ed02bedc96b504344ac53418f63b1da4844b6db61d334dd9b09d0481584dbddc166a654c5b553d5609fb8fb90c01dee9329c68dd74c24ee6bd8eb136d06

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
                      Filesize

                      56KB

                      MD5

                      afd73a6c2e1172e4075c8b37816eb391

                      SHA1

                      eceaeaca967c9ac3239f65b4d4f75d994dabd7ee

                      SHA256

                      ea544793b661304f31f18e9d107a4b4b46bd198d806f6366870746fe52e01df9

                      SHA512

                      5c313c81808c664f056ccd64784e607439ed45874fe322afdf690aba6d8dc54c2b54e42f69ce003bd0aefd0ebe5518f102f846aaa96254d3218d62b4f5dc463b

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
                      Filesize

                      59KB

                      MD5

                      44f9c211701098d36dde44c5cf3afd63

                      SHA1

                      c020bb7dfb5932c5cbe19ca5d9feffde05781134

                      SHA256

                      d636d29f6019bcc232e62553728871097097aae05a6426bb86af15720de2e0e6

                      SHA512

                      b8aa96c4b8861b76f0c5c606f5458cc1e06e6e2ecd684f9ebde9e68a4d5057e84413816d78f88525fef63f4863a4b498c6d8cbc74faf8c555029dde7e34dec5a

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
                      Filesize

                      61KB

                      MD5

                      def5caad8a452d6515bd40df6dd6b51f

                      SHA1

                      c26a793ef0a117b9b960caaabf31fef6036576de

                      SHA256

                      34df5a253007edd15d14f28a333bac638fe961f0f3941b192d7a6a760c2635fe

                      SHA512

                      2f3984f126de1c89cb815e00587d41c9bc32358530d9d2931ef917f6d3a45422a80caf6bcbb1615a61e51d7cb81532795cafefdfc39f9dab7c2f7d70cc22a1bf

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
                      Filesize

                      65KB

                      MD5

                      60db6abbe4d4f22d87cd15c9bdae79e7

                      SHA1

                      4dc25047507cb28a0855c8c2f5bf11fb0dbf1366

                      SHA256

                      10e420d85c6d2905d9ca076681c3b1d648bc1b5b3893c8eb5ff420d2b964f0cb

                      SHA512

                      846fc61367cc3fff2c0516c1872f1380e120684853fa9e4a6d077f94c83c99dfdc9f3d2cf7de587fe3988a3224b7ea7e0f27c7a76e11c5a6daaf03ed15864476

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
                      Filesize

                      65KB

                      MD5

                      c292f0eacff8f95b789c78907bb52a46

                      SHA1

                      497087279afae9c13c5aae642fcbd3f269f31345

                      SHA256

                      5ec466d86f7205e7a99985f0be8cacd0494454780c28ac90ff5d4b906b9dc5e5

                      SHA512

                      854e9d5554d98fcecd3ad777565988ab363863057818392b56c325df6f613fb8efb501026ba8d081eebbca53d72f081cd13a2e90e42f93d6010ed3865bc33b2c

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\infinst.exe
                      Filesize

                      65KB

                      MD5

                      c292f0eacff8f95b789c78907bb52a46

                      SHA1

                      497087279afae9c13c5aae642fcbd3f269f31345

                      SHA256

                      5ec466d86f7205e7a99985f0be8cacd0494454780c28ac90ff5d4b906b9dc5e5

                      SHA512

                      854e9d5554d98fcecd3ad777565988ab363863057818392b56c325df6f613fb8efb501026ba8d081eebbca53d72f081cd13a2e90e42f93d6010ed3865bc33b2c

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\microsoft.directx.direct3dx.dll
                      Filesize

                      2.6MB

                      MD5

                      a73e7421449cca62b0561bad4c8ef23d

                      SHA1

                      cf51ca7d28fcdc79c215450fb759ffe9101b6cfe

                      SHA256

                      7986e3fbe05418fe5d8425f2f1b76b7a7b09952f3ec560b286dd744bf7178059

                      SHA512

                      63d24647ac5d0beb8f1284973927263cb6e05b4c399cda3912178114b42d541dd516c6d67a453ea997d9d0cd9126a1802678062f0951c2547e1b445ba50dfbe4

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\microsoft.directx.direct3dx.dll
                      Filesize

                      2.6MB

                      MD5

                      a73e7421449cca62b0561bad4c8ef23d

                      SHA1

                      cf51ca7d28fcdc79c215450fb759ffe9101b6cfe

                      SHA256

                      7986e3fbe05418fe5d8425f2f1b76b7a7b09952f3ec560b286dd744bf7178059

                      SHA512

                      63d24647ac5d0beb8f1284973927263cb6e05b4c399cda3912178114b42d541dd516c6d67a453ea997d9d0cd9126a1802678062f0951c2547e1b445ba50dfbe4

