Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    301s
  • max time network
    303s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/11/2023, 23:56

General

  • Target

    x-mirage-inst.exe

  • Size

    36.0MB

  • MD5

    9dbe2a0e7c69daf944726046f44134cb

  • SHA1

    bd5033778ec1a2179e59ce48687c0e8713039146

  • SHA256

    155e513d1d4112f866526453f7ebbb4245fb92a0d5b29cad954d3371f63b4c1b

  • SHA512

    f627f2495ab57b6becc6ae9b645c0865d0a0a681d3d480923b854d905361f5a26931948f0493f84731b46d6cdda6ddec23fc18a7ca8ea6cb6b7678370df99861

  • SSDEEP

    786432:kaQSm27Ior0kd9o4Qrz7HL7HW7tLLVaZlOcopVyVFR7:n+mN06QrrbWJLVovuVY7

Score
10/10

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 30 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\x-mirage-inst.exe
    "C:\Users\Admin\AppData\Local\Temp\x-mirage-inst.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:680
    • C:\Users\Admin\AppData\Local\Temp\is-U9B3U.tmp\x-mirage-inst.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-U9B3U.tmp\x-mirage-inst.tmp" /SL5="$60118,36859286,1145856,C:\Users\Admin\AppData\Local\Temp\x-mirage-inst.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1932
      • C:\Program Files (x86)\X-Mirage\X-Mirage.exe
        "C:\Program Files (x86)\X-Mirage\X-Mirage.exe"
        3⤵
        • Modifies firewall policy service
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:2896

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\X-Mirage\CoreFoundationLite.dll

    Filesize

    818KB

    MD5

    26660ae66ff50056beb178ca7ed6d752

    SHA1

    cae5bc0ed81fd9365869bd3b1208de2d460be164

    SHA256

    b40fa20f38b449a999ce89760257ddf2e99a6fdd4d5a858b196f98c3ec4875a4

    SHA512

    0b5a25b4db936147afedc3f8560e7bf41452ead0a87120b6e6d9ed67534cab355e0e241896101de4ac28621dd74cb86a368407ae3902a97a6a6c6b1075a054b7

  • C:\Program Files (x86)\X-Mirage\CoreFoundationLite.dll

    Filesize

    818KB

    MD5

    26660ae66ff50056beb178ca7ed6d752

    SHA1

    cae5bc0ed81fd9365869bd3b1208de2d460be164

    SHA256

    b40fa20f38b449a999ce89760257ddf2e99a6fdd4d5a858b196f98c3ec4875a4

    SHA512

    0b5a25b4db936147afedc3f8560e7bf41452ead0a87120b6e6d9ed67534cab355e0e241896101de4ac28621dd74cb86a368407ae3902a97a6a6c6b1075a054b7

  • C:\Program Files (x86)\X-Mirage\LIBEAY32.dll

    Filesize

    1.2MB

    MD5

    4e26089f023b2e733c73711410d6107c

    SHA1

    ebdba257e2731b7f9261d1a4a120a67a3568615b

    SHA256

    940c21c5aadd737491cef80838deff23d6a92a835de523b615516a9618badd36

    SHA512

    f2f14c3cfb3311e809cd3ddaf1e5c2d9885cfe1e0e6fa5c7c46d73c14607ee18857f93c41aac7e2807652a171d57e2cd2ad594d0661cc7ef1f23641e5e6d41f5

  • C:\Program Files (x86)\X-Mirage\MSVCP140.dll

    Filesize

    440KB

    MD5

    e0dd94aada0b034b212de071c33054da

    SHA1

    6c4f1b3f66d07bbcdcf41eb39b1480bb335efcc8

    SHA256

    08442853f19ce4ff3acae37d87eab33ef81c4c6da62a3432d43253ba79842b64

    SHA512

    76c877056f448e5dab820e990cc186ba886b2d331d689a99295aaff31a63aadb941c2693b0be98d53bd06cd8041a270eb82ddedfbde305cd9a85bcbe42fcf5a2

  • C:\Program Files (x86)\X-Mirage\MSVCR120.dll

    Filesize

    948KB

    MD5

    034ccadc1c073e4216e9466b720f9849

    SHA1

    f19e9d8317161edc7d3e963cc0fc46bd5e4a55a1

    SHA256

    86e39b5995af0e042fcdaa85fe2aefd7c9ddc7ad65e6327bd5e7058bc3ab615f

    SHA512

    5f11ef92d936669ee834a5cef5c7d0e7703bf05d03dc4f09b9dcfe048d7d5adfaab6a9c7f42e8080a5e9aad44a35f39f3940d5cca20623d9cafe373c635570f7

  • C:\Program Files (x86)\X-Mirage\SSLEAY32.dll

    Filesize

    283KB

    MD5

    fc0a8dcb4aaf66f477c61370a1568efb

    SHA1

    fe0123d16a24d35a10c327ced7cba6057bb46de4

    SHA256

    4604e66363b4c2fbf3aaece4402aa9f2d467a7c72809531abd882c8b0438d4b9

    SHA512

    6203fe02fb78e3a0560df38b365e4871846d16446df7f0ca3cd98a2c6803aa9d970c7e1eaf79caf43888d143d06cb5003c097d6212925af38cbc98b7721d3fbf

