47260420773a20443fb1e38a89b7f39c5237a80a842de598e6c8f7f90a3bbd6d

Analysis

max time kernel
149s
max time network
193s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/07/2026, 23:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_CommonRedist/xnafx40_redist.msi
Size 6.7MB
Sample260718-28qhpse13p
SHA256 47260420773a20443fb1e38a89b7f39c5237a80a842de598e6c8f7f90a3bbd6d
MD5 ff1c0202ab7147c9dfd34b582f1da13f
SHA1 5fc95a9ad87a38e71a953af116fd1f1cbe46a3e7
SHA512 9a233fd33fa535d0783ac4a97108166b860d7647998ce184e6e5103200a6c8522a5e4d035b85e02280f5176c092e0d3e61a60f228d7ca17f09fcf2fc5cdf5253
SSDEEP 98304:synfL329J1XswfXO6wiBB+4RZg6aENaCZAU5PMO0MntfERyJGH2YPq/:sYD3C1XXfzH+4cLHU5PM/Mnt+YGlq
TLSH
T1D06622A2751AFF41DDB406FCD970CA490925CF3B82274C686929356A7BF7E0202E9D4F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation ransomware

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1960	DXSETUP.exe

Loads dropped DLL 7 IoCs

pid	Process
1960	DXSETUP.exe
1960	DXSETUP.exe
1960	DXSETUP.exe
1960	DXSETUP.exe
1960	DXSETUP.exe
1960	DXSETUP.exe
3620	MsiExec.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4624	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Drops file in System32 directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\xinput1_3.dll	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\SETA573.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\d3dx9_33.dll	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\SETA39A.tmp	DXSETUP.exe
File created	C:\Windows\SysWOW64\SETA574.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\XAPOFX1_4.dll	DXSETUP.exe
File created	C:\Windows\SysWOW64\SETA34B.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\SETA485.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\D3DX9_41.dll	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\SETA496.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\X3DAudio1_7.dll	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\SETA4A7.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\xactengine3_6.dll	DXSETUP.exe
File created	C:\Windows\SysWOW64\SETA573.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\SETA34B.tmp	DXSETUP.exe
File created	C:\Windows\SysWOW64\SETA485.tmp	DXSETUP.exe
File created	C:\Windows\SysWOW64\SETA496.tmp	DXSETUP.exe
File created	C:\Windows\SysWOW64\SETA4A7.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\XAudio2_6.dll	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\SETA574.tmp	DXSETUP.exe
File created	C:\Windows\SysWOW64\SETA39A.tmp	DXSETUP.exe

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\APR2007_d3dx9_33_x86.cab	msiexec.exe
File created	C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\dxupdate.cab	msiexec.exe
File created	C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\DSETUP.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\APR2007_xinput_x86.cab	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\XNA\Framework\v4.0\EULA.en-US.txt	msiexec.exe
File created	C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\Mar2009_d3dx9_41_x86.cab	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\XNA\Framework\Shared\xnavisualizer.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\XNA\Framework\Shared\XnaVisualizerPS.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\DXSETUP.exe	msiexec.exe
File created	C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\dsetup32.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\Feb2010_X3DAudio_x86.cab	msiexec.exe
File created	C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\Feb2010_xact_x86.cab	msiexec.exe
File created	C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\Feb2010_XAudio_x86.cab	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\XNA\Framework\v4.0\XnaNative.dll	msiexec.exe