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\microsoft.directx.direct3dx.dll
                      Filesize

                      2.7MB

                      MD5

                      5e2b8b8a5ed016468716b9ff82a1806f

                      SHA1

                      f1772121149d87745738cd471d0e504301a9ad0d

                      SHA256

                      5b70f0ac40a38c903062a12ff7cd71d907e75238a044ded9b34fb51e9a9a2799

                      SHA512

                      4620c9bafb7dfaa8d4351d0d99ae3442ceb2220201f16bd9bab4fbeb1f411fd63d4f0e79abf6e762f4d0e62d42608fbeebd13943ce338eca59ad1080ea6c2728

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\microsoft.directx.direct3dx.dll
                      Filesize

                      2.7MB

                      MD5

                      5e2b8b8a5ed016468716b9ff82a1806f

                      SHA1

                      f1772121149d87745738cd471d0e504301a9ad0d

                      SHA256

                      5b70f0ac40a38c903062a12ff7cd71d907e75238a044ded9b34fb51e9a9a2799

                      SHA512

                      4620c9bafb7dfaa8d4351d0d99ae3442ceb2220201f16bd9bab4fbeb1f411fd63d4f0e79abf6e762f4d0e62d42608fbeebd13943ce338eca59ad1080ea6c2728

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\microsoft.directx.direct3dx.dll
                      Filesize

                      550KB

                      MD5

                      d3f1922325be8e7e1c72bfd8179454ce

                      SHA1

                      89134f43ce2af4adfbc4087392aee6fe56be7ff4

                      SHA256

                      8418941d8f1d4c84288e0bf54392378dd3d87b602bb693ff4f8a633022681c12

                      SHA512

                      d33f513ff6c199acabe86eca6dc06d56c330ccb78be4d13fb6b1906a3cba3c93afe982b05cb057f2b88f6e6637452f4d99d4a4fe6f3f7c473de9e67a40758bed

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\microsoft.directx.direct3dx.dll
                      Filesize

                      550KB

                      MD5

                      d3f1922325be8e7e1c72bfd8179454ce

                      SHA1

                      89134f43ce2af4adfbc4087392aee6fe56be7ff4

                      SHA256

                      8418941d8f1d4c84288e0bf54392378dd3d87b602bb693ff4f8a633022681c12

                      SHA512

                      d33f513ff6c199acabe86eca6dc06d56c330ccb78be4d13fb6b1906a3cba3c93afe982b05cb057f2b88f6e6637452f4d99d4a4fe6f3f7c473de9e67a40758bed

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\microsoft.directx.direct3dx.dll
                      Filesize

                      554KB

                      MD5

                      fb3bc0754921873a65f5fbdca845e6ee

                      SHA1

                      67cde5bc8577cd3040e275d290ac021874da9fe8

                      SHA256

                      f500c350dd71df7452b92444e19b4644b04283434a6557123f1e4d9fb078c3f8

                      SHA512

                      292b8bda44e6ff6449c4b38da9b8317491c0f0da3d1e5f7947741de27cc51bbc078fbf947c89c4be3a0b54f7066f0480990d1de57919edba3414aace77c47635

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\microsoft.directx.direct3dx.dll
                      Filesize

                      554KB

                      MD5

                      fb3bc0754921873a65f5fbdca845e6ee

                      SHA1

                      67cde5bc8577cd3040e275d290ac021874da9fe8

                      SHA256

                      f500c350dd71df7452b92444e19b4644b04283434a6557123f1e4d9fb078c3f8

                      SHA512

                      292b8bda44e6ff6449c4b38da9b8317491c0f0da3d1e5f7947741de27cc51bbc078fbf947c89c4be3a0b54f7066f0480990d1de57919edba3414aace77c47635

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\microsoft.directx.direct3dx.dll
                      Filesize

                      562KB

                      MD5

                      afcf5f50c632f3a5598abc28f196d77c

                      SHA1

                      294385693592f9d6320f8b0b18f45bc194d01a4d

                      SHA256

                      5e90089e69e4f7e2e42ea4a81fb62005c3710d0a4acdf207b97ed03f5641d013

                      SHA512

                      29746ffc665051e13386e452c3e41a593b6339e09a228927929be100cddb3e0e0fd3b54abe02eb7d46a3d97466ecb02bac362398b72fd8e804cbb21c8bc856d9

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\microsoft.directx.direct3dx.dll
                      Filesize

                      562KB

                      MD5

                      afcf5f50c632f3a5598abc28f196d77c

                      SHA1

                      294385693592f9d6320f8b0b18f45bc194d01a4d

                      SHA256

                      5e90089e69e4f7e2e42ea4a81fb62005c3710d0a4acdf207b97ed03f5641d013

                      SHA512

                      29746ffc665051e13386e452c3e41a593b6339e09a228927929be100cddb3e0e0fd3b54abe02eb7d46a3d97466ecb02bac362398b72fd8e804cbb21c8bc856d9