  • C:\Program Files (x86)\X-Mirage\VCOMP140.DLL

    Filesize

    146KB

    MD5

    21fce7c5111489a9f8613f3c175c250d

    SHA1

    69cbea5fbeabc0aca406efe87bf9ff09342dca83

    SHA256

    3e7942cfa2a18b463b57153f0f626dd7da0a5ca0a235bae573af5ce48a368066

    SHA512

    b31cd9158d8ba7ba874ea5d08b1356cd087c377a6afb1148567186f1cfaf9e3506a100f54e8e224488d328fa54c0d60ec015f42835f071931fa5a7cec34e49d1

  • C:\Program Files (x86)\X-Mirage\VCRUNTIME140.dll

    Filesize

    74KB

    MD5

    87dd91c56be82866bf96ef1666f30a99

    SHA1

    3b78cb150110166ded8ea51fbde8ea506f72aeaf

    SHA256

    49b0fd1751342c253cac588dda82ec08e4ef43cebc5a9d80deb7928109b90c4f

    SHA512

    58c3ec6761624d14c7c897d8d0842dbeab200d445b4339905dac8a3635d174cdfb7b237d338d2829bc6c602c47503120af5be0c7de6abf2e71c81726285e44d6

  • C:\Program Files (x86)\X-Mirage\X-Mirage.exe

    Filesize

    29.7MB

    MD5

    285a5532c5e1168935004a4e8bc6e56b

    SHA1

    cac9b86a014006310526b59985d7ae97d14ff4dc

    SHA256

    7ef4dbf71172fc8d2f2ad306a43c0c30ed8a8b5197b8d554de10a57b42a44de2

    SHA512

    24bcc6ca2bb734da6cfe2a73c84305f4ddd0e4af15a0a90ff9cf6c5983852d2875987dca0953717b1e2a6b5c78e01a888149dc287b07a5a42052328758533349

  • C:\Program Files (x86)\X-Mirage\X-Mirage.exe

    Filesize

    29.7MB

    MD5

    285a5532c5e1168935004a4e8bc6e56b

    SHA1

    cac9b86a014006310526b59985d7ae97d14ff4dc

    SHA256

    7ef4dbf71172fc8d2f2ad306a43c0c30ed8a8b5197b8d554de10a57b42a44de2

    SHA512

    24bcc6ca2bb734da6cfe2a73c84305f4ddd0e4af15a0a90ff9cf6c5983852d2875987dca0953717b1e2a6b5c78e01a888149dc287b07a5a42052328758533349

  • C:\Program Files (x86)\X-Mirage\X-Mirage.exe

    Filesize

    29.7MB

    MD5

    285a5532c5e1168935004a4e8bc6e56b

    SHA1

    cac9b86a014006310526b59985d7ae97d14ff4dc

    SHA256

    7ef4dbf71172fc8d2f2ad306a43c0c30ed8a8b5197b8d554de10a57b42a44de2

    SHA512

    24bcc6ca2bb734da6cfe2a73c84305f4ddd0e4af15a0a90ff9cf6c5983852d2875987dca0953717b1e2a6b5c78e01a888149dc287b07a5a42052328758533349

  • C:\Program Files (x86)\X-Mirage\avcodec.dll

    Filesize

    18.6MB

    MD5

    6db60d17ca89bdb42aeb33f11e512ec1

    SHA1

    dab4715ba963f65d254fff21436f6f5352a85520

    SHA256

    6592baf4121b9285a25abf1c783dc5d2d4f743ca5984e097f1016c7bafcf8956

    SHA512

    1f88e645736b73a04d67c77db15cee7d778825b8e1581709b304ae343efd042e390b4470a42c05b87f6583e1bd9493a7db15fbbe343451ca4b43ba5103312845

  • C:\Program Files (x86)\X-Mirage\avcodec.dll

    Filesize

    18.6MB

    MD5

    6db60d17ca89bdb42aeb33f11e512ec1

    SHA1

    dab4715ba963f65d254fff21436f6f5352a85520

    SHA256

    6592baf4121b9285a25abf1c783dc5d2d4f743ca5984e097f1016c7bafcf8956

    SHA512

    1f88e645736b73a04d67c77db15cee7d778825b8e1581709b304ae343efd042e390b4470a42c05b87f6583e1bd9493a7db15fbbe343451ca4b43ba5103312845

  • C:\Program Files (x86)\X-Mirage\avdevice.dll

    Filesize

    1.8MB

    MD5

    3a8babc5c166ae70c782f215edb0e1ae

    SHA1

    46b9f13eef5558c323f0fdf91270acfdaac084f3

    SHA256

    7ac04e78ffc3ca4c4a9e80c7ce4c7c4c0259510bd566f0cccc1b8e847d424a7c

    SHA512

    f24d93b50353627dafcc7106942168a73facfe3f729edd1e74e2d9575fb3a3e8a8d6f34e02db4df6c7bf3743bc6235bcfd199e2dc7a8b79575ba282c90f969a7

  • C:\Program Files (x86)\X-Mirage\avdevice.dll

    Filesize

    1.8MB

    MD5

    3a8babc5c166ae70c782f215edb0e1ae

    SHA1

    46b9f13eef5558c323f0fdf91270acfdaac084f3

    SHA256

    7ac04e78ffc3ca4c4a9e80c7ce4c7c4c0259510bd566f0cccc1b8e847d424a7c

    SHA512

    f24d93b50353627dafcc7106942168a73facfe3f729edd1e74e2d9575fb3a3e8a8d6f34e02db4df6c7bf3743bc6235bcfd199e2dc7a8b79575ba282c90f969a7

