0e72ed6d89d9b89690fde8122f46fa851740ef18e850d98d45e56f85a6682994

Analysis

max time kernel
300s
max time network
287s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28/01/2024, 16:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Xbox360_64Eng.exe
Size 7.5MB
Sample240128-vcjlysfeer
SHA256 0e72ed6d89d9b89690fde8122f46fa851740ef18e850d98d45e56f85a6682994
MD5 4c7fbad5bbebc0d3807129092a1de4b9
SHA1 00f7246437c53f3aba5516ac3fc572181c24c666
SHA512 e3acdb5b5e58e2d8aa9f77a3a70a7317fda32e9471d64b7364216cdbcf44abd8ba80088f7f275085ead1f0a536075fc185151c4e31ee472b73be1e5e26d07ab9
SSDEEP 98304:BSUCTRhlUVz71eG+Ybiy/j+Hu9Oy5fNFDm9DOTJ7AHzJJRFlzHObR8AJrYE/0eeN:BYTFEnT0y/+SrK9+JMHFDzxpE/U
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation	setup.exe

Executes dropped EXE 5 IoCs

pid	Process
940	setup.exe
1976	setupstb.exe
1456	DXSETUP.exe
4804	infinst.exe
3788	XBoxStat.exe

Loads dropped DLL 17 IoCs

pid	Process
940	setup.exe
1976	setupstb.exe
1456	DXSETUP.exe
1456	DXSETUP.exe
1456	DXSETUP.exe
1456	DXSETUP.exe
1456	DXSETUP.exe
1456	DXSETUP.exe
1456	DXSETUP.exe
1456	DXSETUP.exe
2652	MsiExec.exe
2652	MsiExec.exe
2652	MsiExec.exe
2652	MsiExec.exe
3788	XBoxStat.exe
3788	XBoxStat.exe
3788	XBoxStat.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XboxStat = "\"C:\\Program Files\\Microsoft Xbox 360 Accessories\\XboxStat.exe\" silentrun"	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\Temp\{e4fce003-ffd5-cf4e-9811-9a8d2533502c}\x64\SET933.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\SETF5BA.tmp	infinst.exe
File created	C:\Windows\System32\DriverStore\Temp\{e4fce003-ffd5-cf4e-9811-9a8d2533502c}\SET934.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\SETF55C.tmp	DXSETUP.exe
File opened for modification	C:\Windows\system32\xinput1_3.dll	infinst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{e4fce003-ffd5-cf4e-9811-9a8d2533502c}\x64\xusb21.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{e4fce003-ffd5-cf4e-9811-9a8d2533502c}\SET945.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\xusb21.inf_amd64_68c06a8fe00c5ac3\x64\xusb21.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{e4fce003-ffd5-cf4e-9811-9a8d2533502c}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{e4fce003-ffd5-cf4e-9811-9a8d2533502c}\x64\WdfCoInstaller01009.dll	DrvInst.exe
File created	C:\Windows\SysWOW64\SETF55C.tmp	DXSETUP.exe
File created	C:\Windows\System32\DriverStore\Temp\{e4fce003-ffd5-cf4e-9811-9a8d2533502c}\x64\SET933.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\xusb21.inf_amd64_68c06a8fe00c5ac3\xusb21.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{e4fce003-ffd5-cf4e-9811-9a8d2533502c}\x64\SET923.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{e4fce003-ffd5-cf4e-9811-9a8d2533502c}\x64	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\xinput1_3.dll	DXSETUP.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{e4fce003-ffd5-cf4e-9811-9a8d2533502c}\SET934.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{e4fce003-ffd5-cf4e-9811-9a8d2533502c}\SET945.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{e4fce003-ffd5-cf4e-9811-9a8d2533502c}\xusb21.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\xusb21.inf_amd64_68c06a8fe00c5ac3\xusb21.PNF	MsiExec.exe
File created	C:\Windows\system32\SETF5BA.tmp	infinst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{e4fce003-ffd5-cf4e-9811-9a8d2533502c}\x64\SET923.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{e4fce003-ffd5-cf4e-9811-9a8d2533502c}\xusb21.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\xusb21.inf_amd64_68c06a8fe00c5ac3\x64\WdfCoInstaller01009.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\xusb21.inf_amd64_68c06a8fe00c5ac3\xusb21.cat	DrvInst.exe

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe	msiexec.exe
File created	C:\Program Files\Microsoft Xbox 360 Accessories\x86\Xusb21.sys	msiexec.exe
File created	C:\Program Files\Microsoft Xbox 360 Accessories\x86\WdfCoInstaller01009.dll	msiexec.exe
File created	C:\Program Files\Microsoft Xbox 360 Accessories\Dw15.exe	msiexec.exe
File created	C:\Program Files\Microsoft Xbox 360 Accessories\Downloader.exe	msiexec.exe
File created	C:\Program Files\Microsoft Xbox 360 Accessories\Xusb21.cat	msiexec.exe
File created	C:\Program Files\Microsoft Xbox 360 Accessories\UpdateRes.dll	msiexec.exe
File created	C:\Program Files\Microsoft Xbox 360 Accessories\1033\dwintl.dll	msiexec.exe
File created	C:\Program Files\Microsoft Xbox 360 Accessories\Xusb21.inf	msiexec.exe
File created	C:\Program Files\Microsoft Xbox 360 Accessories\x64\Xusb21.sys	msiexec.exe
File created	C:\Program Files\Microsoft Xbox 360 Accessories\Readme.txt	msiexec.exe
File created	C:\Program Files\Microsoft Xbox 360 Accessories\x64\WdfCoInstaller01009.dll	msiexec.exe
File created	C:\Program Files\Microsoft Xbox 360 Accessories\Xboxres.dll	msiexec.exe
File created	C:\Program Files\Microsoft Xbox 360 Accessories\Xboxhelp.chm	msiexec.exe
File created	C:\Program Files\Microsoft Xbox 360 Accessories\AUSetting.exe	msiexec.exe
File created	C:\Program Files\Microsoft Xbox 360 Accessories\Checker.exe	msiexec.exe
File created	C:\Program Files\Microsoft Xbox 360 Accessories\DIFxAPI.dll	msiexec.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e57fc94.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI82B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4ED.tmp	msiexec.exe
File created	C:\Windows\Installer\{D9C50188-12D5-4D3E-8F00-682346C2AA5F}\AUSetting.exe	msiexec.exe
File created	C:\Windows\Installer\{D9C50188-12D5-4D3E-8F00-682346C2AA5F}\ARPIcon	msiexec.exe
File opened for modification	C:\Windows\DirectX.log	DXSETUP.exe
File opened for modification	C:\Windows\Installer\e57fc90.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\{D9C50188-12D5-4D3E-8F00-682346C2AA5F}\AUSetting.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{D9C50188-12D5-4D3E-8F00-682346C2AA5F}\XBoxStat.exe	msiexec.exe
File created	C:\Windows\Installer\{D9C50188-12D5-4D3E-8F00-682346C2AA5F}\XBoxHelpChm.ico	msiexec.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIB39.tmp	msiexec.exe
File created	C:\Windows\Installer\e57fc90.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D9C50188-12D5-4D3E-8F00-682346C2AA5F}	msiexec.exe
File created	C:\Windows\Installer\{D9C50188-12D5-4D3E-8F00-682346C2AA5F}\XBoxStat.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{D9C50188-12D5-4D3E-8F00-682346C2AA5F}\XBoxHelpChm.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\{D9C50188-12D5-4D3E-8F00-682346C2AA5F}\ARPIcon	msiexec.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	MsiExec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI626.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 47 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	MsiExec.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	MsiExec.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000fe4aef237c2afe490000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000fe4aef230000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900fe4aef23000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dfe4aef23000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000fe4aef2300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe

Modifies data under HKEY_USERS 53 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22\52C64B7E	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23\52C64B7E	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave"	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption"	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe

