84bde632c5bfd2a7ff84e579e6f7561543ca0aad6d8e7275dae5926ba4f561c1

Analysis

max time kernel
221s
max time network
226s
platform
windows10-2004_x64
resource
win10v2004-20220812-es
resource tags

arch:x64arch:x86image:win10v2004-20220812-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
08/02/2023, 22:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ovisetup.exe
Size

4.4MB
MD5

1692aec61ddcdda471defa199c62d25a
SHA1

484af221468ddb534b74e12970de80d5dfee2b28
SHA256

84bde632c5bfd2a7ff84e579e6f7561543ca0aad6d8e7275dae5926ba4f561c1
SHA512

19155d0770fc0931ab8ac1bf35f56b32c8c122379adac6866b07cebec28932f92be124638cd7bb9fdaff5edd091f3af0c1fbd0757a99de44e24f11214f13329a
SSDEEP

49152:9Hox6U/D1LbDxklrSWZAhizWV4yFK73bBxaaNNG0pHSdtDLboHTBWpHg6UvM98IQ:2x6qaAVpchNG0pHA57HgR

Score

7^/10

discovery evasion persistence trojan

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	ovisetup.exe

Executes dropped EXE 64 IoCs

pid	Process
1432	dxwebsetup.exe
4148	dxwsetup.exe
3936	infinst.exe
2456	infinst.exe
2776	infinst.exe
1576	infinst.exe
1972	infinst.exe
1220	infinst.exe
4828	infinst.exe
2068	infinst.exe
1008	infinst.exe
2576	infinst.exe
2560	infinst.exe
4700	infinst.exe
3680	infinst.exe
4304	infinst.exe
1788	infinst.exe
4656	infinst.exe
1044	infinst.exe
1908	infinst.exe
532	infinst.exe
5076	infinst.exe
1712	infinst.exe
4972	infinst.exe
1128	infinst.exe
4524	infinst.exe
2648	infinst.exe
4612	infinst.exe
2372	infinst.exe
3728	infinst.exe
4528	infinst.exe
2668	infinst.exe
4644	infinst.exe
4072	infinst.exe
1752	infinst.exe
916	infinst.exe
3604	infinst.exe
4548	infinst.exe
1228	infinst.exe
2184	infinst.exe
3248	infinst.exe
1620	infinst.exe
1460	infinst.exe
3432	infinst.exe
792	infinst.exe
1660	infinst.exe
3452	infinst.exe
2908	infinst.exe
3908	infinst.exe
2356	infinst.exe
3700	infinst.exe
1564	infinst.exe
3864	infinst.exe
4084	infinst.exe
4512	infinst.exe
4260	infinst.exe
2476	infinst.exe
4552	infinst.exe
2192	infinst.exe
1616	infinst.exe
2020	infinst.exe
2456	infinst.exe
848	infinst.exe
4628	infinst.exe

Loads dropped DLL 64 IoCs

pid	Process
4148	dxwsetup.exe
4148	dxwsetup.exe
4148	dxwsetup.exe
4148	dxwsetup.exe
4148	dxwsetup.exe
4148	dxwsetup.exe
4148	dxwsetup.exe
4148	dxwsetup.exe
4148	dxwsetup.exe
4148	dxwsetup.exe
4148	dxwsetup.exe
4148	dxwsetup.exe
4148	dxwsetup.exe
4148	dxwsetup.exe
4148	dxwsetup.exe
4148	dxwsetup.exe
4148	dxwsetup.exe
4148	dxwsetup.exe
4148	dxwsetup.exe
4148	dxwsetup.exe
4148	dxwsetup.exe
4148	dxwsetup.exe
4148	dxwsetup.exe
4148	dxwsetup.exe
4148	dxwsetup.exe
1060	regsvr32.exe
1060	regsvr32.exe
4148	dxwsetup.exe
4148	dxwsetup.exe
4148	dxwsetup.exe
4148	dxwsetup.exe
4148	dxwsetup.exe
4148	dxwsetup.exe
4148	dxwsetup.exe
4148	dxwsetup.exe
4148	dxwsetup.exe
4148	dxwsetup.exe
4148	dxwsetup.exe
4148	dxwsetup.exe
4148	dxwsetup.exe
4148	dxwsetup.exe
4148	dxwsetup.exe
4148	dxwsetup.exe
4148	dxwsetup.exe
4148	dxwsetup.exe
4148	dxwsetup.exe
2188	regsvr32.exe
4148	dxwsetup.exe
4904	regsvr32.exe
4148	dxwsetup.exe
4820	regsvr32.exe
4148	dxwsetup.exe
3216	regsvr32.exe
3216	regsvr32.exe
4148	dxwsetup.exe
2912	regsvr32.exe
4148	dxwsetup.exe
1624	regsvr32.exe
1624	regsvr32.exe
4148	dxwsetup.exe
2084	regsvr32.exe
4148	dxwsetup.exe
220	regsvr32.exe
220	regsvr32.exe