  • C:\Program Files (x86)\X-Mirage\avfilter.dll

    Filesize

    4.6MB

    MD5

    9c3f8b6bd5ae8b63e5ddb34f3e4f17b8

    SHA1

    024759b6a7d16f52b64d1afcc87d9bd803360530

    SHA256

    530267b5ee6864ad3ec78ec508fb30b9ce4eecd5008520ccf0443617d632b031

    SHA512

    bd83a2011267780865f64d382b2937ff90a65905b10e371252002403d8b9273aff63aea70c25351ae2e8b77d5467ba2cd2a9bd92abd2e72546f190f8a9c422b2

  • C:\Program Files (x86)\X-Mirage\avfilter.dll

    Filesize

    4.6MB

    MD5

    9c3f8b6bd5ae8b63e5ddb34f3e4f17b8

    SHA1

    024759b6a7d16f52b64d1afcc87d9bd803360530

    SHA256

    530267b5ee6864ad3ec78ec508fb30b9ce4eecd5008520ccf0443617d632b031

    SHA512

    bd83a2011267780865f64d382b2937ff90a65905b10e371252002403d8b9273aff63aea70c25351ae2e8b77d5467ba2cd2a9bd92abd2e72546f190f8a9c422b2

  • C:\Program Files (x86)\X-Mirage\avformat.dll

    Filesize

    6.2MB

    MD5

    80a3ae35ced455032eed0101db12533f

    SHA1

    af6d7aad8c187dec121bf193af6f1ebae85b21b1

    SHA256

    4f3f0636f5ab7b326cd162f618e58a3b4dcfb077a166747a27036fb673df2ef3

    SHA512

    5926ffceb69004c1bc8af3b6015641e2e9fd59ab18b5666eceeb2d45a4bbcbe220bdb396a3949f39b7236b995a5a52c0fefb615082aac9ed8e52d1ee20631f22

  • C:\Program Files (x86)\X-Mirage\avformat.dll

    Filesize

    6.2MB

    MD5

    80a3ae35ced455032eed0101db12533f

    SHA1

    af6d7aad8c187dec121bf193af6f1ebae85b21b1

    SHA256

    4f3f0636f5ab7b326cd162f618e58a3b4dcfb077a166747a27036fb673df2ef3

    SHA512

    5926ffceb69004c1bc8af3b6015641e2e9fd59ab18b5666eceeb2d45a4bbcbe220bdb396a3949f39b7236b995a5a52c0fefb615082aac9ed8e52d1ee20631f22

  • C:\Program Files (x86)\X-Mirage\avutil.dll

    Filesize

    442KB

    MD5

    9f49ce27d078b03b0f334d194351a62c

    SHA1

    30009989d62418b5604946b707f52b093f214104

    SHA256

    757d635f04bbbe5cc5e6e395cceb1d4af97559fbfb36cf0e64702d9c3c8e2a32

    SHA512

    49aa014dd5f6be328e60d2e3c6677415b8c5adaba40ae1a6bc5d0d48f9128e0239f8c6631e76b672acb8ee1b6f709baa5144c59dae51818ab6fa2401e3979746

  • C:\Program Files (x86)\X-Mirage\avutil.dll

    Filesize

    442KB

    MD5

    9f49ce27d078b03b0f334d194351a62c

    SHA1

    30009989d62418b5604946b707f52b093f214104

    SHA256

    757d635f04bbbe5cc5e6e395cceb1d4af97559fbfb36cf0e64702d9c3c8e2a32

    SHA512

    49aa014dd5f6be328e60d2e3c6677415b8c5adaba40ae1a6bc5d0d48f9128e0239f8c6631e76b672acb8ee1b6f709baa5144c59dae51818ab6fa2401e3979746

  • C:\Program Files (x86)\X-Mirage\dnssd.dll

    Filesize

    49KB

    MD5

    9beb76826d249ae9345aa78689f0c310

    SHA1

    9362a05e3f39c09a0f360d2ee07889eb02ae0abe

    SHA256

    0c73e7a42e1870e5de852ff72dde5e34e45b7061513d74086c77f5a6dbbee27a

    SHA512

    8637e64c9531bd42770db51cb523c5cdd12ed3e1637c2d9689f89000fe00ce6b6a11ec7d5a84a316439450901d2a98fd3f2a2d9139bfaabc07d3ce9f755f9706

  • C:\Program Files (x86)\X-Mirage\dnssd.dll

    Filesize

    49KB

    MD5

    9beb76826d249ae9345aa78689f0c310

    SHA1

    9362a05e3f39c09a0f360d2ee07889eb02ae0abe

    SHA256

    0c73e7a42e1870e5de852ff72dde5e34e45b7061513d74086c77f5a6dbbee27a

    SHA512

    8637e64c9531bd42770db51cb523c5cdd12ed3e1637c2d9689f89000fe00ce6b6a11ec7d5a84a316439450901d2a98fd3f2a2d9139bfaabc07d3ce9f755f9706

