Analysis
- max time kernel
85s - max time network
117s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/07/2026, 01:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-13_4f3ece02792041ca1611c17f65408734_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-13_4f3ece02792041ca1611c17f65408734_elex_wannacry.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
22 signatures
150 seconds
General
- Target 2026-07-13_4f3ece02792041ca1611c17f65408734_elex_wannacry.exe
- Size 56.0MB
- Sample260714-btff3sb19m
- SHA256 651ddbd7f9bef93cfa4be26f9c9f195788a8cb636b0207c0fa9fa1d27397652a
- MD5 4f3ece02792041ca1611c17f65408734
- SHA1 01d5bcc47d34fdd42407ac08fafba4c5e81898e1
- SHA512 b3f2169556b0f0c689bf12829db46f1da66c3cfe11c94e0eadd924a3c9010d52dde92fc38881277a4641a349ca149a239334b7b28fd2c8d83254548a980b3ee1
- SSDEEP 1572864:dSTIVEya5AJqkkzUKRrX1RYUijrsdqe3WPD1R9bC0:dSeEyu8qkkzz91YrXvPb9bj
- TLSH T1D3D7338235EFFCD2D43164317B339BDCEBADEA41A468C6DA59E01504617E22339DA3E1
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 4 IoCs
pid Process 688 LaunchINFSectionEx64.exe 3596 LaunchINFSectionEx64.exe 1360 mdxi.exe 1920 Installer.cmd - Loads dropped DLL 64 IoCs
pid Process 1360 mdxi.exe 1360 mdxi.exe 1360 mdxi.exe 1360 mdxi.exe 1360 mdxi.exe 1360 mdxi.exe 1360 mdxi.exe 1360 mdxi.exe 1360 mdxi.exe 1360 mdxi.exe 1360 mdxi.exe 1360 mdxi.exe 1360 mdxi.exe 1360 mdxi.exe 1360 mdxi.exe 1360 mdxi.exe 1360 mdxi.exe 1360 mdxi.exe 1360 mdxi.exe 1360 mdxi.exe 1360 mdxi.exe 1360 mdxi.exe 1360 mdxi.exe 1360 mdxi.exe 1360 mdxi.exe 1360 mdxi.exe 1360 mdxi.exe 1360 mdxi.exe 1360 mdxi.exe 1360 mdxi.exe 1360 mdxi.exe 1360 mdxi.exe 1360 mdxi.exe 1360 mdxi.exe 1360 mdxi.exe 1360 mdxi.exe 3592 vcredist_x86.exe 956 vcredist_x64.exe 1056 vcredist_x86.exe 3452 vcredist_x64.exe 4416 vc_redist.x86.exe 5804 vc_redist.x64.exe 700 vcredist_x86.exe 3188 MsiExec.exe 3188 MsiExec.exe 3188 MsiExec.exe 3188 MsiExec.exe 3188 MsiExec.exe 3188 MsiExec.exe 2968 vcredist_x64.exe 3188 MsiExec.exe 3188 MsiExec.exe 3188 MsiExec.exe 3188 MsiExec.exe 3188 MsiExec.exe 3188 MsiExec.exe 3188 MsiExec.exe 4744 MsiExec.exe 4744 MsiExec.exe 4744 MsiExec.exe 4744 MsiExec.exe 4744 MsiExec.exe 4744 MsiExec.exe 4744 MsiExec.exe - Adds Run key to start application 2 TTPs 7 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{4d8dcf8c-a72a-43e1-9833-c12724db736e} = "\"C:\\ProgramData\\Package Cache\\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\\VC_redist.x86.exe\" /burn.runonce" vc_redist.x86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13} = "\"C:\\ProgramData\\Package Cache\\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\\VC_redist.x64.exe\" /burn.runonce" vc_redist.x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{61087a79-ac85-455c-934d-1fa22cc64f36} = "\"C:\\ProgramData\\Package Cache\\{61087a79-ac85-455c-934d-1fa22cc64f36}\\vcredist_x86.exe\" /burn.runonce" vcredist_x86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{ef6b00ec-13e1-4c25-9064-b2f383cb8412} = "\"C:\\ProgramData\\Package Cache\\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\\vcredist_x64.exe\" /burn.runonce" vcredist_x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13} = "\"C:\\ProgramData\\Package Cache\\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\\VC_redist.x64.exe\" /burn.runonce" VC_redist.x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{61087a79-ac85-455c-934d-1fa22cc64f36} = "\"C:\\ProgramData\\Package Cache\\{61087a79-ac85-455c-934d-1fa22cc64f36}\\vcredist_x86.exe\" /burn.runonce" vcredist_x86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{ef6b00ec-13e1-4c25-9064-b2f383cb8412} = "\"C:\\ProgramData\\Package Cache\\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\\vcredist_x64.exe\" /burn.runonce" vcredist_x64.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Windows\assembly\Desktop.ini mdxi.exe File created C:\Windows\assembly\Desktop.ini mdxi.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\I: MsiExec.exe File opened (read-only) \??\A: MsiExec.exe File opened (read-only) \??\Q: MsiExec.exe File opened (read-only) \??\M: MsiExec.exe File opened (read-only) \??\P: VC_redist.x64.exe File opened (read-only) \??\A: MsiExec.exe File opened (read-only) \??\I: MsiExec.exe File opened (read-only) \??\T: MsiExec.exe File opened (read-only) \??\X: MsiExec.exe File opened (read-only) \??\V: VC_redist.x64.exe File opened (read-only) \??\O: MsiExec.exe File opened (read-only) \??\Y: MsiExec.exe File opened (read-only) \??\A: VC_redist.x64.exe File opened (read-only) \??\D: VC_redist.x64.exe File opened (read-only) \??\K: MsiExec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\L: MsiExec.exe File opened (read-only) \??\R: MsiExec.exe File opened (read-only) \??\U: MsiExec.exe File opened (read-only) \??\T: VC_redist.x64.exe File opened (read-only) \??\N: MsiExec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\P: MsiExec.exe File opened (read-only) \??\D: MsiExec.exe File opened (read-only) \??\L: MsiExec.exe File opened (read-only) \??\W: MsiExec.exe File opened (read-only) \??\Z: MsiExec.exe File opened (read-only) \??\B: MsiExec.exe File opened (read-only) \??\W: MsiExec.exe File opened (read-only) \??\N: VC_redist.x64.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Q: VC_redist.x64.exe File opened (read-only) \??\Y: MsiExec.exe File opened (read-only) \??\I: VC_redist.x64.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: VC_redist.x64.exe File opened (read-only) \??\I: MsiExec.exe File opened (read-only) \??\O: MsiExec.exe File opened (read-only) \??\R: MsiExec.exe File opened (read-only) \??\H: MsiExec.exe File opened (read-only) \??\Z: MsiExec.exe File opened (read-only) \??\W: VC_redist.x64.exe File opened (read-only) \??\Y: MsiExec.exe File opened (read-only) \??\J: VC_redist.x64.exe File opened (read-only) \??\Z: VC_redist.x64.exe File opened (read-only) \??\J: MsiExec.exe File opened (read-only) \??\B: MsiExec.exe File opened (read-only) \??\K: VC_redist.x64.exe File opened (read-only) \??\R: VC_redist.x64.exe File opened (read-only) \??\S: MsiExec.exe File opened (read-only) \??\U: MsiExec.exe File opened (read-only) \??\N: MsiExec.exe File opened (read-only) \??\H: MsiExec.exe File opened (read-only) \??\J: MsiExec.exe File opened (read-only) \??\P: MsiExec.exe File opened (read-only) \??\D: MsiExec.exe File opened (read-only) \??\L: MsiExec.exe File opened (read-only) \??\W: MsiExec.exe File opened (read-only) \??\O: MsiExec.exe File opened (read-only) \??\G: VC_redist.x64.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\system32\SET3298.tmp LaunchINFSectionEx64.exe File created C:\Windows\system32\SET3573.tmp LaunchINFSectionEx64.exe File created C:\Windows\SysWOW64\SET3F47.tmp LaunchINFSectionEx64.exe File opened for modification C:\Windows\system32\mfc120ita.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfcm110.dll msiexec.exe File opened for modification C:\Windows\system32\SET2A99.tmp LaunchINFSectionEx64.exe File opened for modification C:\Windows\system32\XAPOFX1_0.dll LaunchINFSectionEx64.exe File opened for modification C:\Windows\system32\XAPOFX1_3.dll LaunchINFSectionEx64.exe File opened for modification C:\Windows\SysWOW64\SET406D.tmp LaunchINFSectionEx64.exe File created C:\Windows\SysWOW64\SET414C.tmp LaunchINFSectionEx64.exe File opened for modification C:\Windows\SysWOW64\xactengine3_1.dll LaunchINFSectionEx64.exe File opened for modification C:\Windows\system32\SET2A85.tmp LaunchINFSectionEx64.exe File opened for modification C:\Windows\system32\SET34CD.tmp LaunchINFSectionEx64.exe File opened for modification C:\Windows\SysWOW64\mfc120cht.dll msiexec.exe File opened for modification C:\Windows\system32\d3dx10_34.dll LaunchINFSectionEx64.exe File opened for modification C:\Windows\system32\SET2A55.tmp LaunchINFSectionEx64.exe File created C:\Windows\SysWOW64\SET3E77.tmp LaunchINFSectionEx64.exe File opened for modification C:\Windows\SysWOW64\SET3EAA.tmp LaunchINFSectionEx64.exe File opened for modification C:\Windows\SysWOW64\SET3EAB.tmp LaunchINFSectionEx64.exe File opened for modification C:\Windows\SysWOW64\d3dx10_41.dll LaunchINFSectionEx64.exe File opened for modification C:\Windows\SysWOW64\SET4115.tmp LaunchINFSectionEx64.exe File opened for modification C:\Windows\SysWOW64\SET4138.tmp LaunchINFSectionEx64.exe File created C:\Windows\system32\SET2AAA.tmp LaunchINFSectionEx64.exe File opened for modification C:\Windows\system32\SET3266.tmp LaunchINFSectionEx64.exe File created C:\Windows\system32\SET35AB.tmp LaunchINFSectionEx64.exe File created C:\Windows\SysWOW64\SET3F88.tmp LaunchINFSectionEx64.exe File opened for modification C:\Windows\SysWOW64\SET4175.tmp LaunchINFSectionEx64.exe File opened for modification C:\Windows\system32\mfc140rus.dll msiexec.exe File opened for modification \??\c:\Windows\SysWOW64\mfcm100.dll msiexec.exe File opened for modification \??\c:\Windows\system32\mfcm100u.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc110ita.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\SET415F.tmp LaunchINFSectionEx64.exe File opened for modification C:\Windows\SysWOW64\xactengine3_6.dll LaunchINFSectionEx64.exe File opened for modification \??\c:\Windows\SysWOW64\mfc100esn.dll msiexec.exe File opened for modification \??