Modifies registry class 49 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DeviceDisplayObject\HardwareId\USB#VID_045E&PID_028E	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\344B329DFB049244699C118AE584394B\88105C9D5D21E3D4F8008632642CAAF5	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\88105C9D5D21E3D4F8008632642CAAF5	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\88105C9D5D21E3D4F8008632642CAAF5\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\88105C9D5D21E3D4F8008632642CAAF5\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\88105C9D5D21E3D4F8008632642CAAF5\SourceList\Net\1 = "C:\\cf5233524158748566f47eedbb971e96\\XBox360\\Setup64\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\DeviceDisplayObject\HardwareId\USB#VID_045E&PID_028E\Shell\Item1\Command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DeviceDisplayObject\HardwareId\USB#VID_045E&PID_028E\Shell\Item1\Command\ = "explorer.exe C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\GameExplorer.lnk"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\88105C9D5D21E3D4F8008632642CAAF5\PackageCode = "2A39BB47A69FF5443AF62FCCBA4DD8DA"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\DeviceDisplayObject\HardwareId\USB#VID_045E&PID_028E\Shell\Item1	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DeviceDisplayObject\HardwareId	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DeviceDisplayObject\HardwareId\USB#VID_045E&PID_028E\Shell\Item1	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\DeviceDisplayObject\HardwareId\USB#VID_045E&PID_028E\Shell\Item2\Command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DeviceDisplayObject\HardwareId\XUSB#Type_00#SUB_01#VEN_045E\Shell	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\DeviceDisplayObject\HardwareId\XUSB#Type_00#SUB_01#VEN_045E\Shell\Item1\Command	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\88105C9D5D21E3D4F8008632642CAAF5\InstanceType = "0"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\88105C9D5D21E3D4F8008632642CAAF5\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\DeviceDisplayObject\HardwareId\XUSB#Type_00#SUB_01#VEN_045E\Shell\Item1	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\88105C9D5D21E3D4F8008632642CAAF5\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\DeviceDisplayObject\HardwareId\USB#VID_045E&PID_028E\Shell\Item2	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\88105C9D5D21E3D4F8008632642CAAF5\Version = "18088082"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DeviceDisplayObject	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DeviceDisplayObject\HardwareId\USB#VID_045E&PID_028E\Shell\Item1\DefaultAppliesTo	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DeviceDisplayObject\HardwareId\XUSB#Type_00#SUB_01#VEN_045E\Shell\Item1\DefaultAppliesTo	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\88105C9D5D21E3D4F8008632642CAAF5	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\88105C9D5D21E3D4F8008632642CAAF5\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DeviceDisplayObject\HardwareId\USB#VID_045E&PID_028E\Shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DeviceDisplayObject\HardwareId\XUSB#Type_00#SUB_01#VEN_045E\Shell\Item1\Command\ = "explorer.exe C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\GameExplorer.lnk"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\88105C9D5D21E3D4F8008632642CAAF5\SourceList\PackageName = "xboxacc.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DeviceDisplayObject\HardwareId\USB#VID_045E&PID_028E\Shell\Item2\Command\ = "rundll32.exe url.dll,FileProtocolHandler http://go.microsoft.com/fwlink/?LinkID=161830"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DeviceDisplayObject\HardwareId\XUSB#Type_00#SUB_01#VEN_045E\Shell\Item1\MUIVerb = "@C:\\Program Files\\Microsoft Xbox 360 Accessories\\XBoxRes.dll,-235"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\DeviceDisplayObject\HardwareId\XUSB#Type_00#SUB_01#VEN_045E\Shell\Item2	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DeviceDisplayObject\HardwareId\XUSB#Type_00#SUB_01#VEN_045E\Shell\Item2\Command\ = "rundll32.exe url.dll,FileProtocolHandler http://go.microsoft.com/fwlink/?LinkID=161830"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\88105C9D5D21E3D4F8008632642CAAF5\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DeviceDisplayObject\HardwareId\USB#VID_045E&PID_028E\Shell\Item2\MUIVerb = "@C:\\Program Files\\Microsoft Xbox 360 Accessories\\XBoxRes.dll,-236"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DeviceDisplayObject\HardwareId\USB#VID_045E&PID_028E\Shell\Item1\MUIVerb = "@C:\\Program Files\\Microsoft Xbox 360 Accessories\\XBoxRes.dll,-235"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\DeviceDisplayObject\HardwareId\XUSB#Type_00#SUB_01#VEN_045E\Shell\Item2\Command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\88105C9D5D21E3D4F8008632642CAAF5\ProductFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\344B329DFB049244699C118AE584394B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\88105C9D5D21E3D4F8008632642CAAF5\SourceList\LastUsedSource = "n;1;C:\\cf5233524158748566f47eedbb971e96\\XBox360\\Setup64\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DeviceDisplayObject\HardwareId\XUSB#Type_00#SUB_01#VEN_045E	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\88105C9D5D21E3D4F8008632642CAAF5\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\88105C9D5D21E3D4F8008632642CAAF5\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DeviceDisplayObject\HardwareId\XUSB#Type_00#SUB_01#VEN_045E\Shell\Item1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DeviceDisplayObject\HardwareId\XUSB#Type_00#SUB_01#VEN_045E\Shell\Item2\MUIVerb = "@C:\\Program Files\\Microsoft Xbox 360 Accessories\\XBoxRes.dll,-236"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\88105C9D5D21E3D4F8008632642CAAF5\ProductName = "Microsoft Xbox 360 Accessories 1.2"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\88105C9D5D21E3D4F8008632642CAAF5\ProductIcon = "C:\\Windows\\Installer\\{D9C50188-12D5-4D3E-8F00-682346C2AA5F}\\ARPIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\88105C9D5D21E3D4F8008632642CAAF5\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\88105C9D5D21E3D4F8008632642CAAF5\SourceList\Media	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2584	msiexec.exe
2584	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeBackupPrivilege	1568	vssvc.exe
Token: SeRestorePrivilege	1568	vssvc.exe
Token: SeAuditPrivilege	1568	vssvc.exe
Token: SeShutdownPrivilege	3360	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3360	msiexec.exe
Token: SeSecurityPrivilege	2584	msiexec.exe
Token: SeCreateTokenPrivilege	3360	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3360	msiexec.exe
Token: SeLockMemoryPrivilege	3360	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3360	msiexec.exe
Token: SeMachineAccountPrivilege	3360	msiexec.exe
Token: SeTcbPrivilege	3360	msiexec.exe
Token: SeSecurityPrivilege	3360	msiexec.exe
Token: SeTakeOwnershipPrivilege	3360	msiexec.exe
Token: SeLoadDriverPrivilege	3360	msiexec.exe
Token: SeSystemProfilePrivilege	3360	msiexec.exe
Token: SeSystemtimePrivilege	3360	msiexec.exe
Token: SeProfSingleProcessPrivilege	3360	msiexec.exe
Token: SeIncBasePriorityPrivilege	3360	msiexec.exe
Token: SeCreatePagefilePrivilege	3360	msiexec.exe
Token: SeCreatePermanentPrivilege	3360	msiexec.exe
Token: SeBackupPrivilege	3360	msiexec.exe
Token: SeRestorePrivilege	3360	msiexec.exe
Token: SeShutdownPrivilege	3360	msiexec.exe
Token: SeDebugPrivilege	3360	msiexec.exe
Token: SeAuditPrivilege	3360	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3360	msiexec.exe
Token: SeChangeNotifyPrivilege	3360	msiexec.exe
Token: SeRemoteShutdownPrivilege	3360	msiexec.exe
Token: SeUndockPrivilege	3360	msiexec.exe
Token: SeSyncAgentPrivilege	3360	msiexec.exe
Token: SeEnableDelegationPrivilege	3360	msiexec.exe
Token: SeManageVolumePrivilege	3360	msiexec.exe
Token: SeImpersonatePrivilege	3360	msiexec.exe
Token: SeCreateGlobalPrivilege	3360	msiexec.exe
Token: SeRestorePrivilege	2584	msiexec.exe
Token: SeTakeOwnershipPrivilege	2584	msiexec.exe
Token: SeRestorePrivilege	2584	msiexec.exe
Token: SeTakeOwnershipPrivilege	2584	msiexec.exe
Token: SeRestorePrivilege	2584	msiexec.exe
Token: SeTakeOwnershipPrivilege	2584	msiexec.exe
Token: SeRestorePrivilege	2584	msiexec.exe
Token: SeTakeOwnershipPrivilege	2584	msiexec.exe
Token: SeRestorePrivilege	2584	msiexec.exe
Token: SeTakeOwnershipPrivilege	2584	msiexec.exe
Token: SeRestorePrivilege	2584	msiexec.exe
Token: SeTakeOwnershipPrivilege	2584	msiexec.exe
Token: SeRestorePrivilege	2584	msiexec.exe
Token: SeTakeOwnershipPrivilege	2584	msiexec.exe
Token: SeRestorePrivilege	2584	msiexec.exe
Token: SeTakeOwnershipPrivilege	2584	msiexec.exe
Token: SeRestorePrivilege	2584	msiexec.exe
Token: SeTakeOwnershipPrivilege	2584	msiexec.exe
Token: SeRestorePrivilege	2584	msiexec.exe
Token: SeTakeOwnershipPrivilege	2584	msiexec.exe
Token: SeRestorePrivilege	2584	msiexec.exe
Token: SeTakeOwnershipPrivilege	2584	msiexec.exe
Token: SeRestorePrivilege	2584	msiexec.exe
Token: SeTakeOwnershipPrivilege	2584	msiexec.exe
Token: SeRestorePrivilege	2584	msiexec.exe
Token: SeTakeOwnershipPrivilege	2584	msiexec.exe
Token: SeRestorePrivilege	2584	msiexec.exe
Token: SeTakeOwnershipPrivilege	2584	msiexec.exe
Token: SeRestorePrivilege	2584	msiexec.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 940	2836	Xbox360_64Eng.exe	84
PID 2836 wrote to memory of 940	2836	Xbox360_64Eng.exe	84
PID 2836 wrote to memory of 940	2836	Xbox360_64Eng.exe	84
PID 940 wrote to memory of 1976	940	setup.exe	85
PID 940 wrote to memory of 1976	940	setup.exe	85
PID 940 wrote to memory of 1976	940	setup.exe	85
PID 1976 wrote to memory of 1456	1976	setupstb.exe	91
PID 1976 wrote to memory of 1456	1976	setupstb.exe	91
PID 1976 wrote to memory of 1456	1976	setupstb.exe	91
PID 1456 wrote to memory of 4804	1456	DXSETUP.exe	101
PID 1456 wrote to memory of 4804	1456	DXSETUP.exe	101
PID 1976 wrote to memory of 3360	1976	setupstb.exe	102
PID 1976 wrote to memory of 3360	1976	setupstb.exe	102
PID 1976 wrote to memory of 3360	1976	setupstb.exe	102
PID 2584 wrote to memory of 2652	2584	msiexec.exe	104
PID 2584 wrote to memory of 2652	2584	msiexec.exe	104
PID 2844 wrote to memory of 3484	2844	svchost.exe	107
PID 2844 wrote to memory of 3484	2844	svchost.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Xbox360_64Eng.exe
"C:\Users\Admin\AppData\Local\Temp\Xbox360_64Eng.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2836
- \??\c:\cf5233524158748566f47eedbb971e96\setup.exe
  c:\cf5233524158748566f47eedbb971e96\setup.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:940
- - C:\cf5233524158748566f47eedbb971e96\setupstb.exe
    "C:\cf5233524158748566f47eedbb971e96\setupstb.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1976
  - - C:\cf5233524158748566f47eedbb971e96\DirectX\DXSETUP.exe
      C:\cf5233524158748566f47eedbb971e96\DirectX\DXSETUP.exe /silent
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:1456
    - - C:\Users\Admin\AppData\Local\Temp\DXF359.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DXF359.tmp\infinst.exe xinput1_3_x64.inf, Install_Driver
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:4804
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\system32\msiexec.exe" /qn /i "XboxAcc.msi" REBOOT=ReallySuppress GUID="fc4b49c0-9e50-4533-b790-87c1f1c32543"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3360

