Analysis
- user interaction
yes - max time kernel
213s - max time network
242s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/08/2026, 03:16
General
- Target Installer-1.0.7.exe
- Size 9.8MB
- Sample260810-dss2wsdg95
- SHA256 48f359326787a848b89d838a318d797c51fd7feeeee602fff5f46b9d3f7b53ce
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Using powershell.exe command.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- Drops desktop.ini file(s) 2 IoCs
- Drops file in System32 directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies registry class 64 IoCs
- Modifies registry key 1 TTPs 7 IoCs
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of AdjustPrivilegeToken 16 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Installer-1.0.7.exe"C:\Users\Admin\AppData\Local\Temp\Installer-1.0.7.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-3C3DAC51-F9F6-41FF-9683-A401A41FADAD\MadiumInstaller.exe"C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-3C3DAC51-F9F6-41FF-9683-A401A41FADAD\MadiumInstaller.exe" --from-sfx --first-install2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Stop'; if ($null -eq (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue)) { exit 0 }; $status=Get-MpComputerStatus -ErrorAction SilentlyContinue; if ($null -eq $status -or $status.AntivirusEnabled -ne $true) { exit 0 }; $p='C:\Users\Admin\AppData\Local\Madium'.TrimEnd('\'); $current=@((Get-MpPreference -ErrorAction Stop).ExclusionPath); $has=@($current | Where-Object { $_ -and $_.TrimEnd('\') -ieq $p }).Count -gt 0; if (-not $has) { Add-MpPreference -ExclusionPath $p -ErrorAction Stop; $current=@((Get-MpPreference -ErrorAction Stop).ExclusionPath); $has=@($current | Where-Object { $_ -and $_.TrimEnd('\') -ieq $p }).Count -gt 0; if (-not $has) { throw 'Defender did not save the exclusion.' } }"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\dotnet\dotnet.exedotnet.exe --list-runtimes3⤵
- System Time Discovery
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x64 /v Installed3⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query HKLM\SOFTWARE\WOW6432Node\Microsoft\VisualStudio\14.0\VC\Runtimes\x64 /v Installed3⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x86 /v Installed3⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query HKLM\SOFTWARE\WOW6432Node\Microsoft\VisualStudio\14.0\VC\Runtimes\x86 /v Installed3⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query HKLM\SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5} /v pv3⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query HKLM\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5} /v pv3⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query HKCU\Software\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5} /v pv3⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query "HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" /v Release3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NoProfile -NonInteractive -Command "$sig = Get-AuthenticodeSignature -LiteralPath 'C:\Users\Admin\AppData\Local\Madium\Installer\temp\deps\directx-redist.exe'; if ($sig.Status -eq 'Valid') { exit 0 }; exit 1"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Madium\Installer\temp\deps\install.ps1"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Madium\Installer\temp\deps\directx-redist.exe"C:\Users\Admin\AppData\Local\Madium\Installer\temp\deps\directx-redist.exe" /Q /T:"C:\Users\Admin\AppData\Local\Madium\Installer\temp\deps\directx-files"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Madium\Installer\temp\deps\directx-files\DXSETUP.exe"C:\Users\Admin\AppData\Local\Madium\Installer\temp\deps\directx-files\DXSETUP.exe" /silent4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe d3dx9_24_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe d3dx9_25_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe d3dx9_26_x64.inf5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe d3dx9_27_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe d3dx9_28_x64.inf5⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe d3dx9_29_x64.inf5⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe XACT_x64.inf5⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_0.dll5⤵