  • C:\Program Files (x86)\X-Mirage\icudt53.dll

    Filesize

    20.6MB

    MD5

    f7c5fa5e0b9e3619945595f9ce97b09b

    SHA1

    219058c019c86ddc0a809424a9fc53f784d19d9e

    SHA256

    8320943f3b16f321e1d65c1c9c096e7b8fa262a1157d19e0d121729cab6e74c2

    SHA512

    5a51acc72418ba296b6a99bd57c20ae9a68a6ba2b8c639317dd87063a8bdbeae96c6306e7bae3ac9056a088d01d91afb32909a3139090e1d9f1b0011d4eca7a9

  • C:\Program Files (x86)\X-Mirage\icudt53.dll

    Filesize

    20.6MB

    MD5

    f7c5fa5e0b9e3619945595f9ce97b09b

    SHA1

    219058c019c86ddc0a809424a9fc53f784d19d9e

    SHA256

    8320943f3b16f321e1d65c1c9c096e7b8fa262a1157d19e0d121729cab6e74c2

    SHA512

    5a51acc72418ba296b6a99bd57c20ae9a68a6ba2b8c639317dd87063a8bdbeae96c6306e7bae3ac9056a088d01d91afb32909a3139090e1d9f1b0011d4eca7a9

  • C:\Program Files (x86)\X-Mirage\icudt53.dll

    Filesize

    20.6MB

    MD5

    f7c5fa5e0b9e3619945595f9ce97b09b

    SHA1

    219058c019c86ddc0a809424a9fc53f784d19d9e

    SHA256

    8320943f3b16f321e1d65c1c9c096e7b8fa262a1157d19e0d121729cab6e74c2

    SHA512

    5a51acc72418ba296b6a99bd57c20ae9a68a6ba2b8c639317dd87063a8bdbeae96c6306e7bae3ac9056a088d01d91afb32909a3139090e1d9f1b0011d4eca7a9

  • C:\Program Files (x86)\X-Mirage\icuin53.dll

    Filesize

    1.5MB

    MD5

    db6214246b7165f04440fc735562ad66

    SHA1

    b93fdbf61f92db591669d46e7bf959cb32c9bbbf

    SHA256

    0b94f52f7da97e06de50d180ab21a09354a148e801214404a0e8ce6f6fdd8287

    SHA512

    2fe9bf9d831ca5ede938a3a765231740e7f5ec6f6792d040597230f763bad327c8fe6056ae10882c5b6a99eacfc2da3c207085a9fa294eaea7f5aeaffb2ce96f

  • C:\Program Files (x86)\X-Mirage\icuin53.dll

    Filesize

    1.5MB

    MD5

    db6214246b7165f04440fc735562ad66

    SHA1

    b93fdbf61f92db591669d46e7bf959cb32c9bbbf

    SHA256

    0b94f52f7da97e06de50d180ab21a09354a148e801214404a0e8ce6f6fdd8287

    SHA512

    2fe9bf9d831ca5ede938a3a765231740e7f5ec6f6792d040597230f763bad327c8fe6056ae10882c5b6a99eacfc2da3c207085a9fa294eaea7f5aeaffb2ce96f

  • C:\Program Files (x86)\X-Mirage\icuin53.dll

    Filesize

    1.5MB

    MD5

    db6214246b7165f04440fc735562ad66

    SHA1

    b93fdbf61f92db591669d46e7bf959cb32c9bbbf

    SHA256

    0b94f52f7da97e06de50d180ab21a09354a148e801214404a0e8ce6f6fdd8287

    SHA512

    2fe9bf9d831ca5ede938a3a765231740e7f5ec6f6792d040597230f763bad327c8fe6056ae10882c5b6a99eacfc2da3c207085a9fa294eaea7f5aeaffb2ce96f

  • C:\Program Files (x86)\X-Mirage\icuuc53.dll

    Filesize

    1.1MB

    MD5

    d18d4fc2b85c761a6c108a3425379771

    SHA1

    c0c1440a67be91bc21198f30cf0d09d0afcfd45f

    SHA256

    c0d7cb4f0dcfdb176de894887b0ec3f755f2663aa512dad99dbfe8006387e986

    SHA512

    48d1dd04f3092edebe43c216c4d795e93da6cb46d3fad805a8af0cbb8b573727dfe73f4a9b27f3be06b1b04347b05f43c2b46ba20c3886085c6f60f5fa051370

  • C:\Program Files (x86)\X-Mirage\icuuc53.dll

    Filesize

    1.1MB

    MD5

    d18d4fc2b85c761a6c108a3425379771

    SHA1

    c0c1440a67be91bc21198f30cf0d09d0afcfd45f

    SHA256

    c0d7cb4f0dcfdb176de894887b0ec3f755f2663aa512dad99dbfe8006387e986

    SHA512

    48d1dd04f3092edebe43c216c4d795e93da6cb46d3fad805a8af0cbb8b573727dfe73f4a9b27f3be06b1b04347b05f43c2b46ba20c3886085c6f60f5fa051370

  • C:\Program Files (x86)\X-Mirage\libaio.dll

    Filesize

    40KB

    MD5

    9bf87e0aab85fa9689872367b60054b9

    SHA1

    12a8610c65bdc4fb8816aceae4cb80ab30523c89

    SHA256

    20f98dfa560964e45d8c69c474388200d90f020940febd9f534d81292683696a

    SHA512

    f71eacc82b5eb04d7e9b973188e1b7ca59522ae67b95a56ad4db7d19b73b604d65c8eb293b73b1bbab619e3d3379c5d89310b6f4730b936dbd85af317429d02a