Registers COM server for autorun 1 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{fac23f48-31f5-45a8-b49b-5225d61401aa}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_0.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c1e3f122-a2ea-442c-854f-20d98f8357a1}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_1.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cac1105f-619b-4d04-831a-44e1cbf12d57}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f1b577e-5e5a-4e8a-ba73-c657ea8e8598}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_1.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77c56bf4-18a1-42b0-88af-5072ce814949}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{65d822a4-4799-42c6-9b18-d26cf66dd320}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_10.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3b80ee2a-b0f5-4780-9e30-90cb39685b03}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4c5e637a-16c7-4de3-9c46-5ed22181962d}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0977d092-2d95-4e43-8d42-9ddcc2545ed5}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6f6ea3a9-2cf5-41cf-91c1-2170b1540063}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{629cf0de-3ecc-41e7-9926-f7e43eebec51}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c60fae90-4183-4a3f-b2f7-ac1dc49b0e5c}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_2.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c1e3f122-a2ea-442c-854f-20d98f8357a1}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c1e3f122-a2ea-442c-854f-20d98f8357a1}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4c9b6dde-6809-46e6-a278-9b6a97588670}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_5.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4c9b6dde-6809-46e6-a278-9b6a97588670}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{54b68bc7-3a45-416b-a8c9-19bf19ec1df5}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3332f02-3dd0-4de9-9aec-20d85c4111b6}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e48c5a3f-93ef-43bb-a092-2c7ceb946f27}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_7.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3a2495ce-31d0-435b-8ccf-e9f0843fd960}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cd0d66ec-8057-43f5-acbd-66dfb36fd78c}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_7.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cecec95a-d894-491a-bee3-5e106fb59f2d}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c60fae90-4183-4a3f-b2f7-ac1dc49b0e5c}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1138472b-d187-44e9-81f2-ae1b0e7785f1}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3332f02-3dd0-4de9-9aec-20d85c4111b6}\InProcServer32\ = "C:\\Windows\\system32\\xactengine3_2.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e21a7345-eb21-468e-be50-804db97cf708}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03219e78-5bc3-44d1-b92e-f63d89cc6526}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_4.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03219e78-5bc3-44d1-b92e-f63d89cc6526}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f1b577e-5e5a-4e8a-ba73-c657ea8e8598}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77c56bf4-18a1-42b0-88af-5072ce814949}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_8.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3b80ee2a-b0f5-4780-9e30-90cb39685b03}\InProcServer32\ = "C:\\Windows\\system32\\xactengine3_0.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2139e6da-c341-4774-9ac3-b4e026347f64}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_5.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{bcc782bc-6492-4c22-8c35-f5d72fe73c6e}\InProcServer32\ = "C:\\Windows\\system32\\xactengine3_7.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{b802058a-464a-42db-bc10-b650d6f2586a}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8bb7778b-645b-4475-9a73-1de3170bd3af}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d06df0d0-8518-441e-822f-5451d5c595b8}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{248d8a3b-6256-44d3-a018-2ac96c459f47}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e48c5a3f-93ef-43bb-a092-2c7ceb946f27}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{54b68bc7-3a45-416b-a8c9-19bf19ec1df5}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_5.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{94c1affa-66e7-4961-9521-cfdef3128d4f}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cd0d66ec-8057-43f5-acbd-66dfb36fd78c}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{343e68e6-8f82-4a8d-a2da-6e9a944b378c}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3332f02-3dd0-4de9-9aec-20d85c4111b6}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{629cf0de-3ecc-41e7-9926-f7e43eebec51}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e48c5a3f-93ef-43bb-a092-2c7ceb946f27}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_6.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f5ca7b34-8055-42c0-b836-216129eb7e30}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c7338b95-52b8-4542-aa79-42eb016c8c1c}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{94c1affa-66e7-4961-9521-cfdef3128d4f}\InProcServer32\ = "C:\\Windows\\system32\\xactengine3_3.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0977d092-2d95-4e43-8d42-9ddcc2545ed5}\InProcServer32\ = "C:\\Windows\\system32\\xactengine3_4.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8bb7778b-645b-4475-9a73-1de3170bd3af}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cac1105f-619b-4d04-831a-44e1cbf12d57}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{343e68e6-8f82-4a8d-a2da-6e9a944b378c}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6f6ea3a9-2cf5-41cf-91c1-2170b1540063}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_0.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f5ca7b34-8055-42c0-b836-216129eb7e30}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4c9b6dde-6809-46e6-a278-9b6a97588670}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d06df0d0-8518-441e-822f-5451d5c595b8}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0aa000aa-f404-11d9-bd7a-0010dc4f8f81}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_0.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8bb7778b-645b-4475-9a73-1de3170bd3af}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_4.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cecec95a-d894-491a-bee3-5e106fb59f2d}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_6.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cac1105f-619b-4d04-831a-44e1cbf12d57}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_7.dll"	regsvr32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	dxwebsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	dxwebsetup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ovisetup.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	dxwsetup.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	dxwsetup.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	dxwsetup.exe
File opened (read-only)	\??\E:	dxwsetup.exe
File opened (read-only)	\??\M:	dxwsetup.exe
File opened (read-only)	\??\O:	dxwsetup.exe
File opened (read-only)	\??\S:	dxwsetup.exe
File opened (read-only)	\??\V:	dxwsetup.exe
File opened (read-only)	\??\R:	dxwsetup.exe
File opened (read-only)	\??\Z:	dxwsetup.exe
File opened (read-only)	\??\B:	dxwsetup.exe
File opened (read-only)	\??\G:	dxwsetup.exe
File opened (read-only)	\??\H:	dxwsetup.exe
File opened (read-only)	\??\L:	dxwsetup.exe
File opened (read-only)	\??\Q:	dxwsetup.exe
File opened (read-only)	\??\U:	dxwsetup.exe
File opened (read-only)	\??\Y:	dxwsetup.exe
File opened (read-only)	\??\F:	dxwsetup.exe
File opened (read-only)	\??\I:	dxwsetup.exe
File opened (read-only)	\??\J:	dxwsetup.exe
File opened (read-only)	\??\N:	dxwsetup.exe
File opened (read-only)	\??\P:	dxwsetup.exe
File opened (read-only)	\??\A:	dxwsetup.exe
File opened (read-only)	\??\K:	dxwsetup.exe
File opened (read-only)	\??\T:	dxwsetup.exe
File opened (read-only)	\??\X:	dxwsetup.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Mar2009_d3dx10_41_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Aug2008_xaudio_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\system32\SET2958.tmp	infinst.exe
File opened for modification	C:\Windows\system32\SET3E28.tmp	infinst.exe
File created	C:\Windows\SysWOW64\SET4128.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\D3DX9_43.dll	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\MDX_1.0.2909.0_x86.cab	dxwsetup.exe
File created	C:\Windows\system32\SET17B4.tmp	infinst.exe
File created	C:\Windows\SysWOW64\SET2678.tmp	dxwsetup.exe
File created	C:\Windows\SysWOW64\SET3E16.tmp	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Jun2008_d3dx10_38_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\d3dx9_31.dll	dxwsetup.exe
File created	C:\Windows\SysWOW64\SET2103.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\d3dx10_36.dll	dxwsetup.exe
File created	C:\Windows\SysWOW64\SET476B.tmp	dxwsetup.exe
File opened for modification	C:\Windows\system32\SET4DC8.tmp	infinst.exe
File created	C:\Windows\system32\SET3C92.tmp	infinst.exe
File opened for modification	C:\Windows\system32\D3DCompiler_39.dll	infinst.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Aug2005_d3dx9_27_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Jun2008_xaudio_x64.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Mar2009_x3daudio_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\xactengine2_7.dll	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Jun2006_xact_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\system32\SET16CA.tmp	infinst.exe
File created	C:\Windows\SysWOW64\SET189C.tmp	dxwsetup.exe
File opened for modification	C:\Windows\system32\xactengine2_5.dll	infinst.exe
File opened for modification	C:\Windows\system32\SET1FA5.tmp	infinst.exe
File created	C:\Windows\system32\SET33A9.tmp	infinst.exe
File opened for modification	C:\Windows\system32\X3DAudio1_7.dll	infinst.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Apr2007_xinput_x64.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Mar2009_d3dx9_41_x64.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Apr2006_MDX1_x86.cab	dxwsetup.exe
File created	C:\Windows\system32\SET1E8A.tmp	infinst.exe
File created	C:\Windows\SysWOW64\SET1F3D.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\SET2E42.tmp	dxwsetup.exe
File created	C:\Windows\system32\SET306D.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\SET3A18.tmp	dxwsetup.exe
File opened for modification	C:\Windows\system32\SET3B0B.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\SET4EB5.tmp	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Jun2007_d3dx9_34_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Feb2006_d3dx9_29_x64.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Jun2010_D3DCompiler_43_x64.cab	dxwsetup.exe
File created	C:\Windows\system32\SET1FA5.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\SET2755.tmp	dxwsetup.exe
File opened for modification	C:\Windows\system32\d3dx10_35.dll	infinst.exe
File opened for modification	C:\Windows\SysWOW64\SET4C53.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\d3dcsx_42.dll	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\xactengine3_5.dll	dxwsetup.exe
File opened for modification	C:\Windows\system32\xinput1_1.dll	infinst.exe
File opened for modification	C:\Windows\system32\SET361A.tmp	infinst.exe
File created	C:\Windows\system32\SET38F9.tmp	infinst.exe
File created	C:\Windows\SysWOW64\SET44A8.tmp	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Jun2008_d3dx9_38_x64.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\SETA5A.tmp	dxwsetup.exe
File opened for modification	C:\Windows\system32\x3daudio1_0.dll	infinst.exe
File created	C:\Windows\system32\SET2FD1.tmp	infinst.exe
File opened for modification	C:\Windows\system32\XAPOFX1_1.dll	infinst.exe
File opened for modification	C:\Windows\SysWOW64\SET4B58.tmp	dxwsetup.exe
File created	C:\Windows\system32\SET99B.tmp	infinst.exe
File created	C:\Windows\SysWOW64\SET30B7.tmp	dxwsetup.exe
File created	C:\Windows\SysWOW64\SET3870.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\D3DCompiler_38.dll	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\XAPOFX1_4.dll	dxwsetup.exe
File opened for modification	C:\Windows\system32\SET57FA.tmp	infinst.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\msdownld.tmp\AS57DE8F.tmp	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS580B0D.tmp\Feb2006_xact_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS58695A.tmp\Aug2009_d3dcsx_42_x64.cab	dxwsetup.exe
File created	C:\Windows\assembly\tmp\5ZY4HSUI\Microsoft.DirectX.Direct3DX.dll	dxwsetup.exe
File created	C:\Windows\assembly\tmp\83O2AQBT\Microsoft.DirectX.DirectDraw.dll	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS57D73C.tmp\Nov2007_d3dx9_36_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS57F8CD.tmp	dxwsetup.exe