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe d3dx9_30_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe XACT2_1_x64.inf5⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_1.dll5⤵
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe xinput1_1_x64.inf, Install_Driver5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe XACT2_2_x64.inf5⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_2.dll5⤵
- Loads dropped DLL
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe xinput1_2_x64.inf, Install_Driver5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe XACT2_3_x64.inf5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_3.dll5⤵
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe d3dx9_31_x64.inf5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe XACT2_4_x64.inf5⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_4.dll5⤵
- Loads dropped DLL
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe d3dx9_32_x64.inf5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe d3dx10_00_x64.inf5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe XACT2_5_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_5.dll5⤵
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe XACT2_6_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_6.dll5⤵
- Loads dropped DLL
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe d3dx9_33_x64.inf5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe d3dx10_33_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe XACT2_7_x64.inf5⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_7.dll5⤵
- Loads dropped DLL
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe xinput1_3_x64.inf, Install_Driver5⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe d3dx9_34_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe d3dx10_34_x64.inf5⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe XACT2_8_x64.inf5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_8.dll5⤵
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe d3dx9_35_x64.inf5⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe d3dx10_35_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe XACT2_9_x64.inf5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_9.dll5⤵
- Loads dropped DLL
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe d3dx9_36_x64.inf5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe d3dx10_36_x64.inf5⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe X3DAudio1_2_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe XACT2_10_x64.inf5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_10.dll5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe D3DX9_37_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe d3dx10_37_x64.inf5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe X3DAudio1_3_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe XACT3_0_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_0.dll5⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe XAudio2_0_x64.inf5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_0.dll5⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe D3DX9_38_x64.inf5⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe d3dx10_38_x64.inf5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe X3DAudio1_4_x64.inf5⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe XACT3_1_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_1.dll5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe XAudio2_1_x64.inf5⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_1.dll5⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe D3DX9_39_x64.inf5⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe d3dx10_39_x64.inf5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe XACT3_2_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_2.dll5⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe XAudio2_2_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_2.dll5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe X3DAudio1_5_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe XACT3_3_x64.inf5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_3.dll5⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe XAudio2_3_x64.inf5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_3.dll5⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe D3DX9_40_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe d3dx10_40_x64.inf5⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe X3DAudio1_6_x64.inf5⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe XACT3_4_x64.inf5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_4.dll5⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe XAudio2_4_x64.inf5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_4.dll5⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe D3DX9_41_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe d3dx10_41_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe D3DX9_42_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe d3dx10_42_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe d3dx11_42_x64.inf5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe d3dcsx_42_x64.inf5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe D3DCompiler_42_x64.inf5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe XACT3_5_x64.inf5⤵
- Drops file in Windows directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_5.dll5⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe XAudio2_5_x64.inf5⤵
- Drops file in Windows directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_5.dll5⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe X3DAudio1_7_x64.inf5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe XACT3_6_x64.inf5⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_6.dll5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe XAudio2_6_x64.inf5⤵
- Drops file in Windows directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_6.dll5⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe D3DX9_43_x64.inf5⤵
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe d3dx10_43_x64.inf5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe d3dx11_43_x64.inf5⤵
- Drops file in System32 directory
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe d3dcsx_43_x64.inf5⤵
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe D3DCompiler_43_x64.inf5⤵
- Drops file in System32 directory
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe XACT3_7_x64.inf5⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_7.dll5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFBDB.tmp\infinst.exe XAudio2_7_x64.inf5⤵
- Drops file in Windows directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_7.dll5⤵
- Modifies registry class