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\microsoft.directx.direct3dx.dll
                      Filesize

                      563KB

                      MD5

                      ccd53738df4fa27849b6bb05dd67d10d

                      SHA1

                      28126653a3d1b4574fcb0c09176f5fa0ff28ef78

                      SHA256

                      c29d337bf7639fbf424b34cc0409d2715762e1b4d82881fb524a2508381c9f62

                      SHA512

                      aa3a10504fbe49a4c44151beec7d9b543f4b89a51621fa60810f385bdc8a6821e4bfc37cd46f3688013f6f4facd33ab45bd0deb4a1fe16453e1be8f11f2119c3

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\microsoft.directx.direct3dx.dll
                      Filesize

                      563KB

                      MD5

                      ccd53738df4fa27849b6bb05dd67d10d

                      SHA1

                      28126653a3d1b4574fcb0c09176f5fa0ff28ef78

                      SHA256

                      c29d337bf7639fbf424b34cc0409d2715762e1b4d82881fb524a2508381c9f62

                      SHA512

                      aa3a10504fbe49a4c44151beec7d9b543f4b89a51621fa60810f385bdc8a6821e4bfc37cd46f3688013f6f4facd33ab45bd0deb4a1fe16453e1be8f11f2119c3

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\microsoft.directx.direct3dx.dll
                      Filesize

                      564KB

                      MD5

                      43c280c3b15ceb2472ab560d09629664

                      SHA1

                      e3a897d7608d03c93b5c2b8aef52703452cf6696

                      SHA256

                      bebbc40ca25ef22e9d16b0de1123e0cb0444fe7a78b4f0b4395bdfd81618698c

                      SHA512

                      5229eef9153b992684b6dcb4a32b231c63322b5e4b49ef262228c0dcca4760f97cda5d15a7fcdf77d813eb24b359101e716f72988374106ace13473f27e731c5

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\microsoft.directx.direct3dx.dll
                      Filesize

                      564KB

                      MD5

                      43c280c3b15ceb2472ab560d09629664

                      SHA1

                      e3a897d7608d03c93b5c2b8aef52703452cf6696

                      SHA256

                      bebbc40ca25ef22e9d16b0de1123e0cb0444fe7a78b4f0b4395bdfd81618698c

                      SHA512

                      5229eef9153b992684b6dcb4a32b231c63322b5e4b49ef262228c0dcca4760f97cda5d15a7fcdf77d813eb24b359101e716f72988374106ace13473f27e731c5

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\microsoft.directx.direct3dx.dll
                      Filesize

                      564KB

                      MD5

                      490807c150b7d8be44bde871f4df8c56

                      SHA1

                      69b68a5b8cc3f3e75aa2ba284654ca58bb62f23e

                      SHA256

                      36a21fc4f4c8f6ba4ad900613ee1b08ff43f2545585a2601c9fc4cf083d68a77

                      SHA512

                      9442e26de55009428cc6e747637c2cb64bd2f008541ccbb37fed4e83ff66845c7cf3874d93542e0ba544e2db61f4864b665b7720568eba284beb095489f3ca64

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\microsoft.directx.direct3dx.dll
                      Filesize

                      564KB

                      MD5

                      490807c150b7d8be44bde871f4df8c56

                      SHA1

                      69b68a5b8cc3f3e75aa2ba284654ca58bb62f23e

                      SHA256

                      36a21fc4f4c8f6ba4ad900613ee1b08ff43f2545585a2601c9fc4cf083d68a77

                      SHA512

                      9442e26de55009428cc6e747637c2cb64bd2f008541ccbb37fed4e83ff66845c7cf3874d93542e0ba544e2db61f4864b665b7720568eba284beb095489f3ca64

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\microsoft.directx.direct3dx.dll
                      Filesize

                      565KB

                      MD5

                      933085360527de1b4947289ca468184e

                      SHA1

                      d5ee5e1e3c992c7518b5ce510c627c1564131b12

                      SHA256

                      78d85f0e2cb7d7bde534222f4ebfea1c9e06d37ecd3bb7ebd59e35f00b94b11d

                      SHA512

                      2e22398d7cdcd6a46daf3dd3478d861bc4012ba1b54862311ae031ebcd3f908352157cbeea528f22ef1824f8924c3f217311feaf1804cf675eafc07a8d3962eb

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\microsoft.directx.direct3dx.dll
                      Filesize