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1568

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:3772

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 19819315A81861466AE1C380D85E4F72
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  PID:2652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "8" "C:\Users\Admin\AppData\Local\Temp\{26bf2c07-85a0-8443-98f1-11fbe1e89b20}\xusb21.inf" "9" "4f2c7db57" "000000000000014C" "WinSta0\Default" "000000000000015C" "208" "C:\Program Files\Microsoft Xbox 360 Accessories"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:3484

C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe
"C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe" silentrun
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Oct2006_xinput_x64.cab

Path C:\CF5233~1\DirectX\Oct2006_xinput_x64.cab
Size 89KB
SHA256 47f8bafa94e19f10ed2f3e8485876b47d08c0574ebc7474ac3cac9a531f67687
MD5 b92ae76ce6c342d6f268b090a299681f
SHA1 91f40bc7172bbb971d9c843b1baa345df3ee2c33
SHA512 72869a19086bf6f1ff738011a5aeb12b079804e91a2d79218dbbf311ba20d9cdbc002fba383cafd51f20eb283e3a69504451974173da53fd45da3396c1df0fdb
SSDEEP 1536:aZiyQLzORC6HJIZZ8ni1/F6y6KiYTa6Dv/nnDqvf0Fbn+20cMlnaCsoqHae2:KQfAC3Zxt6Ia67/nDqcV+2LonCMD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Oct2006_xinput_x86.cab

Path C:\CF5233~1\DirectX\Oct2006_xinput_x86.cab
Size 47KB
SHA256 dd8154886ececa75b9e7a5d964b1eedf784532ed7a01241078c4bf4d827914ea
MD5 cfa780e0c92033a6d2bf405a56a9f910
SHA1 56a2e4af9dca41c5fe8a23f58c1f4765982581ac
SHA512 4ec835e8b259b4b521f444b87a278824a8e8eaeed34bd6c9f011b51ba2ad4b44d08569f366bdd59956f4088e437f261504c13c85262e82ba3008174ba24223ff
SSDEEP 768:I4rQ0mRRcofq/qC7ueU2KWNyZslv+v2LdjYFKPtXn7dKgAX+lL3baehe:9kVy/NPXNyZsF+voM4BRKReHaeM
MD5 SHA1 SHA512 SSDEEP

Submit Download

dxdllreg_x86.cab

Path C:\CF5233~1\DirectX\dxdllreg_x86.cab
Size 41KB
SHA256 5539816b24e9bc43100055b542151a9103d8498553eee69a3e46abba6c360568
MD5 7245fd3ca887a203a94f31ff49199ab1
SHA1 5f28f66cd1187bf8e6c804a6b555a46d6fba430d
SHA512 04c69ca387cb6557757a684416bc5dfc31afd067a9058f047ac8164828ccd6f47b28ad95a2ef01a72827b7b9d8533db6f7ca32544866ae74d3dac6e7fe4e1ddc
SSDEEP 768:VN8egO1hOIsA8GVhda79p/1Cf06/zz22dHub4MUjahwdQj0m7L3baeu:D8hohKQhdQrNC1RdHubdUvdQHHaeu
MD5 SHA1 SHA512 SSDEEP

Submit Download

dxupdate.cab

Path C:\CF5233~1\DirectX\dxupdate.cab
Size 80KB
SHA256 d4c3aa13868906786dc81317843350d754a04e29b89198e1d51bd85d379e21cc
MD5 c127ceef3e5c3140074a6310f92c36e9
SHA1 8ba440f4ad6d5a7ae8b2cf50375d9a4d78235ed2
SHA512 656d9db5b8962cc560b1a4dff6f9285f67f2316e2028ca6a140989b475a5fccbff0cbb8061fd8aa423a801a1e35bb138f68bef6a243943a57186666f1a4ef18f
SSDEEP 1536:GoiWzlyKQQtwbzupxZ1vOJE0MLckcO2f1eGXzLuZ60+9WuHaeC:ViWhyD4wbULl0+P2NeGXzqJqWff
MD5 SHA1 SHA512 SSDEEP

Submit Download

e57fc93.rbs

Path C:\Config.Msi\e57fc93.rbs
Size 15KB
SHA256 383ed9d4a60be1e0ca07dfc3a7cca8c5cfc38b7bd4fee2ea96cef43fc056f869
MD5 1d6b0e1c66d329163aaf39ba2ecb9380
SHA1 8b47cfd10a2f7211795bbb7e633a76a3498dab3d
SHA512 f758ae6edbd21d8c7930151ebb0422964f2f4777af177e1d85f0c1950bef70bba946bb1cc9e940d1160c9eb1c88da5fac2d8aca576a74eea04b634535754eec7
SSDEEP 384:17cdUUg7J9Hg73eXuB2MDjSqxf+SGzJEUOft5p65pbv3:17cdUUg7J9Hg73eXuB2MDjSqxf+SGzJd
MD5 SHA1 SHA512 SSDEEP