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NoProfile -NonInteractive -Command "$sig = Get-AuthenticodeSignature -LiteralPath 'C:\Users\Admin\AppData\Local\Madium\Installer\temp\deps\directx-redist.exe'; if ($sig.Status -eq 'Valid') { exit 0 }; exit 1"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Madium\Installer\temp\deps\install.ps1"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Madium\Installer\temp\deps\directx-redist.exe"C:\Users\Admin\AppData\Local\Madium\Installer\temp\deps\directx-redist.exe" /Q /T:"C:\Users\Admin\AppData\Local\Madium\Installer\temp\deps\directx-files"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Madium\Installer\temp\deps\directx-files\DXSETUP.exe"C:\Users\Admin\AppData\Local\Madium\Installer\temp\deps\directx-files\DXSETUP.exe" /silent4⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe d3dx9_24_x64.inf5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe d3dx9_25_x64.inf5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe d3dx9_26_x64.inf5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe d3dx9_27_x64.inf5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe d3dx9_28_x64.inf5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe d3dx9_29_x64.inf5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe XACT_x64.inf5⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_0.dll5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe d3dx9_30_x64.inf5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe XACT2_1_x64.inf5⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_1.dll5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe xinput1_1_x64.inf, Install_Driver5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe XACT2_2_x64.inf5⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_2.dll5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe xinput1_2_x64.inf, Install_Driver5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe XACT2_3_x64.inf5⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_3.dll5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe d3dx9_31_x64.inf5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe XACT2_4_x64.inf5⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_4.dll5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe d3dx9_32_x64.inf5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe d3dx10_00_x64.inf5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe XACT2_5_x64.inf5⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_5.dll5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe XACT2_6_x64.inf5⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_6.dll5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe d3dx9_33_x64.inf5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe d3dx10_33_x64.inf5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe XACT2_7_x64.inf5⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_7.dll5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe xinput1_3_x64.inf, Install_Driver5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe d3dx9_34_x64.inf5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe d3dx10_34_x64.inf5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe XACT2_8_x64.inf5⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_8.dll5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe d3dx9_35_x64.inf5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe d3dx10_35_x64.inf5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe XACT2_9_x64.inf5⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_9.dll5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe d3dx9_36_x64.inf5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe d3dx10_36_x64.inf5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe X3DAudio1_2_x64.inf5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe XACT2_10_x64.inf5⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_10.dll5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe D3DX9_37_x64.inf5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe d3dx10_37_x64.inf5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe X3DAudio1_3_x64.inf5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe XACT3_0_x64.inf5⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_0.dll5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe XAudio2_0_x64.inf5⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_0.dll5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe D3DX9_38_x64.inf5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe d3dx10_38_x64.inf5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe X3DAudio1_4_x64.inf5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe XACT3_1_x64.inf5⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_1.dll5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe XAudio2_1_x64.inf5⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_1.dll5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe D3DX9_39_x64.inf5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe d3dx10_39_x64.inf5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe XACT3_2_x64.inf5⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_2.dll5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe XAudio2_2_x64.inf5⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_2.dll5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe X3DAudio1_5_x64.inf5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe XACT3_3_x64.inf5⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_3.dll5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe XAudio2_3_x64.inf5⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_3.dll5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe D3DX9_40_x64.inf5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe d3dx10_40_x64.inf5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe X3DAudio1_6_x64.inf5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe XACT3_4_x64.inf5⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_4.dll5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe XAudio2_4_x64.inf5⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_4.dll5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe D3DX9_41_x64.inf5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe d3dx10_41_x64.inf5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe D3DX9_42_x64.inf5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe d3dx10_42_x64.inf5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe d3dx11_42_x64.inf5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe d3dcsx_42_x64.inf5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe D3DCompiler_42_x64.inf5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe XACT3_5_x64.inf5⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_5.dll5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe XAudio2_5_x64.inf5⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_5.dll5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe X3DAudio1_7_x64.inf5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe XACT3_6_x64.inf5⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_6.dll5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe XAudio2_6_x64.inf5⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_6.dll5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe D3DX9_43_x64.inf5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe d3dx10_43_x64.inf5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe d3dx11_43_x64.inf5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe d3dcsx_43_x64.inf5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe D3DCompiler_43_x64.inf5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe XACT3_7_x64.inf5⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_7.dll5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXA1DA.tmp\infinst.exe XAudio2_7_x64.inf5⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_7.dll5⤵
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Madium.exe.download
Apr2005_d3dx9_25_x64.cab
Apr2005_d3dx9_25_x86.cab
Apr2006_MDX1_x86.cab