Drops file in Windows directory 33 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e599b9a.msi	msiexec.exe
File created	C:\Windows\assembly\tmp\6NLAPXIU\Microsoft.Xna.Framework.Net.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\0AA7CFB2C445A3E47869763FEB56B59E	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\0AA7CFB2C445A3E47869763FEB56B59E\4.0.20823	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA724.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC35E160EDCB8B5FE.TMP	msiexec.exe
File created	C:\Windows\assembly\GACLock.dat	msiexec.exe
File created	C:\Windows\assembly\tmp\ZM96JIQ8\Microsoft.Xna.Framework.Game.dll	msiexec.exe
File created	C:\Windows\Installer\e599b9a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\assembly\tmp\2Q1QG1NC\Microsoft.Xna.Framework.Avatar.dll	msiexec.exe
File created	C:\Windows\assembly\tmp\M4W2HLNB\Microsoft.Xna.Framework.Input.Touch.dll	msiexec.exe
File created	C:\Windows\assembly\tmp\Z79W2ETP\Microsoft.Xna.Framework.Storage.dll	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\0AA7CFB2C445A3E47869763FEB56B59E\4.0.20823\F_CENTRAL_msvcp100_x86.DF495DFD_79F6_34DF_BB1E_E58DB5BDCF2C	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\0AA7CFB2C445A3E47869763FEB56B59E\4.0.20823\F_CENTRAL_msvcr100_x86.DF495DFD_79F6_34DF_BB1E_E58DB5BDCF2C	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\0AA7CFB2C445A3E47869763FEB56B59E\4.0.20823\F_CENTRAL_msvcp100_x86.DF495DFD_79F6_34DF_BB1E_E58DB5BDCF2C	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\0AA7CFB2C445A3E47869763FEB56B59E\4.0.20823\F_CENTRAL_msvcr100_x86.DF495DFD_79F6_34DF_BB1E_E58DB5BDCF2C	msiexec.exe
File created	C:\Windows\Installer\{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}\ProductIcon	msiexec.exe
File created	C:\Windows\assembly\tmp\B30QVJMJ\Microsoft.Xna.Framework.GamerServices.dll	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DF75CEEFDE90E8C4DD.TMP	msiexec.exe
File created	C:\Windows\assembly\tmp\C2L3FPJF\Microsoft.Xna.Framework.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}\ProductIcon	msiexec.exe
File created	C:\Windows\assembly\tmp\UDIXFXCJ\Microsoft.Xna.Framework.Graphics.dll	msiexec.exe
File created	C:\Windows\assembly\tmp\NEU3M9A8\Microsoft.Xna.Framework.Xact.dll	msiexec.exe
File opened for modification	C:\Windows\Logs\DirectX.log	DXSETUP.exe
File created	C:\Windows\SystemTemp\~DFF3BFB5FB12895324.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE59849440F9E8DB4.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9CE2.tmp	msiexec.exe
File created	C:\Windows\assembly\tmp\P7LMKCPT\Microsoft.Xna.Framework.Video.dll	msiexec.exe
File created	C:\Windows\Installer\e599b9c.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4624	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DXSETUP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000007693c80d07c71b6c0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800007693c80d0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff0000000007000100006809007693c80d000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a7693c80d000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d7693c80d000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Modifies data under HKEY_USERS 48 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DXSETUP.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DXSETUP.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "0"	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DXSETUP.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DXSETUP.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DXSETUP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\SourceList\PackageName = "xnafx40_redist.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3eda9b49-2085-498b-9bb2-39a6778493de}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_6.dll"	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cecec95a-d894-491a-bee3-5e106fb59f2d}\ = "AudioReverb"	DXSETUP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8122FF4-9E52-4374-B3D9-B4063E77109D}\InprocServer32	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3eda9b49-2085-498b-9bb2-39a6778493de}\InProcServer32	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e48c5a3f-93ef-43bb-a092-2c7ceb946f27}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_6.dll"	DXSETUP.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.Xna.Framework,fileVersion="4.0.20823.0",version="4.0.0.00000",culture="neutral",publicKeyToken="842CF8BE1DE50553",processorArchitecture="x86" = 6c00660060002e003200510046002b00300041004c0048005600370077003800680027002100740058004e0041004600720061006d00650077006f0072006b005200650064006900730074003e0065006a0036002d0051005b002d0065003900400060004a003d006e0079005e005b005d002a00710000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.Xna.Framework.GamerServices,fileVersion="4.0.20823.0",version="4.0.0.00000",culture="neutral",publicKeyToken="842CF8BE1DE50553",processorArchitecture="MSIL" = 6c00660060002e003200510046002b00300041004c0048005600370077003800680027002100740058004e0041004600720061006d00650077006f0072006b005200650064006900730074003e007a00770076007100640077006800410066003d007a0027006500360077004900760034006700560000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0AA7CFB2C445A3E47869763FEB56B59E\XNAFrameworkRedist	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\ProductName = "Microsoft XNA Framework Redistributable 4.0"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\DirectShow\MediaObjects\Categories	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.Xna.Framework.Graphics,fileVersion="4.0.20823.0",version="4.0.0.00000",culture="neutral",publicKeyToken="842CF8BE1DE50553",processorArchitecture="x86" = 6c00660060002e003200510046002b00300041004c0048005600370077003800680027002100740058004e0041004600720061006d00650077006f0072006b005200650064006900730074003e0055006a0064003f003d002e00310076002400390053007e005a00340068007b0055006f007a00690000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.Xna.Framework.Storage,fileVersion="4.0.20823.0",version="4.0.0.00000",culture="neutral",publicKeyToken="842CF8BE1DE50553",processorArchitecture="MSIL" = 6c00660060002e003200510046002b00300041004c0048005600370077003800680027002100740058004e0041004600720061006d00650077006f0072006b005200650064006900730074003e007b0072006100690027004a006300710041003d00550070005d002e0026004d0043007a007100590000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.Xna.Framework.Video,fileVersion="4.0.20823.0",version="4.0.0.00000",culture="neutral",publicKeyToken="842CF8BE1DE50553",processorArchitecture="MSIL" = 6c00660060002e003200510046002b00300041004c0048005600370077003800680027002100740058004e0041004600720061006d00650077006f0072006b005200650064006900730074003e00550048004a0055006e0053003d0052005d00380048004d005d00250038005d00400059006900750000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\ProductIcon = "C:\\Windows\\Installer\\{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}\\ProductIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\_CommonRedist\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248d8a3b-6256-44d3-a018-2ac96c459f47}	DXSETUP.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.Xna.Framework.Net,fileVersion="4.0.20823.0",version="4.0.0.00000",culture="neutral",publicKeyToken="842CF8BE1DE50553",processorArchitecture="MSIL" = 6c00660060002e003200510046002b00300041004c0048005600370077003800680027002100740058004e0041004600720061006d00650077006f0072006b005200650064006900730074003e00440072005900520072006c002d004a003d0041006b00390052007a005500210029006f005e00380000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.Xna.Framework.Input.Touch,fileVersion="4.0.20823.0",version="4.0.0.00000",culture="neutral",publicKeyToken="842CF8BE1DE50553",processorArchitecture="MSIL" = 6c00660060002e003200510046002b00300041004c0048005600370077003800680027002100740058004e0041004600720061006d00650077006f0072006b005200650064006900730074003e0050006a006300540058005b0053007b00610039003700380070002d005d0061006c0065004900260000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cecec95a-d894-491a-bee3-5e106fb59f2d}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_6.dll"	DXSETUP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\DirectShow\MediaObjects	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\DirectShow\MediaObjects\Categories\f3602b3f-0592-48df-a4cd-674721e7ebeb	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\DirectShow\MediaObjects\a8122ff4-9e52-4374-b3d9-b4063e77109d\ = "XnaVisualizerDmo"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\DirectShow\MediaObjects\a8122ff4-9e52-4374-b3d9-b4063e77109d	MsiExec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\DirectShow\MediaObjects\a8122ff4-9e52-4374-b3d9-b4063e77109d\OutputTypes = 6175647300001000800000aa00389b710100000000001000800000aa00389b71	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cecec95a-d894-491a-bee3-5e106fb59f2d}\InProcServer32\ThreadingModel = "Both"	DXSETUP.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\DirectShow\MediaObjects\a8122ff4-9e52-4374-b3d9-b4063e77109d\InputTypes = 6175647300001000800000aa00389b710100000000001000800000aa00389b71	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8122FF4-9E52-4374-B3D9-B4063E77109D}\InprocServer32\ = "C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\XNA\\Framework\\Shared\\xnavisualizer.dll"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e48c5a3f-93ef-43bb-a092-2c7ceb946f27}\InProcServer32\ThreadingModel = "Both"	DXSETUP.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.Xna.Framework.Xact,fileVersion="4.0.20823.0",version="4.0.0.00000",culture="neutral",publicKeyToken="842CF8BE1DE50553",processorArchitecture="x86" = 6c00660060002e003200510046002b00300041004c0048005600370077003800680027002100740058004e0041004600720061006d00650077006f0072006b005200650064006900730074003e0058003600520051006200610026006500470040005b002d003200630041007600560064007300740000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248d8a3b-6256-44d3-a018-2ac96c459f47}\ = "XACT Engine"	DXSETUP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3eda9b49-2085-498b-9bb2-39a6778493de}	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3eda9b49-2085-498b-9bb2-39a6778493de}\InProcServer32\ThreadingModel = "Both"	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\PackageCode = "CC1B48CD503865840BBC69BD0DED73A5"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248d8a3b-6256-44d3-a018-2ac96c459f47}\InProcServer32\ = "C:\\Windows\\SysWow64\\xactengine3_6.dll"	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3eda9b49-2085-498b-9bb2-39a6778493de}\ = "XAudio2"	DXSETUP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e48c5a3f-93ef-43bb-a092-2c7ceb946f27}\InProcServer32	DXSETUP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\DirectShow\MediaObjects\Categories\f3602b3f-0592-48df-a4cd-674721e7ebeb\a8122ff4-9e52-4374-b3d9-b4063e77109d	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8122FF4-9E52-4374-B3D9-B4063E77109D}\InprocServer32\ThreadingModel = "Both"	MsiExec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.Xna.Framework.Game,fileVersion="4.0.20823.0",version="4.0.0.00000",culture="neutral",publicKeyToken="842CF8BE1DE50553",processorArchitecture="x86" = 6c00660060002e003200510046002b00300041004c0048005600370077003800680027002100740058004e0041004600720061006d00650077006f0072006b005200650064006900730074003e0048006100380066004c0049004f0071007b003f00380032003100310034002e002400740052006c0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\500BB8FAD5F3D2A4D9EFC01E0702D939	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\_CommonRedist\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248d8a3b-6256-44d3-a018-2ac96c459f47}\InProcServer32\ThreadingModel = "Both"	DXSETUP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e48c5a3f-93ef-43bb-a092-2c7ceb946f27}	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8122FF4-9E52-4374-B3D9-B4063E77109D}\ = "VisualizerPlugin Class"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0AA7CFB2C445A3E47869763FEB56B59E	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cecec95a-d894-491a-bee3-5e106fb59f2d}	DXSETUP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8122FF4-9E52-4374-B3D9-B4063E77109D}	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\Version = "67129687"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cecec95a-d894-491a-bee3-5e106fb59f2d}\InProcServer32	DXSETUP.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.Xna.Framework.Avatar,fileVersion="4.0.20823.0",version="4.0.0.00000",culture="neutral",publicKeyToken="842CF8BE1DE50553",processorArchitecture="MSIL" = 6c00660060002e003200510046002b00300041004c0048005600370077003800680027002100740058004e0041004600720061006d00650077006f0072006b005200650064006900730074003e006000490066005200610038006c007d006e00400064003100700042005b00330060002c003900350000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248d8a3b-6256-44d3-a018-2ac96c459f47}\InProcServer32	DXSETUP.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3904	msiexec.exe
3904	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4624	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4624	msiexec.exe
Token: SeSecurityPrivilege	3904	msiexec.exe
Token: SeCreateTokenPrivilege	4624	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4624	msiexec.exe
Token: SeLockMemoryPrivilege	4624	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4624	msiexec.exe
Token: SeMachineAccountPrivilege	4624	msiexec.exe
Token: SeTcbPrivilege	4624	msiexec.exe
Token: SeSecurityPrivilege	4624	msiexec.exe
Token: SeTakeOwnershipPrivilege	4624	msiexec.exe
Token: SeLoadDriverPrivilege	4624	msiexec.exe
Token: SeSystemProfilePrivilege	4624	msiexec.exe
Token: SeSystemtimePrivilege	4624	msiexec.exe
Token: SeProfSingleProcessPrivilege	4624	msiexec.exe
Token: SeIncBasePriorityPrivilege	4624	msiexec.exe
Token: SeCreatePagefilePrivilege	4624	msiexec.exe
Token: SeCreatePermanentPrivilege	4624	msiexec.exe
Token: SeBackupPrivilege	4624	msiexec.exe
Token: SeRestorePrivilege	4624	msiexec.exe
Token: SeShutdownPrivilege	4624	msiexec.exe
Token: SeDebugPrivilege	4624	msiexec.exe
Token: SeAuditPrivilege	4624	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4624	msiexec.exe
Token: SeChangeNotifyPrivilege	4624	msiexec.exe
Token: SeRemoteShutdownPrivilege	4624	msiexec.exe
Token: SeUndockPrivilege	4624	msiexec.exe
Token: SeSyncAgentPrivilege	4624	msiexec.exe
Token: SeEnableDelegationPrivilege	4624	msiexec.exe
Token: SeManageVolumePrivilege	4624	msiexec.exe
Token: SeImpersonatePrivilege	4624	msiexec.exe
Token: SeCreateGlobalPrivilege	4624	msiexec.exe
Token: SeBackupPrivilege	4196	vssvc.exe
Token: SeRestorePrivilege	4196	vssvc.exe
Token: SeAuditPrivilege	4196	vssvc.exe
Token: SeBackupPrivilege	3904	msiexec.exe
Token: SeRestorePrivilege	3904	msiexec.exe
Token: SeRestorePrivilege	3904	msiexec.exe
Token: SeTakeOwnershipPrivilege	3904	msiexec.exe
Token: SeRestorePrivilege	3904	msiexec.exe
Token: SeTakeOwnershipPrivilege	3904	msiexec.exe
Token: SeRestorePrivilege	3904	msiexec.exe
Token: SeTakeOwnershipPrivilege	3904	msiexec.exe
Token: SeRestorePrivilege	3904	msiexec.exe
Token: SeTakeOwnershipPrivilege	3904	msiexec.exe
Token: SeRestorePrivilege	3904	msiexec.exe
Token: SeTakeOwnershipPrivilege	3904	msiexec.exe
Token: SeRestorePrivilege	3904	msiexec.exe
Token: SeTakeOwnershipPrivilege	3904	msiexec.exe
Token: SeRestorePrivilege	3904	msiexec.exe
Token: SeTakeOwnershipPrivilege	3904	msiexec.exe
Token: SeRestorePrivilege	3904	msiexec.exe
Token: SeTakeOwnershipPrivilege	3904	msiexec.exe
Token: SeRestorePrivilege	3904	msiexec.exe
Token: SeTakeOwnershipPrivilege	3904	msiexec.exe
Token: SeRestorePrivilege	3904	msiexec.exe
Token: SeTakeOwnershipPrivilege	3904	msiexec.exe
Token: SeRestorePrivilege	3904	msiexec.exe
Token: SeTakeOwnershipPrivilege	3904	msiexec.exe
Token: SeRestorePrivilege	3904	msiexec.exe
Token: SeTakeOwnershipPrivilege	3904	msiexec.exe
Token: SeRestorePrivilege	3904	msiexec.exe
Token: SeTakeOwnershipPrivilege	3904	msiexec.exe
Token: SeRestorePrivilege	3904	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4624	msiexec.exe
4624	msiexec.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3904 wrote to memory of 672	3904	msiexec.exe	84
PID 3904 wrote to memory of 1960	3904	msiexec.exe	86
PID 3904 wrote to memory of 3620	3904	msiexec.exe	88