                      565KB

                      MD5

                      933085360527de1b4947289ca468184e

                      SHA1

                      d5ee5e1e3c992c7518b5ce510c627c1564131b12

                      SHA256

                      78d85f0e2cb7d7bde534222f4ebfea1c9e06d37ecd3bb7ebd59e35f00b94b11d

                      SHA512

                      2e22398d7cdcd6a46daf3dd3478d861bc4012ba1b54862311ae031ebcd3f908352157cbeea528f22ef1824f8924c3f217311feaf1804cf675eafc07a8d3962eb

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\x3daudio1_0.dll
                      Filesize

                      16KB

                      MD5

                      f77d5ab654881e683cff6650916c424e

                      SHA1

                      56d8f090755f1ec60b13e748b040069ea8759b5b

                      SHA256

                      77cc09cea6de69f12106e6dd9df1c0446a525a54c3953d69d64711b9394cc38f

                      SHA512

                      dcd1273673f4088e854057e47484bb363e1e7ce094bc2c98ad7cc9112877892c1d6fd591dd9cfb325d6c451f2d03a4cdcc238af1ffb5382b7153f079cbe13abd

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\DXBCC9.tmp\xactengine2_0.dll
                      Filesize

                      347KB

                      MD5

                      ce5753f9a27837259eb52f3f47f39593

                      SHA1

                      2eb60f397eff937249521fe0bf5fe89eccee4914

                      SHA256

                      a00ad310f3d7b2d4de2f5a4c081359fa443ce0baecc72ebf39d6b30ccf7babce

                      SHA512

                      93fa47262f1b1ed9b284337f7225bdc06b6931931f385eeb30faaba25f1ccc483d633a40831471da70077d6a1f6a84c21a909daea059ecf316534b1994467230

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dsetup.dll
                      Filesize

                      93KB

                      MD5

                      984cad22fa542a08c5d22941b888d8dc

                      SHA1

                      3e3522e7f3af329f2235b0f0850d664d5377b3cd

                      SHA256

                      57bc22850bb8e0bcc511a9b54cd3da18eec61f3088940c07d63b9b74e7fe2308

                      SHA512

                      8ef171218b331f0591a4b2a5e68dcbae98f5891518ce877f1d8d1769c59c0f4ddae43cc43da6606975078f889c832f0666484db9e047782e7a0ae4a2d41f5bef

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dsetup32.dll
                      Filesize

                      1.5MB

                      MD5

                      a5412a144f63d639b47fcc1ba68cb029

                      SHA1

                      81bd5f1c99b22c0266f3f59959dfb4ea023be47e

                      SHA256

                      8a011da043a4b81e2b3d41a332e0ff23a65d546bd7636e8bc74885e8746927d6

                      SHA512

                      2679a4cb690e8d709cb5e57b59315d22f69f91efa6c4ee841943751c882b0c0457fd4a3376ac3832c757c6dfaffb7d844909c5665b86a95339af586097ee0405

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxupdate.dll
                      Filesize

                      173KB

                      MD5

                      7ed554b08e5b69578f9de012822c39c9

                      SHA1

                      036d04513e134786b4758def5aff83d19bf50c6e

                      SHA256

                      fb4f297e295c802b1377c6684734b7249d55743dfb7c14807bef59a1b5db63a2

                      SHA512

                      7af5f9c4a3ad5c120bcdd681b958808ada4d885d21aeb4a009a36a674ad3ece9b51837212a982db6142a6b5580e5b68d46971b802456701391ce40785ae6ebd9

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxupdate.dll
                      Filesize

                      173KB

                      MD5

                      7ed554b08e5b69578f9de012822c39c9

                      SHA1

                      036d04513e134786b4758def5aff83d19bf50c6e

                      SHA256

                      fb4f297e295c802b1377c6684734b7249d55743dfb7c14807bef59a1b5db63a2

                      SHA512

                      7af5f9c4a3ad5c120bcdd681b958808ada4d885d21aeb4a009a36a674ad3ece9b51837212a982db6142a6b5580e5b68d46971b802456701391ce40785ae6ebd9

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.cif
                      Filesize

                      56KB

                      MD5

                      7b1fbe9f5f43b2261234b78fe115cf8e

                      SHA1

                      dd0f256ae38b4c4771e1d1ec001627017b7bb741

                      SHA256

                      762ff640013db2bd4109d7df43a867303093815751129bd1e33f16bf02e52cce

                      SHA512

                      d21935a9867c0f2f7084917c79fbb1da885a1bfd4793cf669ff4da8c777b3a201857250bfb7c2b616625a8d3573c68395d210446d2c284b41cf09cc7cbb07885

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
                      Filesize

                      515KB

                      MD5

                      ac3a5f7be8cd13a863b50ab5fe00b71c

                      SHA1

                      eee417cd92e263b84dd3b5dcc2b4b463fe6e84d9

                      SHA256

                      8f5e89298e3dc2e22d47515900c37cca4ee121c5ba06a6d962d40ad6e1a595da

                      SHA512

                      c8bbe791373dad681f0ac9f5ab538119bde685d4f901f5db085c73163fc2e868972b2de60e72ccd44f745f1fd88fcde2e27f32302d8cbd3c1f43e6e657c79fba