Apr2006_MDX1_x86_Archive.cab
Apr2006_XACT_x64.cab
Apr2006_XACT_x86.cab
Apr2006_d3dx9_30_x64.cab
Apr2006_d3dx9_30_x86.cab
Apr2006_xinput_x64.cab
Apr2006_xinput_x86.cab
Aug2005_d3dx9_27_x64.cab
Aug2005_d3dx9_27_x86.cab
Aug2006_XACT_x64.cab
Aug2006_XACT_x86.cab
Aug2006_xinput_x64.cab
Aug2006_xinput_x86.cab
Dec2005_d3dx9_28_x64.cab
Dec2005_d3dx9_28_x86.cab
Dec2006_d3dx9_32_x86.cab
Feb2005_d3dx9_24_x64.cab
Feb2005_d3dx9_24_x86.cab
Feb2006_XACT_x64.cab
Feb2006_XACT_x86.cab
Feb2006_d3dx9_29_x64.cab
Feb2006_d3dx9_29_x86.cab
Jun2005_d3dx9_26_x64.cab
Jun2005_d3dx9_26_x86.cab
Jun2006_XACT_x64.cab
Jun2006_XACT_x86.cab
Oct2005_xinput_x64.cab
Oct2005_xinput_x86.cab
Oct2006_XACT_x64.cab
Oct2006_XACT_x86.cab
Oct2006_d3dx9_31_x64.cab
Oct2006_d3dx9_31_x86.cab
dxdllreg_x86.cab
dxupdate.cab
DXSETUP.exe
dsetup.dll
dsetup32.dll
install.ps1
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
D3DCompiler_37.dll
D3DCompiler_38.dll
D3DCompiler_39.dll
D3DCompiler_40.dll
D3DCompiler_41.dll
D3DCompiler_42.dll
D3DCompiler_42_x86.inf
D3DCompiler_43.dll
D3DCompiler_43_x86.inf
X3DAudio1_3.dll
X3DAudio1_3_x86.inf
X3DAudio1_4.dll
X3DAudio1_4_x86.inf
X3DAudio1_5.dll
X3DAudio1_5_x86.inf
X3DAudio1_6.dll
X3DAudio1_6_x86.inf
X3DAudio1_7.dll
X3DAudio1_7_x86.inf
XACT3_0_x86.inf
XACT3_1_x86.inf
XACT3_2_x86.inf
XACT3_3_x86.inf
XACT3_4_x86.inf
XACT3_5_x86.inf
XACT3_6_x86.inf
XACT3_7_x86.inf
XAPOFX1_0.dll
XAPOFX1_1.dll
XAPOFX1_2.dll
XAPOFX1_4.dll
XAPOFX1_5.dll
XAudio2_0.dll
XAudio2_0_x86.inf
XAudio2_1.dll
XAudio2_1_x86.inf
XAudio2_2.dll
XAudio2_2_x86.inf
XAudio2_3.dll
XAudio2_3_x86.inf
XAudio2_4.dll
XAudio2_4_x86.inf
XAudio2_5.dll
XAudio2_5_x86.inf
XAudio2_6.dll
XAudio2_6_x86.inf
XAudio2_7.dll
XAudio2_7_x86.inf
d3dcompiler_33.dll
d3dcompiler_34.dll
d3dcompiler_35.dll
d3dcompiler_36.dll
d3dcsx_42.dll
d3dcsx_42_x86.inf
d3dcsx_43.dll
d3dcsx_43_x86.inf
d3dx10.dll
d3dx10_00_x86.inf
d3dx10_33.dll
d3dx10_33_x86.inf
d3dx10_34.dll
d3dx10_34_x86.inf
d3dx10_35.dll
d3dx10_35_x86.inf
d3dx10_36.dll
d3dx10_36_x86.inf
d3dx10_37.dll
d3dx10_37_x86.inf
d3dx10_38.dll
d3dx10_38_x86.inf
d3dx10_39.dll
d3dx10_39_x86.inf
d3dx10_40.dll
d3dx10_40_x86.inf
d3dx10_41.dll
d3dx10_41_x86.inf
d3dx10_42.dll
d3dx10_42_x86.inf
d3dx10_43.dll
d3dx10_43_x86.inf
d3dx11_42.dll
d3dx11_42_x86.inf
d3dx11_43.dll
d3dx11_43_x86.inf
d3dx9_24.dll
d3dx9_24_x86.inf
d3dx9_25.dll
d3dx9_25_x86.inf
d3dx9_26.dll
d3dx9_26_x86.inf
d3dx9_27.dll
d3dx9_27_x86.inf
d3dx9_28.dll
d3dx9_28_x86.inf
d3dx9_29.dll
d3dx9_29_x86.inf
d3dx9_30.dll
d3dx9_30_x86.inf
d3dx9_31.dll
d3dx9_31_x86.inf
d3dx9_32.dll
d3dx9_32_x86.inf
d3dx9_33.dll
d3dx9_33_x86.inf
d3dx9_34.dll
d3dx9_34_x86.inf
d3dx9_35.dll
d3dx9_35_x86.inf
d3dx9_36.dll
d3dx9_36_x86.inf
d3dx9_37.dll
d3dx9_37_x86.inf
d3dx9_38.dll
d3dx9_38_x86.inf
d3dx9_39.dll
d3dx9_39_x86.inf
d3dx9_40.dll
d3dx9_40_x86.inf
d3dx9_41.dll
d3dx9_41_x86.inf
d3dx9_42.dll
d3dx9_42_x86.inf
d3dx9_43.dll
d3dx9_43_x86.inf
infinst.exe
infinst.exe
infinst.exe
infinst.exe
mdx_1.0.2902.0_x86.cab
mdx_1.0.2903.0_x86.cab
mdx_1.0.2904.0_x86.cab
mdx_1.0.2905.0_x86.cab
mdx_1.0.2906.0_x86.cab
mdx_1.0.2907.0_x86.cab
mdx_1.0.2908.0_x86.cab
mdx_1.0.2909.0_x86.cab
mdx_1.0.2910.0_x86.cab
microsoft.directx.audiovideoplayback.xml
microsoft.directx.diagnostics.xml
microsoft.directx.direct3d.xml
microsoft.directx.directdraw.xml
microsoft.directx.directinput.xml
microsoft.directx.directplay.xml
microsoft.directx.directsound.xml
microsoft.directx.xml
x3daudio1_2_x86.inf
xact2_10_x86.inf
xact2_1_x86.inf
xact2_2_x86.inf
xact2_3_x86.inf
xact2_4_x86.inf
xact2_5_x86.inf
xact2_6_x86.inf
xact2_7_x86.inf
xact2_8_x86.inf
xact2_9_x86.inf
xact_x86.inf
xactengine2_0.dll
xactengine2_1.dll
xactengine2_10.dll
xactengine2_2.dll
xactengine2_3.dll
xactengine2_4.dll
xactengine2_5.dll
xactengine2_6.dll
xactengine2_7.dll
xactengine2_8.dll
xactengine2_9.dll
xactengine3_0.dll