\c:\Windows\SysWOW64\mfc100rus.dll msiexec.exe File created C:\Windows\system32\SET2C42.tmp LaunchINFSectionEx64.exe File opened for modification C:\Windows\system32\XAudio2_3.dll LaunchINFSectionEx64.exe File created C:\Windows\SysWOW64\SET3F34.tmp LaunchINFSectionEx64.exe File opened for modification C:\Windows\system32\xactengine2_4.dll LaunchINFSectionEx64.exe File opened for modification C:\Windows\system32\SET35BC.tmp LaunchINFSectionEx64.exe File opened for modification C:\Windows\SysWOW64\d3dx10_42.dll LaunchINFSectionEx64.exe File created C:\Windows\SysWOW64\SET41E7.tmp LaunchINFSectionEx64.exe File opened for modification C:\Windows\system32\mfc140jpn.dll msiexec.exe File opened for modification C:\Windows\system32\SET35E0.tmp LaunchINFSectionEx64.exe File created C:\Windows\SysWOW64\SET3EFC.tmp LaunchINFSectionEx64.exe File opened for modification C:\Windows\SysWOW64\SET4127.tmp LaunchINFSectionEx64.exe File opened for modification C:\Windows\SysWOW64\SET41E9.tmp LaunchINFSectionEx64.exe File opened for modification C:\Windows\system32\vcomp120.dll msiexec.exe File opened for modification \??\c:\Windows\system32\mfc100jpn.dll msiexec.exe File opened for modification C:\Windows\system32\SET2A86.tmp LaunchINFSectionEx64.exe File opened for modification C:\Windows\system32\XAudio2_4.dll LaunchINFSectionEx64.exe File opened for modification C:\Windows\system32\XAudio2_7.dll LaunchINFSectionEx64.exe File created C:\Windows\SysWOW64\SET41C3.tmp LaunchINFSectionEx64.exe File created C:\Windows\system32\SET35AC.tmp LaunchINFSectionEx64.exe File opened for modification C:\Windows\SysWOW64\SET3E75.tmp LaunchINFSectionEx64.exe File opened for modification C:\Windows\SysWOW64\SET3F58.tmp LaunchINFSectionEx64.exe File opened for modification C:\Windows\SysWOW64\d3dx9_26.dll LaunchINFSectionEx64.exe File opened for modification C:\Windows\SysWOW64\SET40C3.tmp LaunchINFSectionEx64.exe File opened for modification C:\Windows\SysWOW64\xactengine2_7.dll LaunchINFSectionEx64.exe File opened for modification \??\c:\Windows\system32\mfc100chs.dll msiexec.exe File opened for modification C:\Windows\system32\SET2A14.tmp LaunchINFSectionEx64.exe File opened for modification C:\Windows\SysWOW64\d3dx9_33.dll LaunchINFSectionEx64.exe File created C:\Windows\SysWOW64\SET4162.tmp LaunchINFSectionEx64.exe File opened for modification C:\Windows\SysWOW64\xinput1_3.dll LaunchINFSectionEx64.exe - Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification \??\c:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia90.dll msiexec.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia100.dll msiexec.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll msiexec.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\VC\msdia100.dll msiexec.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification \??\c:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfc100ita_x64 msiexec.exe File opened for modification \??\c:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfc100kor_x64 msiexec.exe File opened for modification C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2906.0\Microsoft.DirectX.Direct3DX.dll LaunchINFSectionEx64.exe File created C:\Windows\assembly\tmp\ZJ7UBF2L\Microsoft.DirectX.Diagnostics.dll mdxi.exe File opened for modification C:\Windows\assembly\tmp\O32JTAQU\__AssemblyInfo__.ini mdxi.exe File opened for modification \??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100rus_x86 msiexec.exe File opened for modification \??\c:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfc100_x64 msiexec.exe File opened for modification \??\c:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI497.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4B8.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF4D4E0AEA67E957F8.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI113A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI12C3.tmp msiexec.exe File created C:\Windows\assembly\tmp\1IHJU2O8\Microsoft.DirectX.Direct3DX.dll mdxi.exe File created C:\Windows\SystemTemp\~DFEFCB737341185E32.TMP msiexec.exe File opened for modification \??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100chs_x86 msiexec.exe File opened for modification \??\c:\Windows\Installer\1231c.msp msiexec.exe File opened for modification C:\Windows\Installer\MSI2957.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2C6A.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\SET434E.tmp LaunchINFSectionEx64.exe File opened for modification C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Direct3DX.dll LaunchINFSectionEx64.exe File opened for modification C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\SET4360.tmp LaunchINFSectionEx64.exe File created C:\Windows\SystemTemp\~DFB15D4DFBBAD18814.TMP msiexec.exe File opened for modification \??\c:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfc100deu_x64 msiexec.exe File created C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2903.0\SET439A.tmp LaunchINFSectionEx64.exe File opened for modification C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2904.0\Microsoft.DirectX.Direct3DX.dll LaunchINFSectionEx64.exe File created C:\Windows\Microsoft.NET\DirectX for Managed Code\SET43FA.tmp LaunchINFSectionEx64.exe File created C:\Windows\assembly\tmp\30ROE94Y\Microsoft.DirectX.AudioVideoPlayback.dll mdxi.exe File opened for modification C:\Windows\Installer\MSIE1B.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.AudioVideoPlayback.xml LaunchINFSectionEx64.exe File opened for modification C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Diagnostics.dll LaunchINFSectionEx64.exe File opened for modification C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2904.0\SET439B.tmp LaunchINFSectionEx64.exe File opened for modification C:\Windows\assembly\tmp\5HP2TCEY\__AssemblyInfo__.ini mdxi.exe File opened for modification C:\Windows\Installer\MSIEC00.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI24BB.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2903.0\SET439A.tmp LaunchINFSectionEx64.exe File opened for modification C:\Windows\assembly\tmp\L7BLPM4B\__AssemblyInfo__.ini mdxi.exe File created C:\Windows\SystemTemp\~DF6CDDF18C4ED43C98.TMP msiexec.exe File opened for modification \??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100enu_x86 msiexec.exe File opened for modification C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectSound.dll LaunchINFSectionEx64.exe File opened for modification C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2908.0\Microsoft.DirectX.Direct3DX.xml LaunchINFSectionEx64.exe File opened for modification C:\Windows\Installer\MSIC72.tmp msiexec.exe File created C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\SET4372.tmp LaunchINFSectionEx64.exe File opened for modification C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\SET4386.tmp LaunchINFSectionEx64.exe File opened for modification C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2909.0\SET43D5.tmp LaunchINFSectionEx64.exe File opened for modification C:\Windows\assembly\tmp\EPP8DOA9\__AssemblyInfo__.ini mdxi.exe File created C:\Windows\SystemTemp\~DFEBE2542D766695BC.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF53A61AFDC79798AC.TMP msiexec.exe File opened for modification \??\c:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_msvcp100_x64 msiexec.exe File opened for modification C:\Windows\Installer\MSI128.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Direct3D.xml LaunchINFSectionEx64.exe File opened for modification C:\Windows\Microsoft.NET\DirectX for Managed Code\SET43F9.tmp LaunchINFSectionEx64.exe File opened for modification \??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_msvcr100_x86 msiexec.exe File created C:\Windows\SystemTemp\~DF8A0A7DA29DB2DD01.TMP msiexec.exe File opened for modification C:\Windows\assembly\tmp\3MZSQYLG\__AssemblyInfo__.ini mdxi.exe File opened for modification C:\Windows\assembly\tmp\PAHKZR8T\__AssemblyInfo__.ini mdxi.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI4D8.tmp msiexec.exe File created C:\Windows\dd_vcredist_amd64_001_vcRuntimeMinimum_x64.log vcredist_x64.exe File opened for modification C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2903.0\Microsoft.DirectX.Direct3DX.xml LaunchINFSectionEx64.exe File opened for modification C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2911.0\Microsoft.DirectX.Direct3DX.xml LaunchINFSectionEx64.exe File created C:\Windows\SystemTemp\~DFFEA1781E89070D6A.TMP msiexec.exe File opened for modification \??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100esn_x86 msiexec.exe File opened for modification C:\Windows\Installer\MSI25D8.tmp msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 3 IoCs