Submit Download

dxdllreg_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF359.tmp\dxdllreg_x86.inf
Size 724B
SHA256 54e098294ef0ad3b14b9c77642838b5992fe4573099d8397a1ef566d9e36da40
MD5 8272579b6d88f2ee435aeea19ec7603d
SHA1 6d141721b4b3a50612b4068670d9d10c1a08b4ac
SHA512 9f1311803db1607e079b037f49d8643daa43b59ce6eafb173b18d5a40239a5515091c92b244ffe9cfef2da20530fb15deb6cf5937633b434c3262e765d5a3b21
MD5 SHA1 SHA512

Submit Download

dxupdate.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF359.tmp\dxupdate.dll
Size 147KB
SHA256 0ac9f1cd2822b6c1c8e014b91ade8b8a1f4a05e549c169394f6821b07cba188c
MD5 99865788f3a90de2873bd979e31092ca
SHA1 859f60f1d44b4cd1275c85e3d7066492eee5a2eb
SHA512 04be5041cb80dad17394d5bd82fd85f219c884ab0ace10d0847a4e4aefc40108f2036076f2d33b0dd7ca0c85fb7393c76fdd88b879526d66254bfeff8162fb31
SSDEEP 3072:Lq6LKCswyufQ6fhJBileHYLqpgXlPi5QiruaSL0RBjXSWTxtGVJEkso0Njku:0wyUp3iYppgVPiuiqaSwRBbSLD
MD5 SHA1 SHA512 SSDEEP

Submit Download

dxupdate.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF359.tmp\dxupdate.inf
Size 8KB
SHA256 35b299bd58038d2448cdff6bc97ccc3a5766be769e4aadb9d60c99e9a9218493
MD5 638ef04c8fd9199ffc807f7766312b49
SHA1 ddc6b48de43e384f525b1e1ea969590c0bda9ddf
SHA512 ebef36a202cf28a191522fccd71a0502316ef7b2f173c9a85d7ab7f8830456142b8d538d67bdfb1f05a5e24ba43e6257b80174ad9f27e504f85405bbb67859ba
SSDEEP 192:iXw6TiDxtV0xxmBxbD6Ys7s6xHOJYwYdDxAp8xXZyUxIJf:eXTiDxtV0xxmBxbD6Ys7s6xHOJYwYdDG
MD5 SHA1 SHA512 SSDEEP

Submit Download

infinst.exe

Path C:\Users\Admin\AppData\Local\Temp\DXF359.tmp\infinst.exe
Size 65KB
SHA256 1a008a90db1768c12226ca16b48df724a821c47aa729fb553eb401c7527e770d
MD5 870d6791e146f78a32b7f45370b596ed
SHA1 7f4da1c44a2b82fdf9af9fb62652d49c305cf4a6
SHA512 a7d41c02ac58509c4973e7642b266469c8cf753fdf782c1c49be0a7fdcee955bacdd530b4d204b47e7d62073260c9e10f343fa05f333a51b5dc63f0ca002991b
SSDEEP 1536:+oqL68a7Wx3wTn1xZ2Sn0nfLXJzRgHaej:+oqL6zG34nYq0fLXJzRd0
MD5 SHA1 SHA512 SSDEEP

Submit Download

oct2006_xinput_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF359.tmp\oct2006_xinput_x64.inf
Size 854B
SHA256 b49f7f7f2ca7dac7d6e27ded9fa98e8142d7d265857037ea0417b5f0be04131f
MD5 6845f0928a202783ae7cbe157b58fc1b
SHA1 d19104ae513aa0276ed0c607a5f729908f25f0e2
SHA512 0c7c9f6c594de3eb28ae306a0b5871dbd27f4c7ad3b4b3037453e8e6e388e656363ce2264afc8e827fe44cc47629167cb563e477751c6abaae5c43e275a779a2
MD5 SHA1 SHA512

Submit Download

oct2006_xinput_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF359.tmp\oct2006_xinput_x86.inf
Size 1KB
SHA256 453587cfe15e5f7be5f28f9653f10cd301869baf82c9a3eb34f7e590259a0cc9
MD5 5a184cf9dd0fedd924f65aafaef7c0ac
SHA1 eea00cfe99052315a29e8ca77eb7a549cf00992d
SHA512 6545a9efb7362ad9fa45a604c3f5db0bcf7e81f600dbc53d5e51a309d6a355dfea510a09e5343276412a62cc77f4ce1695a577a49bea049eb7430db4d548f42f
MD5 SHA1 SHA512

Submit Download

xinput1_3.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF359.tmp\xinput1_3.dll
Size 67KB
SHA256 cc42da948da5be1186ed92265f2b5dd895795ac9ed264efe822b242946ad9f39
MD5 da9506e800e13da0abba32bb0c105382
SHA1 78447c8fc4633b86d3cea374fb619fb53e9f9ad7
SHA512 e9161d557fb306f460251ed49fa056e5f7220e4fac859caafaf59db8a1cef0d52c320dbf97238bd73f54362afc232f9ee2c4e0fc79faeecfe382a00b12b11c90
SSDEEP 1536:C+c6d0OTC8eHM+iNzN9OvTEdt3k6/Hae/3:9c6dJeozP+ct09o
MD5 SHA1 SHA512 SSDEEP

Submit Download

xinput1_3.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF359.tmp\xinput1_3.dll
Size 89KB
SHA256 cbbcbf9a902532b7e828edc0bb7eda8a41a6a27c5d1ece10d27bef63aeaa1b0b
MD5 9a74119643271c05fd0cfe91ec757807
SHA1 1d551b44b04b6f56a92bef55a871007865f2dbee
SHA512 1a27ba809e76dff13986c4f16116d90e7a820dfaa1a75969c040941907a50eb8685258508f5f9bef7301cb3831d45eb062be52fb4ae377c0389915e0c9abfd35
SSDEEP 1536:5GIzWvQnniHKBnHp+oHhckfqlR5dRzLXw402L9Ok1Haes:5Gdmi2Hp+oHhhq75dhwmLbcX
MD5 SHA1 SHA512 SSDEEP

Submit Download

xinput1_3_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF359.tmp\xinput1_3_x64.inf
Size 669B
SHA256 4a02b478113bf4b446df09bd029ed85237ffa7eb4f9bdc5a11ed0f1966e9de8d
MD5 e33e6a23fdca1f850eb54e8aa0a4ed4b
SHA1 bc658bfbfa7f6afb445d7a9b35ddfe9be6e75b95
SHA512 db049b8f288b034e098e6762822edd89f9b9adbf2807fb280319e777ed3f0b9ae7df22b9885d7dbd1d3758f61daa7cee999b149d539bd2674008a9119ad64e99
MD5 SHA1 SHA512

Submit Download

DirectX.log

Path C:\Windows\DirectX.log
Size 24KB
SHA256 96bf1f5124fc31b64777ae31002a591b60ce17be363d805fadf2aeb3933a911c
MD5 ea1774bfe58a41b7caa6deed317a8f32
SHA1 22b947cfc2c101ba8c59cb97dab8ee9387a961e1
SHA512 522406a1eed65d4670a3fb047a65dcafe758813b75d1ed4275b89545711358a3cf30c4748e3c3b0b88f03c36903aea4fa0374a2de530682f4a0e8fce33250a0d
SSDEEP 96:mUg+65x2/pzwDbvQQXKtQLuR0atRpgb/bP/0c9Nxq3bnYnIIbBdIbh9bX8HVJGqW:Ngrfxy
MD5 SHA1 SHA512 SSDEEP

Submit Download

DirectX.log

Path C:\Windows\DirectX.log
Size 24KB
SHA256 e9d813d81160a579519e0181aef093711a97b066dcd2caa97a258f39ebebb4ba
MD5 f807511f50c8158e0fa2e89a22ff7117
SHA1 0f98100e582d27732ae456b52346e405faecb49e
SHA512 ad2dbf1bcab01b491288276ec932641569c68bff0a41cb70acc94a43d770a15f7535fa52f7de0ea5e2cf1bad34d90aa37be7f8db9d4ae6db950e2b8970e11a67
SSDEEP 96:mUg+65x2/pzwDbvQQXKtQLuR0atRpgb/bP/0c9Nxq3bnYnIIbBdIbh9bX8HVJGqj:NgrfxxIY
MD5 SHA1 SHA512 SSDEEP