xactengine3_1.dll
xactengine3_2.dll
xactengine3_3.dll
xactengine3_4.dll
xactengine3_5.dll
xactengine3_6.dll
xactengine3_7.dll
xinput1_1.dll
xinput1_1_x86.inf
xinput1_2.dll
xinput1_2_x86.inf
xinput1_3.dll
xinput1_3_x86.inf
AUG2009_D3DCompiler_42_x64.inf
AUG2009_D3DCompiler_42_x86.inf
AUG2009_XACT_x64.inf
AUG2009_XACT_x86.inf
AUG2009_XAudio_x64.inf
AUG2009_XAudio_x86.inf
AUG2009_d3dcsx_42_x64.inf
AUG2009_d3dcsx_42_x86.inf
AUG2009_d3dx10_42_x64.inf
AUG2009_d3dx10_42_x86.inf
AUG2009_d3dx11_42_x64.inf
AUG2009_d3dx11_42_x86.inf
AUG2009_d3dx9_42_x64.inf
AUG2009_d3dx9_42_x86.inf
Aug2008_XACT_x64.inf
Aug2008_XACT_x86.inf
Aug2008_XAudio_x64.inf
Aug2008_XAudio_x86.inf
Aug2008_d3dx10_39_x64.inf
Aug2008_d3dx10_39_x86.inf
Aug2008_d3dx9_39_x64.inf
Aug2008_d3dx9_39_x86.inf
D3DCompiler_37.dll
D3DCompiler_38.dll
D3DCompiler_39.dll
D3DCompiler_40.dll
D3DCompiler_41.dll
D3DCompiler_42.dll
D3DCompiler_43.dll
FEB2010_X3DAudio_x64.inf
FEB2010_X3DAudio_x86.inf
FEB2010_XACT_x64.inf
FEB2010_XACT_x86.inf
FEB2010_XAudio_x64.inf
FEB2010_XAudio_x86.inf
JUN2010_D3DCompiler_43_x64.inf
JUN2010_D3DCompiler_43_x86.inf
JUN2010_XACT_x64.inf
JUN2010_XACT_x86.inf
JUN2010_XAudio_x64.inf
JUN2010_XAudio_x86.inf
JUN2010_d3dcsx_43_x64.inf
JUN2010_d3dcsx_43_x86.inf
JUN2010_d3dx10_43_x64.inf
JUN2010_d3dx10_43_x86.inf
JUN2010_d3dx11_43_x64.inf
JUN2010_d3dx11_43_x86.inf
JUN2010_d3dx9_43_x64.inf
JUN2010_d3dx9_43_x86.inf
Jun2008_X3DAudio_x64.inf
Jun2008_X3DAudio_x86.inf
Jun2008_XACT_x64.inf
Jun2008_XACT_x86.inf
Jun2008_XAudio_x64.inf
Jun2008_XAudio_x86.inf
Jun2008_d3dx10_38_x64.inf
Jun2008_d3dx10_38_x86.inf
Jun2008_d3dx9_38_x64.inf
Jun2008_d3dx9_38_x86.inf
Mar2008_X3DAudio_x64.inf
Mar2008_X3DAudio_x86.inf
Mar2008_XACT_x64.inf
Mar2008_XACT_x86.inf
Mar2008_XAudio_x64.inf
Mar2008_XAudio_x86.inf
Mar2008_d3dx10_37_x64.inf
Mar2008_d3dx10_37_x86.inf
Mar2008_d3dx9_37_x64.inf
Mar2008_d3dx9_37_x86.inf
Mar2009_X3DAudio_x64.inf
Mar2009_X3DAudio_x86.inf
Mar2009_XACT_x64.inf
Mar2009_XACT_x86.inf
Mar2009_XAudio_x64.inf
Mar2009_XAudio_x86.inf
Mar2009_d3dx10_41_x64.inf
Mar2009_d3dx10_41_x86.inf
Mar2009_d3dx9_41_x64.inf
Mar2009_d3dx9_41_x86.inf
Nov2008_X3DAudio_x64.inf
Nov2008_X3DAudio_x86.inf
Nov2008_XACT_x64.inf
Nov2008_XACT_x86.inf
Nov2008_XAudio_x64.inf
Nov2008_XAudio_x86.inf
Nov2008_d3dx10_40_x64.inf
Nov2008_d3dx10_40_x86.inf
Nov2008_d3dx9_40_x64.inf
Nov2008_d3dx9_40_x86.inf
X3DAudio1_3.dll
X3DAudio1_4.dll
X3DAudio1_5.dll
X3DAudio1_6.dll
X3DAudio1_7.dll
XAPOFX1_0.dll
XAPOFX1_1.dll
XAPOFX1_2.dll
XAPOFX1_3.dll
XAPOFX1_3.dll
XAPOFX1_4.dll
XAPOFX1_5.dll
XAudio2_0.dll
XAudio2_1.dll
XAudio2_2.dll
XAudio2_3.dll
XAudio2_4.dll
XAudio2_5.dll
XAudio2_6.dll
XAudio2_7.dll
apr2005_d3dx9_25_x64.inf
apr2005_d3dx9_25_x86.inf
apr2006_d3dx9_30_x64.inf
apr2006_d3dx9_30_x86.inf
apr2006_mdx1_x86.inf
apr2006_mdx1_x86_archive.inf
apr2006_xact_x64.inf
apr2006_xact_x86.inf
apr2006_xinput_x64.inf
apr2006_xinput_x86.inf
apr2007_d3dx10_33_x64.inf
apr2007_d3dx10_33_x86.inf
apr2007_d3dx9_33_x64.inf
apr2007_d3dx9_33_x86.inf
apr2007_xact_x64.inf
apr2007_xact_x86.inf
apr2007_xinput_x64.inf
apr2007_xinput_x86.inf
aug2005_d3dx9_27_x64.inf
aug2005_d3dx9_27_x86.inf
aug2006_xact_x64.inf
aug2006_xact_x86.inf
aug2006_xinput_x64.inf
aug2006_xinput_x86.inf
aug2007_d3dx10_35_x64.inf
aug2007_d3dx10_35_x86.inf
aug2007_d3dx9_35_x64.inf
aug2007_d3dx9_35_x86.inf
aug2007_xact_x64.inf
aug2007_xact_x86.inf
d3dcompiler_33.dll
d3dcompiler_34.dll
d3dcompiler_35.dll
d3dcompiler_36.dll
d3dcsx_42.dll
d3dcsx_43.dll
d3dx10.dll
d3dx10_33.dll
d3dx10_34.dll
d3dx10_35.dll
d3dx10_36.dll
d3dx10_37.dll
d3dx10_38.dll
d3dx10_39.dll
d3dx10_40.dll
d3dx10_41.dll
d3dx10_42.dll
d3dx10_43.dll
d3dx11_42.dll
d3dx11_43.dll
d3dx9_24.dll
d3dx9_25.dll
d3dx9_26.dll
d3dx9_27.dll
d3dx9_28.dll
d3dx9_29.dll
d3dx9_30.dll
d3dx9_31.dll
d3dx9_32.dll
d3dx9_33.dll
d3dx9_34.dll