pid pid_target Process procid_target 4520 3452 WerFault.exe 117 6016 5804 WerFault.exe 133 5364 2968 WerFault.exe 121 - System Location Discovery: System Language Discovery 1 TTPs 47 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-13_4f3ece02792041ca1611c17f65408734_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vc_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vc_redist.x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist_x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vc_redist.x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mdxi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vc_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist_x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist_x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist_x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Installer.cmd Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist_x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist_x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vc_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist_x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vc_redist.x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-13_4f3ece02792041ca1611c17f65408734_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-13_4f3ece02792041ca1611c17f65408734_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000085dc765dd76e689e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380185dc765d0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410185dc765d000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e385dc765d00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e685dc765d00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 27 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\31 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\33 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\30 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\31 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\32 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\34 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2D msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2F msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2f msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\32 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\33 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\30 msiexec.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8BB7778B-645B-4475-9A73-1DE3170BD3AF} LaunchINFSectionEx64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D3332F02-3DD0-4DE9-9AEC-20D85C4111B6}\ = "XACT Engine" LaunchINFSectionEx64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D3332F02-3DD0-4DE9-9AEC-20D85C4111B6}\InProcServer32 LaunchINFSectionEx64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4C9B6DDE-6809-46E6-A278-9B6A97588670}\ = "XAudio2" LaunchINFSectionEx64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C\SourceList msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEMINIMUMVSU_AMD64,V14\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13} vc_redist.x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{54B68BC7-3A45-416B-A8C9-19BF19EC1DF5}\InProcServer32 LaunchINFSectionEx64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C0C56F46-29B1-44E9-9939-A32CE86867E2}\InProcServer32 LaunchINFSectionEx64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3EDA9B49-2085-498B-9BB2-39A6778493DE}\InProcServer32\ = "C:\\Windows\\SysWOW64\\XAudio2_6.dll" LaunchINFSectionEx64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E48C5A3F-93EF-43BB-A092-2C7CEB946F27}\InProcServer32\ThreadingModel = "Both" LaunchINFSectionEx64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1926E8D15D0BCE53481466615F760A7F\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03219E78-5BC3-44D1-B92E-F63D89CC6526} LaunchINFSectionEx64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0977D092-2D95-4E43-8D42-9DDCC2545ED5}\InProcServer32\ = "C:\\Windows\\system32\\xactengine3_4.dll" LaunchINFSectionEx64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E21A7345-EB21-468E-BE50-804DB97CF708} LaunchINFSectionEx64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1F1B577E-5E5A-4E8A-BA73-C657EA8E8598}\ = "XACT Engine" LaunchINFSectionEx64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FAC23F48-31F5-45A8-B49B-5225D61401AA} LaunchINFSectionEx64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\Dependents vc_redist.x86.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E21A7345-EB21-468E-BE50-804DB97CF708}\InProcServer32 LaunchINFSectionEx64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5A508685-A254-4FBA-9B82-9A24B00306AF}\InProcServer32\ThreadingModel = "Both" LaunchINFSectionEx64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C0C56F46-29B1-44E9-9939-A32CE86867E2} LaunchINFSectionEx64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3EDA9B49-2085-498B-9BB2-39A6778493DE}\InProcServer32\ThreadingModel = "Both" LaunchINFSectionEx64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C0C56F46-29B1-44E9-9939-A32CE86867E2}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_0.dll" LaunchINFSectionEx64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C7338B95-52B8-4542-AA79-42EB016C8C1C}\InProcServer32\ThreadingModel = "Both" LaunchINFSectionEx64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{248D8A3B-6256-44D3-A018-2AC96C459F47}\ = "XACT Engine" LaunchINFSectionEx64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{54B68BC7-3A45-416B-A8C9-19BF19EC1DF5}\InProcServer32\ThreadingModel = "Both" LaunchINFSectionEx64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0977D092-2D95-4E43-8D42-9DDCC2545ED5}\ = "XACT Engine" LaunchINFSectionEx64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BCC782BC-6492-4C22-8C35-F5D72FE73C6E}\InProcServer32\ = "C:\\Windows\\SysWOW64\\xactengine3_7.dll" LaunchINFSectionEx64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5A508685-A254-4FBA-9B82-9A24B00306AF}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_7.dll" LaunchINFSectionEx64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6A93130E-1D53-41D1-A9CF-E758800BB179}\InProcServer32 LaunchINFSectionEx64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BCC782BC-6492-4C22-8C35-F5D72FE73C6E}\InProcServer32 LaunchINFSectionEx64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAC1105F-619B-4D04-831A-44E1CBF12D57}\InProcServer32\ThreadingModel = "Both" LaunchINFSectionEx64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F5CA7B34-8055-42C0-B836-216129EB7E30}\InProcServer32 LaunchINFSectionEx64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Dependents vc_redist.x64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A2D1F4F1AD9DFC2399908484D50AD65D msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CE6380BC270BD863282B3D74B09F7570\Language = "1033" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2139E6DA-C341-4774-9AC3-B4E026347F64}\ = "AudioVolumeMeter" LaunchINFSectionEx64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4C9B6DDE-6809-46E6-A278-9B6A97588670} LaunchINFSectionEx64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BC3E0FC6-2E0D-4C45-BC61-D9C328319BD8}\InProcServer32\ = "C:\\Windows\\SysWOW64\\xactengine2_4.dll" LaunchINFSectionEx64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{61087a79-ac85-455c-934d-1fa22cc64f36} vcredist_x86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\ProductName = "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.30.30704" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B802058A-464A-42DB-BC10-B650D6F2586A}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_2.dll" LaunchINFSectionEx64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4C9B6DDE-6809-46E6-A278-9B6A97588670}\InProcServer32\ThreadingModel = "Both" LaunchINFSectionEx64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{629CF0DE-3ECC-41E7-9926-F7E43EEBEC51}\ = "AudioReverb" LaunchINFSectionEx64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C60FAE90-4183-4A3F-B2F7-AC1DC49B0E5C}\InProcServer32\ = "C:\\Windows\\SysWOW64\\xactengine2_2.dll" LaunchINFSectionEx64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v12 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEADDITIONALVSU_AMD64,V12\DEPENDENTS\{EF6B00EC-13E1-4C25-9064-B2F383CB8412} vcredist_x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CE6380BC270BD863282B3D74B09F7570\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{CB0836EC-B072-368D-82B2-D3470BF95707}v12.0.40660\\packages\\vcRuntimeMinimum_amd64\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77C56BF4-18A1-42B0-88AF-5072CE814949}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_8.dll" LaunchINFSectionEx64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E21A7345-EB21-468E-BE50-804DB97CF708}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_1.dll" LaunchINFSectionEx64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3A2495CE-31D0-435B-8CCF-E9F0843FD960}\InProcServer32 LaunchINFSectionEx64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12B8D03ED28D112328CCF0A0D541598E\SourceList\Net msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\44DB0475D85BA123FA0CD6D35465DDC6 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D3332F02-3DD0-4DE9-9AEC-20D85C4111B6}\ = "XACT Engine" LaunchINFSectionEx64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{962F5027-99BE-4692-A468-85802CF8DE61}\ = "XACT Engine" LaunchINFSectionEx64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3B80EE2A-B0F5-4780-9E30-90CB39685B03}\InProcServer32\ = "C:\\Windows\\SysWOW64\\xactengine3_0.dll" LaunchINFSectionEx64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CD0D66EC-8057-43F5-ACBD-66DFB36FD78C}\InProcServer32\ThreadingModel = "Both" LaunchINFSectionEx64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CE6380BC270BD863282B3D74B09F7570\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{CB0836EC-B072-368D-82B2-D3470BF95707}v12.0.40660\\packages\\vcRuntimeMinimum_amd64\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1F1B577E-5E5A-4E8A-BA73-C657EA8E8598} LaunchINFSectionEx64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0AA000AA-F404-11D9-BD7A-0010DC4F8F81}\InProcServer32 