Submit Download

DirectX.log

Path C:\Windows\DirectX.log
Size 28KB
SHA256 d6440662a89f13916b02bf27a0b3222aa220e54855b84420ddd80f6ff33230ee
MD5 0d0f21a3cdb8a897f4f642ba6416b331
SHA1 4b62a4d554eb25dd91227f7e231deb768f977913
SHA512 f3f08c7bcd7fb42211cf6d84de1efa8f981b5392b4a3ebbf1c60f53973b5dc402357de21b7f1b78f0f48e17b9db5f7a186bf23e1273f9febba2f56f24490c1d4
SSDEEP 96:mUg+65x2/pzwDbvQQXKtQLuR0atRpgb/bP/0c9Nxq3bnYnIIbBdIbh9bX8HVJGqy:NgrfxxIX
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI626.tmp

Path C:\Windows\Installer\MSI626.tmp
Size 182KB
SHA256 c6794d4ab509ff22f7f4642d5ab3418d7a6fff940b62d1f3c158a0c2f07db6db
MD5 d202b917c8fabc755937073ade9cc5fb
SHA1 01f0a8e6cda85190f0ef6068b3cbf4119e89056a
SHA512 9262cc996ee0a0f74e77de7d21d84c7768d2e9145157776f06ed13f893069d037f9b0d5c2b1478d0194be11772fe61812b7564141eab901d8ce3edae98d80e0e
SSDEEP 3072:wBSz4jXDvfufG4yhl97moO7dqrkPEZO3BZOKoUfnvM1mcQZYe5hVuc6NJqm8:wBSOXDAjyQF7MIQCBZOecIVuc
MD5 SHA1 SHA512 SSDEEP

Submit Download

DSETUP32.DLL

Path C:\cf5233524158748566f47eedbb971e96\DirectX\DSETUP32.DLL
Size 2.1MB
SHA256 98c1f28f9fe99cd9c79a2da44e0a9cefaac6c97dfb10362fd7ec737c5451fc68
MD5 8a39494b7b90b44467d44a89bc487b8c
SHA1 31105f65c55812cda778d71fc375079cc30d97f8
SHA512 a36a3704e6c3a015bb8f1eab43f75349e27e0f11a97dd7c85fad08a246dff5504c1f3781eac6d7260582da82a43a0d7225a4867c8969d8982a658014eb98b863
SSDEEP 49152:62eeKsFFFFFFFFFFFFFFFFSQJJDQJJDQJJDQJJDQJJDQJJDQJJDQJJDQJJDQJJD0:0ed
MD5 SHA1 SHA512 SSDEEP

Submit Download

dsetup.dll

Path C:\cf5233524158748566f47eedbb971e96\DirectX\dsetup.dll
Size 72KB
SHA256 43080517104d65aa9f1a44c0b1639d302f3f5cdead76d9cc899b168ac94dc246
MD5 4091f1d717181665c0709aab2376479c
SHA1 001fd5b08b12277c00b4d65750f613d8cb3f0e26
SHA512 8e73411973189684913f30878a4f50934b5218e0d4e3ac8706cc23abcb1c2454d53a58273d25ca81fea270eed91e3992f05fbac0ef135659c3175a6e23f1e6a7
SSDEEP 1536:etBhvG0BHO8cSxiFUqwOWaB3d6m9a+3HiBEdktH0MLJM61sHae8:etHvGEHO8/mUqo+d6ZQetH0+JM61xb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Readme.txt

Path C:\cf5233524158748566f47eedbb971e96\XBox360\Setup64\Files\1033\Readme.txt
Size 1KB
SHA256 9fcad9449eb577f0c0a0cb09f51c39003c09a38e17c3d469f239d9b5c1b150f3
MD5 ad9c51bc3907b3165b26bcc0d1c6048a
SHA1 9d4150d016a472657a94950fcdb7a79cb1248683
SHA512 8ef44a0fc52b9a0f5d77b38cadf71f60de1641a95025ca8c38a9199906476d7af78a94763d07fd249730de7c07515c8f17ea4f50e75c99005efa77553e968c35
MD5 SHA1 SHA512

Submit Download

UpdateRes.dll

Path C:\cf5233524158748566f47eedbb971e96\XBox360\Setup64\Files\1033\UpdateRes.dll
Size 569KB
SHA256 bbcf89539c2f2c681c993838c6c6b0c8b434e1c9e8cabf38fc49db899e7a3415
MD5 ed6d17a6ea00c3965dc17aa914b1b267
SHA1 204f71a41452560a6873741e878be47382b0e6f4
SHA512 334b9e34feaf198039a8fa08d2272a4258cb30cf3a7c1ce12862d1095da38e76bf2ec1dbb805eec6950e78d8f808248b6d71174022cf14f4fbe582a7af480974
SSDEEP 6144:lLFZY/xxunDhPcsBoWPbnHvrFliEJBJcDcyx38V3/tO3PI:lpZebsbJjQcyt0sPI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Xboxhelp.chm

Path C:\cf5233524158748566f47eedbb971e96\XBox360\Setup64\Files\1033\Xboxhelp.chm
Size 187KB
SHA256 3e0d7b84d78cd12a9a4fc87f079b1d99b12232c834805d28cce21f061137e721
MD5 752c0d2efd37f2bcae85bdfc2edc1ce0
SHA1 1c83988fafd15df090e76408a66a3b23b13b4220
SHA512 247161c33898e166a452138d2c601d4c285ff39d75ed326e99954d7c15738c71013274db5565b5b75b231fee3771ce6d89803958382d169e914c53fde0f8a73c
SSDEEP 3072:4Amc7x8qsosAZOfhKyybtdMN8xOOzs6EF1om4h7GE8yG74u8Zqdsd0/hM+qc:4Ax7xQie454Or9E3LPz78ZqW4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Xboxres.dll

Path C:\cf5233524158748566f47eedbb971e96\XBox360\Setup64\Files\1033\Xboxres.dll
Size 441KB
SHA256 fd9c1c8eeea230f867b2000256622115885052cc9e9644fc0104b523aae79961
MD5 6e86e6bd2778a3d8428688c3d1bf053a
SHA1 fbbac01951d065b70cde909b37fa791b41b828b5
SHA512 1aef52e2979200fe76a8af7111e9f24be1ae58fbd123991b265b13d349ff9e4c6c8730540260f60857ace7cdf4ed97e0a873644bd7023de17fba91b7cc0a6f31
SSDEEP 6144:aFZY/xxunDhPcsBoWPbnHvrFliEJBJcDcyx38V3/tO3Bw:KZebsbJjQcyt0sBw
MD5 SHA1 SHA512 SSDEEP

Submit Download

dwintl.dll

Path C:\cf5233524158748566f47eedbb971e96\XBox360\Setup64\Files\1033\dwintl.dll
Size 41KB
SHA256 044cdf82297f1769db5917db173f6346e79fec23ec6fd946fb57197ac6292a04
MD5 4457d36bffedc8111a3775b1c9e15319
SHA1 d0c1736df0658fda38fb5244587e0baaaa97fe0b
SHA512 42b1bfac8923e480ed65a4c8ba61c1e289c2f0b2aac76439bf9cba7c0e35babc9c3006fee6b6b0df636392a2521bbc9ae1da537263eb39c3034bbcef6a27c3ce
SSDEEP 384:5kmDYYjMoQCNGh0Plu/gaLioPpW28wW7rdceg06EByLCcMe/oTCXj:G4tn+uFT3ZByL3d/o+Xj
MD5 SHA1 SHA512 SSDEEP

Submit Download

AUSetting.exe

Path C:\cf5233524158748566f47eedbb971e96\XBox360\Setup64\Files\AUSetting.exe
Size 641KB
SHA256 a64c107a9b5acfde6c2ea21f55166d546893daa314b6d5e4c5b3fcfd94d9a851
MD5 a02a804d76612cfef64245145cd6ad6f
SHA1 2a9847e82a02fdb6fc9eac616ff2ce29c19c1366
SHA512 a37d3033d1077cb19858a66b447265ba87eaea6673ce02c5967a57002ee555dd3f4561eee8204d57d770f0d3a4621d1bca2b26dd3073afd9bc08951ac276f44f
SSDEEP 6144:fRWc8je2PyinO9MWVBBIluWtz6nPEyHFZY/xxunDhPcsBoWPbnHvrFliEJBJcDcs:pW7FnqMWL+5+XZebsbJjQcyt0s51
MD5 SHA1 SHA512 SSDEEP