  • C:\Program Files (x86)\X-Mirage\libaio.dll

    Filesize

    40KB

    MD5

    9bf87e0aab85fa9689872367b60054b9

    SHA1

    12a8610c65bdc4fb8816aceae4cb80ab30523c89

    SHA256

    20f98dfa560964e45d8c69c474388200d90f020940febd9f534d81292683696a

    SHA512

    f71eacc82b5eb04d7e9b973188e1b7ca59522ae67b95a56ad4db7d19b73b604d65c8eb293b73b1bbab619e3d3379c5d89310b6f4730b936dbd85af317429d02a

  • C:\Program Files (x86)\X-Mirage\libcurl.dll

    Filesize

    326KB

    MD5

    8767b15c7c750961b959487a58284239

    SHA1

    be393141e7c06222c8a71e0aaa3362a536632f0a

    SHA256

    be39200e35c2ee9e698c954fe4fa1d3c54d27cff3b1c767de60a04de9f548eb2

    SHA512

    480c13a957c627e25210ac7b82d9e6b4e07c3f3add31f0b4f8afe83ae0fa7f5f9dd796fc25ea31837f7308785bd4ad5eda9157c77af48419e6108c1b14a75f30

  • C:\Program Files (x86)\X-Mirage\libcurl.dll

    Filesize

    326KB

    MD5

    8767b15c7c750961b959487a58284239

    SHA1

    be393141e7c06222c8a71e0aaa3362a536632f0a

    SHA256

    be39200e35c2ee9e698c954fe4fa1d3c54d27cff3b1c767de60a04de9f548eb2

    SHA512

    480c13a957c627e25210ac7b82d9e6b4e07c3f3add31f0b4f8afe83ae0fa7f5f9dd796fc25ea31837f7308785bd4ad5eda9157c77af48419e6108c1b14a75f30

  • C:\Program Files (x86)\X-Mirage\libeay32.dll

    Filesize

    1.2MB

    MD5

    4e26089f023b2e733c73711410d6107c

    SHA1

    ebdba257e2731b7f9261d1a4a120a67a3568615b

    SHA256

    940c21c5aadd737491cef80838deff23d6a92a835de523b615516a9618badd36

    SHA512

    f2f14c3cfb3311e809cd3ddaf1e5c2d9885cfe1e0e6fa5c7c46d73c14607ee18857f93c41aac7e2807652a171d57e2cd2ad594d0661cc7ef1f23641e5e6d41f5

  • C:\Program Files (x86)\X-Mirage\libprotobuf.dll

    Filesize

    3.4MB

    MD5

    869a9d19d2e4e00601030732036b5b63

    SHA1

    2dd8222348124a9a10957e7653943728b5862c0e

    SHA256

    8a15265f2921e9014d3e8141bd67c24a41987402cce30f0c5808fe098b5ef279

    SHA512

    3306253413bb9c94b3b503b6a17350304482ca5633e443ad112ac24966faa9ddf7ba59930d093b9b577de8035a86297e463c6b54fcb5d1315da68a7de1c83bcf

  • C:\Program Files (x86)\X-Mirage\libprotobuf.dll

    Filesize

    3.4MB

    MD5

    869a9d19d2e4e00601030732036b5b63

    SHA1

    2dd8222348124a9a10957e7653943728b5862c0e

    SHA256

    8a15265f2921e9014d3e8141bd67c24a41987402cce30f0c5808fe098b5ef279

    SHA512

    3306253413bb9c94b3b503b6a17350304482ca5633e443ad112ac24966faa9ddf7ba59930d093b9b577de8035a86297e463c6b54fcb5d1315da68a7de1c83bcf

  • C:\Program Files (x86)\X-Mirage\mDNSResponder.dll

    Filesize

    561KB

    MD5

    139f1cb6aa9091cf3e2b88b8855e6067

    SHA1

    5cd3369efc4fee7171e5d7c9d1abec2a182d4ef6

    SHA256

    9b04b480c4a0511ad5b758b4e44fc0b97c2ec4cb983d61d07f66a45484855fad

    SHA512

    9c1c6594f2631b71e1604011ec76c0ec4529431650101195ca373502e72d3b233f25457f99a930f73c4d858a6505d5772f8820ad8e45a6a78a044c6095071b95

  • C:\Program Files (x86)\X-Mirage\mDNSResponder.dll

    Filesize

    561KB

    MD5

    139f1cb6aa9091cf3e2b88b8855e6067

    SHA1

    5cd3369efc4fee7171e5d7c9d1abec2a182d4ef6

    SHA256

    9b04b480c4a0511ad5b758b4e44fc0b97c2ec4cb983d61d07f66a45484855fad

    SHA512

    9c1c6594f2631b71e1604011ec76c0ec4529431650101195ca373502e72d3b233f25457f99a930f73c4d858a6505d5772f8820ad8e45a6a78a044c6095071b95

  • C:\Program Files (x86)\X-Mirage\mfc140u.dll

    Filesize

    4.9MB

    MD5

    4b6bf219bb98bccfff4a5ab2b24b5144

    SHA1

    8d33d3cf31beac4bb3b8fa5af3feee62c2d3ecd3

    SHA256

    472b3ed1fb1503e3071e1f64c0eccf48b50b95deff560e24515f1c73819c5134

    SHA512

    51bd2b1966d8f5d20eb929d7f25a4b3b3152fdfc03d05fae0aa32223e7b3e278504ac9eab40626412868277bf56c6a0a056b909db2e4ce212b0283139d830a49

