Overview
overview
8Static
static
3Project.P.I.T.T.zip
windows10-2004-x64
1Project.P.I.T.T.zip
windows11-ltsc_2024-x64
8Project.P....PC.url
windows10-2004-x64
1Project.P....PC.url
windows11-ltsc_2024-x64
1Project.P....up.exe
windows10-2004-x64
7Project.P....up.exe
windows11-ltsc_2024-x64
7Project.P....up.exe
windows10-2004-x64
7Project.P....up.exe
windows11-ltsc_2024-x64
8Project.P....st.exe
windows10-2004-x64
6Project.P....st.exe
windows11-ltsc_2024-x64
6Project.P....64.exe
windows10-2004-x64
4Project.P....64.exe
windows11-ltsc_2024-x64
6Project.P....86.exe
windows10-2004-x64
4Project.P....86.exe
windows11-ltsc_2024-x64
6Project.P....64.exe
windows10-2004-x64
7Project.P....64.exe
windows11-ltsc_2024-x64
7Project.P....86.exe
windows10-2004-x64
7Project.P....86.exe
windows11-ltsc_2024-x64
7Project.P....st.msi
windows10-2004-x64
7Project.P....st.msi
windows11-ltsc_2024-x64
8Project.P....64.dll
windows10-2004-x64
1Project.P....64.dll
windows11-ltsc_2024-x64
1Project.P....tt.exe
windows10-2004-x64
1Project.P....tt.exe
windows11-ltsc_2024-x64
1Project.P....64.dll
windows10-2004-x64
1Project.P....64.dll
windows11-ltsc_2024-x64
1Project.P....64.dll
windows10-2004-x64
1Project.P....64.dll
windows11-ltsc_2024-x64
1Analysis
- max time kernel
899s - max time network
554s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
21/08/2026, 22:37
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
Project.P.I.T.T.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral2
Sample
Project.P.I.T.T.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
900 seconds
Behavioral task
behavioral3
Sample
Project.P.I.T.T/STEAMUNLOCKED » Free Steam Games Pre-installed for PC.url
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral4
Sample
Project.P.I.T.T/STEAMUNLOCKED » Free Steam Games Pre-installed for PC.url
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral5
Sample
Project.P.I.T.T/_Redist/dotNetFx40_Full_setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
900 seconds
Behavioral task
behavioral6
Sample
Project.P.I.T.T/_Redist/dotNetFx40_Full_setup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
900 seconds
Behavioral task
behavioral7
Sample
Project.P.I.T.T/_Redist/dxwebsetup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
900 seconds
Behavioral task
behavioral8
Sample
Project.P.I.T.T/_Redist/dxwebsetup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
20 signatures
900 seconds
Behavioral task
behavioral9
Sample
Project.P.I.T.T/_Redist/oalinst.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
900 seconds
Behavioral task
behavioral10
Sample
Project.P.I.T.T/_Redist/oalinst.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
900 seconds
Behavioral task
behavioral11
Sample
Project.P.I.T.T/_Redist/vcredist_2015-2019_x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
900 seconds
Behavioral task
behavioral12
Sample
Project.P.I.T.T/_Redist/vcredist_2015-2019_x64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
18 signatures
900 seconds
Behavioral task
behavioral13
Sample
Project.P.I.T.T/_Redist/vcredist_2015-2019_x86.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
900 seconds
Behavioral task
behavioral14
Sample
Project.P.I.T.T/_Redist/vcredist_2015-2019_x86.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
18 signatures
900 seconds
Behavioral task
behavioral15
Sample
Project.P.I.T.T/_Redist/vcredist_x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
900 seconds
Behavioral task
behavioral16
Sample
Project.P.I.T.T/_Redist/vcredist_x64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
900 seconds
Behavioral task
behavioral17
Sample
Project.P.I.T.T/_Redist/vcredist_x86.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
900 seconds
Behavioral task
behavioral18
Sample
Project.P.I.T.T/_Redist/vcredist_x86.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
6 signatures
900 seconds
Behavioral task
behavioral19
Sample
Project.P.I.T.T/_Redist/xnafx40_redist.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
18 signatures
900 seconds
Behavioral task
behavioral20
Sample
Project.P.I.T.T/_Redist/xnafx40_redist.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
23 signatures
900 seconds
Behavioral task
behavioral21
Sample
Project.P.I.T.T/game/libgodotsteam.windows.template_release.x86_64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral22
Sample
Project.P.I.T.T/game/libgodotsteam.windows.template_release.x86_64.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral23
Sample
Project.P.I.T.T/game/projectpitt.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral24
Sample
Project.P.I.T.T/game/projectpitt.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
3 signatures
900 seconds
Behavioral task
behavioral25
Sample
Project.P.I.T.T/game/steam_api64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral26
Sample
Project.P.I.T.T/game/steam_api64.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral27
Sample
Project.P.I.T.T/game/steam_api64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral28
Sample
Project.P.I.T.T/game/steam_api64.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
General
- Target Project.P.I.T.T/_Redist/xnafx40_redist.msi
- Size 6.7MB
- Sample260821-2jsxjadf53
- SHA256 e6c41d692ebcba854dad4b1c52bb7ddd05926bad3105595d6596b8bab01c25e7
- MD5 97c2eebb30c5a88c68c8f24f37183f1d
- SHA1 49efdc29f65fc8263c196338552c7009fc96c5de
- SHA512 c9d1017b274ceb1b4ee624cf7e628787c32a727c64f715fbce1f1ae929d9114f8fe1291e34583cec615619b0128c01206b07efc878e7a5c57b792453f73fd0da