LaunchINFSectionEx64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1F1B577E-5E5A-4E8A-BA73-C657EA8E8598} LaunchINFSectionEx64.exe - Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 5780 msiexec.exe 5780 msiexec.exe 5780 msiexec.exe 5780 msiexec.exe 5780 msiexec.exe 5780 msiexec.exe 5780 msiexec.exe 5780 msiexec.exe 5780 msiexec.exe 5780 msiexec.exe 5780 msiexec.exe 5780 msiexec.exe 5780 msiexec.exe 5780 msiexec.exe 5780 msiexec.exe 5780 msiexec.exe 5780 msiexec.exe 5780 msiexec.exe 5780 msiexec.exe 5780 msiexec.exe 5780 msiexec.exe 5780 msiexec.exe 5780 msiexec.exe 5780 msiexec.exe 5780 msiexec.exe 5780 msiexec.exe 5780 msiexec.exe 5780 msiexec.exe 5780 msiexec.exe 5780 msiexec.exe 5780 msiexec.exe 5780 msiexec.exe 5780 msiexec.exe 5780 msiexec.exe 5780 msiexec.exe 5780 msiexec.exe 5780 msiexec.exe 5780 msiexec.exe 5780 msiexec.exe 5780 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeBackupPrivilege 3836 vssvc.exe Token: SeRestorePrivilege 3836 vssvc.exe Token: SeAuditPrivilege 3836 vssvc.exe Token: SeBackupPrivilege 4860 srtasks.exe Token: SeRestorePrivilege 4860 srtasks.exe Token: SeSecurityPrivilege 4860 srtasks.exe Token: SeTakeOwnershipPrivilege 4860 srtasks.exe Token: SeShutdownPrivilege 5336 vcredist_x86.exe Token: SeIncreaseQuotaPrivilege 5336 vcredist_x86.exe Token: SeSecurityPrivilege 5780 msiexec.exe Token: SeCreateTokenPrivilege 5336 vcredist_x86.exe Token: SeAssignPrimaryTokenPrivilege 5336 vcredist_x86.exe Token: SeLockMemoryPrivilege 5336 vcredist_x86.exe Token: SeIncreaseQuotaPrivilege 5336 vcredist_x86.exe Token: SeMachineAccountPrivilege 5336 vcredist_x86.exe Token: SeTcbPrivilege 5336 vcredist_x86.exe Token: SeSecurityPrivilege 5336 vcredist_x86.exe Token: SeTakeOwnershipPrivilege 5336 vcredist_x86.exe Token: SeLoadDriverPrivilege 5336 vcredist_x86.exe Token: SeSystemProfilePrivilege 5336 vcredist_x86.exe Token: SeSystemtimePrivilege 5336 vcredist_x86.exe Token: SeProfSingleProcessPrivilege 5336 vcredist_x86.exe Token: SeIncBasePriorityPrivilege 5336 vcredist_x86.exe Token: SeCreatePagefilePrivilege 5336 vcredist_x86.exe Token: SeCreatePermanentPrivilege 5336 vcredist_x86.exe Token: SeBackupPrivilege 5336 vcredist_x86.exe Token: SeRestorePrivilege 5336 vcredist_x86.exe Token: SeShutdownPrivilege 5336 vcredist_x86.exe Token: SeDebugPrivilege 5336 vcredist_x86.exe Token: SeAuditPrivilege 5336 vcredist_x86.exe Token: SeSystemEnvironmentPrivilege 5336 vcredist_x86.exe Token: SeChangeNotifyPrivilege 5336 vcredist_x86.exe Token: SeRemoteShutdownPrivilege 5336 vcredist_x86.exe Token: SeUndockPrivilege 5336 vcredist_x86.exe Token: SeSyncAgentPrivilege 5336 vcredist_x86.exe Token: SeEnableDelegationPrivilege 5336 vcredist_x86.exe Token: SeManageVolumePrivilege 5336 vcredist_x86.exe Token: SeImpersonatePrivilege 5336 vcredist_x86.exe Token: SeCreateGlobalPrivilege 5336 vcredist_x86.exe Token: SeRestorePrivilege 5780 msiexec.exe Token: SeTakeOwnershipPrivilege 5780 msiexec.exe Token: SeRestorePrivilege 5780 msiexec.exe Token: SeTakeOwnershipPrivilege 5780 msiexec.exe Token: SeRestorePrivilege 5780 msiexec.exe Token: SeTakeOwnershipPrivilege 5780 msiexec.exe Token: SeRestorePrivilege 5780 msiexec.exe Token: SeTakeOwnershipPrivilege 5780 msiexec.exe Token: SeRestorePrivilege 5780 msiexec.exe Token: SeTakeOwnershipPrivilege 5780 msiexec.exe Token: SeRestorePrivilege 5780 msiexec.exe Token: SeTakeOwnershipPrivilege 5780 msiexec.exe Token: SeRestorePrivilege 5780 msiexec.exe Token: SeTakeOwnershipPrivilege 5780 msiexec.exe Token: SeRestorePrivilege 5780 msiexec.exe Token: SeTakeOwnershipPrivilege 5780 msiexec.exe Token: SeRestorePrivilege 5780 msiexec.exe Token: SeTakeOwnershipPrivilege 5780 msiexec.exe Token: SeRestorePrivilege 5780 msiexec.exe Token: SeTakeOwnershipPrivilege 5780 msiexec.exe Token: SeRestorePrivilege 5780 msiexec.exe Token: SeTakeOwnershipPrivilege 5780 msiexec.exe Token: SeRestorePrivilege 5780 msiexec.exe Token: SeTakeOwnershipPrivilege 5780 msiexec.exe Token: SeRestorePrivilege 5780 msiexec.exe - Suspicious use of FindShellTrayWindow 24 IoCs
pid Process 5016 2026-07-13_4f3ece02792041ca1611c17f65408734_elex_wannacry.exe 3592 vcredist_x86.exe 956 vcredist_x64.exe 1056 vcredist_x86.exe 3452 vcredist_x64.exe 4416 vc_redist.x86.exe 5804 vc_redist.x64.exe 700 vcredist_x86.exe 4112 MsiExec.exe 2968 vcredist_x64.exe 4112 MsiExec.exe 3696 MsiExec.exe 1144 VC_redist.x86.exe 3696 MsiExec.exe 4616 MsiExec.exe 568 VC_redist.x64.exe 4616 MsiExec.exe 1700 MsiExec.exe 1700 MsiExec.exe 3156 MsiExec.exe 3156 MsiExec.exe 4228 MsiExec.exe 4228 MsiExec.exe 2724 MsiExec.exe - Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 5780 msiexec.exe 4112 MsiExec.exe 3188 MsiExec.exe 3696 MsiExec.exe 4744 MsiExec.exe 4616 MsiExec.exe 1092 MsiExec.exe 1700 MsiExec.exe 1532 MsiExec.exe 3156 MsiExec.exe 3416 MsiExec.exe 4228 MsiExec.exe 5772 MsiExec.exe 2724 MsiExec.exe - Suspicious use of WriteProcessMemory 46 IoCs
description pid Process procid_target PID 5016 wrote to memory of 3348 5016 2026-07-13_4f3ece02792041ca1611c17f65408734_elex_wannacry.exe 87 PID 3348 wrote to memory of 688 3348 2026-07-13_4f3ece02792041ca1611c17f65408734_elex_wannacry.exe 88 PID 5016 wrote to memory of 2004 5016 2026-07-13_4f3ece02792041ca1611c17f65408734_elex_wannacry.exe 89 PID 2004 wrote to memory of 3596 2004 2026-07-13_4f3ece02792041ca1611c17f65408734_elex_wannacry.exe 90 PID 3596 wrote to memory of 1360 3596 LaunchINFSectionEx64.exe 91 PID 5016 wrote to memory of 1920 5016 2026-07-13_4f3ece02792041ca1611c17f65408734_elex_wannacry.exe 92 PID 1920 wrote to memory of 5988 1920 Installer.cmd 94 PID 1920 wrote to memory of 3536 1920 Installer.cmd 95 PID 3536 wrote to memory of 3592 3536 vcredist_x86.exe 96 PID 1920 wrote to memory of 1080 1920 Installer.cmd 105 PID 1080 wrote to memory of 956 1080 vcredist_x64.exe 106 PID 1920 wrote to memory of 5336 1920 Installer.cmd 109 PID 5336 wrote to memory of 1056 5336 vcredist_x86.exe 110 PID 2848 wrote to memory of 4292 2848 vcredist_x86.exe 114 PID 4292 wrote to memory of 700 4292 vcredist_x86.exe 115 PID 1920 wrote to memory of 4836 1920 Installer.cmd 116 PID 4836 wrote to memory of 3452 4836 vcredist_x64.exe 117 PID 2620 wrote to memory of 1064 2620 vcredist_x64.exe 120 PID 1064 wrote to memory of 2968 1064 vcredist_x64.exe 121 PID 1920 wrote to memory of 3720 1920 Installer.cmd 125 PID 3720 wrote to memory of 4416 3720 vc_redist.x86.exe 126 PID 4416 wrote to memory of 3976 4416 vc_redist.x86.exe 127 PID 3296 wrote to memory of 3192 3296 VC_redist.x86.exe 130 PID 3192 wrote to memory of 1144 3192 VC_redist.x86.exe 131 PID 1920 wrote to memory of 4640 1920 Installer.cmd 132 PID 4640 wrote to memory of 5804 4640 vc_redist.x64.exe 133 PID 5804 wrote to memory of 5088 5804 vc_redist.x64.exe 134 PID 2404 wrote to memory of 4144 2404 VC_redist.x64.exe 137 PID 4144 wrote to memory of 568 4144 VC_redist.x64.exe 138 PID 1920 wrote to memory of 2720 1920 Installer.cmd 141 PID 1920 wrote to memory of 4112 1920 Installer.cmd 142 PID 5780 wrote to memory of 3188 5780 msiexec.exe 143 PID 1920 wrote to memory of 3696 1920 Installer.cmd 144 PID 5780 wrote to memory of 4744 5780 msiexec.exe 145 PID 1920 wrote to memory of 4616 1920 Installer.cmd 146 PID 5780 wrote to memory of 1092 5780 msiexec.exe 149 PID 568 wrote to memory of 2436 568 VC_redist.x64.exe 150 PID 1920 wrote to memory of 1700 1920 Installer.cmd 152 PID 5780 wrote to memory of 1532 5780 msiexec.exe 153 PID 1920 wrote to memory of 4920 1920 Installer.cmd 154 PID 1920 wrote to memory of 120 1920 Installer.cmd 155 PID 1920 wrote to memory of 3156 1920 Installer.cmd 156 PID 5780 wrote to memory of 3416 5780 msiexec.exe 157 PID 1920 wrote to memory of 4228 1920 Installer.cmd 158 PID 5780 wrote to memory of 5772 5780 msiexec.exe 159 PID 1920 wrote to memory of 2724 1920 Installer.cmd 160 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-13_4f3ece02792041ca1611c17f65408734_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-13_4f3ece02792041ca1611c17f65408734_elex_wannacry.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\2026-07-13_4f3ece02792041ca1611c17f65408734_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-13_4f3ece02792041ca1611c17f65408734_elex_wannacry.exe" -sfxwaitall:0 "dx\LaunchINFSectionEx64.exe" dx\DXeurt.inf,Passive,,82⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\LaunchINFSectionEx64.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\LaunchINFSectionEx64.exe" dx\DXeurt.inf,Passive,,83⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:688
-
-
-
C:\Users\Admin\AppData\Local\Temp\2026-07-13_4f3ece02792041ca1611c17f65408734_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-13_4f3ece02792041ca1611c17f65408734_elex_wannacry.exe" -sfxwaitall:0 "dx\LaunchINFSectionEx64.exe" dx\DXmngd.inf,Passive,,82⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\LaunchINFSectionEx64.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\LaunchINFSectionEx64.exe" dx\DXmngd.inf,Passive,,83⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Windows\Microsoft.NET\DirectX for Managed Code\mdxi.exe"C:\Windows\Microsoft.NET\DirectX for Managed Code\mdxi.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1360