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\_CommonRedist\xnafx40_redist.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4624

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3904
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:672
- C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\DXSETUP.exe
  "C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\DXSETUP.exe" /silent
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Modifies registry class
  PID:1960
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Microsoft Shared\XNA\Framework\Shared\xnavisualizer.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:3620

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e599b9b.rbs

Path C:\Config.Msi\e599b9b.rbs
Size 17KB
SHA256 95aa2f078f22b9cbf5f33a04cf61e15185951dd9fd1a9501aa63c79f6703a643
MD5 e053e757fbf4f2b038b4ceeb7dbdbf84
SHA1 18b49d6c00d0d28f3527b14cc54d052f00188d5c
SHA512 6501b9545d666de82625d5acf3651b8d64200b457f32e0c88f2b770e2a6a5a24df921766df436f8aa31a0ca84cb68fbc23efe00cbdabccd8821e69749895a990
SSDEEP 192:/jfsF4rDVZ3akIqCteOAz7wwsI2z7wws3B7/an2ayzRURpN:/jfsSm3qCgz7wwez7wwm98UzSR
TLSH
T1EA8284106A05D2E2E9922F70DF133F2937A6E7C5AB9013AB04CE94648F577C90ED47DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e599b9d.rbs

Path C:\Config.Msi\e599b9d.rbs
Size 596B
SHA256 b056ad552c2f207e7076407b7ac6d2aaaffd68c6650d14e0be1d2af74d51d748
MD5 e9430ca73539e6a0f4cd9160e240bec8
SHA1 2728af5d5ce675324ef9ac5cb79060abbe437564
SHA512 bb4f2204388a5fb10ee9f9ab043b93644f5772b39a68781a6076f64ebef9ad4892b15845509b5e1439fed40bfde3160664d66fd8e0ba62984cfba376dcb7c0fe
TLSH
T1CAF0E142F789A0D7C186A6B5B701AF013A9B9138610085A5480C81DE3CAB5558FF4590
MD5 SHA1 SHA512 TLSH

Submit Download

Apr2007_d3dx9_33_x86.cab

Path C:\PROGRA~2\MICROS~2\XNAGAM~1\v4.0\Redist\DXREDI~1\Apr2007_d3dx9_33_x86.cab
Size 1.5MB
SHA256 219441f975c200352a12dc3d8f82811fc7b53ed28d63761327933afbb660f876
MD5 3676d740157493e80e7b8641289c003c
SHA1 8135aeeab67151dd4e2418d4907077f646e72873
SHA512 abfc5ea36a7368a34193c8f3771ae4e36c0d570ae0a20b11892184cd4e384d6abe6542769e3c890293b4e640faecf6392f84f5733017d8d86c65456caa24c6f7
SSDEEP 24576:WcQY0tIpwa5ydxGuruluTsRWo1Iq9e5m98yiN9/0rjVH60mPxr/1MDT:WcIIi+G9rul8uooec98yi//0rjoDZrCn
TLSH
T1BE753303AE856B85B1072DD15259E315A2FEBC4B37178B01FB6E6DC81547BA032F1B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Apr2007_xinput_x86.cab