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
                      Filesize

                      515KB

                      MD5

                      ac3a5f7be8cd13a863b50ab5fe00b71c

                      SHA1

                      eee417cd92e263b84dd3b5dcc2b4b463fe6e84d9

                      SHA256

                      8f5e89298e3dc2e22d47515900c37cca4ee121c5ba06a6d962d40ad6e1a595da

                      SHA512

                      c8bbe791373dad681f0ac9f5ab538119bde685d4f901f5db085c73163fc2e868972b2de60e72ccd44f745f1fd88fcde2e27f32302d8cbd3c1f43e6e657c79fba

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.inf
                      Filesize

                      477B

                      MD5

                      ad8982eaa02c7ad4d7cdcbc248caa941

                      SHA1

                      4ccd8e038d73a5361d754c7598ed238fc040d16b

                      SHA256

                      d63c35e9b43eb0f28ffc28f61c9c9a306da9c9de3386770a7eb19faa44dbfc00

                      SHA512

                      5c805d78bafff06c36b5df6286709ddf2d36808280f92e62dc4c285edd9176195a764d5cf0bb000da53ca8bbf66ddd61d852e4259e3113f6529e2d7bdbdd6e28

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\OpenIV Setup_0E566883\dxwebsetup.exe
                      Filesize

                      285KB

                      MD5

                      bcbb7c0cd9696068988953990ec5bd11

                      SHA1

                      3c8243734cf43dd7bb2332ba05b58ccacfa4377c

                      SHA256

                      34f64699d4830145cae69bd40115b1f326e70fc6a98456cb3df996d947dddca4

                      SHA512

                      551a2e3aa5fc7c0e79c3bd7c5333df5f1920ea83fe35b99adbbe865ea926fa772d72709bde2ea8f2685f4914cd96ff7b5b6f894f9b99f1120c2abe89c390a786

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\OpenIV Setup_0E566883\dxwebsetup.exe
                      Filesize

                      285KB

                      MD5

                      bcbb7c0cd9696068988953990ec5bd11

                      SHA1

                      3c8243734cf43dd7bb2332ba05b58ccacfa4377c

                      SHA256

                      34f64699d4830145cae69bd40115b1f326e70fc6a98456cb3df996d947dddca4

                      SHA512

                      551a2e3aa5fc7c0e79c3bd7c5333df5f1920ea83fe35b99adbbe865ea926fa772d72709bde2ea8f2685f4914cd96ff7b5b6f894f9b99f1120c2abe89c390a786

                      Download Submit
                    • C:\Windows\DirectX.log
                      Filesize

                      196B

                      MD5

                      dbb57fc7b79fbd3ddbb05f76503166f6

                      SHA1

                      1f4ad98cd755a843b1694d34f34772cbf6a7694f

                      SHA256

                      76f39ed396c622ef7c322757bfb8d814fabde62b604035bec2c8dff9f2a9a96e

                      SHA512

                      1bbb7f8d82080240a4a9b0e83a222e400eca25e8bf5b8ebb931253283657314ca353907af41799558c777eb9503323608762b02101c7bfd2da45532cd1fa3e5e

                      Download Submit
                    • C:\Windows\DirectX.log
                      Filesize

                      511B

                      MD5

                      04b9f64cfc20281946fba9879836e480

                      SHA1

                      7f0214df1a97d277955f05bce306eb2b0111a9ed

                      SHA256

                      8f2c999946b11b8f31dbbd4912e17ef824cbf5e7e70983014ce9e2e1ea240714

                      SHA512

                      6fe9aeac0f36d01fbad03fe52e36fd1549959144e00492c4eec4076102d0ed6bae863ae6c673f5e305015bf2db6e511a86bf76b6eb15e54c3ecd09d9199055e2

                      Download Submit
                    • C:\Windows\DirectX.log
                      Filesize

                      707B

                      MD5

                      e187bc6f041e993659b762cbba747a60

                      SHA1

                      2e5eccc17a788be0aeea74a9ef2809310c306c21

                      SHA256

                      e6f41057758f7bcec7258374d58cf9b232b5830ccb7018bbe4f2d432a9684857

                      SHA512

                      162dc410172b151f57cfe17ae495cf3d62d65cc38e4ab17824886168b5ebf8093081ab5ed41db4172ff254a91d777c73b1f7ebd5ab7a1d015effa747d218c44a

                      Download Submit
                    • C:\Windows\DirectX.log
                      Filesize