File opened for modification	C:\Windows\assembly\tmp\QPGYXX48\__AssemblyInfo__.ini	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS57DCD9.tmp	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS582888.tmp\Jun2007_xact_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS58611D.tmp\Mar2009_x3daudio_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS587DFB.tmp\Jun2010_D3DCompiler_43_x64.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS57E49A.tmp\Aug2008_d3dx10_39_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5811D4.tmp\Aug2006_xact_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS581DBB.tmp\Apr2007_d3dx9_33_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS582888.tmp\Jun2007_xact_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS585CB8.tmp	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS57D45D.tmp\Aug2007_d3dx9_35_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS57EC89.tmp\Mar2009_d3dx10_41_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS57FC19.tmp\Jun2010_D3DCompiler_43_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5805DD.tmp\Dec2005_d3dx9_28_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5812CE.tmp\Aug2006_xact_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5853AF.tmp\Nov2008_x3daudio_x64.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS586311.tmp\Mar2009_xact_x64.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS57BA0F.tmp\Aug2006_xinput_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS57EFF4.tmp\Aug2009_d3dx10_42_x86.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS581762.tmp\Dec2006_d3dx9_32_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5827BD.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS57E0C1.tmp	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS582BE4.tmp\Aug2007_d3dx10_35_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS584373.tmp\Jun2008_d3dx10_38_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5873D9.tmp\Feb2010_x3daudio_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS588E86.tmp	dxwsetup.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File opened for modification	C:\Windows\msdownld.tmp\AS57BBD4.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5805DD.tmp	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5811D4.tmp\Aug2006_xact_x86.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS581AFB.tmp\Dec2006_xact_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File opened for modification	C:\Windows\msdownld.tmp\AS57EFF4.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS58350B.tmp\Nov2007_x3daudio_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS584D66.tmp	dxwsetup.exe
File opened for modification	C:\Windows\assembly\tmp\30ROE94Y\__AssemblyInfo__.ini	dxwsetup.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File opened for modification	C:\Windows\msdownld.tmp\AS57DE8F.tmp\Jun2008_d3dx9_38_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS581CB1.tmp	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5870CC.tmp\Aug2009_xact_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS587C65.tmp\Jun2010_d3dcsx_43_x64.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS58806C.tmp\Jun2010_xact_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS57BE35.tmp\Apr2007_xinput_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS57C097.tmp\Apr2005_d3dx9_25_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS57C4DD.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS57D383.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS57F0AF.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS587FB1.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS588619.tmp	dxwsetup.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File created	C:\Windows\msdownld.tmp\AS57CE33.tmp\Apr2007_d3dx9_33_x86.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS580F24.tmp\Apr2006_xact_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5819F2.tmp\Dec2006_xact_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS585303.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS586311.tmp\Mar2009_xact_x64.cab	dxwsetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000dcccb42f1bc641320000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000dcccb42f0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff000000000700010000680900dcccb42f000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000dcccb42f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000dcccb42f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8bb7778b-645b-4475-9a73-1de3170bd3af}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_4.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{074b110f-7f58-4743-aea5-12f15b5074ed}\InProcServer32\ThreadingModel = "Both"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2139e6da-c341-4774-9ac3-b4e026347f64}\InProcServer32	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{65d822a4-4799-42c6-9b18-d26cf66dd320}\ = "XACT Engine"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{629cf0de-3ecc-41e7-9926-f7e43eebec51}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_2.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03219e78-5bc3-44d1-b92e-f63d89cc6526}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248d8a3b-6256-44d3-a018-2ac96c459f47}\InProcServer32	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3a2495ce-31d0-435b-8ccf-e9f0843fd960}\InProcServer32\ = "C:\\Windows\\SysWow64\\xactengine2_6.dll"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9cab402c-1d37-44b4-886d-fa4f36170a4c}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_3.dll"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3eda9b49-2085-498b-9bb2-39a6778493de}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_6.dll"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3a2495ce-31d0-435b-8ccf-e9f0843fd960}\InProcServer32\ThreadingModel = "Both"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3a2495ce-31d0-435b-8ccf-e9f0843fd960}\ = "XACT Engine"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3eda9b49-2085-498b-9bb2-39a6778493de}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{54b68bc7-3a45-416b-a8c9-19bf19ec1df5}\InProcServer32	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c7338b95-52b8-4542-aa79-42eb016c8c1c}\ = "AudioVolumeMeter"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4c9b6dde-6809-46e6-a278-9b6a97588670}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{248d8a3b-6256-44d3-a018-2ac96c459f47}\ = "XACT Engine"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0aa000aa-f404-11d9-bd7a-0010dc4f8f81}\InProcServer32\ = "C:\\Windows\\SysWow64\\xactengine2_0.dll"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cd0d66ec-8057-43f5-acbd-66dfb36fd78c}\InProcServer32\ThreadingModel = "Both"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03219e78-5bc3-44d1-b92e-f63d89cc6526}	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1138472b-d187-44e9-81f2-ae1b0e7785f1}\InProcServer32	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{54b68bc7-3a45-416b-a8c9-19bf19ec1df5}\InProcServer32\ = "C:\\Windows\\SysWow64\\xactengine2_5.dll"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{65d822a4-4799-42c6-9b18-d26cf66dd320}\InProcServer32\ThreadingModel = "Both"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3332f02-3dd0-4de9-9aec-20d85c4111b6}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1138472b-d187-44e9-81f2-ae1b0e7785f1}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{074b110f-7f58-4743-aea5-12f15b5074ed}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{248d8a3b-6256-44d3-a018-2ac96c459f47}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4c9b6dde-6809-46e6-a278-9b6a97588670}\InProcServer32	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c60fae90-4183-4a3f-b2f7-ac1dc49b0e5c}	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f4769300-b949-4df9-b333-00d33932e9a6}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e180344b-ac83-4483-959e-18a5c56a5e19}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f4769300-b949-4df9-b333-00d33932e9a6}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_1.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e180344b-ac83-4483-959e-18a5c56a5e19}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{074b110f-7f58-4743-aea5-12f15b5074ed}\InProcServer32\ = "C:\\Windows\\SysWow64\\xactengine3_5.dll"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cecec95a-d894-491a-bee3-5e106fb59f2d}\ = "AudioReverb"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cecec95a-d894-491a-bee3-5e106fb59f2d}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f1b577e-5e5a-4e8a-ba73-c657ea8e8598}\InProcServer32\ = "C:\\Windows\\SysWow64\\xactengine2_1.dll"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d06df0d0-8518-441e-822f-5451d5c595b8}\ = "AudioReverb"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3eda9b49-2085-498b-9bb2-39a6778493de}\ = "XAudio2"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c0c56f46-29b1-44e9-9939-a32ce86867e2}\ = "AudioVolumeMeter"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4c5e637a-16c7-4de3-9c46-5ed22181962d}\ = "XAudio2"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c7338b95-52b8-4542-aa79-42eb016c8c1c}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_4.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3a2495ce-31d0-435b-8ccf-e9f0843fd960}	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3a2495ce-31d0-435b-8ccf-e9f0843fd960}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e21a7345-eb21-468e-be50-804db97cf708}\ = "XAudio2"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3332f02-3dd0-4de9-9aec-20d85c4111b6}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{b802058a-464a-42db-bc10-b650d6f2586a}\InProcServer32	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{65d822a4-4799-42c6-9b18-d26cf66dd320}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{fac23f48-31f5-45a8-b49b-5225d61401aa}\ = "XAudio2"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{629cf0de-3ecc-41e7-9926-f7e43eebec51}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4c5e637a-16c7-4de3-9c46-5ed22181962d}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c60fae90-4183-4a3f-b2f7-ac1dc49b0e5c}\InProcServer32\ = "C:\\Windows\\SysWow64\\xactengine2_2.dll"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c7338b95-52b8-4542-aa79-42eb016c8c1c}\InProcServer32	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{bcc782bc-6492-4c22-8c35-f5d72fe73c6e}\InProcServer32\ThreadingModel = "Both"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{bcc782bc-6492-4c22-8c35-f5d72fe73c6e}\InProcServer32\ = "C:\\Windows\\system32\\xactengine3_7.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c60fae90-4183-4a3f-b2f7-ac1dc49b0e5c}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77c56bf4-18a1-42b0-88af-5072ce814949}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0977d092-2d95-4e43-8d42-9ddcc2545ed5}\InProcServer32\ThreadingModel = "Both"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e48c5a3f-93ef-43bb-a092-2c7ceb946f27}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f1b577e-5e5a-4e8a-ba73-c657ea8e8598}\InProcServer32\ThreadingModel = "Both"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e48c5a3f-93ef-43bb-a092-2c7ceb946f27}\ = "AudioVolumeMeter"	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2584	ovisetup.exe
2584	ovisetup.exe
2584	ovisetup.exe
2584	ovisetup.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeBackupPrivilege	4952	vssvc.exe
Token: SeRestorePrivilege	4952	vssvc.exe
Token: SeAuditPrivilege	4952	vssvc.exe
Token: SeBackupPrivilege	3724	srtasks.exe
Token: SeRestorePrivilege	3724	srtasks.exe
Token: SeSecurityPrivilege	3724	srtasks.exe
Token: SeTakeOwnershipPrivilege	3724	srtasks.exe
Token: SeBackupPrivilege	3724	srtasks.exe
Token: SeRestorePrivilege	3724	srtasks.exe
Token: SeSecurityPrivilege	3724	srtasks.exe
Token: SeTakeOwnershipPrivilege	3724	srtasks.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 1432	2584	ovisetup.exe	82
PID 2584 wrote to memory of 1432	2584	ovisetup.exe	82
PID 2584 wrote to memory of 1432	2584	ovisetup.exe	82
PID 1432 wrote to memory of 4148	1432	dxwebsetup.exe	84
PID 1432 wrote to memory of 4148	1432	dxwebsetup.exe	84
PID 1432 wrote to memory of 4148	1432	dxwebsetup.exe	84
PID 4148 wrote to memory of 3936	4148	dxwsetup.exe	97
PID 4148 wrote to memory of 3936	4148	dxwsetup.exe	97
PID 4148 wrote to memory of 2456	4148	dxwsetup.exe	98
PID 4148 wrote to memory of 2456	4148	dxwsetup.exe	98
PID 4148 wrote to memory of 2776	4148	dxwsetup.exe	99
PID 4148 wrote to memory of 2776	4148	dxwsetup.exe	99
PID 4148 wrote to memory of 1576	4148	dxwsetup.exe	100
PID 4148 wrote to memory of 1576	4148	dxwsetup.exe	100
PID 4148 wrote to memory of 1972	4148	dxwsetup.exe	101
PID 4148 wrote to memory of 1972	4148	dxwsetup.exe	101
PID 4148 wrote to memory of 1220	4148	dxwsetup.exe	102
PID 4148 wrote to memory of 1220	4148	dxwsetup.exe	102
PID 4148 wrote to memory of 4828	4148	dxwsetup.exe	103
PID 4148 wrote to memory of 4828	4148	dxwsetup.exe	103
PID 4148 wrote to memory of 1060	4148	dxwsetup.exe	104
PID 4148 wrote to memory of 1060	4148	dxwsetup.exe	104
PID 4148 wrote to memory of 2068	4148	dxwsetup.exe	105
PID 4148 wrote to memory of 2068	4148	dxwsetup.exe	105
PID 4148 wrote to memory of 1008	4148	dxwsetup.exe	106
PID 4148 wrote to memory of 1008	4148	dxwsetup.exe	106
PID 4148 wrote to memory of 2188	4148	dxwsetup.exe	107
PID 4148 wrote to memory of 2188	4148	dxwsetup.exe	107
PID 4148 wrote to memory of 2576	4148	dxwsetup.exe	108
PID 4148 wrote to memory of 2576	4148	dxwsetup.exe	108
PID 4148 wrote to memory of 2560	4148	dxwsetup.exe	109
PID 4148 wrote to memory of 2560	4148	dxwsetup.exe	109
PID 4148 wrote to memory of 4904	4148	dxwsetup.exe	110
PID 4148 wrote to memory of 4904	4148	dxwsetup.exe	110
PID 4148 wrote to memory of 4700	4148	dxwsetup.exe	111
PID 4148 wrote to memory of 4700	4148	dxwsetup.exe	111
PID 4148 wrote to memory of 3680	4148	dxwsetup.exe	112
PID 4148 wrote to memory of 3680	4148	dxwsetup.exe	112
PID 4148 wrote to memory of 4820	4148	dxwsetup.exe	113
PID 4148 wrote to memory of 4820	4148	dxwsetup.exe	113
PID 4148 wrote to memory of 4304	4148	dxwsetup.exe	114
PID 4148 wrote to memory of 4304	4148	dxwsetup.exe	114
PID 4148 wrote to memory of 1788	4148	dxwsetup.exe	115
PID 4148 wrote to memory of 1788	4148	dxwsetup.exe	115
PID 4148 wrote to memory of 3216	4148	dxwsetup.exe	116
PID 4148 wrote to memory of 3216	4148	dxwsetup.exe	116
PID 4148 wrote to memory of 4656	4148	dxwsetup.exe	117
PID 4148 wrote to memory of 4656	4148	dxwsetup.exe	117
PID 4148 wrote to memory of 1044	4148	dxwsetup.exe	118
PID 4148 wrote to memory of 1044	4148	dxwsetup.exe	118
PID 4148 wrote to memory of 1908	4148	dxwsetup.exe	119
PID 4148 wrote to memory of 1908	4148	dxwsetup.exe	119
PID 4148 wrote to memory of 2912	4148	dxwsetup.exe	120
PID 4148 wrote to memory of 2912	4148	dxwsetup.exe	120
PID 4148 wrote to memory of 532	4148	dxwsetup.exe	121
PID 4148 wrote to memory of 532	4148	dxwsetup.exe	121
PID 4148 wrote to memory of 1624	4148	dxwsetup.exe	122
PID 4148 wrote to memory of 1624	4148	dxwsetup.exe	122
PID 4148 wrote to memory of 5076	4148	dxwsetup.exe	123
PID 4148 wrote to memory of 5076	4148	dxwsetup.exe	123
PID 4148 wrote to memory of 1712	4148	dxwsetup.exe	124
PID 4148 wrote to memory of 1712	4148	dxwsetup.exe	124
PID 4148 wrote to memory of 4972	4148	dxwsetup.exe	125
PID 4148 wrote to memory of 4972	4148	dxwsetup.exe	125