Path C:\PROGRA~2\MICROS~2\XNAGAM~1\v4.0\Redist\DXREDI~1\Apr2007_xinput_x86.cab
Size 55KB
SHA256 5ab7bb15394e4ece850da5453413ab1de2ea97d5c93f86482b75073aaa05da9c
MD5 f83f54f45ac15a32dc17614c4f6882d4
SHA1 fc8542fcd33bb9e669806409f677edec9bfb64fb
SHA512 e4dcccc3a4299d262b94b24ff4b29394bed71e211b80a8a457acc4ab89325500082e6a9b597bc7b1dbc35746d01a9aa038a9c3a401aa42a426fcc3d15f410c9a
SSDEEP 1536:/cnwcwzHEdb27WH2SfZDNu75ddnVR+ZFaNk0ZRu1FaeK:Cwb+2eZonQwju1Ef
TLSH
T17E43D0C6880CD84EBEC52EA1367DFA51BC3CD3C384B66917456BF896088B3D1A704B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Feb2010_X3DAudio_x86.cab

Path C:\PROGRA~2\MICROS~2\XNAGAM~1\v4.0\Redist\DXREDI~1\Feb2010_X3DAudio_x86.cab
Size 20KB
SHA256 7fbf09682fd15d721ff2c5cb110b5ffcf5982cd2dd8d72b708cf3cd0bc4fa250
MD5 ed093ce20bddc7c42ede4daf772ed5aa
SHA1 21beb0ef8130be1c62b8467dfb67bf3f7548cea1
SHA512 734e397f4ed2554944e1d1f6f799794c4027792a06e9da25bab58e6e4ff58146058d8b45ff0cb9c861f77989cad029164945f22ffcb459432e1d3a2c7172525c
SSDEEP 384:BbCiWM4cwP+niRGYZ2TrvF+q7yAfLORxNy+E1jYvzLXci2jpv63y:QE/wPRY62fFr2ADSxA+OsPMi2jpvx
TLSH
T11A92C0D2AA3DD00DEEAE6CD992B8DC573E7D93C60936451F20EEE7C400A33C58756469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Feb2010_XACT_x86.cab

Path C:\PROGRA~2\MICROS~2\XNAGAM~1\v4.0\Redist\DXREDI~1\Feb2010_XACT_x86.cab
Size 90KB
SHA256 0ba00c41443639dea9b816fa2608088ccef5dbe850531dff4c1e7993804b0b60
MD5 5cf3585c99a59319ac10e18cc92f0024
SHA1 c48c25e6b7094eaf337fa986960f9895e5f465ba
SHA512 26b8213a5105b37912632c8abc1a07381210836e620f8f70d77b3b412a406e2e38df7af037001fe27f2da874e143c59aa7dbff90a9183e7619a8e5af0a23b158
SSDEEP 1536:RnXubXErHES9SjYKM+wqFI5mg4itqGEZ7d2McjVk5nu1BznlUmIWiBC955:pubWkAOY/+wqFOhqGOLoVy8BzF2C955
TLSH
T1D59302FB4F79A219DEE52CD1A6C4A9273374D2C20E515062827BC9C413A2BE09F7C939
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Feb2010_XAudio_x86.cab

Path C:\PROGRA~2\MICROS~2\XNAGAM~1\v4.0\Redist\DXREDI~1\Feb2010_XAudio_x86.cab
Size 270KB
SHA256 281bb0e12f617e9ae7fe3301a7d4a08201b377caa0311a886e8cddc2526f734a
MD5 5da6e4a80fa53568d2fdde31cbff2979
SHA1 9606fda70427cd9f4eb8e67b625417e2775e6876
SHA512 649fc2578388064267ebe8e55daada29d2e51ae6422b10088b6bfacd229bc0439aafdc4f9af7b3b5e187df179c72b4d85f70839a8c91505d17da06d53a40cf3b
SSDEEP 6144:ScGQ0hz7ScOGCq29xXhKj2bVZevb+7KwDcxbaLhz6:aQu3TxCqCZEGVZej+BDVd6
TLSH
T1C74412A28C9A65D34D17A33EF39C54872CF5DBC126A15004601AEAEB52D7BE3CF2764C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mar2009_d3dx9_41_x86.cab

Path C:\PROGRA~2\MICROS~2\XNAGAM~1\v4.0\Redist\DXREDI~1\Mar2009_d3dx9_41_x86.cab
Size 1.5MB
SHA256 5146e15d4c65590704286bfcfbbcc31e98a6832f8a7cc3bfdcb1e7fa5a647bb1
MD5 0fdd6e4e5dfc5d913261355746402214
SHA1 a80c28755c9d3ca163bd377d1bd951a1c111733c
SHA512 9eb85c4507881fc1004c906ee954273bfbea8979d70b2321f197a3cf82121734225103e4239a9bfb591a980b70400a5d19b93482abc108c46614a20476a81f90
SSDEEP 24576:tFtN95ew18Yl4WTrZnZSibmmq18Whxp9pWISiIz9cXwowwenm2AB4qDA2mVxw:LewRFZ8ib6T3p9pW9/Z4bM/XkAQ
TLSH
T1D9753390A7381805F49E2A0A295DFD082F2535CFAE579825386E35C9DC6D78BFA0DC4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxupdate.cab

Path C:\PROGRA~2\MICROS~2\XNAGAM~1\v4.0\Redist\DXREDI~1\dxupdate.cab
Size 93KB
SHA256 54d68f154058433865708ee0dbf3ecf2d609ffbd618e84a1056440379494d9fd
MD5 c187448c8104d30087f3f25a9d112014
SHA1 b64ac3e44f2f38a3bf8400f11a40a39039fc9caa
SHA512 9148cece409557444eeaf66dee58e2a6043a64d7b76b91e6c4074a5ba0d066cd1ebb2c60d44e1c7a40ca1dc63d72aa7afcc410202901d5afbf2116e3ba8b0f11
SSDEEP 1536:CegbA3a2D3njmzI60hJijpy/Ykm3BSLGK/grkE5qYYH5UzbMrW+uft9rHUx:Jt3ao7hSynHLHEoYYHGAWlft9ox
TLSH
T18D9312C0AE8C328FB0567824524CF9326CB977D396A143139C89688613B7BF1DF26C2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xnavisualizer.dll

Path C:\Program Files (x86)\Common Files\Microsoft Shared\XNA\Framework\Shared\xnavisualizer.dll
Size 46KB
SHA256 11bcc9f47d9b0397f6d78c08e7208ee812cbef54bb02a8c3a681608879471c8c
MD5 ba187b4db5dae1bee29e6f18b7775b8b
SHA1 efce87100c26165cfd7eb627534e42cb72ddb5b7
SHA512 c9c2c3760e495c611a925bb5ae162d4c4ac90f53e2c0a9d20f68085ab43cc0f0a7ad1d201564649e4cf67ef4402d874626c6911f01f8a055da0b993730afc12c
SSDEEP 768:QCMZ7X+W+WJtZlVWsWGr4Dl4e9SRf4LROn6d+zjhX2BAH:Q3ZL+W+WNWGK4eTVOnXzNGe
TLSH
T110232B01A544D0B3DCDA61B0566CB27651AEEBB207E022C32E771BDEDCB57D09E3834A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DSETUP.dll