                      903B

                      MD5

                      9c56441f5bcd0f11e0f2f68a2342f3d1

                      SHA1

                      4ae15ade8ae6d33d952fbfaad00340fd77ede450

                      SHA256

                      a1e67f4128792424bebc683eda7ca7dbed3d7172c9c8ea1af563b2335b9e7dc1

                      SHA512

                      79d2bae43f497b22bab666b8c43f5dacf5c4639b857b456e05b00632b8559a619d9627ae4489c2324a3a8f974b6b143c1357d43794d0aea0a1dca85f8d97fd13

                      Download Submit
                    • C:\Windows\DirectX.log
                      Filesize

                      980B

                      MD5

                      3c0839d8935c1491e00c727dc2fb6a6f

                      SHA1

                      4d644a0677ef7e49a87787797da70c3ed567e0e3

                      SHA256

                      afce053ee76cc6719e41e378153b8991844cc910b5176431cbc2dbdeb709f9e6

                      SHA512

                      acfddc1592f81995222890f842e55aa8b3667959d679c1eac1fc8f4ede0e5814378acf229d277236e48de7b1d03d91e0508bd1db4dea285842944efbf576cb8c

                      Download Submit
                    • C:\Windows\DirectX.log
                      Filesize

                      1KB

                      MD5

                      262dacea5bb4561f91c10f63d85b3652

                      SHA1

                      b75563f2d6b83d33776be35380e785b79f678d07

                      SHA256

                      51148c8ebc46dc4ff1d0ce7765905d96e7b4f68581dea83e69f9147664176e13

                      SHA512

                      be551b07147709b15cf058e0fae9698609aeed33bcecde881d461a16c6e59250fb41c27d7762ad540039e526171584ee49dad5f313abb341b4a04273b5484cd4

                      Download Submit
                    • C:\Windows\SysWOW64\directx\websetup\dsetup.dll
                      Filesize

                      93KB

                      MD5

                      984cad22fa542a08c5d22941b888d8dc

                      SHA1

                      3e3522e7f3af329f2235b0f0850d664d5377b3cd

                      SHA256

                      57bc22850bb8e0bcc511a9b54cd3da18eec61f3088940c07d63b9b74e7fe2308

                      SHA512

                      8ef171218b331f0591a4b2a5e68dcbae98f5891518ce877f1d8d1769c59c0f4ddae43cc43da6606975078f889c832f0666484db9e047782e7a0ae4a2d41f5bef

                      Download Submit
                    • C:\Windows\SysWOW64\directx\websetup\dsetup32.dll
                      Filesize

                      1.5MB

                      MD5

                      a5412a144f63d639b47fcc1ba68cb029

                      SHA1

                      81bd5f1c99b22c0266f3f59959dfb4ea023be47e

                      SHA256

                      8a011da043a4b81e2b3d41a332e0ff23a65d546bd7636e8bc74885e8746927d6

                      SHA512

                      2679a4cb690e8d709cb5e57b59315d22f69f91efa6c4ee841943751c882b0c0457fd4a3376ac3832c757c6dfaffb7d844909c5665b86a95339af586097ee0405

                      Download Submit
                    • C:\Windows\SysWOW64\xactengine2_0.dll
                      Filesize

                      224KB

                      MD5

                      2112fe0c46662d429347a7d7b49e3ece

                      SHA1

                      8cf607547e9c5a10f129a3a8f8f32bd295c0d5b4

                      SHA256

                      cfd1c2d34feb7d94f282e97bf762a99bfa7309dc7353d96dfe4aadc187d26c67

                      SHA512

                      77f77add8411d418798d643d783752896d3fcac002f15696caeaf45b5396d2d42fe53bfb409d66ad505cdaac0ef0a20a62aa45b50aebe65237d2c44af36bbc34

                      Download Submit
                    • C:\Windows\SysWOW64\xactengine2_0.dll
                      Filesize

                      224KB

                      MD5

                      2112fe0c46662d429347a7d7b49e3ece

                      SHA1

                      8cf607547e9c5a10f129a3a8f8f32bd295c0d5b4

                      SHA256

                      cfd1c2d34feb7d94f282e97bf762a99bfa7309dc7353d96dfe4aadc187d26c67

                      SHA512

                      77f77add8411d418798d643d783752896d3fcac002f15696caeaf45b5396d2d42fe53bfb409d66ad505cdaac0ef0a20a62aa45b50aebe65237d2c44af36bbc34

                      Download Submit
                    • C:\Windows\system32\xactengine2_0.dll
                      Filesize

                      347KB

                      MD5

                      ce5753f9a27837259eb52f3f47f39593

                      SHA1

                      2eb60f397eff937249521fe0bf5fe89eccee4914

                      SHA256

                      a00ad310f3d7b2d4de2f5a4c081359fa443ce0baecc72ebf39d6b30ccf7babce

                      SHA512

                      93fa47262f1b1ed9b284337f7225bdc06b6931931f385eeb30faaba25f1ccc483d633a40831471da70077d6a1f6a84c21a909daea059ecf316534b1994467230