C:\Users\Admin\AppData\Local\Temp\ovisetup.exe
"C:\Users\Admin\AppData\Local\Temp\ovisetup.exe"
1⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Users\Admin\AppData\Local\Temp\OpenIV Setup_0E56893A\dxwebsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\OpenIV Setup_0E56893A\dxwebsetup.exe" /Q
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1432
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe /windowsupdate
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops desktop.ini file(s)
    - Enumerates connected drives
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4148
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe d3dx9_24_x64.inf
      4⤵
      Executes dropped EXE
      PID:3936
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe d3dx9_25_x64.inf
      4⤵
      Executes dropped EXE
      PID:2456
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe d3dx9_26_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:2776
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe d3dx9_27_x64.inf
      4⤵
      Executes dropped EXE
      PID:1576
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe d3dx9_28_x64.inf
      4⤵
      Executes dropped EXE
      PID:1972
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe d3dx9_29_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:1220
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe XACT_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:4828
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_0.dll
      4⤵
      Loads dropped DLL
      Registers COM server for autorun
      PID:1060
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe d3dx9_30_x64.inf
      4⤵
      Executes dropped EXE
      PID:2068
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe XACT2_1_x64.inf
      4⤵
      Executes dropped EXE
      PID:1008
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_1.dll
      4⤵
      Loads dropped DLL
      Registers COM server for autorun
      PID:2188
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe xinput1_1_x64.inf, Install_Driver
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:2576
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe XACT2_2_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:2560
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_2.dll
      4⤵
      Loads dropped DLL
      Registers COM server for autorun
      Modifies registry class
      PID:4904
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe xinput1_2_x64.inf, Install_Driver
      4⤵
      Executes dropped EXE
      PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe XACT2_3_x64.inf
      4⤵
      Executes dropped EXE
      PID:3680
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_3.dll
      4⤵
      Loads dropped DLL
      Registers COM server for autorun
      Modifies registry class
      PID:4820
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe d3dx9_31_x64.inf
      4⤵
      Executes dropped EXE
      PID:4304
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe XACT2_4_x64.inf
      4⤵
      Executes dropped EXE
      PID:1788
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_4.dll
      4⤵
      Loads dropped DLL
      PID:3216
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe d3dx9_32_x64.inf
      4⤵
      Executes dropped EXE
      PID:4656
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe d3dx10_00_x64.inf
      4⤵
      Executes dropped EXE
      PID:1044
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe XACT2_5_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:1908
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_5.dll
      4⤵
      Loads dropped DLL
      Registers COM server for autorun
      PID:2912
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe XACT2_6_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:532
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_6.dll
      4⤵
      Loads dropped DLL
      Registers COM server for autorun
      Modifies registry class
      PID:1624
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe d3dx9_33_x64.inf
      4⤵
      Executes dropped EXE
      PID:5076
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe d3dx10_33_x64.inf
      4⤵
      Executes dropped EXE
      PID:1712
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe XACT2_7_x64.inf
      4⤵
      Executes dropped EXE
      PID:4972
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_7.dll
      4⤵
      Loads dropped DLL
      Registers COM server for autorun
      PID:2084
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe xinput1_3_x64.inf, Install_Driver
      4⤵
      Executes dropped EXE
      PID:1128
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe d3dx9_34_x64.inf
      4⤵
      Executes dropped EXE
      PID:4524
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe d3dx10_34_x64.inf
      4⤵
      Executes dropped EXE
      PID:2648
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe XACT2_8_x64.inf
      4⤵
      Executes dropped EXE
      PID:4612
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_8.dll
      4⤵
      Loads dropped DLL
      Registers COM server for autorun
      Modifies registry class
      PID:220
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe d3dx9_35_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:2372
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe d3dx10_35_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:3728
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe XACT2_9_x64.inf
      4⤵
      Executes dropped EXE
      PID:4528
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_9.dll
      4⤵
      Registers COM server for autorun
      PID:1064
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe d3dx9_36_x64.inf
      4⤵
      Executes dropped EXE
      PID:2668
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe d3dx10_36_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      PID:4644
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe X3DAudio1_2_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:4072
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe XACT2_10_x64.inf
      4⤵
      Executes dropped EXE
      PID:1752
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_10.dll
      4⤵
      Registers COM server for autorun
      Modifies registry class
      PID:3092
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe D3DX9_37_x64.inf
      4⤵
      Executes dropped EXE
      PID:916
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe d3dx10_37_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:3604
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe X3DAudio1_3_x64.inf
      4⤵
      Executes dropped EXE
      PID:4548
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe XACT3_0_x64.inf
      4⤵
      Executes dropped EXE
      PID:1228
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_0.dll
      4⤵
      Registers COM server for autorun
      PID:3732
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe XAudio2_0_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:2184
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_0.dll
      4⤵
      Registers COM server for autorun
      PID:1480
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe D3DX9_38_x64.inf
      4⤵
      Executes dropped EXE
      PID:3248
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe d3dx10_38_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:1620
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe X3DAudio1_4_x64.inf
      4⤵
      Executes dropped EXE
      PID:1460
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe XACT3_1_x64.inf
      4⤵
      Executes dropped EXE
      PID:3432
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_1.dll
      4⤵
      PID:1560
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe XAudio2_1_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:792
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_1.dll
      4⤵
      Registers COM server for autorun
      Modifies registry class
      PID:1776
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe D3DX9_39_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      PID:1660
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe d3dx10_39_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:3452
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe XACT3_2_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:2908
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_2.dll
      4⤵
      Registers COM server for autorun
      Modifies registry class
      PID:1708
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe XAudio2_2_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      PID:3908
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_2.dll
      4⤵
      Registers COM server for autorun
      Modifies registry class
      PID:3280
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe X3DAudio1_5_x64.inf
      4⤵
      Executes dropped EXE
      PID:2356
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe XACT3_3_x64.inf
      4⤵
      Executes dropped EXE
      PID:3700
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_3.dll
      4⤵
      Registers COM server for autorun
      PID:4936
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe XAudio2_3_x64.inf
      4⤵
      Executes dropped EXE
      PID:1564
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_3.dll
      4⤵
      Registers COM server for autorun
      Modifies registry class
      PID:4900
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe D3DX9_40_x64.inf
      4⤵
      Executes dropped EXE
      PID:3864
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe d3dx10_40_x64.inf
      4⤵
      Executes dropped EXE
      PID:4084
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe X3DAudio1_6_x64.inf
      4⤵
      Executes dropped EXE
      PID:4512
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe XACT3_4_x64.inf
      4⤵
      Executes dropped EXE
      PID:4260
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_4.dll
      4⤵
      Registers COM server for autorun
      PID:412
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe XAudio2_4_x64.inf
      4⤵
      Executes dropped EXE
      PID:2476
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_4.dll
      4⤵
      Registers COM server for autorun
      Modifies registry class
      PID:1256
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe D3DX9_41_x64.inf
      4⤵
      Executes dropped EXE
      PID:4552
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe d3dx10_41_x64.inf
      4⤵
      Executes dropped EXE
      PID:2192
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe D3DX9_42_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:1616
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe d3dx10_42_x64.inf
      4⤵
      Executes dropped EXE
      PID:2020
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe d3dx11_42_x64.inf
      4⤵
      Executes dropped EXE
      PID:2456
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe d3dcsx_42_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:848
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe D3DCompiler_42_x64.inf
      4⤵
      Executes dropped EXE
      PID:4628
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe XACT3_5_x64.inf
      4⤵
      PID:1260
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_5.dll
      4⤵
      Modifies registry class
      PID:2264
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe XAudio2_5_x64.inf
      4⤵
      PID:1576
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_5.dll
      4⤵
      Registers COM server for autorun
      Modifies registry class
      PID:3652
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe X3DAudio1_7_x64.inf
      4⤵
      Drops file in System32 directory
      PID:1056
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe XACT3_6_x64.inf
      4⤵
      PID:4420
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_6.dll
      4⤵
      Registers COM server for autorun
      Modifies registry class
      PID:1772
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe XAudio2_6_x64.inf
      4⤵
      Drops file in Windows directory
      PID:3588
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_6.dll
      4⤵
      Registers COM server for autorun
      Modifies registry class
      PID:3232
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe D3DX9_43_x64.inf
      4⤵
      PID:3832
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe d3dx10_43_x64.inf
      4⤵
      PID:2816
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe d3dx11_43_x64.inf
      4⤵
      PID:2952
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe d3dcsx_43_x64.inf
      4⤵
      PID:1604
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe D3DCompiler_43_x64.inf
      4⤵
      Drops file in System32 directory
      PID:2896
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe XACT3_7_x64.inf
      4⤵
      PID:2920
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_7.dll
      4⤵
      Registers COM server for autorun
      Modifies registry class
      PID:2936
  - - C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe XAudio2_7_x64.inf
      4⤵
      PID:5060
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_7.dll
      4⤵
      Registers COM server for autorun
      Modifies registry class
      PID:4996