Path C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\DSETUP.dll
Size 91KB
SHA256 9d47b4fa2dcce6a02a51324cfb97f5e153086c2eb8832b211e175cbe5fb850b3
MD5 4d48dbe4d3a06c497435014e5c583f34
SHA1 159cbc37080b7ea3ceae8d25125b99f9f4948341
SHA512 b8029bde36e4d6581916c131ec51d74f4a2b03abf5a238c503e1c7b19980d0946606375f0b4c3bd10b9c514e084368c356be8536b282bee887037d7d7f139732
SSDEEP 1536:HDtBqvGfTOOeR3+MPb3hzgS/1nJvMgqAlTJQs0MajclgUukW+j2c5o5INSeVg7X9:jtAvGbOOA39b3h7/1CfWYcZ5x5o58Sey
TLSH
T1C7937D15BA90C072D8D120F916CCE7B1A6BEE1B40B2999C7F35047DAD9713C6AA3934F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DSETUP32.DLL

Path C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\DSETUP32.DLL
Size 1.6MB
SHA256 a5c6df12f9fe2edab2a22fe7abf3cb17eac110a6fd469f2570ba04afc88ad767
MD5 7c7cc9feb1026678c48bbabe84ea57c2
SHA1 4fe9c466fc65cf07af0e1440743b1822ab65849b
SHA512 d9cca6dfd5966d45342b87afb6091bc8ad3beff039f9bc9c523f8118dc6723337c279cd652c19624250ed3934d8f4a2b15670652867c0114b7e785bbab4212e0
SSDEEP 49152:TjTO/4OOOOOOOOOOOOOOOOMiWeXiWeXiWeXiWeXiWeXiWeXiWeXiWeXiWeXiWeXF:TCd
TLSH
T10475AE35B1D40331E6B203B167128AB7F73EDBDDE21AD521B9AE82552186B8CC33E355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DXSETUP.exe

Path C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\DXSETUP.exe
Size 512KB
SHA256 16953a202265db5655b3dd972b855619728da76545a2f94bcbb6c43262f48d5b
MD5 11dd6e8ab9759d1ac91ffe0d0e4949cb
SHA1 2a86774d0c87050d5c7aa9738cc3975303a40d0e
SHA512 06828f51b3866f7c2b29861707bf8552b742e366783115b3062f08a9c0005c96507ecf1fff92ad41dc0318ad715176c39c84ff0424372b080bf7c031e4f307de
SSDEEP 3072:Yi6LKe0XPM8nUc2nDzw0FWtj/WM0PSQ5lbSN2LhaM96rKmMH2/5Mjt4zT1mFDYkZ:we2nDzw0FWdwewUM1Ws4VIH
TLSH
T122B41C1067F99225F4F36B386AB913964E3ABE91DD38C55E6314319E4A31E80DE70B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FEB2010_X3DAudio_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DX9F92.tmp\FEB2010_X3DAudio_x86.inf
Size 1KB
SHA256 d4da3e530982812d1e2a31570b80af541fac1b13c72997d2aad7ea3bfeaf4a4a
MD5 e84adf38d499ae39090ad60fd76d76e3
SHA1 6af4d58bc04aac2723e8b97649f1b35fb1aca84c
SHA512 6714992e7aee7bd0798fbec68f92c97ee502127580e21e1b6693ed6737312b44dbc9fd9ef579fe552590e9e5a4904df94e4116334265a34699a04aa76ab87c24
TLSH
T1FD21269ACC0294707685B2B27F8F768F5B670417E9612508B3CB0E94BB73701219D1FE
MD5 SHA1 SHA512 TLSH

Submit Download

FEB2010_XACT_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DX9F92.tmp\FEB2010_XACT_x86.inf
Size 1KB
SHA256 e850fdb84bcac0f667927e53fee943efd3f43be6c6a0ae1e17f3fff83ddb2635
MD5 82c10b720e33be099f69e4010d44ecd2
SHA1 e95a2eb23db3fd610d71089500aad523f93c9469
SHA512 853261c439b26cdc8991ac289b9f9925976452ed613481b0cf09e75444882805ffa15633eba441d8e1a04641f5f6378b68e2270a6a48d3911d7f9c2c0b1235bd
TLSH
T11331BCD9D802D131768DB271BF4B368E97774407E860261873CA0E9EEBA3201568C8FA
MD5 SHA1 SHA512 TLSH

Submit Download

FEB2010_XAudio_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DX9F92.tmp\FEB2010_XAudio_x86.inf
Size 1KB
SHA256 74c827ef94881099761e04397ef8f162fd0ccaf4876a5503c4b53a5216d2acca
MD5 e6e942a2cfbb587bfcc4203b5bb34fd4
SHA1 2e0172ea1936911a98e11a6e98990703e24172c0
SHA512 3d70d76e6f459819a1703c5019a2e10fe518ee6e8eb5d3313fe57d3d1b6313b52c4904398a26841c78a9ecf9d715e1201e834ab3df47265e070ec94417a78e4d
TLSH
T1A0317CC9CC0293717B88B1B27F5F3A8F57670416ED612108B3D64E996BE3202256C9FE
MD5 SHA1 SHA512 TLSH

Submit Download

Mar2009_d3dx9_41_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DX9F92.tmp\Mar2009_d3dx9_41_x86.inf
Size 1KB
SHA256 bd29711cc2ecd924990167ffa95f48842e24aeed3acef1023717040240b4bbb6
MD5 b37a5ff044eb65521a290c79ba1a3e00
SHA1 ed505464894bd3e52654834487f3821ae117edfe
SHA512 eae4408cfa7f9c39b101489688cc570a184b8a57f3d20d3b0452a581fb80c4f485dc2f512a39669a92a5bde81fbf474e1585f566ff482e87610780c23126c21e
TLSH
T12D3157DDCC02E4307A94B6B27BAF364F5727460BEA61310977C90990AFB3341115D2F8
MD5 SHA1 SHA512 TLSH

Submit Download

X3DAudio1_7.dll

Path C:\Users\Admin\AppData\Local\Temp\DX9F92.tmp\X3DAudio1_7.dll
Size 21KB
SHA256 288c701bdedf1d45c63dd0b7d424a752f8819f90feb5088c582f76bc98970ba3
MD5 c811e70c8804cfff719038250a43b464
SHA1 ec48da45888ccea388da1425d5322f5ee9285282
SHA512 09f2f4d412485ef69aceacc90637c90fad25874f534433811c5ed88225285559db1d981a3ab7bc3a20336e96fb43b4801b4b48a3668c64c21436ee3ea3c32f45
SSDEEP 384:hd8NTutwAV7uTOJ/jUKdiAdzJWZuW8lLXci2jXHUcwVP:hmAV7uTO7jzU8Mi2jXHUcwVP
TLSH
T14CA27C55BA7DC112E9A819F0217EFC873C3DEB944B1282E3119270DCCA653D0AFF9666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XAPOFX1_4.dll

Path C:\Users\Admin\AppData\Local\Temp\DX9F92.tmp\XAPOFX1_4.dll
Size 72KB
SHA256 0aee44b12913a95840ee6431d90518b0d72c54a27392e21ee6995e2151554a06
MD5 e4ce2af32f501a7f7dddd908704a0ee6
SHA1 9dc2976efb15b6fba08bebdeb98929b6961063a5
SHA512 ec14a58414d595a36c6b575cdae690f11481cd3f0b35fd2f4c6a6d162a6272882cfe03da865e09a34972775790529f51c80b69056a2fcb909f25b549ed2f7f01
SSDEEP 1536:1/GrYvIGDi/t+YoCBlrT8EGscPCEBu0OI+k95M:qYw/VoCBl0EGsjEh1+k95M
TLSH
T11D734C026CF9C6F2F46468F5D4BD39A73838CA84A7248AC3625445D1D9F07E0AEF93B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

apr2007_d3dx9_33_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DX9F92.tmp\apr2007_d3dx9_33_x86.inf
Size 1KB
SHA256 349a09a2791d697bffffc61410a536cdcf258f0d7c86dda44a297e8aec4bdf00
MD5 044cae9c30c88bda73727243f5e5206d
SHA1 de744e349cf4ea458b10657d510966d21ad08d67
SHA512 18e501142004afbcd28b41bdd3a9b19e2eebc047d7858ee11a9135f19759cfd8c643ff074a51e937bbcab7162888fd95effc146be21fe63dfc300ef03ed44056
TLSH
T1F13157D9C802D4347694B2B2BB9F374F263B450BEA51214C73CA0990AFB3761125D2F8
MD5 SHA1 SHA512 TLSH