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Installer.cmd"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Installer.cmd" /auto2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
- System Location Discovery: System Language Discovery
PID:5988
-
-
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /uninstall /passive /norestart3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{8B8C823A-626C-4261-B0E4-B1883F8BE018} {B329F568-1A44-444D-B1F6-876DE4C1F9C9} 35364⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:3592
-
-
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /uninstall /passive /norestart3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{842F9425-EF6C-4047-9821-1A2562505606} {66540834-2E05-4072-8285-9E14E800A80D} 10804⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:956
-
-
-
C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe"C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /uninstall /passive /norestart3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5336 -
C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe"C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{AE1D548E-E2D7-459D-A6AE-3313DC3B6F97} {E6F43B9C-F627-4DB1-99B0-2DCBDDFBC13A} 53364⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:1056
-
-
-
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /uninstall /passive /norestart3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{EFF55BAF-21C7-43F5-ABF4-1BD145C92785} {14C3374A-DEC4-4199-B251-3FD9CF0C89ED} 48364⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:3452 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3452 -s 12165⤵
- Program crash
PID:4520
-
-
-
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\vc_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\vc_redist.x86.exe" /uninstall /passive /norestart3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\vc_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\vc_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\vc_redist.x86.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 /uninstall /passive /norestart4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\vc_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\vc_redist.x86.exe" -q -burn.elevated BurnPipe.{DFCD53FB-7286-4C10-97F1-5AB8D8BBAD57} {7DFC2D12-2A8B-47D7-8239-AE3236ED9359} 44165⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3976
-
-
-
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\vc_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\vc_redist.x64.exe" /uninstall /passive /norestart3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\vc_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\vc_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\vc_redist.x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 /uninstall /passive /norestart4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5804 -
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\vc_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\vc_redist.x64.exe" -q -burn.elevated BurnPipe.{7E9E3A45-EF60-46A5-BB4D-F5C7A474A8EF} {68D900E2-DC68-4F78-896F-6394F36B2419} 58045⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5088
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5804 -s 9525⤵
- Program crash
PID:6016
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
- System Location Discovery: System Language Discovery
PID:2720
-
-
C:\Windows\SysWOW64\MsiExec.exe"MsiExec.exe" /X{9BE518E6-ECC6-35A9-88E4-87755C07200F} /passive /norestart3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4112
-
-
C:\Windows\SysWOW64\MsiExec.exe"MsiExec.exe" /X{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /passive /norestart3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3696
-
-
C:\Windows\SysWOW64\MsiExec.exe"MsiExec.exe" /X{B175520C-86A2-35A7-8619-86DC379688B9} /passive /norestart3⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4616
-
-
C:\Windows\SysWOW64\MsiExec.exe"MsiExec.exe" /X{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /passive /norestart3⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1700
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
- System Location Discovery: System Language Discovery
PID:4920
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
- System Location Discovery: System Language Discovery
PID:120
-
-
C:\Windows\SysWOW64\MsiExec.exe"MsiExec.exe" /X{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /passive /norestart3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3156
-
-
C:\Windows\SysWOW64\MsiExec.exe"MsiExec.exe" /X{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /passive /norestart3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4228
-
-
C:\Windows\SysWOW64\MsiExec.exe"MsiExec.exe" /X{37B8F9C7-03FB-3253-8781-2517C99D7C00} /passive /norestart3⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2724
-
-
C:\Windows\SysWOW64\MsiExec.exe"MsiExec.exe" /X{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97} /passive /norestart3⤵PID:1100
-
-
C:\Windows\SysWOW64\MsiExec.exe"MsiExec.exe" /X{CB0836EC-B072-368D-82B2-D3470BF95707} /passive /norestart3⤵PID:3856
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:3252
-
-
C:\Windows\SysWOW64\MsiExec.exe"MsiExec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2005\x64\vcredist.msi" MSIFASTINSTALL=3 /qb3⤵PID:2332
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:4424
-
-
C:\Windows\SysWOW64\MsiExec.exe"MsiExec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2008\x64\vc_red.msi" MSIFASTINSTALL=3 /qb3⤵PID:2272
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:3672
-
-
C:\Windows\SysWOW64\MsiExec.exe"MsiExec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2010\x64\vc_red.msi" MSIFASTINSTALL=3 /qb3⤵PID:4216
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:1112
-
-
C:\Windows\SysWOW64\MsiExec.exe"MsiExec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x64\vc_runtimeMinimum_x64.msi" MSIFASTINSTALL=3 /qb3⤵PID:4572
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:2368
-
-
C:\Windows\SysWOW64\MsiExec.exe"MsiExec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x64\vc_runtimeAdditional_x64.msi" MSIFASTINSTALL=3 /qb3⤵PID:4896
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:2904
-
-
C:\Windows\SysWOW64\MsiExec.exe"MsiExec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x64\vc_runtimeMinimum_x64.msi" MSIFASTINSTALL=3 /qb3⤵PID:1396
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:3016
-
-
C:\Windows\SysWOW64\MsiExec.exe"MsiExec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x64\vc_runtimeAdditional_x64.msi" MSIFASTINSTALL=3 /qb3⤵PID:1596
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:1448
-
-
C:\Windows\SysWOW64\MsiExec.exe"MsiExec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2022\x64\vc_runtimeMinimum_x64.msi" MSIFASTINSTALL=3 /qb3⤵PID:5808
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:4432
-
-
C:\Windows\SysWOW64\MsiExec.exe"MsiExec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2022\x64\vc_runtimeAdditional_x64.msi" MSIFASTINSTALL=3 /qb3⤵PID:200
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:1552
-
-
C:\Windows\SysWOW64\MsiExec.exe"MsiExec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2005\x86\vcredist.msi" MSIFASTINSTALL=3 /qb3⤵PID:3632
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:3176
-
-
C:\Windows\SysWOW64\MsiExec.exe"MsiExec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2008\x86\vc_red.msi" MSIFASTINSTALL=3 /qb3⤵PID:4136
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:6076
-
-
C:\Windows\SysWOW64\MsiExec.exe"MsiExec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2010\x86\vc_red.msi" MSIFASTINSTALL=3 /qb3⤵PID:1148
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:3012
-
-
C:\Windows\SysWOW64\MsiExec.exe"MsiExec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x86\vc_runtimeMinimum_x86.msi" MSIFASTINSTALL=3 /qb3⤵PID:3188
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:4164
-
-
C:\Windows\SysWOW64\MsiExec.exe"MsiExec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x86\vc_runtimeAdditional_x86.msi" MSIFASTINSTALL=3 /qb3⤵PID:6132
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:2744
-
-
C:\Windows\SysWOW64\MsiExec.exe"MsiExec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x86\vc_runtimeMinimum_x86.msi" MSIFASTINSTALL=3 /qb3⤵PID:956
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3836
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
PID:4860
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:31⤵PID:3504
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5780 -
\??\c:\Windows\syswow64\MsiExec.exec:\Windows\syswow64\MsiExec.exe -Embedding A59D5F38B5C3898E675642AD51E609622⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3188
-
-
\??\c:\Windows\syswow64\MsiExec.exec:\Windows\syswow64\MsiExec.exe -Embedding 3BC2242FA813C279DB0589911999C11C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4744
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F255B0EC3BC6FCBE94F279DE18B3055B2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1092
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 3BECC79A4BB22A183422ED865F9A067F2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1532
-
-
\??\c:\Windows\System32\MsiExec.exec:\Windows\System32\MsiExec.exe -Embedding 8C7C9F414CA5E902D8B4697A59A7668B2⤵
- Suspicious use of SetWindowsHookEx
PID:3416
-
-
\??\c:\Windows\System32\MsiExec.exec:\Windows\System32\MsiExec.exe -Embedding B6D07122E86E0A9DBB7331EEC8F5C9982⤵