- SSDEEP 98304:wynfL329J1XswfXO6wiBB+4RZg6aENaCZAU5PMO0MntfERyJGH2YPq/:wYD3C1XXfzH+4cLHU5PM/Mnt+YGlq
- TLSH T1906622A2751AFF41DDF406BCE970CA490925CF3782270C686929356A7BF7E1202E9D4F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Executes dropped EXE 1 IoCs
pid Process 4772 DXSETUP.exe - Loads dropped DLL 7 IoCs
pid Process 4772 DXSETUP.exe 4772 DXSETUP.exe 4772 DXSETUP.exe 4772 DXSETUP.exe 4772 DXSETUP.exe 4772 DXSETUP.exe 5876 MsiExec.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\X: msiexec.exe - Drops file in System32 directory 21 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\XAPOFX1_4.dll DXSETUP.exe File opened for modification C:\Windows\SysWOW64\SETDB91.tmp DXSETUP.exe File created C:\Windows\SysWOW64\SETDBF0.tmp DXSETUP.exe File opened for modification C:\Windows\SysWOW64\xinput1_3.dll DXSETUP.exe File created C:\Windows\SysWOW64\SETDD3A.tmp DXSETUP.exe File opened for modification C:\Windows\SysWOW64\SETDD79.tmp DXSETUP.exe File created C:\Windows\SysWOW64\SETDE84.tmp DXSETUP.exe File opened for modification C:\Windows\SysWOW64\XAudio2_6.dll DXSETUP.exe File created C:\Windows\SysWOW64\SETDB91.tmp DXSETUP.exe File opened for modification C:\Windows\SysWOW64\d3dx9_33.dll DXSETUP.exe File opened for modification C:\Windows\SysWOW64\SETDBF0.tmp DXSETUP.exe File opened for modification C:\Windows\SysWOW64\D3DX9_41.dll DXSETUP.exe File opened for modification C:\Windows\SysWOW64\X3DAudio1_7.dll DXSETUP.exe File created C:\Windows\SysWOW64\SETDD79.tmp DXSETUP.exe File opened for modification C:\Windows\SysWOW64\xactengine3_6.dll DXSETUP.exe File opened for modification C:\Windows\SysWOW64\SETDE84.tmp DXSETUP.exe File created C:\Windows\SysWOW64\SETDCFA.tmp DXSETUP.exe File opened for modification C:\Windows\SysWOW64\SETDCFA.tmp DXSETUP.exe File opened for modification C:\Windows\SysWOW64\SETDD3A.tmp DXSETUP.exe File opened for modification C:\Windows\SysWOW64\SETDE85.tmp DXSETUP.exe File created C:\Windows\SysWOW64\SETDE85.tmp DXSETUP.exe - Drops file in Program Files directory 14 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\APR2007_d3dx9_33_x86.cab msiexec.exe File created C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\dsetup32.dll msiexec.exe File created C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\DSETUP.dll msiexec.exe File created C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\Feb2010_xact_x86.cab msiexec.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\XNA\Framework\v4.0\EULA.en-US.txt msiexec.exe File created C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\Mar2009_d3dx9_41_x86.cab msiexec.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\XNA\Framework\v4.0\XnaNative.dll msiexec.exe File created C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\DXSETUP.exe msiexec.exe File created C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\dxupdate.cab msiexec.exe File created C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\Feb2010_X3DAudio_x86.cab msiexec.exe File created C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\Feb2010_XAudio_x86.cab msiexec.exe File created C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\APR2007_xinput_x86.cab msiexec.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\XNA\Framework\Shared\xnavisualizer.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\XNA\Framework\Shared\XnaVisualizerPS.dll msiexec.exe - Drops file in Windows directory 33 IoCs
description ioc Process File created C:\Windows\assembly\GACLock.dat msiexec.exe File created C:\Windows\SystemTemp\~DFFD81D32D1407B385.TMP msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DFFDC4164557DCC4D7.TMP msiexec.exe File created C:\Windows\Installer\e59c944.msi msiexec.exe File opened for modification C:\Windows\Installer\{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}\ProductIcon msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\0AA7CFB2C445A3E47869763FEB56B59E\4.0.20823\F_CENTRAL_msvcp100_x86.DF495DFD_79F6_34DF_BB1E_E58DB5BDCF2C msiexec.exe File opened for modification C:\Windows\Installer\e59c942.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9} msiexec.exe File created C:\Windows\SystemTemp\~DF6819811D09C5A778.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSICF3D.tmp msiexec.exe File created C:\Windows\assembly\tmp\MD54T8IW\Microsoft.Xna.Framework.Net.dll msiexec.exe File created C:\Windows\assembly\tmp\HRLHIS3X\Microsoft.Xna.Framework.Xact.dll msiexec.exe File created C:\Windows\assembly\tmp\ZH6N6BRE\Microsoft.Xna.Framework.Avatar.dll msiexec.exe File created C:\Windows\assembly\tmp\96EDM1NK\Microsoft.Xna.Framework.Graphics.dll msiexec.exe File created C:\Windows\assembly\tmp\SN7QVS3J\Microsoft.Xna.Framework.Video.dll msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\0AA7CFB2C445A3E47869763FEB56B59E\4.0.20823 msiexec.exe File opened for modification C:\Windows\Logs\DirectX.log DXSETUP.exe File created C:\Windows\assembly\tmp\HTPKQN0T\Microsoft.Xna.Framework.Game.dll msiexec.exe File created C:\Windows\assembly\tmp\CN0EHB1X\Microsoft.Xna.Framework.GamerServices.dll msiexec.exe File created C:\Windows\assembly\tmp\ETXBFWNP\Microsoft.Xna.Framework.Input.Touch.dll msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\0AA7CFB2C445A3E47869763FEB56B59E\4.0.20823\F_CENTRAL_msvcp100_x86.DF495DFD_79F6_34DF_BB1E_E58DB5BDCF2C msiexec.exe File opened for modification C:\Windows\Installer\MSIE1CC.