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4952

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3724

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\XACT_x64.inf

Filesize
765B

MD5
d04068a4eb11d24217a7f24cbb17c1cb

SHA1
35a12d7abbf3635efb3bd9f5bb4d1bed2d9c13c5

SHA256
0015e51246d381e426489c733a5d5662cb6db3caafa25fe4d00554b082fc753f

SHA512
46170920353534fda9d0476aa3c8ae4273beef52dfca70e1dd2251f608e0b57092ef7f5ce16cb67c84bdfc40188429695c1b25054fbbe23374bff4ba77c4ef23

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\d3dx9_24.dll

Filesize
3.4MB

MD5
b165df72e13e6af74d47013504319921

SHA1
c45b192cf8904b7579bbc26c799aa7ffa5cbb1d4

SHA256
1ec422bd6421c741eef57847260967f215913649901e21dd9c46eb1b3bb10906

SHA512
859b6cd538735e5cc1c44f63d66b25588ad1ad32202cae606ff95b8c4a80f6a66db9ef7c5d43820010de9334b8bbbfb079939ce89ba0b760f5d651d7fa8268ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\d3dx9_24_x64.inf

Filesize
679B

MD5
2c4e850789bf9606aa4783cd9c26099a

SHA1
036ee1c9ce3b8c495b3d155fe83e54c00a2611d4

SHA256
f02bd6bb0ca1ed41698def1465c05f5b47ca459f886647f2d84f85c5c09dad9c

SHA512
f09cb85eb7024c89024d12dd40021d1df046bb825a985bee1cb164a5c026693325bc5d64491702731ed5cb71b5af7eef34f8a922bee6d9d5881ff113dce23d21

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\d3dx9_25.dll

Filesize
3.6MB

MD5
4c56e7c5b2a61353e534c7d15d05856d

SHA1
e6e0a59a1e8217ae06cda29942537bc4be25d5a1

SHA256
10b09474bfe4e2bb395472628646bc5f353fbfbec976575c45eeff49984ebaa6

SHA512
6f630ea0764b4551d80a96f6c2b9391ed5741f14431eec951699c0e42b9434a45841d71bea5576b285cc20d38fd082b4cfc8062e4aa61f80aed9e57869cdd5d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\d3dx9_25_x64.inf

Filesize
667B

MD5
fbed164855ae10f4c2d4eb238f414e6a

SHA1
7c3ec7759a23e77242bdc70c8033c013f2c794d6

SHA256
9af2752d59fc38dd26d30769132a0887ff4123269c0dc4406f5107295e69c7c1

SHA512
68e7d441aa0b842329f63ed34bb392d1582b635eee1bd1c8a797e9a59303fc85b0d842de0fd29d88fa3c8ac0bb6d858671101633161487d6353e73c862fb228d

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\d3dx9_26.dll

Filesize
3.6MB

MD5
44f5c5e27d6825e4e62420bc29b8b533

SHA1
046455294e199af99c7c2d9174d25b230e6fd0e6

SHA256
30b06dbbd202494bae3b87487e7273adcffd17a9d2c29977030fde0570aa841b

SHA512
0c9adca329c386cb2caf0f36d672ba326929f02c29748b13188bb7ade3fbec9131ce86a6bf1b3064a2fbb8de6b8adc34208f667df31c5db182918e79744a830b

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\d3dx9_26_x64.inf

Filesize
667B

MD5
831fb8a4394d256a5d7c15c16757912c

SHA1
961d7274de32808c4dce971d943ddd79a12e8d49

SHA256
6c152334efa5b011a44f160a23a5c58b66f3bcebbf6c4bc0722a526d36699a4b

SHA512
40f3d40cb40bd887ffa15a5fc60468e48f06bb1704d19061f9b51a9e2c15ab363644aac4618276910f6fc8d90f1083931916a9943306dcf736fc72feba2385c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\d3dx9_27.dll

Filesize
3.6MB

MD5
914c3237e4d145a18dcd1d0d4c8659e1

SHA1
32503c8f8d80551c896bc2dbf2c8ae3c490f0ec4

SHA256
f9dd288c9895973f8db1856d172779041c6dee173ad1ef53b1727fc85cb6b75f

SHA512
c760b5b0b5507da8f2336b2b0625f344f28fac33da16a7d8771a122b0ba54ebf5d2a2f702f4ebb83ded746f38d63abd378a9aa3b3e50579fab7c047fe38e2c02

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\d3dx9_27_x64.inf

Filesize
667B

MD5
925202b48a83647982cb0d55ab10668d

SHA1
b04a29859288545a3f8f9daf6aa39bb7a8b4b59c

SHA256
6f56c5be97e703584dd832f35ebdc78c6aeb07cc9df155d47ed9903142086488

SHA512
72b6b4b951d04ecee1c4ea613734113b864a542dcc554e86e8d7b7fa2b0d05a1e7623051ca0809c3e934cf28cadca54acb76ad515f71a263ffd17c3872677b69

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\d3dx9_28.dll

Filesize
3.6MB

MD5
88bac8306d4ec79a82b1ffa17dc8cf4a

SHA1
0a0ab361f04ccba8268418ebff098d3da1ac26a9

SHA256
a2870f86e2f1b11646ff3f404bdbde10520c481c1400b20d25fdf56e66fb0a17

SHA512
b664033e270d71ff88139bb3e71fcdfc8417f65d7c80a12f921a60b0d825ebfe26a14bf16f9d23a10af5c866c1715e21c879993f9be1c54261c376a7cbbe511f

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\d3dx9_28_x64.inf

Filesize
667B

MD5
2e7a073438fe5ef17d0a7581afc4e37e

SHA1
adf56255c6f49509c04db26b2594756030df29fd

SHA256
dae4f2beced67333eb6aade70a4a711581f789d0a442f8fb16ba6db5ab261700

SHA512
2244afec5dc7a549d2782fe3caf7f825351a3209df70a5ad9f379cc89ec6099a72ef7316f4b96f641cf978b51cd8c1fc143a3d3f504639e24241f66418863749

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\d3dx9_29.dll

Filesize
3.7MB

MD5
68b35cbdb4a8cc424718bbcc894feeea

SHA1
c1874de5c76a55a1c42c5da20d7204201586ca4c

SHA256
d496c31a6b0f41398ecad7698987c55c2cb88eb6568976ba9b01a197879dd9dc

SHA512
da3b8251417b63d086e4223219309faea6faf3ed9f70f0345ad77f6843fc8c121ed36403aa50601434962d3089d529baa1faef0bc29602567fa3f91749d8625f

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\d3dx9_29_x64.inf

Filesize
667B

MD5
45be046f3bd08c19a5d1d0eecc97ad55

SHA1
8ce2e16a977e39ef24d9821f9dbf0aefa49472bf

SHA256
5ce705889566e690bc48e7f3fc41ec12b856e92d52c60aee45e1c223aa44848c

SHA512
340814dfd9faffd008e3c2eb0065d36f64d4cd418d4f648c4b594539daf45b41bfc641cc53176c2c577f72384b959912e0041b4a02341636941ede39b142bfcc

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\dxupdate.dll

Filesize
173KB

MD5
7ed554b08e5b69578f9de012822c39c9

SHA1
036d04513e134786b4758def5aff83d19bf50c6e

SHA256
fb4f297e295c802b1377c6684734b7249d55743dfb7c14807bef59a1b5db63a2

SHA512
7af5f9c4a3ad5c120bcdd681b958808ada4d885d21aeb4a009a36a674ad3ece9b51837212a982db6142a6b5580e5b68d46971b802456701391ce40785ae6ebd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\dxupdate.dll

Filesize
173KB

MD5
7ed554b08e5b69578f9de012822c39c9

SHA1
036d04513e134786b4758def5aff83d19bf50c6e

SHA256
fb4f297e295c802b1377c6684734b7249d55743dfb7c14807bef59a1b5db63a2

SHA512
7af5f9c4a3ad5c120bcdd681b958808ada4d885d21aeb4a009a36a674ad3ece9b51837212a982db6142a6b5580e5b68d46971b802456701391ce40785ae6ebd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe

Filesize
56KB

MD5
ac36c85030678eb69a498793a36a81e9

SHA1
a1719053eec7a206bd1d005e1038a1a7ca2eb1a0

SHA256
85a8b155b066d81efb5d4959f5ea59a9ce43d40663cb2aba05ef0e6d01c22c18

SHA512
47f26ed02bedc96b504344ac53418f63b1da4844b6db61d334dd9b09d0481584dbddc166a654c5b553d5609fb8fb90c01dee9329c68dd74c24ee6bd8eb136d06

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe

Filesize
56KB

MD5
ac36c85030678eb69a498793a36a81e9

SHA1
a1719053eec7a206bd1d005e1038a1a7ca2eb1a0

SHA256
85a8b155b066d81efb5d4959f5ea59a9ce43d40663cb2aba05ef0e6d01c22c18

SHA512
47f26ed02bedc96b504344ac53418f63b1da4844b6db61d334dd9b09d0481584dbddc166a654c5b553d5609fb8fb90c01dee9329c68dd74c24ee6bd8eb136d06

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe

Filesize
56KB

MD5
afd73a6c2e1172e4075c8b37816eb391

SHA1
eceaeaca967c9ac3239f65b4d4f75d994dabd7ee

SHA256
ea544793b661304f31f18e9d107a4b4b46bd198d806f6366870746fe52e01df9

SHA512
5c313c81808c664f056ccd64784e607439ed45874fe322afdf690aba6d8dc54c2b54e42f69ce003bd0aefd0ebe5518f102f846aaa96254d3218d62b4f5dc463b

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe

Filesize
59KB

MD5
44f9c211701098d36dde44c5cf3afd63

SHA1
c020bb7dfb5932c5cbe19ca5d9feffde05781134

SHA256
d636d29f6019bcc232e62553728871097097aae05a6426bb86af15720de2e0e6

SHA512
b8aa96c4b8861b76f0c5c606f5458cc1e06e6e2ecd684f9ebde9e68a4d5057e84413816d78f88525fef63f4863a4b498c6d8cbc74faf8c555029dde7e34dec5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe

Filesize
61KB

MD5
def5caad8a452d6515bd40df6dd6b51f

SHA1
c26a793ef0a117b9b960caaabf31fef6036576de

SHA256
34df5a253007edd15d14f28a333bac638fe961f0f3941b192d7a6a760c2635fe

SHA512
2f3984f126de1c89cb815e00587d41c9bc32358530d9d2931ef917f6d3a45422a80caf6bcbb1615a61e51d7cb81532795cafefdfc39f9dab7c2f7d70cc22a1bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe

Filesize
65KB

MD5
60db6abbe4d4f22d87cd15c9bdae79e7

SHA1
4dc25047507cb28a0855c8c2f5bf11fb0dbf1366

SHA256
10e420d85c6d2905d9ca076681c3b1d648bc1b5b3893c8eb5ff420d2b964f0cb

SHA512
846fc61367cc3fff2c0516c1872f1380e120684853fa9e4a6d077f94c83c99dfdc9f3d2cf7de587fe3988a3224b7ea7e0f27c7a76e11c5a6daaf03ed15864476

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe

Filesize
65KB

MD5
c292f0eacff8f95b789c78907bb52a46

SHA1
497087279afae9c13c5aae642fcbd3f269f31345

SHA256
5ec466d86f7205e7a99985f0be8cacd0494454780c28ac90ff5d4b906b9dc5e5

SHA512
854e9d5554d98fcecd3ad777565988ab363863057818392b56c325df6f613fb8efb501026ba8d081eebbca53d72f081cd13a2e90e42f93d6010ed3865bc33b2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\infinst.exe

Filesize
65KB

MD5
c292f0eacff8f95b789c78907bb52a46

SHA1
497087279afae9c13c5aae642fcbd3f269f31345

SHA256
5ec466d86f7205e7a99985f0be8cacd0494454780c28ac90ff5d4b906b9dc5e5

SHA512
854e9d5554d98fcecd3ad777565988ab363863057818392b56c325df6f613fb8efb501026ba8d081eebbca53d72f081cd13a2e90e42f93d6010ed3865bc33b2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\microsoft.directx.direct3dx.dll

Filesize
2.6MB

MD5
a73e7421449cca62b0561bad4c8ef23d

SHA1
cf51ca7d28fcdc79c215450fb759ffe9101b6cfe

SHA256
7986e3fbe05418fe5d8425f2f1b76b7a7b09952f3ec560b286dd744bf7178059

SHA512
63d24647ac5d0beb8f1284973927263cb6e05b4c399cda3912178114b42d541dd516c6d67a453ea997d9d0cd9126a1802678062f0951c2547e1b445ba50dfbe4

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\microsoft.directx.direct3dx.dll

Filesize
2.6MB

MD5
a73e7421449cca62b0561bad4c8ef23d

SHA1
cf51ca7d28fcdc79c215450fb759ffe9101b6cfe

SHA256
7986e3fbe05418fe5d8425f2f1b76b7a7b09952f3ec560b286dd744bf7178059

SHA512
63d24647ac5d0beb8f1284973927263cb6e05b4c399cda3912178114b42d541dd516c6d67a453ea997d9d0cd9126a1802678062f0951c2547e1b445ba50dfbe4

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\microsoft.directx.direct3dx.dll

Filesize
2.7MB

MD5
5e2b8b8a5ed016468716b9ff82a1806f

SHA1
f1772121149d87745738cd471d0e504301a9ad0d

SHA256
5b70f0ac40a38c903062a12ff7cd71d907e75238a044ded9b34fb51e9a9a2799

SHA512
4620c9bafb7dfaa8d4351d0d99ae3442ceb2220201f16bd9bab4fbeb1f411fd63d4f0e79abf6e762f4d0e62d42608fbeebd13943ce338eca59ad1080ea6c2728

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\microsoft.directx.direct3dx.dll

Filesize
2.7MB

MD5
5e2b8b8a5ed016468716b9ff82a1806f

SHA1
f1772121149d87745738cd471d0e504301a9ad0d

SHA256
5b70f0ac40a38c903062a12ff7cd71d907e75238a044ded9b34fb51e9a9a2799

SHA512
4620c9bafb7dfaa8d4351d0d99ae3442ceb2220201f16bd9bab4fbeb1f411fd63d4f0e79abf6e762f4d0e62d42608fbeebd13943ce338eca59ad1080ea6c2728

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\microsoft.directx.direct3dx.dll

Filesize
550KB

MD5
d3f1922325be8e7e1c72bfd8179454ce

SHA1
89134f43ce2af4adfbc4087392aee6fe56be7ff4

SHA256
8418941d8f1d4c84288e0bf54392378dd3d87b602bb693ff4f8a633022681c12

SHA512
d33f513ff6c199acabe86eca6dc06d56c330ccb78be4d13fb6b1906a3cba3c93afe982b05cb057f2b88f6e6637452f4d99d4a4fe6f3f7c473de9e67a40758bed

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\microsoft.directx.direct3dx.dll

Filesize
550KB

MD5
d3f1922325be8e7e1c72bfd8179454ce

SHA1
89134f43ce2af4adfbc4087392aee6fe56be7ff4

SHA256
8418941d8f1d4c84288e0bf54392378dd3d87b602bb693ff4f8a633022681c12

SHA512
d33f513ff6c199acabe86eca6dc06d56c330ccb78be4d13fb6b1906a3cba3c93afe982b05cb057f2b88f6e6637452f4d99d4a4fe6f3f7c473de9e67a40758bed

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\microsoft.directx.direct3dx.dll

Filesize
562KB

MD5
afcf5f50c632f3a5598abc28f196d77c

SHA1
294385693592f9d6320f8b0b18f45bc194d01a4d

SHA256
5e90089e69e4f7e2e42ea4a81fb62005c3710d0a4acdf207b97ed03f5641d013

SHA512
29746ffc665051e13386e452c3e41a593b6339e09a228927929be100cddb3e0e0fd3b54abe02eb7d46a3d97466ecb02bac362398b72fd8e804cbb21c8bc856d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\microsoft.directx.direct3dx.dll

Filesize
562KB

MD5
afcf5f50c632f3a5598abc28f196d77c

SHA1
294385693592f9d6320f8b0b18f45bc194d01a4d

SHA256
5e90089e69e4f7e2e42ea4a81fb62005c3710d0a4acdf207b97ed03f5641d013

SHA512
29746ffc665051e13386e452c3e41a593b6339e09a228927929be100cddb3e0e0fd3b54abe02eb7d46a3d97466ecb02bac362398b72fd8e804cbb21c8bc856d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\microsoft.directx.direct3dx.dll

Filesize
563KB

MD5
ccd53738df4fa27849b6bb05dd67d10d

SHA1
28126653a3d1b4574fcb0c09176f5fa0ff28ef78

SHA256
c29d337bf7639fbf424b34cc0409d2715762e1b4d82881fb524a2508381c9f62

SHA512
aa3a10504fbe49a4c44151beec7d9b543f4b89a51621fa60810f385bdc8a6821e4bfc37cd46f3688013f6f4facd33ab45bd0deb4a1fe16453e1be8f11f2119c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\microsoft.directx.direct3dx.dll