- Suspicious use of SetWindowsHookEx
PID:5772
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6EFED24A4300E396686CCD87957D959E2⤵PID:3828
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F3C306B4EFBA2C682703D7AC0DDFB9E82⤵PID:3224
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A7DA239EC523BBDE3A524CD4AD3678DC2⤵PID:6124
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D18C735E358989A45D27B39C069FCA6C2⤵PID:5028
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0C4C51F7FA1A903529CF06F3590CA0562⤵PID:1556
-
-
C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe"C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /burn.runonce1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe"C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260714022715.log"2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe"C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260714022715.log" -burn.unelevated BurnPipe.{8ACC5566-CC4E-4B45-B3A2-B19D0E49680B} {35AFEAA7-FA3B-48A0-A2E1-E6B8142A1D68} 42923⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:700
-
-
-
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /burn.runonce1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260714022719.log"2⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260714022719.log" -burn.unelevated BurnPipe.{1F451146-0ADC-4D33-93AF-FA315C574670} {E5FA0A9B-F5A4-4F36-AF16-D648E4767819} 10643⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:2968 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 10884⤵
- Program crash
PID:5364
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3452 -ip 34521⤵PID:2476
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" /burn.runonce1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260714022721.log"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260714022721.log"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:1144
-
-
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" /burn.runonce1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260714022724.log"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260714022724.log"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:568 -
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{04E24AAD-6A53-4C61-88A6-227360CDF037} {2331C72D-D645-4CF8-B896-CA084D4DAD48} 5684⤵
- Adds Run key to start application
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:2436
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 5804 -ip 58041⤵PID:2020
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2968 -ip 29681⤵PID:1448
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59d336.rbs
- Size 21KB
- SHA256 7880b6f979d5734148f45affbcceae5769f678eee78cb89b251aa9fe91fe11cb
- MD5 ced9ab861381a80713b196377329ddd3
- SHA1 039e3ef3e13f4791940870049615ae4055befd36
- SHA512 bfacb47f767578f2b7a2d37a9073e3547b510493df3083604a4ac3d4c9d2a7ae36555ffbfd64c1fc5c06b94392d887b92484975df1a3582cc68c0162971cbfe6
- SSDEEP 384:onRsWRLwe5esSOMX3Mq8KywUf9WX1JSYtTAZQ4pB:oRZUe5erOMX3Mq8KtI9WX1JSYtTAZQ4T
- TLSH T182A2DB03B640D6D3D8672B30DD2B1B257B76C7E99311839B04EC92344EA77C62F9A58E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e59d347.rbs
- Size 14KB
- SHA256 52a704c67f1c7cee863eb7e86a1fc0d99cee012d8ed4bc9cd2b82593407c74ff
- MD5 cd63866e8e82b9b7b0d197e16c3da819
- SHA1 19cbbb99fd8ad8159d15516bdd294abbd1674a18
- SHA512 71f107dd1b39de1aba70a802012eb4eced1b4ee2352f3546a88c08eb9513f44481a61416e3f72cbff174ad66bed9406bf95be5a428949e3a67f6c68f747c841a
- SSDEEP 96:B7/MNp48xNpM0Q7ztH8R/eDwYx12tH8RIeDwYCj71rR7c7QNpx1FNpLxcNpkFaxm:BLYR7YbRoYYaqbzfCgPo6/WIfl
- TLSH T1B052F003AB0586C7DDA62B30CA231B247B73C7EE9354835B21DDD1748E577862E8D68E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e59d34e.rbs
- Size 20KB
- SHA256 cc91ee844372f0974cbdaeb81bce5d659c409831a7708e6ee6bfc594fcde9998
- MD5 6fe3b0bd5d4b0160b9019df668c1f75e
- SHA1 4523f0d2582e1960e007ed23bf5e0f142c86a55e
- SHA512 94e173808acbb6212f3aadc05e8be7d2211adc34ab6c97be4c136753db4d7f45be83c684b5215deb36ae2e9ff91e82a66b81f6572da0317679e0e31ca9f445d0
- SSDEEP 384:X0RaglRIgFfXMawmn28I1S9HXVZFbLQPO0iODIYIexGGTixG13ft:XoagIifXMawmn28IA9HXVZFbkPO0ieIc
- TLSH T1D1A2FE03A64495D3D8B62F70DD670BA47B72CBE99361434B40DCD5394F933C22E9AA8E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e59d35f.rbs
- Size 17KB
- SHA256 60b551c4147733a4cc70a4e98854590150da771b2514c848c8c2c4acd6f22e88
- MD5 7de7459624b0cd1a07bdb9798c25cd95
- SHA1 7aba785b84c24a48d0176d1f85efba61843681e0
- SHA512 2a3f96b09d430909a602df240aa68fb22749a48e76e1a4186288d043d583e0e2b2595c48224a61f17f6747292e1b21f21aeaf595f7d97e51e5542c82a1807d6e
- SSDEEP 96:XeRp55Rp/NfWT8RqeDd11xQo8ReeDd11Cjtknz0yWcW/Rp0Q2RpVdzRp9OXw3Tjz:X2R51GRl1Hn4Xyin5f7e+nh18X0Ny
- TLSH T1C082FE42A94096C3E8662B70DD5717703BB6D7E5E344839B40DC92349F877D22F9E28E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e59d366.rbs
- Size 21KB
- SHA256 6534470cf0f47d3b7ca69e24488f39b07585d303d33febfc3278612759a725b5
- MD5 30483a17c6317c8aa9e5f22a622b730f
- SHA1 62065b90d7a1d2e5be86bf528767849ed27c8067
- SHA512 03f3fcc7853a1710a77db6247779ec19f04ac8bf05fdacf8613211109c1b93e65627f1e70dd3f4b12687127b57d26039cc86751d79597025720b7c102c8e43e1
- SSDEEP 384:nKRbGRSnAKxNAUhUC7xJjrMNYPzIbSfTkwl40vIZ2fRkP:nKSWAKhkms
- TLSH T1F1A20F03768089E3D8622BB1DD671BA53F72D7D99350434B50ECD2348F633C72E5AA9A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e59d37a.rbs
- Size 31KB
- SHA256 9406484dc09630156010e6df35497b36f112828777037e68755e47ad6f501726
- MD5 b7ca74526849c832df1bf74486075140
- SHA1 959bf2f953bfb1f658bff95dcca42ed356ffc7a1
- SHA512 2af912e26dd6a53cbfdc740e9dc2994eb7cf0508e62fd143ea687fabe2d4d19c9e79cdd01ad09347da0adbaf491aed56e88fbcb5260ce38230321089b3f8a245
- SSDEEP 384:2W8N8uRSeRDTu8iu8Au8XcAlRTMV/ZawBV3yFgmkJRu+Ru2S:2jtXs2VvRIVxDe6JRu+RuJ
- TLSH T132E26402F64EDAD2ED283730CE872BA57BD3D3E6530E1A5B00CE91701B46BD94D5D26A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e59d37e.rbs
- Size 22KB
- SHA256 910474bf10d7ae30e030abe5adb9ac53f346df01ced8c4a8a7804d9af3fa4b7a
- MD5 0f16ef5b6960a751e9e2d6d00cf22dee
- SHA1 4c5809a188dd4593e8a57ab56a1d5fb37090cf07
- SHA512 d1b8e6eed0c63e132b62cf1c4ed18d987525b7cec111627856b8db9c4720382eb303f5c7964a110a0c487f2f9873de0028ffd9d8265d8b0afcf995742c932838
- SSDEEP 384:wuR3RRdNUZUGz5YkrcZqbogvXDb7k5ECxvWPMgK7:wensE
- TLSH T158A2CB026A40C5E3C86B2B30ED671B693B32D7D59394878700DD91748EA73D72F5DA8E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e59d38f.rbs
- Size 49KB
- SHA256 80aaf43e51774da0c2bcf95ed3c36df5827d0afd3818a30aee95ca6bd5be72c5
- MD5 f1f3f0c11202feb33bb03084ff54c019
- SHA1 f6181ca9589aada11b73ca1cd4297bfc0db831e5
- SHA512 93b2de598412207f9add5cf1f26c034ce6d495854372d59e90b431f99c8b4b91dc0f70bfaef99a68576b6c32cf07c1448e8ca5c14fec7fb37f7e9174a89f0560
- SSDEEP 768:3p8iWVQKRy2Rs2iOD0MMGrLxBgqYfJ1gVsyQvJV1QR/LSI:UJ7Ma
- TLSH T11133CD027344D6D3D6662E30CD070BB57F3BC2A69321866B54ADC1788FA7BC62E85E4D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e59d3b3.rbf
- Size 3B
- SHA256 13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
- MD5 21438ef4b9ad4fc266b6129a2f60de29
- SHA1 5eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd
- SHA512 37436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237
- MD5 SHA1 SHA512
- Path C:\Config.Msi\e59d3bb.rbs
- Size 20KB
- SHA256 4b14641d4bec7e61f50755bc32b9c18bc4a1da462bb201e7b44be091d77dd034
- MD5 8b643be0a030ffcc39c63c532204e546
- SHA1 9a03cc601d38a53a9cd9d9255a84f8aca51a3b8b
- SHA512 fa53841d81a80217b34e0eed8bc81c20084c2b5b5ff1369864f5dfa30dec23a84c8f7c13d30627a8ee8486e5a4c2fb3fb6cca8163ea19a8ceb7888a7e38e828b
- SSDEEP 192:KGRO1kRL1XCt7oUNwADIc1f+W+y4+oAkgC7f7:KGRO6RLMVC81f/cq0f7
- TLSH T119A20C02BA80C9D2D4766B31CD671B653B76D7D5A350438B50DC91308F93BCA2F9DA8E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e59d3cb.rbs
- Size 31KB
- SHA256 fe7b682f66ba932a4f72ffb551440c427b82fde55edfa27db5ecd573f56f3161
- MD5 4406d84815e44b22dec7a9aaa386bac1
- SHA1 81465ae3e33c2d58d02ebfa37875f66b608964d2
- SHA512 bb29a7d5fa80a8cf5ead4de33919ef433e5319142cd6caa45d2f04a84b0c0bede31b5117222b3348774f794988fbf4e5933c6bb3331d627a93f23e0d8798c233
- SSDEEP 768:8i0nKGEYuxy1SQBP1sAE6HRzY1WY3BYBYFY7YYYpYYlxlQrnr:o16s
- TLSH T118E27207F316A6D2E9493F74C5032B6CBB97D7A5830E064F44DDC8A00E66BC66E5938B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e59d3cf.rbs
- Size 52KB
- SHA256 90aaccbdec8650fe5e73371dd901ff4b9bf49e2234bae184c962430e1ae2cfc8
- MD5 0fb326f2f9bcfeb13d7b1401760b0ce6
- SHA1 210cc118b97eba4c5ed4167a8999b5d2b84e4d4e
- SHA512 30f0d6b50e673faae792112c3906678531be8d6e7375422b04f5c999ee3d751a61b8951baa560a8b96fecccd635bdba22358eb65754d7fab1b51966af4ff77bc
- SSDEEP 384:IlUaRnLRxt9I29m4Z9qjSZvPrwtFpCndsTfjUEulJGw8fRZKO1RZxJ9ZRZOBRZDA:IfljZ9qM7k1/fuv/HO
- TLSH T1333340027680D0D2D5652BB2FC2F0794BF36DAA65721029F81DDD6388E273C66E8DE4D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e59d3fa.rbs
- Size 15KB
- SHA256 08f94d9b84a8353a20925271886e652a4964b95056a6416ea507a58694bd2a6e
- MD5 4d300053dcc7cb688d079c0b8f9ca111
- SHA1 477579a771d15f6720281fc23f1ef340c9f4414c
- SHA512 f9bb159278f77fb5dc04dd5c3a3174946332b3a27b26c381244a9a8a140e0af2a684cab6efb3f57e0074cbef73fd9a12c5c45149d463ff38a390a83395c0a18e
- SSDEEP 384:GF9RUqX27RRUmX2tsDQZpgBmQ7fpqPfdw3v:GJOr4M
- TLSH T125623F426A1681E2D8672B30CA0B1BA93F76C7D5D355834B01CD96308F477CA7EDDA8E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e59d40d.rbs
- Size 41KB