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF2ED9ECBF683DFB86.TMP msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\0AA7CFB2C445A3E47869763FEB56B59E\4.0.20823\F_CENTRAL_msvcr100_x86.DF495DFD_79F6_34DF_BB1E_E58DB5BDCF2C msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\0AA7CFB2C445A3E47869763FEB56B59E\4.0.20823\F_CENTRAL_msvcr100_x86.DF495DFD_79F6_34DF_BB1E_E58DB5BDCF2C msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\0AA7CFB2C445A3E47869763FEB56B59E msiexec.exe File created C:\Windows\Installer\{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}\ProductIcon msiexec.exe File created C:\Windows\Installer\e59c942.msi msiexec.exe File created C:\Windows\assembly\tmp\4N07HZTD\Microsoft.Xna.Framework.dll msiexec.exe File created C:\Windows\assembly\tmp\3TXJD4GV\Microsoft.Xna.Framework.Storage.dll msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4280 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DXSETUP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ffbf1fc65d8bbf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ffbf1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ffbf1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ffbf1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ffbf1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies data under HKEY_USERS 53 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DXSETUP.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" DXSETUP.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" DXSETUP.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DXSETUP.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" DXSETUP.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" DXSETUP.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\urlmon.dll,-4200 = "Open File - Security Warning" DXSETUP.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DXSETUP.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "2" DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DXSETUP.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DXSETUP.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0AA7CFB2C445A3E47869763FEB56B59E\XNAFrameworkRedist msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248d8a3b-6256-44d3-a018-2ac96c459f47} DXSETUP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cecec95a-d894-491a-bee3-5e106fb59f2d}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_6.dll" DXSETUP.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\MuiCache SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.Xna.Framework.Input.Touch,fileVersion="4.0.20823.0",version="4.0.0.00000",culture="neutral",publicKeyToken="842CF8BE1DE50553",processorArchitecture="MSIL" = 6c00660060002e003200510046002b00300041004c0048005600370077003800680027002100740058004e0041004600720061006d00650077006f0072006b005200650064006900730074003e0050006a006300540058005b0053007b00610039003700380070002d005d0061006c0065004900260000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\Version = "67129687" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\DirectShow\MediaObjects\a8122ff4-9e52-4374-b3d9-b4063e77109d\InputTypes = 6175647300001000800000aa00389b710100000000001000800000aa00389b71 MsiExec.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.Xna.Framework.Game,fileVersion="4.0.20823.0",version="4.0.0.00000",culture="neutral",publicKeyToken="842CF8BE1DE50553",processorArchitecture="x86" = 6c00660060002e003200510046002b00300041004c0048005600370077003800680027002100740058004e0041004600720061006d00650077006f0072006b005200650064006900730074003e0048006100380066004c0049004f0071007b003f00380032003100310034002e002400740052006c0000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.Xna.Framework.Net,fileVersion="4.0.20823.0",version="4.0.0.00000",culture="neutral",publicKeyToken="842CF8BE1DE50553",processorArchitecture="MSIL" = 6c00660060002e003200510046002b00300041004c0048005600370077003800680027002100740058004e0041004600720061006d00650077006f0072006b005200650064006900730074003e00440072005900520072006c002d004a003d0041006b00390052007a005500210029006f005e00380000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\500BB8FAD5F3D2A4D9EFC01E0702D939 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\SourceList\PackageName = "xnafx40_redist.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3eda9b49-2085-498b-9bb2-39a6778493de}\InProcServer32\ThreadingModel = "Both" DXSETUP.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.Xna.Framework,fileVersion="4.0.20823.0",version="4.0.0.00000",culture="neutral",publicKeyToken="842CF8BE1DE50553",processorArchitecture="x86" = 6c00660060002e003200510046002b00300041004c0048005600370077003800680027002100740058004e0041004600720061006d00650077006f0072006b005200650064006900730074003e0065006a0036002d0051005b002d0065003900400060004a003d006e0079005e005b005d002a00710000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\Language = "1033" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8122FF4-9E52-4374-B3D9-B4063E77109D}\InprocServer32\ = "C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\XNA\\Framework\\Shared\\xnavisualizer.dll" MsiExec.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{4DCAC728-5BB6-4434-BC3F-2AFC21DAD15C} explorer.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248d8a3b-6256-44d3-a018-2ac96c459f47}\InProcServer32\ThreadingModel = "Both" DXSETUP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\ProductName = "Microsoft XNA Framework Redistributable 4.0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\DirectShow\MediaObjects\a8122ff4-9e52-4374-b3d9-b4063e77109d\ = "XnaVisualizerDmo" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8122FF4-9E52-4374-B3D9-B4063E77109D}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8122FF4-9E52-4374-B3D9-B4063E77109D}\InprocServer32\ThreadingModel = "Both" MsiExec.