  • C:\Program Files (x86)\X-Mirage\mfc140u.dll

    Filesize

    4.9MB

    MD5

    4b6bf219bb98bccfff4a5ab2b24b5144

    SHA1

    8d33d3cf31beac4bb3b8fa5af3feee62c2d3ecd3

    SHA256

    472b3ed1fb1503e3071e1f64c0eccf48b50b95deff560e24515f1c73819c5134

    SHA512

    51bd2b1966d8f5d20eb929d7f25a4b3b3152fdfc03d05fae0aa32223e7b3e278504ac9eab40626412868277bf56c6a0a056b909db2e4ce212b0283139d830a49

  • C:\Program Files (x86)\X-Mirage\msvcp140.dll

    Filesize

    440KB

    MD5

    e0dd94aada0b034b212de071c33054da

    SHA1

    6c4f1b3f66d07bbcdcf41eb39b1480bb335efcc8

    SHA256

    08442853f19ce4ff3acae37d87eab33ef81c4c6da62a3432d43253ba79842b64

    SHA512

    76c877056f448e5dab820e990cc186ba886b2d331d689a99295aaff31a63aadb941c2693b0be98d53bd06cd8041a270eb82ddedfbde305cd9a85bcbe42fcf5a2

  • C:\Program Files (x86)\X-Mirage\msvcr120.dll

    Filesize

    948KB

    MD5

    034ccadc1c073e4216e9466b720f9849

    SHA1

    f19e9d8317161edc7d3e963cc0fc46bd5e4a55a1

    SHA256

    86e39b5995af0e042fcdaa85fe2aefd7c9ddc7ad65e6327bd5e7058bc3ab615f

    SHA512

    5f11ef92d936669ee834a5cef5c7d0e7703bf05d03dc4f09b9dcfe048d7d5adfaab6a9c7f42e8080a5e9aad44a35f39f3940d5cca20623d9cafe373c635570f7

  • C:\Program Files (x86)\X-Mirage\postproc.dll

    Filesize

    53KB

    MD5

    87c42599205e4c2bfae8461220d3a769

    SHA1

    1b2c3e5328606f939b5e1d970fe44db983226773

    SHA256

    75d2529ca2c22a60a498ffb2b7892ba16322201f73375e9127bd70d6dc5ce3da

    SHA512

    edf4f2813038353be770114d983dfe97d0a3f80d01cb86027e178552c84e07e935317a9c2564da199f2a81d80b6fbad827acc8c86f7c1a7351aabd18195190b1

  • C:\Program Files (x86)\X-Mirage\postproc.dll

    Filesize

    53KB

    MD5

    87c42599205e4c2bfae8461220d3a769

    SHA1

    1b2c3e5328606f939b5e1d970fe44db983226773

    SHA256

    75d2529ca2c22a60a498ffb2b7892ba16322201f73375e9127bd70d6dc5ce3da

    SHA512

    edf4f2813038353be770114d983dfe97d0a3f80d01cb86027e178552c84e07e935317a9c2564da199f2a81d80b6fbad827acc8c86f7c1a7351aabd18195190b1

  • C:\Program Files (x86)\X-Mirage\ssleay32.dll

    Filesize

    283KB

    MD5

    fc0a8dcb4aaf66f477c61370a1568efb

    SHA1

    fe0123d16a24d35a10c327ced7cba6057bb46de4

    SHA256

    4604e66363b4c2fbf3aaece4402aa9f2d467a7c72809531abd882c8b0438d4b9

    SHA512

    6203fe02fb78e3a0560df38b365e4871846d16446df7f0ca3cd98a2c6803aa9d970c7e1eaf79caf43888d143d06cb5003c097d6212925af38cbc98b7721d3fbf

  • C:\Program Files (x86)\X-Mirage\swresample.dll

    Filesize

    266KB

    MD5

    8b188c605ec20a8ef2835509b3a92edc

    SHA1

    8c10259a17402542f046d5f2264cdd0f15d858a0

    SHA256

    87639126579aaa6e79b9054557fd20a4f9e158634e27a8d50542ea8dbe8ffe2c

    SHA512

    65a6056f676109f7cb2be56dd0f573ab0e27c3d411c1ab3115611b098a5c00e6a05add23c064b2081c6a8d945e31f733c34551a142636e26de128e25826c01ae

  • C:\Program Files (x86)\X-Mirage\swresample.dll

    Filesize

    266KB

    MD5

    8b188c605ec20a8ef2835509b3a92edc

    SHA1

    8c10259a17402542f046d5f2264cdd0f15d858a0

    SHA256

    87639126579aaa6e79b9054557fd20a4f9e158634e27a8d50542ea8dbe8ffe2c

    SHA512

    65a6056f676109f7cb2be56dd0f573ab0e27c3d411c1ab3115611b098a5c00e6a05add23c064b2081c6a8d945e31f733c34551a142636e26de128e25826c01ae

  • C:\Program Files (x86)\X-Mirage\swscale.dll

    Filesize

    417KB

    MD5

    b94dd6629e544e6998e28f8cb96b0c3c

    SHA1

    bbfc1f32222e68d38768d92be4ee955965e33458

    SHA256

    9dd3f8e566b7f3d1be193f24e8ff2d2993be3b34c2d659de249ffcaa05325afd

    SHA512

    b83bdfe8236fd5761ed663fcf5e2289dd476a38f83b37ea067316beaa0c5f5f3578d8afa119fc46d0248d11a78efbe064dba08e8835cc49694397a57e610256f