- SHA256 d1e0cc84ee384ef8ccc5ee743efcd93eb747c844d021893724a43dc2307355df
- MD5 6a69d0d283225cbfac94a45fe3e1487b
- SHA1 5b472bc3147344dd9c5b864a09b78acd63bec764
- SHA512 77a349b3b9609d3fc8c244e21fa497cb56b2be5db56827e33bce9018cec934ec67f786bf6fccdde69e9dd96f33508a12dd1e65b8ee14daa2488960b94a1c241f
- SSDEEP 768:YQyMuCg21kTx9/DoflxL1JcEYswN04NNcnLj45:PyMuCg21kTx9/DoflxL1JcEYfkg
- TLSH T12A1351027900C0C7E5662BB1EC2F17847375D7D79B21439F85CEA534AE873CA5E89E4A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e59d413.rbs
- Size 3KB
- SHA256 a8c5ed1d95ceeca6df1fa7c8e53389bbd2ff324f293dcd87a24df504fc401df1
- MD5 cadc45c425c270d7d730d71e072ca6a1
- SHA1 9b7a0ca7fff90254b76d8645ca9e2c89a5f12a56
- SHA512 df84325147f889a7f413f93741ad024115a44ab042f48582ab7f852bfe2c0955b977a3ec899d21fefa6f6c2ef2c98e5b2545cf56da2199c37c72b85d69ab484a
- TLSH T1C671B142DA4482D6ECA96B30CD471B2037B3D3DAC364838715CC91709E47BD5AFEA58A
- MD5 SHA1 SHA512 TLSH
- Path C:\Config.Msi\e59d416.rbs
- Size 3KB
- SHA256 2135f04367a284838268067c72f8e930fd012f2e8b8a699724e8c74984f31ffd
- MD5 32032371651d6e68fd979b21d8582204
- SHA1 e9be0be17d2f3ad00b868777b1f5dfd349c393dc
- SHA512 4d40016d807fc105f32e580018ff561dfa6f6b19167043a3846b47cc7141eec40eec2f92285d9e061bef3aea2267a49d757a6444d9e2984ded4c671cfa162690
- TLSH T1B271CB03954893D6DCE2BB30CA571B1433B7C7DAD7648387008C92700E477DAAFEA28A
- MD5 SHA1 SHA512 TLSH
- Path C:\Config.Msi\e59d41a.rbs
- Size 14KB
- SHA256 22f1faf919b761f737882667c6d1c8c2a00546eed738dce7a333a9e5d218d005
- MD5 f288e97b982e621f4c50892a53326261
- SHA1 81817368b2851aaceaf1cf852bb83e166584a4d4
- SHA512 29648dd03c116f7ed6087fbfb0f1fb39e062497e4c1d35ebf8b63f08b2f2efd6b1fee22b54c11f30afa822df7ecc7d45de5b163c0c29923c40bdba4a11e8e2f0
- SSDEEP 192:hyJXuj2IYcw/0FBCl1dlAkI4dlAkJnFEXENNep6F:hytuj2IYcwzIoIOh
- TLSH T1FD62F042A60082D3E8AB2B74DE5727183BB5D3DBD391638B08CD91304F437CA5F9969E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e59d41f.rbs
- Size 21KB
- SHA256 4168378ac98255f8cb708456606271e7de2ea985f7d7e68609762a26f7dc1ddf
- MD5 2a44b2715c6be1a8fcdb44a160698e1f
- SHA1 04e73c118f9353d28ec616e7759991a1735e6115
- SHA512 4775c78b8100af2bc20b34e4369e805ecc297fe8db4d4842164d85249fdabc76fee4331da6d8e95c3c04bef2feba0badfaa8333ad4b169982af99053612d9d82
- SSDEEP 384:IMT8MgXEtmrnb0MM0IE+AfCuS588UkRQT4TB5XDcpq:IMT8MgXEtmrnb0MM0IScLF
- TLSH T190A2ED42A640D6C3D8A76B30DE5B1B653735C3DAA7A4534B01CCD0345FD33CA6F9AA8A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e59d424.rbs
- Size 18KB
- SHA256 6b623699a958367c08e8de58441706a858a78901bc0351a2d0d02b407137374d
- MD5 d71d0e2056e4785fc940e6029ee28286
- SHA1 5b51f7be04b262843b61783806a3aee96648e440
- SHA512 bf4c14d497c3217584bf2c524c35765c4571737f91d4d99434ee8679be023442f4f1c54c83302dc036f22004495eb504084a348597292d2bbe711d2de1d2c377
- SSDEEP 192:L4eWt646A6/6Z6v6u6+U6p676m656o6h6t6TqhlEZrkdVClQJXvs4IlaJXvs4Vle:LH7TCwSVmge9QLI0YFE8FETB
- TLSH T1C692FB01AA04C5D3D8A72670DD57172637B6E3DEE7A5930B00CC91349EC3BCA5FAD29A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e59d429.rbs
- Size 21KB
- SHA256 2fd7d11905c607b1436917827920c6462f750cb7176b180518d167bdaec6de5b
- MD5 d9eeee6757fbb5aef4b3bbb49e8cf50c
- SHA1 1f2e8b3adccc5756f72bdaa489439519f96677a4
- SHA512 f1425c0a9ccc18b73f620d41b3f1782dffdbb2e67556dbd62196812872b452f3a3e9af075cac539c2271338182c9996322194040813a8d02b2b1e963d1cea9de
- SSDEEP 384:LWG9VQIBsY6pYbtjz4XegzsalckU72eC6dFDSM+Mw8pce/rWl:LWG9VQIBsY6pYbtPmeg8F+bf8OFl
- TLSH T1EDA2EC4AAA008593D46B2B70DD976B683772C7DA9761934B04DCE0308F933C66FDD68E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e59d438.rbs
- Size 41KB
- SHA256 5678bd8a30c583f605b8f98c3d05c08ae1bbd496d1570b46a324cebe94b57108
- MD5 4af54fb1463d24bcacafe9ba79f034e5
- SHA1 0479cf55e626316b83e962c3c17a4d930272e6c3
- SHA512 3860d8466f76c05754b195df26509b633506d92b74dbea1e4b44954acf5330d6cc48882cdaf80698dae34cee07e35e095bbe0043c83d7e4316bce8768931b3d2
- SSDEEP 768:rBW4uxO+YgpiqeHs0wgdKztZk52OllTbZg:w61g
- TLSH T16713EF426600D2C3EAA61A30CE071B657B7AC3E6D715976F14CED0704FC3BC92E99B5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e59d43e.rbs
- Size 3KB
- SHA256 e2dd51e35dd1b2e4aae60f5dab6ce58fdb91caa0f5391f5b1f523f7686973723
- MD5 2d2e866bc2159aaee94acd0e28ea3e0a
- SHA1 753e16e47c3922b587a5e0a291e66ec945326775
- SHA512 fd938bb343b23dc56b6231cceb87a2c7d9f847e53be0cb73ee40b91723f27701184a60f576273bca28d01a93bc2c812f6683e4c2a9c31a88eeacacdd0b9e486a
- TLSH T10E71A9039904D2C2EDE63BB0D9571B6537B3C7EA8790938B11CC91704E47BC6AEDA24A
- MD5 SHA1 SHA512 TLSH
- Path C:\Config.Msi\e59d441.rbs
- Size 3KB
- SHA256 7fb7f5a5ae5960d1a3920b757b8c145387e00e8b07eee2353726162fcacf8305
- MD5 f62e3416a81de8d529ce213a556f2634
- SHA1 232d8f73ffab5893012601f1d1b4846decd4cd77
- SHA512 5ccf06558681ef41060833c44ba64a6e3f3dffe19f0906ba87d99a3841fddfda39611144f4c4e9ad791f2e5b8341f18b698cc17fcaf09333fb30e65c04091abb
- TLSH T12A71C043994492D2DCA62B70CA270B6877B7D7DE9750438B458CC1740E877C5AEDB28B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2010\x86\vc_red.msi
- Size 196KB
- SHA256 9e51555009f1d7839c090ec50db52ec755a870a14caefe78ec4abe984dfac5b8
- MD5 3c189067ef0d1fc8d42a8ff6a151f040
- SHA1 78d09605b608a7d58ac55c86a5f3176345d07590
- SHA512 bb313896bae8bdfd1d3435d349e0d7911b43fc148306be09a718b446b7577910d29242a7d289a65800559884002e1533bc49063a399656e62bf81d5c03381d8a
- SSDEEP 3072:BdoNmUU75uXwwOTMYRradauqCcJg95fOdi4tLw3mmqyyyyyyyyy:BdQSRWd1qdmDmmqyyyyyyyyy
- TLSH T146145B42B653C133E8827330156E673E3F3C6C645B61858B328AB69D5F73AC4963A3D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Installer.cmd
- Size 424KB
- SHA256 be8c97df5351fa7eb466f883d67aa9f06655c714ae3dc44459455599cae49afb
- MD5 3bd1178622d8ff8830fec4d4e2a33481
- SHA1 7c68ddd59fb93c94914b2aad099278a72634343e
- SHA512 c79269e0c32e9691c385876ac11166c692cb0cc64ad6a102467d5b1ea0a726a6665e8bdab0cddc56d3cabc12f85110b555ae608e96a92340ea9620a05bfb24f7
- SSDEEP 6144:EVU2AHulogBEO1/L1+sKWSeUUv4MG9kKRLtMk3QmpighFpsSqc8Bo+ynRgp/MoXN:oU2AANidSeGmAghAeJg13Jwo
- TLSH T113946B10B562C033E26196B10D7ACFA69A78AC715F7059CB73C05EBA5D306C2AB35F1B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\29063dx.xml
- Size 1.4MB
- SHA256 59986eba5cb424d9c388a2d23e4581ae465d3ff767eee913f6cd07dc1f9e7254
- MD5 dae21601cf373590e5ab8eb13fb79b7a
- SHA1 bf15bbbc72980a5a506a8333f150f9cbb73bb35e
- SHA512 c9d0b272634cdc5f6dbbc4789789d1d9178df9e90cc906be90326384699d49e69ac095a802a90d02ce84f69f7f9b0412ec2f3582709100912e23f344bb1d0d4b
- SSDEEP 6144:W6HD4/iYC7RchI1FyUtEERyjgrzl6ZhNt2VnHttN8+D5qkgGjO2NMT7fIN0Y5m:7D+iYC7RchI1FyatN8+D5qkuIN0Y5m
- TLSH T1F165FF20B6DCCA2684A342131C84B980FB5C4677645EDD1D388D6F2E6B76ED1E63F893
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64D3DCompiler_37.dll
- Size 1.8MB
- SHA256 425f0d7ee0f2845424266aa56f2cdce3a61541d5e2c7d7813f4373e45df0cb8b
- MD5 31026cea5afa2798292179102c06fe40
- SHA1 d0a4291094d188e3132eff6c566f1a4074036965
- SHA512 5131bb146140bc5a9e3abd5408519d1bc350f64ff0c39ba10ad2ef576f5e45e6e55b7d4bbf75d443c825ff03f736fe71cf0f2430cf588cb5eedbf9b8d37471df
- SSDEEP 24576:TAT9yOlzhX22O1oM76wSX7dN7GwTFvoBbcd4tx4qrV/lL3jfqPPkLY5z:o9/lzhYV76wA7d5GyvubK4tyq5/JLq9
- TLSH T130854B47E3A150E8C1ABC1748A926357FEB1B848532057E75290E7252F7BBE1AD3FB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64D3DCompiler_38.dll
- Size 1.9MB
- SHA256 1ff6374215e326b72dbdc2fe8af4f9002c5d755358ed8795d781f4a1078af174
- MD5 a7e59bb6fac119fabb83f18bd72aa1d7
- SHA1 4026fdef6f07ce8045350791d532d517c80b2109
- SHA512 384a2b0412557441178ef7d42380a39bfd96be691adf5ccb30c709904916ee42f874762ef74717b56a79ddbddcaa391524766231196ee4eee61c5b462d3b0e7a
- SSDEEP 24576:oRntYsMDgAyrPAIg1Kb/gBqASgJyLabuW3nl1LUuOJQ8doi3+mb:OYsMDgzkIMKb/gUAr02buW3l1LUui1dP
- TLSH T1AE954A47E3A190E8C1A7C138CA525356FAB1BC18472457E79250E72A2F77FE1AD3EB04
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64D3DCompiler_39.dll
- Size 1.9MB
- SHA256 54f4f734dd149ef9ee8c999cc3d7858082b85c551f17fa08553cde1abdee3c3e
- MD5 7741a0a6ced6c441b97d625b730d6075
- SHA1 3208ff2450f303e618c7ed62cf1036d03a2cc58c
- SHA512 057089bc7ba1faf974ae69dd29e6952f32c773b40393f405910058ef7e3a49c85e11f97dc5f535452c58a109bd989a7dfc741293baaba1d42d0b53cdacd34d8f
- SSDEEP 49152:owjuL075fPu83KnqH68VAxEgSjyZAU6Itn:oN07tv3KquEgSjyZAU6c
- TLSH T120954A47F3A150E8C1A7C134CA529356FAB1BC48472457E79290E72A2F77BE1AD3EB04
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64D3DCompiler_40.dll
- Size 2.5MB
- SHA256 bd81cf5c9b127519dbeb284e699e9d7545ee1130e655fd6a4e66b959e9d9aaac
- MD5 37309b833480dc69fde7db68f9b8bc20
- SHA1 2de2234f94d422a8f6d286150c307772850a8702
- SHA512 576f31d7619eb0dc98d90d8b831692eb9b489592c8605c27af7fe4b9c0fb1afc2ffc080b40a140feda01ca03d869cc577b6c443af6cdc52a3f6f9c456ce3a418
- SSDEEP 49152:AusFs53eKgXlTagGdz5TWOSTzJCBPEFvcNq4O:ka3YG1tWsmvcNnO
- TLSH T164C54A46E3A3C0F8C56BC134C553961AEB70B808432457D7B650EB6E2F77BE29A3A714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64D3DCompiler_41.dll
- Size 2.3MB
- SHA256 f96d915c2d51346fe1a35a7d0b7acef7a3734af2c75579085fce9d1a29e0f2e6
- MD5 a59a5bade4af200c720d99eae6e04e0e
- SHA1 3c918aee68fa2465e56b93cb7cfe884e2e166c96
- SHA512 07a1d209a307ac8c66052e8b189ce86ae61ce43547bf633526784279182236041a3d3bc92ce4d4c5e28437464b25dd2d7a596d7cdcdccc6237a253fd60362d32
- SSDEEP 49152:k+H4QPVoh+InjjYI/KfcSvkhpfWCMWZjIvYAl/CsSP:njcJnA7NWZr
- TLSH T19BB56B4AE3A180E9C567C138C653A213EB70780447209BD75650EB6E2F77FE29A7F724
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64D3DCompiler_42.dll