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\500BB8FAD5F3D2A4D9EFC01E0702D939\0AA7CFB2C445A3E47869763FEB56B59E msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248d8a3b-6256-44d3-a018-2ac96c459f47}\InProcServer32\ = "C:\\Windows\\SysWow64\\xactengine3_6.dll" DXSETUP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e48c5a3f-93ef-43bb-a092-2c7ceb946f27}\ = "AudioVolumeMeter" DXSETUP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e48c5a3f-93ef-43bb-a092-2c7ceb946f27}\InProcServer32 DXSETUP.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\DirectShow\MediaObjects\a8122ff4-9e52-4374-b3d9-b4063e77109d\OutputTypes = 6175647300001000800000aa00389b710100000000001000800000aa00389b71 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8122FF4-9E52-4374-B3D9-B4063E77109D} MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3eda9b49-2085-498b-9bb2-39a6778493de} DXSETUP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3eda9b49-2085-498b-9bb2-39a6778493de}\InProcServer32 DXSETUP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e48c5a3f-93ef-43bb-a092-2c7ceb946f27}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_6.dll" DXSETUP.exe Set value (data) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\ProductIcon = "C:\\Windows\\Installer\\{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}\\ProductIcon" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cecec95a-d894-491a-bee3-5e106fb59f2d} DXSETUP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 692 msiexec.exe 692 msiexec.exe 4592 explorer.exe 4592 explorer.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4280 msiexec.exe Token: SeIncreaseQuotaPrivilege 4280 msiexec.exe Token: SeSecurityPrivilege 692 msiexec.exe Token: SeCreateTokenPrivilege 4280 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4280 msiexec.exe Token: SeLockMemoryPrivilege 4280 msiexec.exe Token: SeIncreaseQuotaPrivilege 4280 msiexec.exe Token: SeMachineAccountPrivilege 4280 msiexec.exe Token: SeTcbPrivilege 4280 msiexec.exe Token: SeSecurityPrivilege 4280 msiexec.exe Token: SeTakeOwnershipPrivilege 4280 msiexec.exe Token: SeLoadDriverPrivilege 4280 msiexec.exe Token: SeSystemProfilePrivilege 4280 msiexec.exe Token: SeSystemtimePrivilege 4280 msiexec.exe Token: SeProfSingleProcessPrivilege 4280 msiexec.exe Token: SeIncBasePriorityPrivilege 4280 msiexec.exe Token: SeCreatePagefilePrivilege 4280 msiexec.exe Token: SeCreatePermanentPrivilege 4280 msiexec.exe Token: SeBackupPrivilege 4280 msiexec.exe Token: SeRestorePrivilege 4280 msiexec.exe Token: SeShutdownPrivilege 4280 msiexec.exe Token: SeDebugPrivilege 4280 msiexec.exe Token: SeAuditPrivilege 4280 msiexec.exe Token: SeSystemEnvironmentPrivilege 4280 msiexec.exe Token: SeChangeNotifyPrivilege 4280 msiexec.exe Token: SeRemoteShutdownPrivilege 4280 msiexec.exe Token: SeUndockPrivilege 4280 msiexec.exe Token: SeSyncAgentPrivilege 4280 msiexec.exe Token: SeEnableDelegationPrivilege 4280 msiexec.exe Token: SeManageVolumePrivilege 4280 msiexec.exe Token: SeImpersonatePrivilege 4280 msiexec.exe Token: SeCreateGlobalPrivilege 4280 msiexec.exe Token: SeBackupPrivilege 2856 vssvc.exe Token: SeRestorePrivilege 2856 vssvc.exe Token: SeAuditPrivilege 2856 vssvc.exe Token: SeBackupPrivilege 692 msiexec.exe Token: SeRestorePrivilege 692 msiexec.exe Token: SeRestorePrivilege 692 msiexec.exe Token: SeTakeOwnershipPrivilege 692 msiexec.exe Token: SeRestorePrivilege 692 msiexec.exe Token: SeTakeOwnershipPrivilege 692 msiexec.exe Token: SeRestorePrivilege 692 msiexec.exe Token: SeTakeOwnershipPrivilege 692 msiexec.exe Token: SeRestorePrivilege 692 msiexec.exe Token: SeTakeOwnershipPrivilege 692 msiexec.exe Token: SeRestorePrivilege 692 msiexec.exe Token: SeTakeOwnershipPrivilege 692 msiexec.exe Token: SeRestorePrivilege 692 msiexec.exe Token: SeTakeOwnershipPrivilege 692 msiexec.exe Token: SeRestorePrivilege 692 msiexec.exe Token: SeTakeOwnershipPrivilege 692 msiexec.exe Token: SeRestorePrivilege 692 msiexec.exe Token: SeTakeOwnershipPrivilege 692 msiexec.exe Token: SeRestorePrivilege 692 msiexec.exe Token: SeTakeOwnershipPrivilege 692 msiexec.exe Token: SeRestorePrivilege 692 msiexec.exe Token: SeTakeOwnershipPrivilege 692 msiexec.exe Token: SeRestorePrivilege 692 msiexec.exe Token: SeTakeOwnershipPrivilege 692 msiexec.exe Token: SeRestorePrivilege 692 msiexec.exe Token: SeTakeOwnershipPrivilege 692 msiexec.exe Token: SeRestorePrivilege 692 msiexec.exe Token: SeTakeOwnershipPrivilege 692 msiexec.exe Token: SeRestorePrivilege 692 msiexec.exe - Suspicious use of FindShellTrayWindow 53 IoCs
pid Process 4280 msiexec.exe 4280 msiexec.exe 2264 sihost.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe - Suspicious use of SendNotifyMessage 39 IoCs
pid Process 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe 4592 explorer.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4280 msiexec.exe 692 msiexec.exe 5876 MsiExec.exe 1656 StartMenuExperienceHost.exe 4592 explorer.exe 4052 SearchHost.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 692 wrote to memory of 4672 692 msiexec.exe 95 PID 692 wrote to memory of 4772 692 msiexec.exe 97 PID 692 wrote to memory of 5876 692 msiexec.exe 99 PID 2264 wrote to memory of 4592 2264 sihost.exe 107 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Project.P.I.T.T\_Redist\xnafx40_redist.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4280