                      Download Submit
                    • memory/332-234-0x0000000000000000-mapping.dmp
                      Download
                    • memory/448-242-0x0000000000000000-mapping.dmp
                      Download
                    • memory/604-237-0x0000000000000000-mapping.dmp
                      Download
                    • memory/752-275-0x0000000000000000-mapping.dmp
                      Download
                    • memory/788-189-0x0000000000000000-mapping.dmp
                      Download
                    • memory/916-292-0x0000000000000000-mapping.dmp
                      Download
                    • memory/1332-297-0x0000000000400000-0x0000000002428000-memory.dmp
                      Filesize

                      32.2MB

                      Download
                    • memory/1332-296-0x0000000011000000-0x0000000011040000-memory.dmp
                      Filesize

                      256KB

                      Download
                    • memory/1332-294-0x0000000000400000-0x0000000002428000-memory.dmp
                      Filesize

                      32.2MB

                      Download
                    • memory/1404-219-0x0000000000000000-mapping.dmp
                      Download
                    • memory/1468-288-0x0000000000000000-mapping.dmp
                      Download
                    • memory/1504-258-0x0000000000000000-mapping.dmp
                      Download
                    • memory/1612-134-0x0000000000000000-mapping.dmp
                      Download
                    • memory/1824-203-0x0000000000000000-mapping.dmp
                      Download
                    • memory/2032-216-0x0000000000000000-mapping.dmp
                      Download
                    • memory/2136-214-0x0000000000000000-mapping.dmp
                      Download
                    • memory/2160-220-0x0000000000000000-mapping.dmp
                      Download
                    • memory/2256-291-0x0000000000000000-mapping.dmp
                      Download
                    • memory/2268-259-0x0000000000000000-mapping.dmp
                      Download
                    • memory/2460-169-0x0000000000000000-mapping.dmp
                      Download
                    • memory/2668-184-0x0000000000000000-mapping.dmp
                      Download
                    • memory/2684-286-0x0000000000000000-mapping.dmp
                      Download
                    • memory/2704-224-0x0000000000000000-mapping.dmp
                      Download
                    • memory/2780-287-0x0000000000000000-mapping.dmp
                      Download
                    • memory/2828-290-0x0000000000000000-mapping.dmp
                      Download
                    • memory/2836-194-0x0000000000000000-mapping.dmp
                      Download
                    • memory/2992-263-0x0000000000000000-mapping.dmp
                      Download
                    • memory/2992-264-0x0000000002120000-0x0000000002189000-memory.dmp
                      Filesize

                      420KB

                      Download
                    • memory/2992-265-0x0000000002121000-0x000000000217C000-memory.dmp
                      Filesize

                      364KB

                      Download
                    • memory/3012-215-0x0000000000000000-mapping.dmp
                      Download
                    • memory/3028-211-0x0000000000000000-mapping.dmp
                      Download
                    • memory/3068-284-0x0000000000000000-mapping.dmp
                      Download
                    • memory/3112-279-0x0000000000000000-mapping.dmp
                      Download
                    • memory/3140-272-0x0000000000000000-mapping.dmp
                      Download
                    • memory/3140-273-0x0000000001EF0000-0x0000000001F59000-memory.dmp
                      Filesize

                      420KB

                      Download
                    • memory/3140-274-0x0000000001EF1000-0x0000000001F4C000-memory.dmp
                      Filesize

                      364KB

                      Download
                    • memory/3172-213-0x0000000000381000-0x00000000003B5000-memory.dmp
                      Filesize

                      208KB

                      Download
                    • memory/3172-253-0x0000000004E51000-0x0000000004E8D000-memory.dmp
                      Filesize

                      240KB

                      Download
                    • memory/3172-236-0x0000000004E51000-0x0000000004E8A000-memory.dmp
                      Filesize

                      228KB

                      Download
                    • memory/3172-261-0x0000000004E51000-0x0000000004E8D000-memory.dmp
                      Filesize

                      240KB

                      Download
                    • memory/3172-212-0x0000000000380000-0x00000000003BD000-memory.dmp
                      Filesize

                      244KB

                      Download
                    • memory/3172-240-0x0000000004E51000-0x0000000004E8A000-memory.dmp
                      Filesize

                      228KB

                      Download
                    • memory/3172-222-0x0000000000380000-0x00000000003BD000-memory.dmp
                      Filesize

                      244KB

                      Download
                    • memory/3172-223-0x0000000000381000-0x00000000003B6000-memory.dmp
                      Filesize

                      212KB

                      Download
                    • memory/3172-218-0x0000000000381000-0x00000000003B5000-memory.dmp
                      Filesize

                      208KB

                      Download
                    • memory/3172-217-0x0000000000380000-0x00000000003BD000-memory.dmp
                      Filesize