Filesize
563KB

MD5
ccd53738df4fa27849b6bb05dd67d10d

SHA1
28126653a3d1b4574fcb0c09176f5fa0ff28ef78

SHA256
c29d337bf7639fbf424b34cc0409d2715762e1b4d82881fb524a2508381c9f62

SHA512
aa3a10504fbe49a4c44151beec7d9b543f4b89a51621fa60810f385bdc8a6821e4bfc37cd46f3688013f6f4facd33ab45bd0deb4a1fe16453e1be8f11f2119c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\microsoft.directx.direct3dx.dll

Filesize
565KB

MD5
933085360527de1b4947289ca468184e

SHA1
d5ee5e1e3c992c7518b5ce510c627c1564131b12

SHA256
78d85f0e2cb7d7bde534222f4ebfea1c9e06d37ecd3bb7ebd59e35f00b94b11d

SHA512
2e22398d7cdcd6a46daf3dd3478d861bc4012ba1b54862311ae031ebcd3f908352157cbeea528f22ef1824f8924c3f217311feaf1804cf675eafc07a8d3962eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\microsoft.directx.direct3dx.dll

Filesize
565KB

MD5
933085360527de1b4947289ca468184e

SHA1
d5ee5e1e3c992c7518b5ce510c627c1564131b12

SHA256
78d85f0e2cb7d7bde534222f4ebfea1c9e06d37ecd3bb7ebd59e35f00b94b11d

SHA512
2e22398d7cdcd6a46daf3dd3478d861bc4012ba1b54862311ae031ebcd3f908352157cbeea528f22ef1824f8924c3f217311feaf1804cf675eafc07a8d3962eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\microsoft.directx.direct3dx.dll

Filesize
564KB

MD5
43c280c3b15ceb2472ab560d09629664

SHA1
e3a897d7608d03c93b5c2b8aef52703452cf6696

SHA256
bebbc40ca25ef22e9d16b0de1123e0cb0444fe7a78b4f0b4395bdfd81618698c

SHA512
5229eef9153b992684b6dcb4a32b231c63322b5e4b49ef262228c0dcca4760f97cda5d15a7fcdf77d813eb24b359101e716f72988374106ace13473f27e731c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\microsoft.directx.direct3dx.dll

Filesize
564KB

MD5
43c280c3b15ceb2472ab560d09629664

SHA1
e3a897d7608d03c93b5c2b8aef52703452cf6696

SHA256
bebbc40ca25ef22e9d16b0de1123e0cb0444fe7a78b4f0b4395bdfd81618698c

SHA512
5229eef9153b992684b6dcb4a32b231c63322b5e4b49ef262228c0dcca4760f97cda5d15a7fcdf77d813eb24b359101e716f72988374106ace13473f27e731c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\microsoft.directx.direct3dx.dll

Filesize
564KB

MD5
490807c150b7d8be44bde871f4df8c56

SHA1
69b68a5b8cc3f3e75aa2ba284654ca58bb62f23e

SHA256
36a21fc4f4c8f6ba4ad900613ee1b08ff43f2545585a2601c9fc4cf083d68a77

SHA512
9442e26de55009428cc6e747637c2cb64bd2f008541ccbb37fed4e83ff66845c7cf3874d93542e0ba544e2db61f4864b665b7720568eba284beb095489f3ca64

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\microsoft.directx.direct3dx.dll

Filesize
564KB

MD5
490807c150b7d8be44bde871f4df8c56

SHA1
69b68a5b8cc3f3e75aa2ba284654ca58bb62f23e

SHA256
36a21fc4f4c8f6ba4ad900613ee1b08ff43f2545585a2601c9fc4cf083d68a77

SHA512
9442e26de55009428cc6e747637c2cb64bd2f008541ccbb37fed4e83ff66845c7cf3874d93542e0ba544e2db61f4864b665b7720568eba284beb095489f3ca64

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\microsoft.directx.direct3dx.dll

Filesize
554KB

MD5
fb3bc0754921873a65f5fbdca845e6ee

SHA1
67cde5bc8577cd3040e275d290ac021874da9fe8

SHA256
f500c350dd71df7452b92444e19b4644b04283434a6557123f1e4d9fb078c3f8

SHA512
292b8bda44e6ff6449c4b38da9b8317491c0f0da3d1e5f7947741de27cc51bbc078fbf947c89c4be3a0b54f7066f0480990d1de57919edba3414aace77c47635

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\microsoft.directx.direct3dx.dll

Filesize
554KB

MD5
fb3bc0754921873a65f5fbdca845e6ee

SHA1
67cde5bc8577cd3040e275d290ac021874da9fe8

SHA256
f500c350dd71df7452b92444e19b4644b04283434a6557123f1e4d9fb078c3f8

SHA512
292b8bda44e6ff6449c4b38da9b8317491c0f0da3d1e5f7947741de27cc51bbc078fbf947c89c4be3a0b54f7066f0480990d1de57919edba3414aace77c47635

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\x3daudio1_0.dll

Filesize
16KB

MD5
f77d5ab654881e683cff6650916c424e

SHA1
56d8f090755f1ec60b13e748b040069ea8759b5b

SHA256
77cc09cea6de69f12106e6dd9df1c0446a525a54c3953d69d64711b9394cc38f

SHA512
dcd1273673f4088e854057e47484bb363e1e7ce094bc2c98ad7cc9112877892c1d6fd591dd9cfb325d6c451f2d03a4cdcc238af1ffb5382b7153f079cbe13abd

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXDDBA.tmp\xactengine2_0.dll

Filesize
347KB

MD5
ce5753f9a27837259eb52f3f47f39593

SHA1
2eb60f397eff937249521fe0bf5fe89eccee4914

SHA256
a00ad310f3d7b2d4de2f5a4c081359fa443ce0baecc72ebf39d6b30ccf7babce

SHA512
93fa47262f1b1ed9b284337f7225bdc06b6931931f385eeb30faaba25f1ccc483d633a40831471da70077d6a1f6a84c21a909daea059ecf316534b1994467230

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dsetup.dll

Filesize
93KB

MD5
984cad22fa542a08c5d22941b888d8dc

SHA1
3e3522e7f3af329f2235b0f0850d664d5377b3cd

SHA256
57bc22850bb8e0bcc511a9b54cd3da18eec61f3088940c07d63b9b74e7fe2308

SHA512
8ef171218b331f0591a4b2a5e68dcbae98f5891518ce877f1d8d1769c59c0f4ddae43cc43da6606975078f889c832f0666484db9e047782e7a0ae4a2d41f5bef

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dsetup32.dll

Filesize
1.5MB

MD5
a5412a144f63d639b47fcc1ba68cb029

SHA1
81bd5f1c99b22c0266f3f59959dfb4ea023be47e

SHA256
8a011da043a4b81e2b3d41a332e0ff23a65d546bd7636e8bc74885e8746927d6

SHA512
2679a4cb690e8d709cb5e57b59315d22f69f91efa6c4ee841943751c882b0c0457fd4a3376ac3832c757c6dfaffb7d844909c5665b86a95339af586097ee0405

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxupdate.dll

Filesize
173KB

MD5
7ed554b08e5b69578f9de012822c39c9

SHA1
036d04513e134786b4758def5aff83d19bf50c6e

SHA256
fb4f297e295c802b1377c6684734b7249d55743dfb7c14807bef59a1b5db63a2

SHA512
7af5f9c4a3ad5c120bcdd681b958808ada4d885d21aeb4a009a36a674ad3ece9b51837212a982db6142a6b5580e5b68d46971b802456701391ce40785ae6ebd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxupdate.dll

Filesize
173KB

MD5
7ed554b08e5b69578f9de012822c39c9

SHA1
036d04513e134786b4758def5aff83d19bf50c6e

SHA256
fb4f297e295c802b1377c6684734b7249d55743dfb7c14807bef59a1b5db63a2

SHA512
7af5f9c4a3ad5c120bcdd681b958808ada4d885d21aeb4a009a36a674ad3ece9b51837212a982db6142a6b5580e5b68d46971b802456701391ce40785ae6ebd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.cif

Filesize
56KB

MD5
7b1fbe9f5f43b2261234b78fe115cf8e

SHA1
dd0f256ae38b4c4771e1d1ec001627017b7bb741

SHA256
762ff640013db2bd4109d7df43a867303093815751129bd1e33f16bf02e52cce

SHA512
d21935a9867c0f2f7084917c79fbb1da885a1bfd4793cf669ff4da8c777b3a201857250bfb7c2b616625a8d3573c68395d210446d2c284b41cf09cc7cbb07885

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe

Filesize
515KB

MD5
ac3a5f7be8cd13a863b50ab5fe00b71c

SHA1
eee417cd92e263b84dd3b5dcc2b4b463fe6e84d9

SHA256
8f5e89298e3dc2e22d47515900c37cca4ee121c5ba06a6d962d40ad6e1a595da

SHA512
c8bbe791373dad681f0ac9f5ab538119bde685d4f901f5db085c73163fc2e868972b2de60e72ccd44f745f1fd88fcde2e27f32302d8cbd3c1f43e6e657c79fba

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe

Filesize
515KB

MD5
ac3a5f7be8cd13a863b50ab5fe00b71c

SHA1
eee417cd92e263b84dd3b5dcc2b4b463fe6e84d9

SHA256
8f5e89298e3dc2e22d47515900c37cca4ee121c5ba06a6d962d40ad6e1a595da

SHA512
c8bbe791373dad681f0ac9f5ab538119bde685d4f901f5db085c73163fc2e868972b2de60e72ccd44f745f1fd88fcde2e27f32302d8cbd3c1f43e6e657c79fba