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4672
-
-
C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\DXSETUP.exe"C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\DXSETUP.exe" /silent2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
PID:4772
-
-
C:\Windows\syswow64\MsiExec.exe"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Microsoft Shared\XNA\Framework\Shared\xnavisualizer.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5876
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2856
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4100
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4592
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1656
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4052
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵PID:5384
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Installer Packages
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59c943.rbs
- Size 17KB
- SHA256 8025b24d7c59c7f6d0676b39a3f525ba23e396dcf913ac83915062c8621f3f76
- MD5 4aa9d9cf65d0a16ad626618cea861d69
- SHA1 490e4037ed0ed78ccc9cd615e0544de53df715a8
- SHA512 328223b588e8ab18469057ca488a82c0f0cf2513bf00e2b6b35ecfc702c3ab5f206193622645f9324ed112835a196c9faceab9e950a678b35c267d152f5c61c9
- SSDEEP 192:TjfsF4rDVZ3akIqCtekJGhAQ7wwsI2Q7wws3B7/an2ayzRURpp:TjfsSm3qCnQ7wweQ7wwm98UzSt
- TLSH T12A8284106A05D2E2D9922F70DF133F2537A2A7C5AB9013AB00CE94648F577C90ED47DA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e59c945.rbs
- Size 596B
- SHA256 7a502c5be5799d4c0651257f63d42972367decd55d22b2ba2d949f417b219e36
- MD5 1ecfe2fad3e4bdc6792e287d3ebb97b7
- SHA1 a02e65261bd758a64dc39fde6f74bbf907b6a806
- SHA512 19a66a7ca13f7cd0a4d3a610b1013f4d1ed066ac45b948620699b38a8f29c12118e4a98e55bd70dec31d76823bd2cd49a1d5ee563102daf8e983765c4ca7dc9c
- TLSH T1E5F0E143F78960D7C186A7F5B701AF012A9B9138621085B5480C81DE3CAB5568FF45D0
- MD5 SHA1 SHA512 TLSH
- Path C:\PROGRA~2\MICROS~2\XNAGAM~1\v4.0\Redist\DXREDI~1\Apr2007_d3dx9_33_x86.cab
- Size 1.5MB
- SHA256 219441f975c200352a12dc3d8f82811fc7b53ed28d63761327933afbb660f876
- MD5 3676d740157493e80e7b8641289c003c
- SHA1 8135aeeab67151dd4e2418d4907077f646e72873
- SHA512 abfc5ea36a7368a34193c8f3771ae4e36c0d570ae0a20b11892184cd4e384d6abe6542769e3c890293b4e640faecf6392f84f5733017d8d86c65456caa24c6f7
- SSDEEP 24576:WcQY0tIpwa5ydxGuruluTsRWo1Iq9e5m98yiN9/0rjVH60mPxr/1MDT:WcIIi+G9rul8uooec98yi//0rjoDZrCn
- TLSH T1BE753303AE856B85B1072DD15259E315A2FEBC4B37178B01FB6E6DC81547BA032F1B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~2\MICROS~2\XNAGAM~1\v4.0\Redist\DXREDI~1\Apr2007_xinput_x86.cab
- Size 55KB
- SHA256 5ab7bb15394e4ece850da5453413ab1de2ea97d5c93f86482b75073aaa05da9c
- MD5 f83f54f45ac15a32dc17614c4f6882d4
- SHA1 fc8542fcd33bb9e669806409f677edec9bfb64fb
- SHA512 e4dcccc3a4299d262b94b24ff4b29394bed71e211b80a8a457acc4ab89325500082e6a9b597bc7b1dbc35746d01a9aa038a9c3a401aa42a426fcc3d15f410c9a
- SSDEEP 1536:/cnwcwzHEdb27WH2SfZDNu75ddnVR+ZFaNk0ZRu1FaeK:Cwb+2eZonQwju1Ef
- TLSH T17E43D0C6880CD84EBEC52EA1367DFA51BC3CD3C384B66917456BF896088B3D1A704B2D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~2\MICROS~2\XNAGAM~1\v4.0\Redist\DXREDI~1\Feb2010_X3DAudio_x86.cab
- Size 20KB
- SHA256 7fbf09682fd15d721ff2c5cb110b5ffcf5982cd2dd8d72b708cf3cd0bc4fa250
- MD5 ed093ce20bddc7c42ede4daf772ed5aa
- SHA1 21beb0ef8130be1c62b8467dfb67bf3f7548cea1
- SHA512 734e397f4ed2554944e1d1f6f799794c4027792a06e9da25bab58e6e4ff58146058d8b45ff0cb9c861f77989cad029164945f22ffcb459432e1d3a2c7172525c
- SSDEEP 384:BbCiWM4cwP+niRGYZ2TrvF+q7yAfLORxNy+E1jYvzLXci2jpv63y:QE/wPRY62fFr2ADSxA+OsPMi2jpvx
- TLSH T11A92C0D2AA3DD00DEEAE6CD992B8DC573E7D93C60936451F20EEE7C400A33C58756469
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~2\MICROS~2\XNAGAM~1\v4.0\Redist\DXREDI~1\Feb2010_XACT_x86.cab
- Size 90KB
- SHA256 0ba00c41443639dea9b816fa2608088ccef5dbe850531dff4c1e7993804b0b60
- MD5 5cf3585c99a59319ac10e18cc92f0024
- SHA1 c48c25e6b7094eaf337fa986960f9895e5f465ba
- SHA512 26b8213a5105b37912632c8abc1a07381210836e620f8f70d77b3b412a406e2e38df7af037001fe27f2da874e143c59aa7dbff90a9183e7619a8e5af0a23b158
- SSDEEP 1536:RnXubXErHES9SjYKM+wqFI5mg4itqGEZ7d2McjVk5nu1BznlUmIWiBC955:pubWkAOY/+wqFOhqGOLoVy8BzF2C955
- TLSH T1D59302FB4F79A219DEE52CD1A6C4A9273374D2C20E515062827BC9C413A2BE09F7C939
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~2\MICROS~2\XNAGAM~1\v4.0\Redist\DXREDI~1\Feb2010_XAudio_x86.cab
- Size 270KB
- SHA256 281bb0e12f617e9ae7fe3301a7d4a08201b377caa0311a886e8cddc2526f734a
- MD5 5da6e4a80fa53568d2fdde31cbff2979
- SHA1 9606fda70427cd9f4eb8e67b625417e2775e6876
- SHA512 649fc2578388064267ebe8e55daada29d2e51ae6422b10088b6bfacd229bc0439aafdc4f9af7b3b5e187df179c72b4d85f70839a8c91505d17da06d53a40cf3b
- SSDEEP 6144:ScGQ0hz7ScOGCq29xXhKj2bVZevb+7KwDcxbaLhz6:aQu3TxCqCZEGVZej+BDVd6
- TLSH T1C74412A28C9A65D34D17A33EF39C54872CF5DBC126A15004601AEAEB52D7BE3CF2764C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~2\MICROS~2\XNAGAM~1\v4.0\Redist\DXREDI~1\Mar2009_d3dx9_41_x86.cab
- Size 1.5MB
- SHA256 5146e15d4c65590704286bfcfbbcc31e98a6832f8a7cc3bfdcb1e7fa5a647bb1
- MD5 0fdd6e4e5dfc5d913261355746402214
- SHA1 a80c28755c9d3ca163bd377d1bd951a1c111733c
- SHA512 9eb85c4507881fc1004c906ee954273bfbea8979d70b2321f197a3cf82121734225103e4239a9bfb591a980b70400a5d19b93482abc108c46614a20476a81f90