  • C:\Program Files (x86)\X-Mirage\swscale.dll

    Filesize

    417KB

    MD5

    b94dd6629e544e6998e28f8cb96b0c3c

    SHA1

    bbfc1f32222e68d38768d92be4ee955965e33458

    SHA256

    9dd3f8e566b7f3d1be193f24e8ff2d2993be3b34c2d659de249ffcaa05325afd

    SHA512

    b83bdfe8236fd5761ed663fcf5e2289dd476a38f83b37ea067316beaa0c5f5f3578d8afa119fc46d0248d11a78efbe064dba08e8835cc49694397a57e610256f

  • C:\Program Files (x86)\X-Mirage\trprofile.dll

    Filesize

    232KB

    MD5

    45763ea5455fdc25fcf9655fb7619fe2

    SHA1

    f8193880bd5221a9fe8ce4fc66965e607faeec12

    SHA256

    b7b8579fe0d144552f847357b28c6e06f23a6d550d11a0a767d8ccd3dc7a2128

    SHA512

    51d2245bdecd4c2442db8bdc5672ece6a75ce3d48a578d640b811e37f7d9848408f5e7effc598935507933f2c19278e3626f3714bc2cc5c261e05567bf764018

  • C:\Program Files (x86)\X-Mirage\trprofile.dll

    Filesize

    232KB

    MD5

    45763ea5455fdc25fcf9655fb7619fe2

    SHA1

    f8193880bd5221a9fe8ce4fc66965e607faeec12

    SHA256

    b7b8579fe0d144552f847357b28c6e06f23a6d550d11a0a767d8ccd3dc7a2128

    SHA512

    51d2245bdecd4c2442db8bdc5672ece6a75ce3d48a578d640b811e37f7d9848408f5e7effc598935507933f2c19278e3626f3714bc2cc5c261e05567bf764018

  • C:\Program Files (x86)\X-Mirage\trprofile_r.data

    Filesize

    3KB

    MD5

    b182cd6e44be34e3c8b46c3d58809316

    SHA1

    75554e8fc3d7b3e891dea716d456416cb332a5c0

    SHA256

    6c4e187080ddd12b17922cd48a3ec4aaaf035fbd4408a8056449e185aed842ac

    SHA512

    2057f73117f5377784d4c9b7604eccd2a75bf25054cc91a10d99eb8ab900e3ca08885d07d332b1810dd773810019d822d23ef7b76af5264dedcfe6a8a1e69248

  • C:\Program Files (x86)\X-Mirage\trreg_ui.dll

    Filesize

    987KB

    MD5

    0402b19acf0c2b06363037c4247e368b

    SHA1

    8888c2ad143c90222082f84c23cfc315d1ac05ae

    SHA256

    3f43f631d48373abdcc134cc43542061806684637601abaa2d962dc186884348

    SHA512

    bb758f1f8898df2628055766c5216a816e47fd20a01028d26310d19ae186e155e2e4ad6c71dfa0892a72c1478b1400b7dc042cf706c23560aecedeeea33e3ab4

  • C:\Program Files (x86)\X-Mirage\trreg_ui.dll

    Filesize

    987KB

    MD5

    0402b19acf0c2b06363037c4247e368b

    SHA1

    8888c2ad143c90222082f84c23cfc315d1ac05ae

    SHA256

    3f43f631d48373abdcc134cc43542061806684637601abaa2d962dc186884348

    SHA512

    bb758f1f8898df2628055766c5216a816e47fd20a01028d26310d19ae186e155e2e4ad6c71dfa0892a72c1478b1400b7dc042cf706c23560aecedeeea33e3ab4

  • C:\Program Files (x86)\X-Mirage\trrender_d3d9.dll

    Filesize

    35KB

    MD5

    238de75c1014aa812316f5a8a2288fe4

    SHA1

    da7d693011c032cb43e2368586076c473ff6ec1c

    SHA256

    7e697fbe56d7b523ed2eba1047fc8e1d8ff81cc0156c3a0c74f9491465879725

    SHA512

    bd7900e1d02da6ebaa34b43a9770bd3ba125be495b2e8c9657d2886981b68b8dbe454917854c27109a2609922f407ad29ce3383f0fc85530b836905e84e15765

  • C:\Program Files (x86)\X-Mirage\trrender_d3d9.dll

    Filesize

    35KB

    MD5

    238de75c1014aa812316f5a8a2288fe4

    SHA1

    da7d693011c032cb43e2368586076c473ff6ec1c

    SHA256

    7e697fbe56d7b523ed2eba1047fc8e1d8ff81cc0156c3a0c74f9491465879725

    SHA512

    bd7900e1d02da6ebaa34b43a9770bd3ba125be495b2e8c9657d2886981b68b8dbe454917854c27109a2609922f407ad29ce3383f0fc85530b836905e84e15765

  • C:\Program Files (x86)\X-Mirage\trrender_dsound.dll

    Filesize

    44KB

    MD5

    bff035c8cb6464a472badd118b48ae70

    SHA1

    f5c9b29c2e7f13239ae6dab0dd46c43f52622e96

    SHA256

    75f48a92fdf8fda440a257eca84cc921bc84a9080f472dc3143df8d0c37e0c29

    SHA512

    7eac75506526f81d81dbfb470b435305e05de15f20fa4d7dcdc5bbbc5e343ba2b4c26b2cc133e8aad2600793ca0178dc402c226b1218e397b631d7ede2ff4323