Submit Download

Checker.exe

Path C:\cf5233524158748566f47eedbb971e96\XBox360\Setup64\Files\Checker.exe
Size 814KB
SHA256 2d79646539e19ea835b26f25f35970a5c06bf865608fde6c27b224d2b1743eb3
MD5 bcd85eb22e163a1b48eeb2498509f699
SHA1 159843b2d812ab6a39db70c777195adb3eb64736
SHA512 b4fce70d62cb7472019c0d22b6e786a5c73d0242d4b17e0a46c416f2b9c11e7e4f0c4b9535c24a5bc1517bda689d2c90611aeac72001ee87cf6ad5c4ea1faa10
SSDEEP 6144:maVs7w8b6ulcMEQbTNaNG/GKyZOhp6DEo0t+pkBpn8mTFZY/xxunDhPcsBoWPbnf:bbMEQbqRKy3g+p6bBZebsbJjQcyt0sr0
MD5 SHA1 SHA512 SSDEEP

Submit Download

DIFxAPI.dll

Path C:\cf5233524158748566f47eedbb971e96\XBox360\Setup64\Files\DIFxAPI.dll
Size 513KB
SHA256 83c43d65084cd202aa9982af6d87c963a05035f1e2cdac48304fa299584e3242
MD5 f5558c67a3adb662d43d40a1cbde4160
SHA1 74ad5dd123037cf4d434c5073cbe04c0bcba4e79
SHA512 6df9f780adda4f52d7fbb3baa6af3028c0523ff514f1df0e7dfe380ce21116e09a6f1f3820c316a9af7e16043eb04cdbfe5e885ca24528661c05e32cd18b2046
SSDEEP 12288:6sxYL+kJmoPdVp6s3EJBjCvuF17+2NdJfx:6sxwSoPdVoBjCvuF17+2NdJfx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Downloader.exe

Path C:\cf5233524158748566f47eedbb971e96\XBox360\Setup64\Files\Downloader.exe
Size 579KB
SHA256 58194c48c49ff56a7846b455786ccd77320ccb27c2dd6744c2e92203b684f502
MD5 646d1f838407f67b2755fddaae7d867f
SHA1 a13648f998211a6b977610ff64835af1f335c335
SHA512 15d8944131741c589a2af0d0df712417fc43aa6d16b9b1192d4a83ebc82556b9b0b65fe08bb595297b5aaddb1729770fff374a33775a8354da57a416356dce13
SSDEEP 6144:B+XO0qj2T+DkdqUHwTLFZY/xxunDhPcsBoWPbnHvrFliEJBJcDcyx38V3/tO3+2:/jbIZipZebsbJjQcyt0s+2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dw15.exe

Path C:\cf5233524158748566f47eedbb971e96\XBox360\Setup64\Files\Dw15.exe
Size 550KB
SHA256 bc1d6408540851b858633f92f3fe118165bbb3203aef7f10be5395c785dd4d1d
MD5 6a6591b1405f2470888242a49de3526b
SHA1 1f42e8762dbf9cbcf0b32b36f7188c06056307b9
SHA512 d768a3f669e6fc1ccd68f909b3f17035743449fa08d1e4427c2d2928683a389b8e0ed91f84b439d4c54ba21984831c19da72f8e11148cb58aa0376b2c675d892
SSDEEP 12288:+a3nK0cV8X8l51RCHKCUI7XHgZwKhJAeCGl1Cg:8XV2a1RnKLHgZJJk6cg
MD5 SHA1 SHA512 SSDEEP

Submit Download

XBoxStat.exe

Path C:\cf5233524158748566f47eedbb971e96\XBox360\Setup64\Files\XBoxStat.exe
Size 805KB
SHA256 f6e7418823e45085f4d4f50dd25a55ed517c0a335c6c2f69a1139b30677d3da9
MD5 ed43758bf94b8a5221d69f1b7f63f13d
SHA1 19885579de83d13629f1c0abc11511ce91ed3110
SHA512 7c5754952b9a6ddf2bccf0530f5b9daccea90b2b3bb435a51585a0d1ac24a7dc82621d1f663dd0acf0e9548ef7729fa6798d371931ebd29bb92fe5215979efc7
SSDEEP 12288:75JiG1urGjZBZqlQZebsbJjQcyt0sGBPL:75JiG4rGjZjZgsbDlHPL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Xusb21.cat

Path C:\cf5233524158748566f47eedbb971e96\XBox360\Setup64\Files\driver\Vista_XP\Xusb21.cat
Size 8KB
SHA256 7003842637a56fa30da64360e509ffdae739fe5d6dfa34c8089d7457d8a0c2ea
MD5 a2b4768f255a22d3f204e6fecdea8b0b
SHA1 0ec413acc59d625240dd4fd73e5d586003f09393
SHA512 9182a72695160909de7ecae0542537226d0970922331ce1e6d92a2c6d5994ea42865f5aa70d64f857b7e1ee5944b0d0f760076049dd1e3ec1291efdcca0f7c89
SSDEEP 192:BRwbwEFtt5LEhRKQ1hjXHUz1TrJj3huipIk0i70cs4:DjXHUXluqF0izs4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Xusb21.inf

Path C:\cf5233524158748566f47eedbb971e96\XBox360\Setup64\Files\driver\Vista_XP\Xusb21.inf
Size 8KB
SHA256 203f63fc0a7d86d4eb6e00a312ae5a3a34071bd96c2d343b25fd50afb234a122
MD5 070ef268bc6bff65107d5792456619e4
SHA1 86aebedeed5decd5ad335a19dd6e9204ea434e81
SHA512 68c6636a6e2f9c3a96daa6cbd160d2cc981f8865f73b72ef3dd3eab8d953fb48838aedbf0a157f0c37f76ea9c0a1bc2c45fb81ef9b82dbf88ce802b1a4ef3154
SSDEEP 96:AEHxCwn0gGjFM+qKSIaBgraXZEE0RfewozsH:nn0g3+NalEfpelo
MD5 SHA1 SHA512 SSDEEP

Submit Download

WdfCoInstaller01007.dll

Path C:\cf5233524158748566f47eedbb971e96\XBox360\Setup64\Files\driver\Vista_XP\x64\WdfCoInstaller01007.dll
Size 1.4MB
SHA256 749cc009f1cae5c633083897e906b381aa685829fee2d7cd5e07bae543848ff7
MD5 0e9ad2d3784a0996a5131512939c09c0
SHA1 f9de6ec1455b88f4e85c34c168e13a737da7aecb
SHA512 e3b7e70289f24943bafc3eb503c73e6e10926b2231238feb813664d5f7d748815094294134bca9452c9c589695c0bd1f9a247b6cef4ff67bc1a8762482b28af0
SSDEEP 24576:riSKT6VCRCracQNL2NwlBS34HtEnJJkIUTARiXCtW5XmSf/hBOpb+5LBIG:riSpqaOGwV4JJkIoA0XLm0POMD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Xusb21.sys

Path C:\cf5233524158748566f47eedbb971e96\XBox360\Setup64\Files\driver\Vista_XP\x64\Xusb21.sys
Size 73KB
SHA256 b7a7a906a7bb0f760ed241f998c647d728c4db5d8778afe585df38331165803f
MD5 9176c0822faa649e45121875be32f5d2
SHA1 0f50710fa3b0a91aa1aec819f3e00667970f7210
SHA512 1bca9095fec0d9f52303296efcb85ed5b5c739a66ce9799a4138e3ec5761a3133ef318e2a5156fce1b8bac13fbf4658a7ed56486fc09342113842a5b729e434a
SSDEEP 768:LetNSs21HLHSv4+RytW3oY6bLq0U3SDOLb2bPFsVPU1dVCHyd/ACCqBR8i2QISw8:Q3sWCbL1UOOL5uVlUpSn0sr/SxZ1E
MD5 SHA1 SHA512 SSDEEP

Submit Download

WdfCoInstaller01007.dll

Path C:\cf5233524158748566f47eedbb971e96\XBox360\Setup64\Files\driver\Vista_XP\x86\WdfCoInstaller01007.dll
Size 1.1MB
SHA256 bcf6fbbdf1ad402dc761f87d79688c9b81aa70d63b835fc6618fc8e0686f39f4
MD5 81d9bcceb78795cd0315b24960f2d130
SHA1 a697a3d09e3f9d0ee69df229d14e7e9ae671829b
SHA512 0107bab9c18d5227dfc8734f27b7f9ce4ada9e9c79f85ef85bcb80ebfae593b7d65a834ec3c3b50ef89a5f466eef98eb4ffddece907cb50f7261272b9482631c
SSDEEP 24576:lqP9bArz7F+ET/IbCLvipNz0hOERdNhpjdESl/T:yArvbaN9E7Nz+4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Xusb21.sys