- SSDEEP 24576:tFtN95ew18Yl4WTrZnZSibmmq18Whxp9pWISiIz9cXwowwenm2AB4qDA2mVxw:LewRFZ8ib6T3p9pW9/Z4bM/XkAQ
- TLSH T1D9753390A7381805F49E2A0A295DFD082F2535CFAE579825386E35C9DC6D78BFA0DC4F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~2\MICROS~2\XNAGAM~1\v4.0\Redist\DXREDI~1\dxupdate.cab
- Size 93KB
- SHA256 54d68f154058433865708ee0dbf3ecf2d609ffbd618e84a1056440379494d9fd
- MD5 c187448c8104d30087f3f25a9d112014
- SHA1 b64ac3e44f2f38a3bf8400f11a40a39039fc9caa
- SHA512 9148cece409557444eeaf66dee58e2a6043a64d7b76b91e6c4074a5ba0d066cd1ebb2c60d44e1c7a40ca1dc63d72aa7afcc410202901d5afbf2116e3ba8b0f11
- SSDEEP 1536:CegbA3a2D3njmzI60hJijpy/Ykm3BSLGK/grkE5qYYH5UzbMrW+uft9rHUx:Jt3ao7hSynHLHEoYYHGAWlft9ox
- TLSH T18D9312C0AE8C328FB0567824524CF9326CB977D396A143139C89688613B7BF1DF26C2D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Microsoft Shared\XNA\Framework\Shared\xnavisualizer.dll
- Size 46KB
- SHA256 11bcc9f47d9b0397f6d78c08e7208ee812cbef54bb02a8c3a681608879471c8c
- MD5 ba187b4db5dae1bee29e6f18b7775b8b
- SHA1 efce87100c26165cfd7eb627534e42cb72ddb5b7
- SHA512 c9c2c3760e495c611a925bb5ae162d4c4ac90f53e2c0a9d20f68085ab43cc0f0a7ad1d201564649e4cf67ef4402d874626c6911f01f8a055da0b993730afc12c
- SSDEEP 768:QCMZ7X+W+WJtZlVWsWGr4Dl4e9SRf4LROn6d+zjhX2BAH:Q3ZL+W+WNWGK4eTVOnXzNGe
- TLSH T110232B01A544D0B3DCDA61B0566CB27651AEEBB207E022C32E771BDEDCB57D09E3834A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\DSETUP.dll
- Size 91KB
- SHA256 9d47b4fa2dcce6a02a51324cfb97f5e153086c2eb8832b211e175cbe5fb850b3
- MD5 4d48dbe4d3a06c497435014e5c583f34
- SHA1 159cbc37080b7ea3ceae8d25125b99f9f4948341
- SHA512 b8029bde36e4d6581916c131ec51d74f4a2b03abf5a238c503e1c7b19980d0946606375f0b4c3bd10b9c514e084368c356be8536b282bee887037d7d7f139732
- SSDEEP 1536:HDtBqvGfTOOeR3+MPb3hzgS/1nJvMgqAlTJQs0MajclgUukW+j2c5o5INSeVg7X9:jtAvGbOOA39b3h7/1CfWYcZ5x5o58Sey
- TLSH T1C7937D15BA90C072D8D120F916CCE7B1A6BEE1B40B2999C7F35047DAD9713C6AA3934F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\DXSETUP.exe
- Size 512KB
- SHA256 16953a202265db5655b3dd972b855619728da76545a2f94bcbb6c43262f48d5b
- MD5 11dd6e8ab9759d1ac91ffe0d0e4949cb
- SHA1 2a86774d0c87050d5c7aa9738cc3975303a40d0e
- SHA512 06828f51b3866f7c2b29861707bf8552b742e366783115b3062f08a9c0005c96507ecf1fff92ad41dc0318ad715176c39c84ff0424372b080bf7c031e4f307de
- SSDEEP 3072:Yi6LKe0XPM8nUc2nDzw0FWtj/WM0PSQ5lbSN2LhaM96rKmMH2/5Mjt4zT1mFDYkZ:we2nDzw0FWdwewUM1Ws4VIH
- TLSH T122B41C1067F99225F4F36B386AB913964E3ABE91DD38C55E6314319E4A31E80DE70B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\dsetup32.dll
- Size 1.6MB
- SHA256 a5c6df12f9fe2edab2a22fe7abf3cb17eac110a6fd469f2570ba04afc88ad767
- MD5 7c7cc9feb1026678c48bbabe84ea57c2
- SHA1 4fe9c466fc65cf07af0e1440743b1822ab65849b
- SHA512 d9cca6dfd5966d45342b87afb6091bc8ad3beff039f9bc9c523f8118dc6723337c279cd652c19624250ed3934d8f4a2b15670652867c0114b7e785bbab4212e0
- SSDEEP 49152:TjTO/4OOOOOOOOOOOOOOOOMiWeXiWeXiWeXiWeXiWeXiWeXiWeXiWeXiWeXiWeXF:TCd
- TLSH T10475AE35B1D40331E6B203B167128AB7F73EDBDDE21AD521B9AE82552186B8CC33E355
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 599B
- SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
- MD5 658ab8c32d4cc5deb36ac5f63da4658b
- SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
- SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
- TLSH T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\DXD6CE.tmp\FEB2010_X3DAudio_x86.inf
- Size 1KB
- SHA256 d4da3e530982812d1e2a31570b80af541fac1b13c72997d2aad7ea3bfeaf4a4a
- MD5 e84adf38d499ae39090ad60fd76d76e3
- SHA1 6af4d58bc04aac2723e8b97649f1b35fb1aca84c
- SHA512 6714992e7aee7bd0798fbec68f92c97ee502127580e21e1b6693ed6737312b44dbc9fd9ef579fe552590e9e5a4904df94e4116334265a34699a04aa76ab87c24
- TLSH T1FD21269ACC0294707685B2B27F8F768F5B670417E9612508B3CB0E94BB73701219D1FE
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\DXD6CE.tmp\FEB2010_XACT_x86.inf
- Size 1KB
- SHA256 e850fdb84bcac0f667927e53fee943efd3f43be6c6a0ae1e17f3fff83ddb2635
- MD5 82c10b720e33be099f69e4010d44ecd2
- SHA1 e95a2eb23db3fd610d71089500aad523f93c9469
- SHA512 853261c439b26cdc8991ac289b9f9925976452ed613481b0cf09e75444882805ffa15633eba441d8e1a04641f5f6378b68e2270a6a48d3911d7f9c2c0b1235bd
- TLSH T11331BCD9D802D131768DB271BF4B368E97774407E860261873CA0E9EEBA3201568C8FA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\DXD6CE.tmp\FEB2010_XAudio_x86.inf
- Size 1KB
- SHA256 74c827ef94881099761e04397ef8f162fd0ccaf4876a5503c4b53a5216d2acca
- MD5 e6e942a2cfbb587bfcc4203b5bb34fd4
- SHA1 2e0172ea1936911a98e11a6e98990703e24172c0
- SHA512 3d70d76e6f459819a1703c5019a2e10fe518ee6e8eb5d3313fe57d3d1b6313b52c4904398a26841c78a9ecf9d715e1201e834ab3df47265e070ec94417a78e4d
- TLSH T1A0317CC9CC0293717B88B1B27F5F3A8F57670416ED612108B3D64E996BE3202256C9FE
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\DXD6CE.tmp\Mar2009_d3dx9_41_x86.inf
- Size 1KB
- SHA256 bd29711cc2ecd924990167ffa95f48842e24aeed3acef1023717040240b4bbb6
- MD5 b37a5ff044eb65521a290c79ba1a3e00
- SHA1 ed505464894bd3e52654834487f3821ae117edfe
- SHA512 eae4408cfa7f9c39b101489688cc570a184b8a57f3d20d3b0452a581fb80c4f485dc2f512a39669a92a5bde81fbf474e1585f566ff482e87610780c23126c21e
- TLSH T12D3157DDCC02E4307A94B6B27BAF364F5727460BEA61310977C90990AFB3341115D2F8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\DXD6CE.tmp\X3DAudio1_7.dll
- Size 21KB
- SHA256 288c701bdedf1d45c63dd0b7d424a752f8819f90feb5088c582f76bc98970ba3
- MD5 c811e70c8804cfff719038250a43b464
- SHA1 ec48da45888ccea388da1425d5322f5ee9285282