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.inf

Filesize
477B

MD5
ad8982eaa02c7ad4d7cdcbc248caa941

SHA1
4ccd8e038d73a5361d754c7598ed238fc040d16b

SHA256
d63c35e9b43eb0f28ffc28f61c9c9a306da9c9de3386770a7eb19faa44dbfc00

SHA512
5c805d78bafff06c36b5df6286709ddf2d36808280f92e62dc4c285edd9176195a764d5cf0bb000da53ca8bbf66ddd61d852e4259e3113f6529e2d7bdbdd6e28

Download Submit
C:\Users\Admin\AppData\Local\Temp\OpenIV Setup_0E56893A\dxwebsetup.exe

Filesize
285KB

MD5
bcbb7c0cd9696068988953990ec5bd11

SHA1
3c8243734cf43dd7bb2332ba05b58ccacfa4377c

SHA256
34f64699d4830145cae69bd40115b1f326e70fc6a98456cb3df996d947dddca4

SHA512
551a2e3aa5fc7c0e79c3bd7c5333df5f1920ea83fe35b99adbbe865ea926fa772d72709bde2ea8f2685f4914cd96ff7b5b6f894f9b99f1120c2abe89c390a786

Download Submit
C:\Users\Admin\AppData\Local\Temp\OpenIV Setup_0E56893A\dxwebsetup.exe

Filesize
285KB

MD5
bcbb7c0cd9696068988953990ec5bd11

SHA1
3c8243734cf43dd7bb2332ba05b58ccacfa4377c

SHA256
34f64699d4830145cae69bd40115b1f326e70fc6a98456cb3df996d947dddca4

SHA512
551a2e3aa5fc7c0e79c3bd7c5333df5f1920ea83fe35b99adbbe865ea926fa772d72709bde2ea8f2685f4914cd96ff7b5b6f894f9b99f1120c2abe89c390a786

Download Submit
C:\Windows\DirectX.log

Filesize
315B

MD5
8d5f8ea73284422ad5724e6d44490151

SHA1
291c27bab7978d9a4308def3f516bea0b0415599

SHA256
42ee224b474946d11ce67bf01d0b839197a9e3dbb8d923603223f3c535a3c5f4

SHA512
848a4c48951cdc8977c53312c20e55fad8d073129241184785e2943944e731b14762dcc2f1b42b9a7d536a5ad43676a18a9ebba4e9fc76a37ce89b15e0a3f12d

Download Submit
C:\Windows\DirectX.log

Filesize
511B

MD5
c2543dad104b1e138b2b42cbe09e6f3e

SHA1
4c8e1c05647688c890b587cc97dc58e3fd428edf

SHA256
e88277364b4fe32e28de2fc3a6f246a1a416b6e8c2474474b1039ba0af95da8f

SHA512
81c81de1f2ff309c9c0e74fa67a7fd28e5bf325882a40627ef557f3eddcb58f2c9f3a6026c84ffbcd149a7bad65043b8108949c18440845750c23536353a5ecf

Download Submit
C:\Windows\DirectX.log

Filesize
588B

MD5
cda3d0081000cb9f6edf96bc6d038599

SHA1
56ef22812b533b77520fa474ef11cf214aa26fdc

SHA256
708d48f603d833f3815b0ecd9553a2d11ed1cbade41ca6e838e38c094b7f2c70

SHA512
17464310818cdc4a7be8437aa085707a6b6ba2a6025f10cbae16cb22980189d076bdf7b74372bfafdfbf74d8560c25a8a365f241ac8a58e2ab0771df5b2ec0b1

Download Submit
C:\Windows\DirectX.log

Filesize
903B

MD5
22e8027e55ff30bb4767d95a571bcf45

SHA1
1404225c48b771165a56226735c1983b27289383

SHA256
039a766f8849e428fec465e9b016974cf41a8bdd4281e113f01407fcaeb99125

SHA512
fb4cfea63310183d1117ff32c5174cf845b2bbd525ead56a4b224d857dbba42875dfa2e17e697a239f5cd69b52c1ac4944d412cbbf3afdde6280a9757668d5ba

Download Submit
C:\Windows\DirectX.log

Filesize
1KB

MD5
b5a70e6572e8cfa9255956704249c0ec

SHA1
1cf7af7f647f44e7c2688e2350738bc593757f22

SHA256
24a06f5d0bc914474a9f975cacd72ab6b8d02c673e1343fcba9863c8a4bc017a

SHA512
be3affaac65b26fc81d3706c0a16ef1e796802941e18bcdfc3d35956df302d5c8c891519f16180af5ca6233fe3ad33dd990f91872741891807237df7e6270bcf

Download Submit
C:\Windows\DirectX.log

Filesize
1KB

MD5
a5c5491682aa58b74a1ec087b8d2efcb

SHA1
9bed0b0dc1488bbd13537e4df1e4b1b4caa59f87

SHA256
449e7d424571444f058f59b9cd942b458cbf248d4ada23ed11a47fe1ac2be678

SHA512
4f97876e66e3c55a91a021e32d1c111dd5cdfb282720075a9a5fe93d81e7af11f5d1dd7961d9e31ac572dc16dceb08f850a3f2310dbabcbaa6e33c87ca05b89a

Download Submit
C:\Windows\SysWOW64\directx\websetup\dsetup.dll

Filesize
93KB

MD5
984cad22fa542a08c5d22941b888d8dc

SHA1
3e3522e7f3af329f2235b0f0850d664d5377b3cd

SHA256
57bc22850bb8e0bcc511a9b54cd3da18eec61f3088940c07d63b9b74e7fe2308

SHA512
8ef171218b331f0591a4b2a5e68dcbae98f5891518ce877f1d8d1769c59c0f4ddae43cc43da6606975078f889c832f0666484db9e047782e7a0ae4a2d41f5bef

Download Submit
C:\Windows\SysWOW64\directx\websetup\dsetup32.dll

Filesize
1.5MB

MD5
a5412a144f63d639b47fcc1ba68cb029

SHA1
81bd5f1c99b22c0266f3f59959dfb4ea023be47e

SHA256
8a011da043a4b81e2b3d41a332e0ff23a65d546bd7636e8bc74885e8746927d6

SHA512
2679a4cb690e8d709cb5e57b59315d22f69f91efa6c4ee841943751c882b0c0457fd4a3376ac3832c757c6dfaffb7d844909c5665b86a95339af586097ee0405

Download Submit
C:\Windows\SysWOW64\xactengine2_0.dll

Filesize
224KB

MD5
2112fe0c46662d429347a7d7b49e3ece

SHA1
8cf607547e9c5a10f129a3a8f8f32bd295c0d5b4

SHA256
cfd1c2d34feb7d94f282e97bf762a99bfa7309dc7353d96dfe4aadc187d26c67

SHA512
77f77add8411d418798d643d783752896d3fcac002f15696caeaf45b5396d2d42fe53bfb409d66ad505cdaac0ef0a20a62aa45b50aebe65237d2c44af36bbc34

Download Submit
C:\Windows\System32\xactengine2_0.dll

Filesize
347KB

MD5
ce5753f9a27837259eb52f3f47f39593

SHA1
2eb60f397eff937249521fe0bf5fe89eccee4914

SHA256
a00ad310f3d7b2d4de2f5a4c081359fa443ce0baecc72ebf39d6b30ccf7babce

SHA512
93fa47262f1b1ed9b284337f7225bdc06b6931931f385eeb30faaba25f1ccc483d633a40831471da70077d6a1f6a84c21a909daea059ecf316534b1994467230

Download Submit
C:\Windows\system32\xactengine2_0.dll

Filesize
347KB

MD5
ce5753f9a27837259eb52f3f47f39593

SHA1
2eb60f397eff937249521fe0bf5fe89eccee4914

SHA256
a00ad310f3d7b2d4de2f5a4c081359fa443ce0baecc72ebf39d6b30ccf7babce

SHA512
93fa47262f1b1ed9b284337f7225bdc06b6931931f385eeb30faaba25f1ccc483d633a40831471da70077d6a1f6a84c21a909daea059ecf316534b1994467230

Download Submit
memory/220-243-0x0000000002110000-0x0000000002179000-memory.dmp

Filesize
420KB

Download
memory/220-244-0x0000000002111000-0x000000000216C000-memory.dmp

Filesize
364KB

Download
memory/1060-210-0x0000000000920000-0x000000000097C000-memory.dmp

Filesize
368KB

Download
memory/1060-211-0x0000000000921000-0x0000000000970000-memory.dmp

Filesize
316KB

Download
memory/1624-233-0x0000000001E11000-0x0000000001E68000-memory.dmp

Filesize
348KB

Download
memory/1624-232-0x0000000001E10000-0x0000000001E74000-memory.dmp

Filesize
400KB

Download
memory/2584-132-0x0000000000400000-0x0000000000907000-memory.dmp

Filesize
5.0MB

Download
memory/2584-134-0x0000000000400000-0x0000000000907000-memory.dmp

Filesize
5.0MB

Download
memory/2584-135-0x0000000000400000-0x0000000000907000-memory.dmp

Filesize
5.0MB

Download
memory/2584-272-0x0000000000400000-0x0000000000907000-memory.dmp

Filesize
5.0MB

Download
memory/3216-225-0x0000000000601000-0x0000000000652000-memory.dmp

Filesize
324KB

Download
memory/3216-224-0x0000000000600000-0x000000000065E000-memory.dmp

Filesize
376KB

Download