Path C:\cf5233524158748566f47eedbb971e96\XBox360\Setup64\Files\driver\Vista_XP\x86\Xusb21.sys
Size 60KB
SHA256 785defae550cab5bdfa15cf195a1def5ad188efead2d8b1508972cf892bb75a9
MD5 09e5340bd9b2cb730bf4dc6be7721291
SHA1 66fdb3e104738cc12374dcc42c8ef8fd4575d689
SHA512 15229674624c1316a45e6dcea219780994d973def28f1332a5cdd5c289fe948c23cb3a62bc9cced914e046b1a9a6dd154bcbba5ba904f6e81b71984cac6ee429
SSDEEP 768:gN1FQesiXM/EcHtwX+Mmwb/BUFsdAwjuYLGHsj3xXhZz4qjXHUO:gbFeO7b5Uqp33psqrHUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Xusb21.cat

Path C:\cf5233524158748566f47eedbb971e96\XBox360\Setup64\Files\driver\Win7\Xusb21.cat
Size 8KB
SHA256 7ae9cc0416e916020ece6d67c9dc3b8b211e382837e641381f8dd2a02776705e
MD5 5fc54d5acbf05714794b31397ff0b6a4
SHA1 6d47a2f6851a9a4723dc7ac11971d25f3d18edd7
SHA512 f16fcc113b87d18ee55072a4b66f7d9337f5e2a6ea6a7036ac83d53c74d9a7a934d47890841098e7c341e4a0ddfa246129929f5dc9a689c422a0775ecb8377ca
SSDEEP 192:gNfNeeKieQv2hrRKQ1hjXHUz1TrJj3huipIk0iLpT5d4N:go7njXHUXluqF0i4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Xusb21.inf

Path C:\cf5233524158748566f47eedbb971e96\XBox360\Setup64\Files\driver\Win7\Xusb21.inf
Size 8KB
SHA256 94561e355912d6cf0189654352d65e99543e6bb27275d6f9bcc66151d937ca29
MD5 afda2e73d89a3bbc264ff149f73657fb
SHA1 0aebef6f936cfe16e003f7e141631fab754d9816
SHA512 bdd7cf7993e1c6e60de979a4ec4c2f68dd2da038286110c4093ae0235b2bacb5f1957b297d2d1bdf6484745174bcb6be4a88911efbb63270a7c6be7e9c70a40e
SSDEEP 96:AEHx+wnKgG97M+qKSIaBglaXHEEhRfewozsH:rnKg3+Na1Empelo
MD5 SHA1 SHA512 SSDEEP

Submit Download

WdfCoInstaller01009.dll

Path C:\cf5233524158748566f47eedbb971e96\XBox360\Setup64\Files\driver\Win7\x64\WdfCoInstaller01009.dll
Size 1.4MB
SHA256 688b876807ec2643c67bcf97fad8ec5076d46e2806298c5c4f91838cd776264f
MD5 6cf30f4a73b8b7e040a2d9a1a3e6978c
SHA1 3f4aa0f411df176c4bfb1ba2d222d30c95a28528
SHA512 10442b639f651e7b21490d7eecbeb885ffe2d5b5a4f8ff2319e3a4c440c4355bea60de7956464986db6a999fa5ac3f88722cc85532b2bb30763b890e9fcce2ed
SSDEEP 24576:QUqY6Q4ARKiXtxVY2QRh9q18EhnsvLfInDlG43OoZgckVTpV/I9xN51ftN:JqtbCPtxmRh018eSLfIhhRuzt/I7R
MD5 SHA1 SHA512 SSDEEP

Submit Download

Xusb21.sys

Path C:\cf5233524158748566f47eedbb971e96\XBox360\Setup64\Files\driver\Win7\x64\Xusb21.sys
Size 78KB
SHA256 0aabceb627e274e338ddd9ba664baa128d7c00af04c95c776c2affa6bb17f680
MD5 2c6bc21b2d5b58d8b1d638c1704cb494
SHA1 3a8bd80b98d660a7fad96eb6ce1efba632a0327f
SHA512 e48f54799798d0bfd619ea06f398cf7af13abfc41df545be2d5e06adcc72da5479683072485f7b96e8d0bea469113325476085300409eba73dda8496ff8d0ac7
SSDEEP 1536:s6BbLL8Wl0IIbSn99J0OcNlNVvhYfqrHU:s6BbL5uILcNrVpYfqo
MD5 SHA1 SHA512 SSDEEP

Submit Download

WdfCoInstaller01009.dll

Path C:\cf5233524158748566f47eedbb971e96\XBox360\Setup64\Files\driver\Win7\x86\WdfCoInstaller01009.dll
Size 1.1MB
SHA256 8918fbd942276083a13a1382e6a8a270cd52d723aa8d92926bcfd43818badad6
MD5 9747dbb7293ac99e8e8609d0a0f42896
SHA1 7fbfe4fba26d78ab13080896c7fdf1c3bc66718a
SHA512 df500707fb9967914130b900320d925ec445b2f7cc0a1f7987073520182caee49fe031aa759f5d161f753b7fb12ecc65730ebae247107787fe903d1a5b1736a9
SSDEEP 24576:nYlKFGoU8JQbk7HK3tGX1T1IveS5sm7sUp:YwEovJ97qdQSHh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Xusb21.sys

Path C:\cf5233524158748566f47eedbb971e96\XBox360\Setup64\Files\driver\Win7\x86\Xusb21.sys
Size 64KB
SHA256 9d614c5d3bb679ccf15ca6dd044318692ea6d89b89d80d690e79a1c0b941430f
MD5 276842a27953be204a2507096f09b1f3
SHA1 7cbf3695ec38617fa48831d343f9214e381c75ea
SHA512 98150ac58a710cc38be1cb6d1e4b0b8fd7a6cd09c803d6cbc7a2e9c6d8dd929163f348cc5b0a4ec41f8a80c11d3fee5ff1b264b657c78460b5b5991345caaf03
SSDEEP 768:Aa8MCUO2Cno0EoByYFVL89W9PhJ0YvtjOsnj3e6unG/i6tGginsjz4qjpvk:AwfmByEZ89gL0QtC4jAodGgWNq5
MD5 SHA1 SHA512 SSDEEP

Submit Download

0f4ed0be-76e0-4ab7-acd3-b30c1ef0f092.devicemetadata-ms

Path C:\cf5233524158748566f47eedbb971e96\XBox360\Setup64\Microsoft\Windows\DeviceMetadataStore\en-US\0f4ed0be-76e0-4ab7-acd3-b30c1ef0f092.devicemetadata-ms
Size 66KB
SHA256 e5eabaffd74429641982270921110a810748e3e5f8ffaec5b5ba8663dd313940
MD5 447662e8cd96c810b8b3e69088082b63
SHA1 e3257a43ac1e2569c3999b531ec1ff1c0846c0bf
SHA512 b119650707e64ea3ebf086e8780a07d36ffca89ac65c0c85397703bed08fc58ca16b6c0af1876d38353304da3c9b9c7958d79a2c3bb9973f1fd011219822e5b5
SSDEEP 1536:2mbm23c9sRnbDNU5i5eUABteQWN5xnyji8JZ/iP:u41RnV5e/fxO55VYZ/iP
MD5 SHA1 SHA512 SSDEEP

Submit Download

c5b82015-4cf0-40e4-8a84-ad80af3458d6.devicemetadata-ms

Path C:\cf5233524158748566f47eedbb971e96\XBox360\Setup64\Microsoft\Windows\DeviceMetadataStore\en-US\c5b82015-4cf0-40e4-8a84-ad80af3458d6.devicemetadata-ms
Size 66KB
SHA256 82f4867972b4eae4755bd97a82c27946d2fea6ebcf1afff4a0a9afb33600ccf3
MD5 e7282834d8f829b153cb25c48ab2fadd
SHA1 1021ce8dae6dc68fe7afbd44b700d61dea40b798
SHA512 d77deee4af0332ce38e053199f05445d15a3fa6bc20b09b3a3ab29f154bc2fd152edac14dcd35da1a774223caa2f5e6ad89319c8a97e5cdfba3e2298acc861c1
SSDEEP 1536:6mnlsd78cgmNu1X6QzbkKUABteQWN5xnyfi85Z1fw:nud7jgauF/fxO55R0Z1fw
MD5 SHA1 SHA512 SSDEEP