                      244KB

                      Download
                    • memory/3172-246-0x0000000004E51000-0x0000000004E8C000-memory.dmp
                      Filesize

                      236KB

                      Download
                    • memory/3172-228-0x0000000000381000-0x00000000003B7000-memory.dmp
                      Filesize

                      216KB

                      Download
                    • memory/3172-270-0x0000000004E51000-0x0000000004E8D000-memory.dmp
                      Filesize

                      240KB

                      Download
                    • memory/3172-137-0x0000000000000000-mapping.dmp
                      Download
                    • memory/3172-202-0x0000000000381000-0x00000000003B5000-memory.dmp
                      Filesize

                      208KB

                      Download
                    • memory/3172-201-0x0000000000380000-0x00000000003BD000-memory.dmp
                      Filesize

                      244KB

                      Download
                    • memory/3172-227-0x0000000000380000-0x00000000003BD000-memory.dmp
                      Filesize

                      244KB

                      Download
                    • memory/3228-226-0x0000000000000000-mapping.dmp
                      Download
                    • memory/3288-289-0x0000000000000000-mapping.dmp
                      Download
                    • memory/3316-249-0x0000000000000000-mapping.dmp
                      Download
                    • memory/3360-248-0x0000000000000000-mapping.dmp
                      Download
                    • memory/3368-221-0x0000000000000000-mapping.dmp
                      Download
                    • memory/3380-283-0x0000000000000000-mapping.dmp
                      Download
                    • memory/3404-281-0x0000000000000000-mapping.dmp
                      Download
                    • memory/3504-247-0x0000000000000000-mapping.dmp
                      Download
                    • memory/3644-267-0x0000000000000000-mapping.dmp
                      Download
                    • memory/3800-244-0x0000000000000000-mapping.dmp
                      Download
                    • memory/3940-174-0x0000000000000000-mapping.dmp
                      Download
                    • memory/4056-271-0x0000000000000000-mapping.dmp
                      Download
                    • memory/4124-229-0x0000000000000000-mapping.dmp
                      Download
                    • memory/4192-241-0x0000000000000000-mapping.dmp
                      Download
                    • memory/4248-280-0x0000000000000000-mapping.dmp
                      Download
                    • memory/4264-266-0x0000000000000000-mapping.dmp
                      Download
                    • memory/4276-243-0x0000000000000000-mapping.dmp
                      Download
                    • memory/4340-277-0x0000000000000000-mapping.dmp
                      Download
                    • memory/4380-225-0x0000000000000000-mapping.dmp
                      Download
                    • memory/4448-285-0x0000000000000000-mapping.dmp
                      Download
                    • memory/4484-250-0x0000000000000000-mapping.dmp
                      Download
                    • memory/4552-254-0x0000000000000000-mapping.dmp
                      Download
                    • memory/4572-233-0x0000000000000000-mapping.dmp
                      Download
                    • memory/4716-282-0x0000000000000000-mapping.dmp
                      Download
                    • memory/4760-262-0x0000000000000000-mapping.dmp
                      Download
                    • memory/4764-255-0x0000000000000000-mapping.dmp
                      Download
                    • memory/4764-256-0x00000000020D0000-0x0000000002139000-memory.dmp
                      Filesize

                      420KB

                      Download
                    • memory/4764-257-0x00000000020D1000-0x000000000212C000-memory.dmp
                      Filesize

                      364KB

                      Download
                    • memory/4780-209-0x0000000000000000-mapping.dmp
                      Download
                    • memory/4784-276-0x0000000000000000-mapping.dmp
                      Download
                    • memory/4800-251-0x0000000000000000-mapping.dmp
                      Download
                    • memory/4864-278-0x0000000000000000-mapping.dmp
                      Download
                    • memory/4884-132-0x0000000000400000-0x0000000000907000-memory.dmp
                      Filesize

                      5.0MB

                      Download
                    • memory/4884-144-0x0000000000400000-0x0000000000907000-memory.dmp
                      Filesize

                      5.0MB

                      Download
                    • memory/4884-293-0x0000000000400000-0x0000000000907000-memory.dmp
                      Filesize

                      5.0MB

                      Download
                    • memory/4912-179-0x0000000000000000-mapping.dmp
                      Download
                    • memory/4960-230-0x0000000000000000-mapping.dmp
                      Download
                    • memory/4960-231-0x0000000000960000-0x00000000009BE000-memory.dmp
                      Filesize

                      376KB

                      Download
                    • memory/4960-232-0x0000000000961000-0x00000000009B2000-memory.dmp
                      Filesize

                      324KB

                      Download
                    • memory/5008-268-0x0000000000000000-mapping.dmp
                      Download
                    • memory/5068-238-0x0000000000000000-mapping.dmp
                      Download