Submit Download

apr2007_xinput_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DX9F92.tmp\apr2007_xinput_x86.inf
Size 1KB
SHA256 1c798cb80e9e46ce03356ea7316e1eff5d3a88ccdd7cbfbfcdce73cded23b4e5
MD5 e188f534500688cec2e894d3533997b4
SHA1 f073f8515b94cb23b703ab5cdb3a5cfcc10b3333
SHA512 332ccb25c5ed92ae48c5805a330534d985d6b41f9220af0844d407b2019396fcefea7076b409439f5ab8a9ca6819b65c07ada7bd3aa1222429966dc5a440d4f7
TLSH
T1D42126DDC8039435778AF2B27F9F7A8F663B8406E951221C73CA4994AB73341126C2F8
MD5 SHA1 SHA512 TLSH

Submit Download

d3dx9_33.dll

Path C:\Users\Admin\AppData\Local\Temp\DX9F92.tmp\d3dx9_33.dll
Size 3.3MB
SHA256 c6b7b2ad7742dde5dd8d1a35fdc1c185e586e551ad9c74d3fb21759cd8ca4da8
MD5 cdb1cd22baff21f48606b3c1a18b000b
SHA1 9315b5db975a34dbebdb4dcae652ba1db01c482c
SHA512 c5fb24de8f1ee6fc1ed6e74580b5d22599ea4eb6c3589645fff0b15dc8dca051c4917e60fbc00ca86542dd63a8f5e40da92ea77e24826c0c6bdba9b58c36d4db
SSDEEP 98304:9Yho7VaMeKQqGfyxXIicOExzUx8PjtvssPFAQAl7fxI8f6B2+:ih8V2KQqGfyxXIicOExzUx8Bssun3f69
TLSH
T128F5ADA1F6424135CCE242B0418E73F861ADCF7157601ACF96A42FD8AEF66D28F34697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dx9_41.dll

Path C:\Users\Admin\AppData\Local\Temp\DX9F92.tmp\d3dx9_41.dll
Size 4.0MB
SHA256 6ac4df203af419d3f3b7d9a99e14a3490ea3ad307c474bfe36baea642b1421f6
MD5 3fa06cf5079b84155d18b05c08f7131b
SHA1 fafe52876151a08f39dbb6b4aa137dd85558ba5f
SHA512 24d29c3ffb6532da860fef4dd93e61f7532cea3af94928495a3af0231e7dff6db5cad25713451a2e722c076462b94818cd6969a1c7d8905585b0f64e12174d1e
SSDEEP 98304:DdpF8pg4HYUQpisB7+86QJxpj+p9jdIcFXZvkyIOPsmQJAax0z:ppF8pVAisL6QJxpj+p9jdIcFXZMyILAf
TLSH
T19416BF60D60A8039CCDA51B5664E33B5356C8F71432057CF62683FEAAE747E29F3825B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxupdate.dll

Path C:\Users\Admin\AppData\Local\Temp\DX9F92.tmp\dxupdate.dll
Size 169KB
SHA256 b1f954cd75dc3c9d5bc57f1a4c28720ee3639aa8a4306f3da7b27d3c361ff8f5
MD5 c4842e139fca422e265c91c44a1341d6
SHA1 299a5ab4644fe7302b515aa10ef0f1715046275c
SHA512 e85a35164e0feafa73a676dacf67d275b8e8aa5be40d861743662a7d1ac8135625c2d59a73e5c77fe1e3e8bd8523d9c823c89137aa4cb1b32d392cd9a1b59989
SSDEEP 3072:SF6LKSiwVi/9SXBLGqkNWMPCydN0BMz/xYHWl7LdOIlkhuGzyZT25FnSINKz:YwVaMMjUMPCydN0Bu/OHW5LdrCQGOZmw
TLSH
T191046C2DBB80D471C4E200F9650C26B16BFEA9B6072A80D7E3501BD9E8A57C5E17D39F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxupdate.inf

Path C:\Users\Admin\AppData\Local\Temp\DX9F92.tmp\dxupdate.inf
Size 12KB
SHA256 7530c6e18dbb522c5f4fbf6714962c185ea318f9eab7aeb833b0cc07cd2fe656
MD5 8c281fcb5546d1ed3cdaf6e3f7303139
SHA1 de342a17f2df0386f6584e2f55ae43c558ceb6c4
SHA512 344ea0a375c8851fcf413f441a1cac3013b3748d1630a4d677da72e98f41823bf9427d896de7e1fe35bf868279538cf3b8322aa6ef20025bff48a6bb7f8c42d3
SSDEEP 384:eXTiDxtV0xxmBxbD6Ys7s6xHOJYwYdDxAp8xXZyUxIJ4:eXi4
TLSH
T14C429976B9168259F40EB3A01AAF3EC55E3B004FB43124CD79EF11B0572E1ADA2FE454
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xactengine3_6.dll

Path C:\Users\Admin\AppData\Local\Temp\DX9F92.tmp\xactengine3_6.dll
Size 233KB
SHA256 8a7e7c5ac2e6230f0249d46751522e7ecf85e7490cf7491ab73bf2e7e59e4c0f
MD5 f81c4678a55ffee585ac75825faf5582
SHA1 8fb2e6cf2a022eaed2ff5e3e225b3ca1e453d1cc
SHA512 8c8071bc2640d5c0fcf140ad68d4788cbb0706d17313c3cb74e25624a748b282acbf77eda678cf0d5fecf2ec3d583508c6f4eaf5c84073909b616f59b4f4e5fe
SSDEEP 6144:FHNB4NleX2RWWLykwq3/niRkI9yYJH0/eX:FHNBelM2RWWLykwq3WkIcYJHhX
TLSH
T1D834A4109541A27ACCF77AF94AEE3078B65CABC1130524D747D87AFBDB166E13A3408E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xinput1_3.dll

Path C:\Users\Admin\AppData\Local\Temp\DX9F92.tmp\xinput1_3.dll
Size 79KB
SHA256 8d540d484ea41e374fd0107d55d253f87ded4ce780d515d8fd59bbe8c98970a7
MD5 77f595dee5ffacea72b135b1fce1312e
SHA1 d2a710b332de3ef7a576e0aed27b0ae66892b7e9
SHA512 a8683050d7758c248052c11ac6a46c9a0b3b3773902cca478c1961b6d9d2d57c75a8c925ba5af4499989c0f44b34eaf57abafafa26506c31e5e4769fb3439746
SSDEEP 1536:TVeqvNS6T6jxeEsU6b0xZtDDVb9X8u9JA7zitdrz/R8cy/FaeBD:TVeqvNOeFgxZ9DVVtRBy/EeD
TLSH
T199835B107480D236D8E361F806FDB714763CD66513A559C32BC4BBEE9EA63C26E3069B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e599b9c.msi