d3dx9_35.dll
d3dx9_36.dll
d3dx9_37.dll
d3dx9_38.dll
d3dx9_39.dll
d3dx9_40.dll
d3dx9_41.dll
d3dx9_42.dll
d3dx9_43.dll
dec2005_d3dx9_28_x64.inf
dec2005_d3dx9_28_x86.inf
dec2006_d3dx10_00_x64.inf
dec2006_d3dx10_00_x86.inf
dec2006_d3dx9_32_x64.inf
dec2006_d3dx9_32_x86.inf
dec2006_xact_x64.inf
dec2006_xact_x86.inf
dxdllreg_x86.inf
dxupdate.dll
dxupdate.inf
feb2006_d3dx9_29_x64.inf
feb2006_d3dx9_29_x86.inf
feb2006_xact_x64.inf
feb2006_xact_x86.inf
feb2007_xact_x64.inf
feb2007_xact_x86.inf
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
jun2005_d3dx9_26_x64.inf
jun2005_d3dx9_26_x86.inf
jun2006_xact_x64.inf
jun2006_xact_x86.inf
jun2007_d3dx10_34_x64.inf
jun2007_d3dx10_34_x86.inf
jun2007_d3dx9_34_x64.inf
jun2007_d3dx9_34_x86.inf
jun2007_xact_x64.inf
jun2007_xact_x86.inf
mdx_1.0.2904.0_x86.inf
microsoft.directx.direct3dx.dll
microsoft.directx.direct3dx.xml
microsoft.directx.direct3dx.xml
nov2007_d3dx10_36_x64.inf
nov2007_d3dx10_36_x86.inf
nov2007_d3dx9_36_x64.inf
nov2007_d3dx9_36_x86.inf
nov2007_x3daudio_x64.inf
nov2007_x3daudio_x86.inf
nov2007_xact_x64.inf
nov2007_xact_x86.inf
oct2005_xinput_x64.inf
oct2005_xinput_x86.inf
oct2006_d3dx9_31_x64.inf
oct2006_d3dx9_31_x86.inf
oct2006_xact_x64.inf
oct2006_xact_x86.inf
x3daudio1_0.dll
x3daudio1_0.dll
x3daudio1_1.dll
x3daudio1_1.dll
x3daudio1_2.dll
x3daudio1_2.dll
x3daudio1_2.dll
xactengine2_0.dll
xactengine2_1.dll
xactengine2_10.dll
xactengine2_2.dll
xactengine2_3.dll
xactengine2_4.dll
xactengine2_5.dll
xactengine2_6.dll
xactengine2_7.dll
xactengine2_8.dll
xactengine2_9.dll
xactengine3_0.dll
xactengine3_1.dll
xactengine3_2.dll
xactengine3_3.dll
xactengine3_4.dll
xactengine3_5.dll
xactengine3_6.dll
xactengine3_7.dll
xinput1_1.dll
xinput1_2.dll
xinput1_3.dll
MadiumInstaller.exe
app.so
AssetManifest.bin
FontManifest.json
NOTICES.Z
NativeAssetsManifest.json
MaterialIcons-Regular.otf
ink_sparkle.frag
stretch_effect.frag
icudtl.dat
flutter_windows.dll
__PSScriptPolicyTest_bo14dang.yly.ps1
DirectX.log
DirectX.log
DirectX.log
DirectX.log
SET3FE9.tmp
XAPOFX1_3.dll
x3daudio1_2.dll
OLD3C6E.tmp
OLD5F96.tmp
Microsoft.DirectX.AudioVideoPlayback.dll
__AssemblyInfo__.ini
__AssemblyInfo__.ini
Microsoft.DirectX.Diagnostics.dll
__AssemblyInfo__.ini
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
__AssemblyInfo__.ini
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3D.dll
__AssemblyInfo__.ini
__AssemblyInfo__.ini
Microsoft.DirectX.DirectDraw.dll
__AssemblyInfo__.ini
__AssemblyInfo__.ini
Microsoft.DirectX.DirectInput.dll
__AssemblyInfo__.ini
__AssemblyInfo__.ini
Microsoft.DirectX.DirectPlay.dll
__AssemblyInfo__.ini
__AssemblyInfo__.ini
Microsoft.DirectX.DirectSound.dll
__AssemblyInfo__.ini
__AssemblyInfo__.ini
Microsoft.DirectX.dll
__AssemblyInfo__.ini
__AssemblyInfo__.ini
memory/1980-4681-0x00000000021C0000-0x000000000221E000-memory.dmp
memory/2264-10383-0x0000024947750000-0x0000024947912000-memory.dmp
memory/2264-10384-0x0000024947E50000-0x0000024948378000-memory.dmp
memory/3232-88-0x000002475DD60000-0x000002475DD82000-memory.dmp
memory/3952-15032-0x0000000002100000-0x000000000215E000-memory.dmp
memory/4420-28-0x0000024764300000-0x0000024764380000-memory.dmp
memory/4420-29-0x0000024764300000-0x0000024764380000-memory.dmp
memory/4420-24-0x0000024763C50000-0x00000247641A9000-memory.dmp
memory/4420-25-0x00000247641B0000-0x00000247641B1000-memory.dmp
memory/4420-22-0x0000024763C50000-0x00000247641A9000-memory.dmp
memory/4420-23-0x0000024763C50000-0x00000247641A9000-memory.dmp
memory/4420-21-0x0000024763C40000-0x0000024763C41000-memory.dmp
memory/5496-6136-0x0000000002020000-0x0000000002089000-memory.dmp
memory/7140-15371-0x00000000022C0000-0x0000000002324000-memory.dmp
memory/7364-15947-0x0000000001F00000-0x0000000001F69000-memory.dmp
memory/8276-15637-0x0000000001F40000-0x0000000001FA6000-memory.dmp