Submit Download

XboxAcc.msi

Path C:\cf5233524158748566f47eedbb971e96\XBox360\Setup64\XboxAcc.msi
Size 1.2MB
SHA256 b3d4394f75e8c0e16f4cb7e2330de2e55c02dd8ddc6d8ef6e400ecf9910801a3
MD5 075affbdfc36c956d9c2176b215f7f16
SHA1 3fc9b6c1259c2567920e5a4d042168df177cdce3
SHA512 ed03c93aec6b8c42df6196eaf28aac02a8edb6c826d7309670fdacabd5a9ac2d7f10e595acdb905785c3971ff306789f4e324c67fb87d2e7632c9d0b14e837d7
SSDEEP 12288:uOrIsIJjQcytlsOiTdFf0KY5nAOXbsAJjFcyt08WIQF7/BfKU:uOUsID0Of8znAOLsAUlOQF7/BL
MD5 SHA1 SHA512 SSDEEP

Submit Download

dxsetup.exe

Path C:\cf5233524158748566f47eedbb971e96\directx\dxsetup.exe
Size 473KB
SHA256 49393ceb849e4bb59117e18b60a541d33cd30ca475ab32e300162d76a46ca907
MD5 f16f4669d34aea8abf85ae81aa6a785c
SHA1 2ad4028cb578411cad242ec2faf5d3e607552a6d
SHA512 3ee04e01dce0412be95da658d84c59cbc7b77ac787ab52cb2df76db05e202aa0eb201160c16624d85db471949e04d852e3383ca5ee1ac2141e6bd44c4c3ef002
SSDEEP 3072:Yi6LKeo3UuF3I8BNIf2tbJx/jPoYJstNSN2LhaM96rKmMH2/5Mjt4zT1mFDYkCI3:wfzw1x7oqwUM1Ws4Va
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\cf5233524158748566f47eedbb971e96\setup.exe
Size 689KB
SHA256 9d8f858ca3201b7b04cc0564d70d3e8a809c93c69170799854d0e949d46685ff
MD5 4d5b5599f1cb63d895307f8dea8b674c
SHA1 111eecba8c0c1f39b4c9e252644ad586a4bb10dd
SHA512 f905402444250de754d08d3fe25184d17f95220d589d7091673c93ae57a528c0d2b11fef34bb665f04ab14f5d90b1b88ecb125702c543cbe510392ae777dc2c9
SSDEEP 6144:tb9IS3db0kSFUdWFBM5dJ8TkW6LYuTRIq8ygsHDIyjsym5d:tCsdgkSFtFBMPET6LYu9D5djT05d
MD5 SHA1 SHA512 SSDEEP

Submit Download

setupstb.exe

Path C:\cf5233524158748566f47eedbb971e96\setupstb.exe
Size 917KB
SHA256 93d0ab42d292ea420915873b3eee5146f798c8ac6859cb4c018613339ae4b4bc
MD5 1affb5275b299ff887b4783cddd14992
SHA1 f463a948fbfcb61a52e7353adfc0a966ee79232b
SHA512 71da41cea4b48b4aa37cfa518d51c40be1dbdbabf752cfbfc061bbf197d8819278d10e37b918eab49d640430c95e344430b99acb102abea2621c2ba19ffe8389
SSDEEP 24576:IQdHWgNHdCQClNJ+vKNMFB6ETUYu9D5djZJ:95cJ+vK+FTUYmdL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Eng.rtf

Path C:\cf5233524158748566f47eedbb971e96\xbox360\Setup64\Files\1033\Eng.rtf
Size 27KB
SHA256 a61c6406dd3166ca09b9646e1db3f050aa27a20ea16e186d1844f9c2439031cf
MD5 9ce52f91919e9a813572d62b5eb3d07a
SHA1 a6dfdcd594ce080f374d3bd0bbc6f461b699c0fc
SHA512 328b29e6187b89bab7f7c89e09fb64936a40b9a02efacf7f9a9ffce087c228cb5535e309b1ee3635ff178cf0ddfc10afa9c6ff93f337e5efb88b67a28a375792
SSDEEP 768:6q+fwkNVQXpAZ0YskSeTA26aYq6KFUPzAcmeN/K:6fYmVIO0GSeTA26aYuFUccms/K
MD5 SHA1 SHA512 SSDEEP

Submit Download

setupres.dll

Path C:\cf5233524158748566f47eedbb971e96\xbox360\setup64\files\1033\setupres.dll
Size 378KB
SHA256 b9c9cb70e197be8add0e2dd5a909600657f9a0fa9d74369c33c5a52a354cbcc5
MD5 0cdbd662148b2a54db3e56168e386e65
SHA1 3940563518d3539450cf82ab8f05ad27c1c504a8
SHA512 043054540ad8ffac7eb4e197e6591a947f03a2d8d6b044c314917ff0ededc71b2b509eb6b5ec87faa96b82ed1da17053e3da951d1aff67998af8508746d2f1ea
SSDEEP 1536:TDN9dFznqvxq+IUB2xUm5O/RgklzSz94kxFeOG8QnJVuQkylRMA0chGNHTpJfcDj:c
MD5 SHA1 SHA512 SSDEEP

Submit Download

setupres.dll

Path C:\cf5233524158748566f47eedbb971e96\xbox360\setup64\files\1033\setupres.dll
Size 2.0MB
SHA256 4f6b6a418476b3a3af6e4e132d30e9504907bc99c3f8892eea0a7cb2c17f4dcf
MD5 971782886c8f7770bb7f9c1a6abec139
SHA1 9fbd4bf0374440c657de2e67a0900390f06d5ef3
SHA512 ea8fed615db403e22d38b34d9158b6a8ae2f95cd7540b56dff3cb69fe2710a7edbc814bcef273c5d6f9a7fdd031330f7b348f2fd3a7ac1bd50993737c44a3dca
SSDEEP 12288:mH4SULPyI/6ExLgZn2ksNuZQ2qhn7fqJrjgDeT269AQTZebsbJjQcyt0sS2:W4SULPl/G2kLQ2qB7yZgsbDlR2
MD5 SHA1 SHA512 SSDEEP

Submit Download

lang.ini

Path \??\c:\cf5233524158748566f47eedbb971e96\lang.ini
Size 23B
SHA256 ebb498ec3498be69ffce90a25ba3b67af4d518347b7e28181c7f97905101c6c5
MD5 37eb4d739414162ab9b2dc924b9f88da
SHA1 64cac5f7b74914f3de6bf5e06ff03c267c087ad4
SHA512 1d859870defe1b231948a5484df6758c1d02a5624cae51f63b55e7c8a7d64249e398b37f943dd3d2526491cb105c147fdb000bf37ca901629585b3173ee104a9
MD5 SHA1 SHA512

Submit Download

setupres.dll

Path \??\c:\cf5233524158748566f47eedbb971e96\xbox360\Setup64\Files\1033\setupres.dll
Size 690KB
SHA256 7e493cfa5545fde74352b7e3636955cb73f39e684c5d45a117e6b50d2cb83252
MD5 a84d3419110bc09a6a7b1e1bff415d53
SHA1 f0140d7b3e431798ef666cfee1c4e0c32d668376
SHA512 572a4ff564a6fc03e02e463373b4c01ad0119ac73882dec371f4b186d4f55c69d99ddc765531e3463ba5346c767b754d9ea21414548de0ebe88f80ba276f4a2c
SSDEEP 1536:TDN9dFznqvxq+IUB2xUm5O/RgklzSz94kxFeOG8QnJVuQkylRMA0chGNHTpJfcDa:kYpBbsGSijPyK7hY3M
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1456-85-0x0000000002780000-0x00000000027AA000-memory.dmp

Download

memory/1456-65-0x0000000002490000-0x00000000026B8000-memory.dmp

Download

memory/1456-60-0x0000000000620000-0x0000000000635000-memory.dmp

Download

memory/3788-686-0x00000000001E0000-0x00000000001FA000-memory.dmp

Download