Path C:\Windows\Installer\e599b9c.msi
Size 6.7MB
SHA256 47260420773a20443fb1e38a89b7f39c5237a80a842de598e6c8f7f90a3bbd6d
MD5 ff1c0202ab7147c9dfd34b582f1da13f
SHA1 5fc95a9ad87a38e71a953af116fd1f1cbe46a3e7
SHA512 9a233fd33fa535d0783ac4a97108166b860d7647998ce184e6e5103200a6c8522a5e4d035b85e02280f5176c092e0d3e61a60f228d7ca17f09fcf2fc5cdf5253
SSDEEP 98304:synfL329J1XswfXO6wiBB+4RZg6aENaCZAU5PMO0MntfERyJGH2YPq/:sYD3C1XXfzH+4cLHU5PM/Mnt+YGlq
TLSH
T1D06622A2751AFF41DDB406FCD970CA490925CF3B82274C686929356A7BF7E0202E9D4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DirectX.log

Path C:\Windows\Logs\DirectX.log
Size 3KB
SHA256 652f56ffd3039160dd65319b162c53e8ba1290f9463f56c2322f498fbb7e15d8
MD5 9e1d51979ad6eca642263220df124dd4
SHA1 844addd32ca95c231bf48edc3e3efa514e1a8575
SHA512 02954151bb91f7ac540738043ccf9ab03afe562b86d6c80e5b99dfe88e132fa6bc412e0500f7941851fbb52ef69fa76adeed1790207f796afc1dc081648fe0f9
TLSH
T1C871599C2C7BDC71B880542ABB3A7ED8930E6243155502E5B1F64644D6C8FAF2F4E1BE
MD5 SHA1 SHA512 TLSH

Submit Download

DirectX.log

Path C:\Windows\Logs\DirectX.log
Size 10KB
SHA256 2d86dc937da5d4d9a12e1dee75ca4c118d917975fe814162c50a5dfbea10c237
MD5 3c6f348c261a37f2ba204efe4eebb424
SHA1 3e88bdce67d1b7b99e0e006a2e981791c00000d8
SHA512 9636bb386bf03fd90816db3a05ac76d54f62c69033efd66741854a1d081995ce527c71767f7e09634822a2a6f2c9ca99c81c24be9a50e14ef89bf91a610981fe
SSDEEP 96:3v5tT4DwMNfDDDvoYfSVYz2JMilZxITHb33MEVVJyfzfYfIADpVAD5lzf0PNx+q/:/5tof
TLSH
T1B032639C2C37DC71B890541E7B697ED5630EA243156002E5B2EA4790D6C8FAF2B4F1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Xna.Framework.Graphics.dll

Path C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Xna.Framework.Graphics\v4.0_4.0.0.0__842cf8be1de50553\Microsoft.Xna.Framework.Graphics.dll
Size 417KB
SHA256 39aed7fd8e308ccace5ce9390256f1c829ca72c2eccd97d4a0f629f24015d3a5
MD5 c76b932d5308f2c33b2b25077fc93fdc
SHA1 3877403187dc35eb57cbe9940166e57021b2275b
SHA512 d84c39c2aaff47a0a9899a695ccf450b1c126388f25e9c186a313a31c81f584768d8a5928916fe6e0a7dafee66c7d11909ebdd1468b7b80a3892de1ddf252f74
SSDEEP 12288:7gKRqrd/5XPtFMiPN7xqbbpa36OBjoKGef1:hRu/qJa36OBjoKGef1
TLSH
T108945B4A37808A3BC26F57B694AB0724937BD143A74AE7CF185053ED3CAA7C4D931297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Xna.Framework.Xact.dll

Path C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Xna.Framework.Xact\v4.0_4.0.0.0__842cf8be1de50553\Microsoft.Xna.Framework.Xact.dll
Size 74KB
SHA256 6824bb0b7b42626d1ed5b7ab7e4dab4a380fa010175d4de0fadb1c3904e491d1
MD5 cf7788e795f1c743d6ee0bf8de3fa502
SHA1 db2bf000c096a91aca46da5fe35326761c63053f
SHA512 13cd0d8d7479d7bb9b721cbd8109764bfb58e4dc01661e8fd6819f1cb182e408766e7cc61103e95763bdc1e11ab4b901ae05c8748e18b5f730ec78c5868f7781
SSDEEP 1536:piWyY+tzyo5dDaYt9qsudKGef39D92YrSDyvG+:pijBzyo2YtMsudKGefZ92BJ+
TLSH
T188736C4533858A6BEBDF8B7278B0FA44013664A2AFD3FBD711A193E518563C0C935B93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Xna.Framework.dll

Path C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Xna.Framework\v4.0_4.0.0.0__842cf8be1de50553\Microsoft.Xna.Framework.dll
Size 657KB
SHA256 8b7aa4c4939f243b21432747281cc8aacdcda56191a16d9eaa036b4136cf0da4
MD5 343f79fe3dcfe0828f7ac2a13f8f7210
SHA1 8daafd2b9e44f0b46b2dc6ba4607ef155964db0e
SHA512 651d7acf8effe6a77ce094c88163adb950830d2f5779f900129391f2f9ca7393163749084e861fbd742e26f61c350225107d64dcf888c0b5d4ac9de8ae99d44a
SSDEEP 12288:NSC7r7PBfZ99ZJV3NzQhXV34zB6KGefjmqboY:J7HPBdZKa4KGefjmqboY
TLSH
T17DE44A18A7C8793FE19F5775B0284E3A2776A515A703EBCF04A053B92C6B7E0C931297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Xna.Framework.Avatar.dll

Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Xna.Framework.Avatar\v4.0_4.0.0.0__842cf8be1de50553\Microsoft.Xna.Framework.Avatar.dll
Size 24KB
SHA256 7688ebdffc98433eef8aada293a8c4beec6d6acfc0e1f91ca8eb2f1c350e7cec
MD5 7b26de335983eb8b800a67ef5ff077d5
SHA1 f614672dd8b25985a417ed339a6a6532c9e57800
SHA512 fc14dcda0703c8ade152bee32b4c4175c37e98500cc1370d4de0ffd0eac398edae3a42d29711e6ec841231fab0eed228fc6eba69347b54a8e125866ae6822043
SSDEEP 384:q4QsedMlPLtXTuZclArYIJT8gdRDY94dhuBW37sWl:8zdMlzxCiArZR8Gdnr
TLSH
T1B6B22946E7088631CBFF09776C7A3D4501BE7252F9D7CF6A172881963C4A7241A66F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Xna.Framework.GamerServices.dll

Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Xna.Framework.GamerServices\v4.0_4.0.0.0__842cf8be1de50553\Microsoft.Xna.Framework.GamerServices.dll
Size 70KB
SHA256 627e84c06cc4e409870b068c9ec9149adba425e47e64185f92d839db2aa35484
MD5 f1e460b7805cbc4901c410f2767912ab
SHA1 01e7f335e58af5140bc7953518739f43c59f1c98
SHA512 3f34bb839deb6af6b68946aaeac17fa3a1e419d2f8310f37d1f460bda329c2bd46e380fe18f883389dcc64e482e596a0b31e0291b202abefe1c6976d5dec8751
SSDEEP 768:99nzBVtN1ZbkfimxzhXR8IIlNfPh3tVBx3+mdaMty1FL5borGO4WBxCk3nfnRoCI:n1ZbkXxtOIILR9jx3k1FsGO48uPFXx
TLSH
T1C8634C005B48573ECBEE5979B4A32C1102B9D2D66593EFCF6EA892DF1CAB74442213C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Xna.Framework.Input.Touch.dll

Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Xna.Framework.Input.Touch\v4.0_4.0.0.0__842cf8be1de50553\Microsoft.Xna.Framework.Input.Touch.dll
Size 22KB
SHA256 2191bad4540b50723acbda55bd2c6e5d80cc6f84ad989ff89ddda672348577b2
MD5 911fbe5496efbaed4ea67497fa63c633
SHA1 570911a579cd752ceedbe9b07efc1c8c832cfda9
SHA512 6ffc30116c62f9a91e5d6fee4133e87417df14aafdf5443f7002b46c20ddbf0eca242ea54f8711b31defb42ad0ef3f5f11b16e699ce3dbdaa728ec1661e00d7d
SSDEEP 384:CDqti6XlMyIP0ZL8dOLuSneTbjRcuV81Vzh57WkroW:CfIK08T7XYzl
TLSH
T19CA2E917974C0336DFDB5E3D68AA388A12BBB666F4C3EBDA011C95561C437180E23757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Xna.Framework.Net.dll

Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Xna.Framework.Net\v4.0_4.0.0.0__842cf8be1de50553\Microsoft.Xna.Framework.Net.dll
Size 53KB
SHA256 3c0b37068ad56193fd613eb8f6bd321e7e08a99b9cf85606ccddf060afb1263b
MD5 378479eead647cedc6b74bf84e5514a2
SHA1 8dac9af1bec30f93a4aa6650ced1f64dd0791841
SHA512 6b0cb09a21121d2eed1277c0989d5ae142b6c724886ada5f713f762c61641901fadbb4fdea115cbdb662ceee220aa7d684e5a7a0613fc3a642bbad36e9c22e88
SSDEEP 768:vvTTIObJK98eL8PaEntvuh8tItI3CJUvKZTswdnXBr8H:fPGYaEntvyIIi3CJUvKZA8xr8H
TLSH
T1C2333A40464D473AD3EF4DBBF465343903F1F262B7E3EBC52EE890EA08A276509A5527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Xna.Framework.Storage.dll

Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Xna.Framework.Storage\v4.0_4.0.0.0__842cf8be1de50553\Microsoft.Xna.Framework.Storage.dll
Size 20KB
SHA256 7edbb80c699ce3ead8aee5a512ee34c7718cb5dceeb1d0577e788ad8d0ad9383
MD5 17c4074e1d0977182060959ec63e18a6
SHA1 af73bc4b90899793525ca472a1b90312c33063e9
SHA512 b7d7fc7b21f3fd480e6ee40cfb3682b898382ad2397cc38ef7258db68dcac31de0f64b8adae5ac92d0b31c3cf85c2489a04dfa77675104134d874fb4871e91b0
SSDEEP 384:OFMldl8akzAlg5asAq+P1BG89bbCuIQkB1kD+hpNWwLMW:GMl38tMOcsAq+POdp72+z
TLSH
T1F8920702A74C0236DFDF4D7968A63C4510BAF597F8C3EB865A29E49A1C677281963B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Xna.Framework.Video.dll

Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Xna.Framework.Video\v4.0_4.0.0.0__842cf8be1de50553\Microsoft.Xna.Framework.Video.dll
Size 17KB
SHA256 63c7673c936747abd9ebe779e8837c8b8add2c078a31216684fbf8c6bcab2745
MD5 94b8554692a89f1955b9219e0f26442b
SHA1 cd34862740a30b2f0fd391fa16b082edb79d155b
SHA512 9a6762e9cd8bd26dd347c8166dc59b31159c9e5295d39773c69228d73b5f3f850bbd41f733b1f880623bcd4c929f13d66e2168f2e1972842a6e031d069ec92b4
SSDEEP 192:DABS32p6Uhw/uO0Tab8uj1O9BQ6eVixgj4xxdhzg/L0Xc90OOSN1c1mWabsW:DABRpTC/3bM7Q6eeU4xx8hcEWabsW
TLSH
T19382E912A30C0236CFEF9A796C647C8511FB7667F8D3DFC66629859A1D827201D63B43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XAudio2_6.dll

Path C:\Windows\SysWOW64\XAudio2_6.dll
Size 515KB
SHA256 61b57170f7c6365714396072d22cb98746718c0f44c9f0d5c62fdb1b218639c7
MD5 4976243bd70fae3d1d24e49739ab2710
SHA1 6ef27b10bcf4e697fe77c3e964b326be11e4444f
SHA512 af2d6aaad44bed880a1a2ee947618b142c76a5eca42d4608196b74df9108a9649059d8207e84a58b76ad43aefe9b66ffcc519f8126667177011cf4199f163e83
SSDEEP 12288:QWi8lqH+P+wCS+OlElME9IdMANXtaDWzF6xuwEiS:QBtZEPMAN0WzoxuwhS
TLSH
T17CB43A12A4528275C9F722F184AE333B2738CB8457451AD753E499F9EED21E07FB01EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 de2a9d8bf334e7a491ab22e44e5a8a1d529a718e3186dadf1223c1f8eb159325
MD5 3608ac73d7b554753ee6883f954eab26
SHA1 a5075e5e1a72e2042a7d4ffb8473ace00a087e93
SHA512 dd4d8b3a619111e4e24a027a380374dc5b5c107be2772d340317c87ddf31a0146a69f9799315c6378236d81775461ed11b20464b6090a6e569cbc91946d4aa52
SSDEEP 24576:t2gmSp1ldoO/vvTLB2q+RknK/qpBA4eA22p9XpEqzRaIE2OvYR7d7nANh:h
TLSH
T1EA47C22436F92210E7F79E3CA8F0AA234D3A7D5B9C15DE8D05411B4E0961FB1E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{aea5076e-846b-4d30-b0f1-4368ab435270}_OnDiskSnapshotProp

Path \??\Volume{0dc89376-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{aea5076e-846b-4d30-b0f1-4368ab435270}_OnDiskSnapshotProp
Size 6KB
SHA256 a1f70220f51661ac598cecdf2e708f0c588354c76dcfae3c5472051f239db9ff
MD5 f33ec3beeac7dbe365dadf6f7453c062
SHA1 f082310bcdad962e8ab51df3dedd7e0d9108882f
SHA512 064a0ea19ba161fad62849109d7abf4bcc8b7c7992e71c2f973bd133da2477455af663a4c1a541c38bebdc5a9518cd433fb8c9e6fd35c7846c2aedbe6ca49ad5
SSDEEP 96:F6UzwTvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:crb++ZVm
TLSH
T135D178185AF54711E2B3AB3229F18557A877B911EF33CB8E0298238E6670910F875F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3904-39-0x000002162BCE0000-0x000002162BCF4000-memory.dmp

Download

memory/3904-45-0x000002162BCC0000-0x000002162BCCA000-memory.dmp

Download

memory/3904-42-0x000002162BC70000-0x000002162BC7C000-memory.dmp

Download

memory/3904-21-0x000002162BC50000-0x000002162BC5C000-memory.dmp

Download

memory/3904-33-0x0000000000790000-0x00000000007FC000-memory.dmp

Download

memory/3904-30-0x000002162BCA0000-0x000002162BCB8000-memory.dmp

Download

memory/3904-27-0x000002162BC80000-0x000002162BC98000-memory.dmp

Download

memory/3904-24-0x00000000006E0000-0x000000000078A000-memory.dmp

Download

memory/3904-48-0x0000000000800000-0x0000000000816000-memory.dmp

Download

memory/3904-36-0x000002162BC60000-0x000002162BC6C000-memory.dmp

Download