- SHA512 09f2f4d412485ef69aceacc90637c90fad25874f534433811c5ed88225285559db1d981a3ab7bc3a20336e96fb43b4801b4b48a3668c64c21436ee3ea3c32f45
- SSDEEP 384:hd8NTutwAV7uTOJ/jUKdiAdzJWZuW8lLXci2jXHUcwVP:hmAV7uTO7jzU8Mi2jXHUcwVP
- TLSH T14CA27C55BA7DC112E9A819F0217EFC873C3DEB944B1282E3119270DCCA653D0AFF9666
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\DXD6CE.tmp\XAPOFX1_4.dll
- Size 72KB
- SHA256 0aee44b12913a95840ee6431d90518b0d72c54a27392e21ee6995e2151554a06
- MD5 e4ce2af32f501a7f7dddd908704a0ee6
- SHA1 9dc2976efb15b6fba08bebdeb98929b6961063a5
- SHA512 ec14a58414d595a36c6b575cdae690f11481cd3f0b35fd2f4c6a6d162a6272882cfe03da865e09a34972775790529f51c80b69056a2fcb909f25b549ed2f7f01
- SSDEEP 1536:1/GrYvIGDi/t+YoCBlrT8EGscPCEBu0OI+k95M:qYw/VoCBl0EGsjEh1+k95M
- TLSH T11D734C026CF9C6F2F46468F5D4BD39A73838CA84A7248AC3625445D1D9F07E0AEF93B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\DXD6CE.tmp\XAudio2_6.dll
- Size 515KB
- SHA256 61b57170f7c6365714396072d22cb98746718c0f44c9f0d5c62fdb1b218639c7
- MD5 4976243bd70fae3d1d24e49739ab2710
- SHA1 6ef27b10bcf4e697fe77c3e964b326be11e4444f
- SHA512 af2d6aaad44bed880a1a2ee947618b142c76a5eca42d4608196b74df9108a9649059d8207e84a58b76ad43aefe9b66ffcc519f8126667177011cf4199f163e83
- SSDEEP 12288:QWi8lqH+P+wCS+OlElME9IdMANXtaDWzF6xuwEiS:QBtZEPMAN0WzoxuwhS
- TLSH T17CB43A12A4528275C9F722F184AE333B2738CB8457451AD753E499F9EED21E07FB01EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\DXD6CE.tmp\apr2007_d3dx9_33_x86.inf
- Size 1KB
- SHA256 349a09a2791d697bffffc61410a536cdcf258f0d7c86dda44a297e8aec4bdf00
- MD5 044cae9c30c88bda73727243f5e5206d
- SHA1 de744e349cf4ea458b10657d510966d21ad08d67
- SHA512 18e501142004afbcd28b41bdd3a9b19e2eebc047d7858ee11a9135f19759cfd8c643ff074a51e937bbcab7162888fd95effc146be21fe63dfc300ef03ed44056
- TLSH T1F13157D9C802D4347694B2B2BB9F374F263B450BEA51214C73CA0990AFB3761125D2F8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\DXD6CE.tmp\apr2007_xinput_x86.inf
- Size 1KB
- SHA256 1c798cb80e9e46ce03356ea7316e1eff5d3a88ccdd7cbfbfcdce73cded23b4e5
- MD5 e188f534500688cec2e894d3533997b4
- SHA1 f073f8515b94cb23b703ab5cdb3a5cfcc10b3333
- SHA512 332ccb25c5ed92ae48c5805a330534d985d6b41f9220af0844d407b2019396fcefea7076b409439f5ab8a9ca6819b65c07ada7bd3aa1222429966dc5a440d4f7
- TLSH T1D42126DDC8039435778AF2B27F9F7A8F663B8406E951221C73CA4994AB73341126C2F8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\DXD6CE.tmp\d3dx9_33.dll
- Size 3.3MB
- SHA256 c6b7b2ad7742dde5dd8d1a35fdc1c185e586e551ad9c74d3fb21759cd8ca4da8
- MD5 cdb1cd22baff21f48606b3c1a18b000b
- SHA1 9315b5db975a34dbebdb4dcae652ba1db01c482c
- SHA512 c5fb24de8f1ee6fc1ed6e74580b5d22599ea4eb6c3589645fff0b15dc8dca051c4917e60fbc00ca86542dd63a8f5e40da92ea77e24826c0c6bdba9b58c36d4db
- SSDEEP 98304:9Yho7VaMeKQqGfyxXIicOExzUx8PjtvssPFAQAl7fxI8f6B2+:ih8V2KQqGfyxXIicOExzUx8Bssun3f69
- TLSH T128F5ADA1F6424135CCE242B0418E73F861ADCF7157601ACF96A42FD8AEF66D28F34697
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\DXD6CE.tmp\d3dx9_41.dll
- Size 4.0MB
- SHA256 6ac4df203af419d3f3b7d9a99e14a3490ea3ad307c474bfe36baea642b1421f6
- MD5 3fa06cf5079b84155d18b05c08f7131b
- SHA1 fafe52876151a08f39dbb6b4aa137dd85558ba5f
- SHA512 24d29c3ffb6532da860fef4dd93e61f7532cea3af94928495a3af0231e7dff6db5cad25713451a2e722c076462b94818cd6969a1c7d8905585b0f64e12174d1e
- SSDEEP 98304:DdpF8pg4HYUQpisB7+86QJxpj+p9jdIcFXZvkyIOPsmQJAax0z:ppF8pVAisL6QJxpj+p9jdIcFXZMyILAf
- TLSH T19416BF60D60A8039CCDA51B5664E33B5356C8F71432057CF62683FEAAE747E29F3825B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\DXD6CE.tmp\dxupdate.dll
- Size 169KB
- SHA256 b1f954cd75dc3c9d5bc57f1a4c28720ee3639aa8a4306f3da7b27d3c361ff8f5
- MD5 c4842e139fca422e265c91c44a1341d6
- SHA1 299a5ab4644fe7302b515aa10ef0f1715046275c
- SHA512 e85a35164e0feafa73a676dacf67d275b8e8aa5be40d861743662a7d1ac8135625c2d59a73e5c77fe1e3e8bd8523d9c823c89137aa4cb1b32d392cd9a1b59989
- SSDEEP 3072:SF6LKSiwVi/9SXBLGqkNWMPCydN0BMz/xYHWl7LdOIlkhuGzyZT25FnSINKz:YwVaMMjUMPCydN0Bu/OHW5LdrCQGOZmw
- TLSH T191046C2DBB80D471C4E200F9650C26B16BFEA9B6072A80D7E3501BD9E8A57C5E17D39F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\DXD6CE.tmp\dxupdate.inf
- Size 12KB
- SHA256 7530c6e18dbb522c5f4fbf6714962c185ea318f9eab7aeb833b0cc07cd2fe656
- MD5 8c281fcb5546d1ed3cdaf6e3f7303139
- SHA1 de342a17f2df0386f6584e2f55ae43c558ceb6c4
- SHA512 344ea0a375c8851fcf413f441a1cac3013b3748d1630a4d677da72e98f41823bf9427d896de7e1fe35bf868279538cf3b8322aa6ef20025bff48a6bb7f8c42d3
- SSDEEP 384:eXTiDxtV0xxmBxbD6Ys7s6xHOJYwYdDxAp8xXZyUxIJ4:eXi4
- TLSH T14C429976B9168259F40EB3A01AAF3EC55E3B004FB43124CD79EF11B0572E1ADA2FE454
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\DXD6CE.tmp\xactengine3_6.dll
- Size 233KB
- SHA256 8a7e7c5ac2e6230f0249d46751522e7ecf85e7490cf7491ab73bf2e7e59e4c0f
- MD5 f81c4678a55ffee585ac75825faf5582
- SHA1 8fb2e6cf2a022eaed2ff5e3e225b3ca1e453d1cc
- SHA512 8c8071bc2640d5c0fcf140ad68d4788cbb0706d17313c3cb74e25624a748b282acbf77eda678cf0d5fecf2ec3d583508c6f4eaf5c84073909b616f59b4f4e5fe
- SSDEEP 6144:FHNB4NleX2RWWLykwq3/niRkI9yYJH0/eX:FHNBelM2RWWLykwq3WkIcYJHhX
- TLSH T1D834A4109541A27ACCF77AF94AEE3078B65CABC1130524D747D87AFBDB166E13A3408E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\DXD6CE.tmp\xinput1_3.dll
- Size 79KB
- SHA256 8d540d484ea41e374fd0107d55d253f87ded4ce780d515d8fd59bbe8c98970a7
- MD5 77f595dee5ffacea72b135b1fce1312e
- SHA1 d2a710b332de3ef7a576e0aed27b0ae66892b7e9
- SHA512 a8683050d7758c248052c11ac6a46c9a0b3b3773902cca478c1961b6d9d2d57c75a8c925ba5af4499989c0f44b34eaf57abafafa26506c31e5e4769fb3439746