  • C:\Program Files (x86)\X-Mirage\trrender_dsound.dll

    Filesize

    44KB

    MD5

    bff035c8cb6464a472badd118b48ae70

    SHA1

    f5c9b29c2e7f13239ae6dab0dd46c43f52622e96

    SHA256

    75f48a92fdf8fda440a257eca84cc921bc84a9080f472dc3143df8d0c37e0c29

    SHA512

    7eac75506526f81d81dbfb470b435305e05de15f20fa4d7dcdc5bbbc5e343ba2b4c26b2cc133e8aad2600793ca0178dc402c226b1218e397b631d7ede2ff4323

  • C:\Program Files (x86)\X-Mirage\trver.data

    Filesize

    25B

    MD5

    e4d15c9a8599252f26bfd87b6cdbc273

    SHA1

    083704776c282d5af5fc509d936e021bb48e3a67

    SHA256

    9fb9423ec9c3152a101754d57bdb09a2253d985012c3177cebb06159aeca525a

    SHA512

    b0177de247fff3cea47486568defc2936485b5b786a7e2baa68c8bc6db13b9153822eb0af9e6f4e1bae18dbbcb71b32980a12ac0542084ea54620ecd62fdc7ce

  • C:\Program Files (x86)\X-Mirage\vcomp140.dll

    Filesize

    146KB

    MD5

    21fce7c5111489a9f8613f3c175c250d

    SHA1

    69cbea5fbeabc0aca406efe87bf9ff09342dca83

    SHA256

    3e7942cfa2a18b463b57153f0f626dd7da0a5ca0a235bae573af5ce48a368066

    SHA512

    b31cd9158d8ba7ba874ea5d08b1356cd087c377a6afb1148567186f1cfaf9e3506a100f54e8e224488d328fa54c0d60ec015f42835f071931fa5a7cec34e49d1

  • C:\Program Files (x86)\X-Mirage\vcruntime140.dll

    Filesize

    74KB

    MD5

    87dd91c56be82866bf96ef1666f30a99

    SHA1

    3b78cb150110166ded8ea51fbde8ea506f72aeaf

    SHA256

    49b0fd1751342c253cac588dda82ec08e4ef43cebc5a9d80deb7928109b90c4f

    SHA512

    58c3ec6761624d14c7c897d8d0842dbeab200d445b4339905dac8a3635d174cdfb7b237d338d2829bc6c602c47503120af5be0c7de6abf2e71c81726285e44d6

  • C:\Users\Admin\AppData\Local\Temp\is-U9B3U.tmp\x-mirage-inst.tmp

    Filesize

    2.8MB

    MD5

    1337cc8677dc43eeba9292f63898f445

    SHA1

    c2dc1c91c186c20abbd8c8691b89697e8b81519c

    SHA256

    109f45236402f178b8d4a1d8d67829d62229424fa7bd8fc0873d526a20cb9dc6

    SHA512

    0e6d576f2f68caeb22f0455ded5cc54701c143e1c3d43e6f3fbb1ad3667c2860e1a3809953cae5f4329231ea7b7e2ef2ab81783f91b7e85b545eec6d1a220fd2

  • C:\Users\Admin\AppData\Local\Temp\is-U9B3U.tmp\x-mirage-inst.tmp

    Filesize

    2.8MB

    MD5

    1337cc8677dc43eeba9292f63898f445

    SHA1

    c2dc1c91c186c20abbd8c8691b89697e8b81519c

    SHA256

    109f45236402f178b8d4a1d8d67829d62229424fa7bd8fc0873d526a20cb9dc6

    SHA512

    0e6d576f2f68caeb22f0455ded5cc54701c143e1c3d43e6f3fbb1ad3667c2860e1a3809953cae5f4329231ea7b7e2ef2ab81783f91b7e85b545eec6d1a220fd2

  • memory/680-0-0x0000000000400000-0x0000000000525000-memory.dmp

    Filesize

    1.1MB

  • memory/680-7-0x0000000000400000-0x0000000000525000-memory.dmp

    Filesize

    1.1MB

  • memory/680-242-0x0000000000400000-0x0000000000525000-memory.dmp

    Filesize

    1.1MB

  • memory/1932-241-0x0000000000400000-0x00000000006DA000-memory.dmp

    Filesize

    2.9MB

  • memory/1932-146-0x0000000000400000-0x00000000006DA000-memory.dmp

    Filesize

    2.9MB

  • memory/1932-8-0x0000000000400000-0x00000000006DA000-memory.dmp

    Filesize

    2.9MB

  • memory/1932-11-0x00000000008B0000-0x00000000008B1000-memory.dmp

    Filesize

    4KB

  • memory/1932-55-0x0000000000400000-0x00000000006DA000-memory.dmp

    Filesize

    2.9MB

  • memory/1932-5-0x00000000008B0000-0x00000000008B1000-memory.dmp

    Filesize

    4KB

  • memory/2896-236-0x0000000002E60000-0x0000000002FE8000-memory.dmp

    Filesize

    1.5MB

  • memory/2896-240-0x0000000005C50000-0x0000000005C51000-memory.dmp

    Filesize

    4KB