- SSDEEP 1536:TVeqvNS6T6jxeEsU6b0xZtDDVb9X8u9JA7zitdrz/R8cy/FaeBD:TVeqvNOeFgxZ9DVVtRBy/EeD
- TLSH T199835B107480D236D8E361F806FDB714763CD66513A559C32BC4BBEE9EA63C26E3069B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e59c944.msi
- Size 6.7MB
- SHA256 e6c41d692ebcba854dad4b1c52bb7ddd05926bad3105595d6596b8bab01c25e7
- MD5 97c2eebb30c5a88c68c8f24f37183f1d
- SHA1 49efdc29f65fc8263c196338552c7009fc96c5de
- SHA512 c9d1017b274ceb1b4ee624cf7e628787c32a727c64f715fbce1f1ae929d9114f8fe1291e34583cec615619b0128c01206b07efc878e7a5c57b792453f73fd0da
- SSDEEP 98304:wynfL329J1XswfXO6wiBB+4RZg6aENaCZAU5PMO0MntfERyJGH2YPq/:wYD3C1XXfzH+4cLHU5PM/Mnt+YGlq
- TLSH T1906622A2751AFF41DDF406BCE970CA490925CF3782270C686929356A7BF7E1202E9D4F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logs\DirectX.log
- Size 11KB
- SHA256 7c1fd44cd0c34b06c2334181977a1c0c87942a21cfbab352d2577772c9a93c51
- MD5 2601fa33a4a4bc068f3f7062059892c5
- SHA1 fea704e1079112dcc91b27e854ebd315b3433620
- SHA512 8d8f4fc800e85b002ed7467781d1f9b72327575d711b4624801204ef243a6cdb21c651802b3c39e489774df7e42340843ca49dca51994145562169848cbc5526
- SSDEEP 96:jZswcACFCsWvDvv0cjmxUPCNw2ZFZkvbbDTQQR5lOLHrYrIcnlZsXlZPjgjZF6qK:tRHX+
- TLSH T18F32A3BDA835C8BDBC185409A26B7CC3700E12638D5402BC93EA56DF9618F5F9E4E2DD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Xna.Framework.Xact\v4.0_4.0.0.0__842cf8be1de50553\Microsoft.Xna.Framework.Xact.dll
- Size 74KB
- SHA256 6824bb0b7b42626d1ed5b7ab7e4dab4a380fa010175d4de0fadb1c3904e491d1
- MD5 cf7788e795f1c743d6ee0bf8de3fa502
- SHA1 db2bf000c096a91aca46da5fe35326761c63053f
- SHA512 13cd0d8d7479d7bb9b721cbd8109764bfb58e4dc01661e8fd6819f1cb182e408766e7cc61103e95763bdc1e11ab4b901ae05c8748e18b5f730ec78c5868f7781
- SSDEEP 1536:piWyY+tzyo5dDaYt9qsudKGef39D92YrSDyvG+:pijBzyo2YtMsudKGefZ92BJ+
- TLSH T188736C4533858A6BEBDF8B7278B0FA44013664A2AFD3FBD711A193E518563C0C935B93
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Xna.Framework.Avatar\v4.0_4.0.0.0__842cf8be1de50553\Microsoft.Xna.Framework.Avatar.dll
- Size 24KB
- SHA256 7688ebdffc98433eef8aada293a8c4beec6d6acfc0e1f91ca8eb2f1c350e7cec
- MD5 7b26de335983eb8b800a67ef5ff077d5
- SHA1 f614672dd8b25985a417ed339a6a6532c9e57800
- SHA512 fc14dcda0703c8ade152bee32b4c4175c37e98500cc1370d4de0ffd0eac398edae3a42d29711e6ec841231fab0eed228fc6eba69347b54a8e125866ae6822043
- SSDEEP 384:q4QsedMlPLtXTuZclArYIJT8gdRDY94dhuBW37sWl:8zdMlzxCiArZR8Gdnr
- TLSH T1B6B22946E7088631CBFF09776C7A3D4501BE7252F9D7CF6A172881963C4A7241A66F23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Xna.Framework.Net\v4.0_4.0.0.0__842cf8be1de50553\Microsoft.Xna.Framework.Net.dll
- Size 53KB
- SHA256 3c0b37068ad56193fd613eb8f6bd321e7e08a99b9cf85606ccddf060afb1263b
- MD5 378479eead647cedc6b74bf84e5514a2
- SHA1 8dac9af1bec30f93a4aa6650ced1f64dd0791841
- SHA512 6b0cb09a21121d2eed1277c0989d5ae142b6c724886ada5f713f762c61641901fadbb4fdea115cbdb662ceee220aa7d684e5a7a0613fc3a642bbad36e9c22e88
- SSDEEP 768:vvTTIObJK98eL8PaEntvuh8tItI3CJUvKZTswdnXBr8H:fPGYaEntvyIIi3CJUvKZA8xr8H
- TLSH T1C2333A40464D473AD3EF4DBBF465343903F1F262B7E3EBC52EE890EA08A276509A5527
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Xna.Framework.Storage\v4.0_4.0.0.0__842cf8be1de50553\Microsoft.Xna.Framework.Storage.dll
- Size 20KB
- SHA256 7edbb80c699ce3ead8aee5a512ee34c7718cb5dceeb1d0577e788ad8d0ad9383
- MD5 17c4074e1d0977182060959ec63e18a6
- SHA1 af73bc4b90899793525ca472a1b90312c33063e9
- SHA512 b7d7fc7b21f3fd480e6ee40cfb3682b898382ad2397cc38ef7258db68dcac31de0f64b8adae5ac92d0b31c3cf85c2489a04dfa77675104134d874fb4871e91b0
- SSDEEP 384:OFMldl8akzAlg5asAq+P1BG89bbCuIQkB1kD+hpNWwLMW:GMl38tMOcsAq+POdp72+z
- TLSH T1F8920702A74C0236DFDF4D7968A63C4510BAF597F8C3EB865A29E49A1C677281963B03
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Xna.Framework.Video\v4.0_4.0.0.0__842cf8be1de50553\Microsoft.Xna.Framework.Video.dll
- Size 17KB
- SHA256 63c7673c936747abd9ebe779e8837c8b8add2c078a31216684fbf8c6bcab2745
- MD5 94b8554692a89f1955b9219e0f26442b
- SHA1 cd34862740a30b2f0fd391fa16b082edb79d155b
- SHA512 9a6762e9cd8bd26dd347c8166dc59b31159c9e5295d39773c69228d73b5f3f850bbd41f733b1f880623bcd4c929f13d66e2168f2e1972842a6e031d069ec92b4
- SSDEEP 192:DABS32p6Uhw/uO0Tab8uj1O9BQ6eVixgj4xxdhzg/L0Xc90OOSN1c1mWabsW:DABRpTC/3bM7Q6eeU4xx8hcEWabsW
- TLSH T19382E912A30C0236CFEF9A796C647C8511FB7667F8D3DFC66629859A1D827201D63B43
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 b0f272ac040ae8dbbbd3ffd137a6ab9e7a9b6160501c30922dabca17ce0f4261
- MD5 562a280fd970c83e692dda879b30cfa0
- SHA1 a613714b6517825ae8db570c1d2582d8d378a50e
- SHA512 cc930d78f3b13ff03bf46081d48c83760082599a1822efd6ff4c7db74430739727abe82d7049a58fecc9c8ce4b5abf55abb499f904d527dc9df9c2bd8be71718
- SSDEEP 24576:LFo3DMP4doO/vvTL/yAsMilQPrOWX7rf0R6e9BCE65iqpLNMMoR2s12NoeG:aH4
- TLSH T19C57B51436F92100E7F79E3CA8F06A234D397D5BAC19DE8D45511B8E0922F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c61fbfff-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{7193873f-d369-4467-b709-c39998060029}_OnDiskSnapshotProp
- Size 6KB
- SHA256 49c2681120bf8472c550f172a3f518f44673c2e584b4395f05264658631caae6
- MD5 f36dad462e653d0b64a84465acdf6ab7
- SHA1 432af6472d1a0e0d61c1ea67c6faa50e0f92c2fa
- SHA512 2d7a4b566543dc5949211ab92f63e95e8d680a3c458b3961d371ca1b264aea5c470ecd2c62fec1928d7e022418980ae3237e19c0bdccc3b8158830ad2526c06a
- SSDEEP 96:FZ7vW5milDvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:b7WLl/b++uVm
- TLSH T1F2D167085AE54711F2B3AB3229F18557A837B911FF33CB8E0198238E6671910F935F5B
- MD5 SHA1 SHA512 SSDEEP TLSH