- Size 2.5MB
- SHA256 4d61e843aa86d8801a60d01b8e872379c5b2503795a2bcbe6141978396ade00b
- MD5 e92d2e4afa43cd39a8c1c2c2db59667e
- SHA1 35011f5ffdd070ce9d19052d589af02df9e3e94e
- SHA512 1cd8966b58be205b99cca480ea3fdeea38214580fb464bd6e6397e3ba1854dba1f71a964dc4f1ef47ce668e71deb8c785c3b827aa2630f1827961b6c61514239
- SSDEEP 49152:cOk2W3AmsPwVLo+UzmUYzfdVZI5IP+lB4YtevCOWh:bWw1upCOWh
- TLSH T149C57D47F3A180E9C9ABC1B48A535317EB70780443249BD75250EA662FBBFE25A3F714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64D3DCompiler_43.dll
- Size 2.4MB
- SHA256 44c3a7e330b54a35a9efa015831392593aa02e7da1460be429d17c3644850e8a
- MD5 ada0c39d4eacdc81fd84163a95d62079
- SHA1 207321f1b449985b2d06ed50b989fa6259e4eb8e
- SHA512 1afc63db5d2030b76abc19094fc9fef28cc6250bd265294647e65db81f13749c867722924460f7a6021c739f4057f95501f0322cdec28a2101bf94164557a1a5
- SSDEEP 49152:zf59zPxKcvHzDB6t3+C0/aJfyLg7Ie4Xy+5j4m2CTB:M2642o7lftd
- TLSH T1ACC56C46B6A080F9C6AB81748A975703FBB0781403245BDB5160E6656FB3FF26E3F724
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64X3DAudio1_3.dll
- Size 27KB
- SHA256 96c2a80a7fa7670d323e584b956cc98f69f2a22e5329ce4a93269468b142de44
- MD5 c4c2ed69b18ee1c60026877fcc470fa7
- SHA1 59dc0272c4e376a2598dbd9a82dc07be32fbad78
- SHA512 f85612fae3734054722a030852ea46d303ffbe3920485344ae8e48cef02ac1a0a20e608a1b44645c93bd6d1091748e16cbde605640e982132415144013763f3c
- SSDEEP 768:+3LIRKmmUvIH5kzOWu+tXckM19U8Cy/jt:+YQUvIZkzOWu+v0u8Cy/x
- TLSH T1D5C24B81E67CD14EF8166CF562A8F9837C3573C1872989DB62E299CC046B7C086B962D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64X3DAudio1_4.dll
- Size 27KB
- SHA256 e38b62c0946b9e4e1446e0f8c6335fc7328eb20cc587e310983f3f6d6571ac5d
- MD5 de6004d16dbacd781ed4596c4fea7d14
- SHA1 1e1c8b6b5b1b2094140ea8bad543639c8a0f29b4
- SHA512 dd5fc2e7bb8fa922afed47a820cff84d896c24410ff1038548036840d7fcf649d15765aa137c3f2cd9b6a87189c62660c15da56bf03971e70e62bb81b5556df4
- SSDEEP 384:4VL0knTJ5SSGm4T9wqvgH5k0YXOAFd1gpeJNeQcJzWZtWcnELKt8Cy/jZ:KnTJ5SSGmAlIH5k0Y+BI5cJCyU8Cy/jZ
- TLSH T1B8C24B91EA7CC28EF8162CB563A4F5537C7573814B29CADB23F199CC056B3C08BB5629
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64X3DAudio1_5.dll
- Size 25KB
- SHA256 8dd91637f40136f8f941d0b9e8a096964336759a91beb3265a78627e800da85f
- MD5 cff1c1f7b9f855ddee431d7b5dcacdf8
- SHA1 7199379d9e86d512f7536a6d74d133539492c8c1
- SHA512 e5309418b9d4f9cc715431cd744465f75213836caa417ba39d82388f7f452e3c9626341858f019d030d3390e555d6130a325408a6ffea138bd4fe5cd4280223a
- SSDEEP 384:GEL0knTJ5SSGm4T9wqvgH5k0YXOAFd1gpeJNeQcurW8sWsELKt8C1j1Am:tnTJ5SSGmAlIH5k0Y+BI5curPU8C1j+m
- TLSH T1CAC24B91F97CC28EF41628F563A4F5537C35738087288ADB53F299C815AB3C08BF6629
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64X3DAudio1_6.dll
- Size 24KB
- SHA256 0afcf64138aacab2b4a5e110392a7d978694dc545845f89782c07c650f212f3b
- MD5 eee871cc4f5563ff8b3c8385b32b0c5f
- SHA1 940fd8c5a0cda898e55c80b36b139d766ed7e126
- SHA512 e2bd013d7b8232bd6bab21832374d48f4316a02299c96e526c416b832d13bf2824f81db9f9a96c76d4d7ff1cc989053392f413132592757c51725ffa7cf722d4
- SSDEEP 768:gnT15Suamt3IH5kowCIK+0ocnz4qjXHUl:gVt3IZkowH5cEqrHUl
- TLSH T16AB24B90E97CC19DF42628F573A4F563BD35338087258ADB53F299C816AB3C08BF5626
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64X3DAudio1_7.dll
- Size 24KB
- SHA256 9460709339701ad471a5cabe6365355f4d586dc4fcb86507c1331839dc555446
- MD5 b4ff2a39685c1a6d43f0e56eb350af3a
- SHA1 466f80be26352f8331900a6da5b0a18dc7b39c0e
- SHA512 cef31793e1b1714826aa95d256ebbec457e8cf9003767db46909bf879af86f954f475ac84e1ee8cccf1dcfe4a52624e3d7e8bfaff5f567e97cab19207db7f913
- SSDEEP 384:9Yr0knT15SFM0kVqvgH5kwA3fV92aO9PFnIyaWZuWeLXci2jXHUpvg3Yl:InT15SFDIH5kwAOFnIKeMi2jXHUy3Yl
- TLSH T1BEB23A94FA7CC18DF42668F4A2E1F853BD3533814B1485CF13E1A9D8166B3C18BB6726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64d3dcompiler_33.dll
- Size 1.3MB
- SHA256 90dc7e301a3dfb1c015cb73811b77a5ea21f8ee46944011bca3a270584473013
- MD5 3ebf620536a13ca343e52eca4f0de7f8
- SHA1 b46cd27a56c832b04246e22d4d05e0af3ab3d0ba
- SHA512 456aa59fa6b1e3523544f3d644f946ccbe814f8f6ba175b18b2be0600fd72972904f65899d4a2768a261cd8d1f9b7618a2e867ef3aeded8167e0e45a0d4134be
- SSDEEP 24576:qdy1UKdAAi4mygBH2zDINpwFeuiXounteD53aERvR:qI1peiDITwFweD53DZ
- TLSH T108554A52F2A244F5C4A78275CA5393A3FA71FC44432457C79290BB1A5F3BBA0AD3B718
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64d3dcompiler_34.dll
- Size 1.3MB
- SHA256 95538ba7d65336b617f64d66789f3bf53f9bf52ffd4f717483d1a7e6a02c64b3
- MD5 9d9407f52b8e24e99358d9944b0d5fa3
- SHA1 323d9a17d5db1fa8b6d96cb15d14a41d1462d945
- SHA512 61b64c2f4b33e7a5ddcf60d05212bf97fd8ac32c4f064959aa95225a9baeba9f22877074b10ebfcf768c894750ffe432f06f98ab126fa40f231d3f8ecfbce83f
- SSDEEP 24576:5XRhc9B28rpsJep6FWAYO7/0hdYzgwSNVMdX7K0yRcC/:1R8pWxgAYFdYz0NOdX7YH
- TLSH T16E554A52F2A244F5C4A78275CA9393A3FA71FC44432457C79290BB1A5F3BBE0693B718
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64d3dcompiler_35.dll
- Size 1.9MB
- SHA256 b82f096607a52b76f69a2db03392e008dd60a7dce74665b0e09f5593ba7ca7ca
- MD5 b21427edf0449e92000ff497daaf89c9
- SHA1 520c94fcdfc585a4d327c7c8cca0ee313a0020ee
- SHA512 79b56fa1884500bcb5c728fe38a5135ab752f346d976a02a7c9043ca990eab54ca0e21ca688fe9a1246525cc1b21fa1985e77b645769a6dc444165ef13c284af
- SSDEEP 24576:LgJea9ZiUakXGrRKeSEHBasyQpMYi5862q1U/N/mDFtoNZXyycwVxtk/Ist1FbFj:EQa9YAG1KaasK58lmcvXzVO1Se
- TLSH T1D8952A93F2A181D9C06A81348A865363EBB1FC48072567DB5790E72E2F37BD06D7E718
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64d3dcompiler_36.dll
- Size 1.9MB
- SHA256 d002a8731182968d4036d54e401f9792a57c1c84caef576059ca18190b4698a4
- MD5 7299df5cf81135934740211d9a946737
- SHA1 7dbe7065b501306d60c083ef58da3690e05ae1da
- SHA512 3b35409a58a0e7d09a4a9d81277304660af8829f614cd0ae2f46b9ec88f71a773a1e55ddc1e1694fdfe6b877e535cc1a588adfa7328d4ad4798d2e2fb542d7e4
- SSDEEP 24576:j5gAdUk7FVtw0XlMRtOtiOvj/ImtHDSdihq4L3/Fx5kH3uuTghC9bJdPusNc5S0J:uGUk7PVMxOvzFSd2PO+9AuYW
- TLSH T128954B83F2A181D9C47681348A865323EBB1FC58072467DB5790E72A2F77BD0AD7E718
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64d3dcsx_42.dll
- Size 5.3MB
- SHA256 8852c218583dc11113705bd89dabd51b0f77db6b393eaf9a9a751652b7cdef24
- MD5 f13b90f5090eba9041558bc6aaed79b8
- SHA1 9bfb532b69ffe30b60e563c091b695781558efeb
- SHA512 7acdb168a355f2ced8273b6b0aac7a29a175f82362ee2e7e38158b881dea2609be96cbdd5a03a4ffb2e2b724ba570c80ed79d017016c10faa6c82117b3fc82b6
- SSDEEP 98304:emMWitf1/IEZwaXMRGOzHLguLu6L/qMZXry8G8MNfWzjm+YhSqvV4YvlDo/eDBuI:elf1/IEZwaXMgO/gAu6zq6XG8G8MB4Vy
- TLSH T15D461222D76180EBE47C5B3146BB2B0C75B2A85B87E222F7DF15A71C5D3F7900634AA1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64d3dcsx_43.dll
- Size 1.8MB
- SHA256 3c9e1b87f2763f58402b5104d21e0d9d5db352fcccf7801eaa4cd1f5dbc20945
- MD5 5f1da86286a2dfb01c4fed55c2dd1d61
- SHA1 c28525d941f1db5169cd56839559a3e9c0bb0c13
- SHA512 9099faded2fc4909ce43dfe1ac804eaa97bab747889b7f437b69c1624d78f59ee3575ed2849cb75b707eb00b6775c4780b96d856023c498309acd690b0bcd8a7
- SSDEEP 24576:lUZXPi+If1/TeOB4e4dEQMtqVC43uFx1fr8:Gdiff1/TeAH4dpMATe
- TLSH T10795F516CB155AFBD5BD027249E30B24B77290A37EF312B3CF0946255CAE3D8A5319B8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64d3dx10.dll
- Size 458KB
- SHA256 03115a37f75fffb7abf07a59ec6ecb5217d3479bc95f92846c7e9b91822a0567
- MD5 8251826f04ba0822d08ad9b92c65a3d5
- SHA1 5468f1ee33710b5ad4dd43ab6eaf2e5e5cb2099c
- SHA512 bd7a36d8bc7885f549b255e1bb636580c9235c36d34f8abb5623c23d3900df416150a79688eb464340fb394262a156c2bd612ee8f9d7e6a858b288c0eb4d2cb0
- SSDEEP 6144:+Gr927Zj4cXUcFGq7f3gQ9wBVLlGpYFvFKIbu998J:0ZjhUcFWVLlTS8J
- TLSH T1A8A45B40B2B5C0EAF13E753DB0D5F11BFA7134140B2406CB97A4856AEBA7AD04EFA746
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64d3dx10_33.dll
- Size 494KB
- SHA256 3f0248c3bb9bda2a901b343b3b58172e175a86450d421f0fc4aebbd5a7d11477
- MD5 839c3921005bb41d441e3752c74f2292
- SHA1 bb419fd4cd2e9fc9133c88cd6011524411a63fea
- SHA512 f814096af7e17ab01879d2976dbe0f52b0421f355087289f92b10719338852d6fcae88db06afcc4b9a6f95709458f90c4a14a1e26ba40918bc631137ac1309d2
- SSDEEP 6144:anSrK2fBPwZWD0vpK4Oy4ma1HzsjZqaLJuh1yofzEQh7D6GX:bf9wZfOygzq3K7OGX
- TLSH T164B45B41B2B5C1EAF03E653DB0D5F11FFA3134100B2046CB97A4856AEBA3AD44EBB756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64d3dx10_34.dll
- Size 494KB
- SHA256 f7f367df5d0fb5e32113515339d928a51d4253b1c0e21854277f67d0b271fce3
- MD5 1ed4e7a82bd5c7deed082f00e63bb7a0
- SHA1 99bfa08d5c91db1c18f21c115386b923f83c8cf2
- SHA512 3f4ffea3d06a9f85682cc65e741698f718d26291a2b21388356e9d146801318f6a0757b53368e3492ac0de071d8452ae95479b5d41d110f5a5e09051ba0c2ddc
- SSDEEP 6144:bn2xvcsITSF8Tbh5vxIHixaHjA86izya/wdbJORuuY1yofTNzx6k+MJoBF:bncIWyHvxS6iua0nZyMEF
- TLSH T109B45B41B2B5C1EAF03E653CB0D5F11FF97134100B2406CB97B4866AEBA3AD44EBA756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64d3dx10_35.dll
- Size 496KB
- SHA256 2030b7d57c88b653a0eb55ea85ad90c6c8630a00f5a56ea5f9b6985acdda5289
- MD5 84116aa94672d623b95217648ae5b5b9
- SHA1 7858db123a9c7bb12841e0f69b633d8e8d6e7e52
- SHA512 4f7d4ffcfd105c9e12c2d72d7d099699c2a6bd24bbff5cf29c09b7bf296a391bfa88964ebc9affa06681eff7966bb9e2efe7d2edb4f51ef604692ad00d4b3ade
- SSDEEP 6144:QouLNDM3cvjZELdY220pOqFdY3xkSfcnOyqsYFtXBGXEqu31yofOze+JldMc:Qd+3cLZFRTq1OyqdqF1Mc
- TLSH T1D4B44A41B2B5C1EAF13E653CB0D5F11BF93134100B2046CB97A4866AEBA7AD44EFB752
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64d3dx10_36.dll
- Size 496KB
- SHA256 6b632dcf9ef779d72855eeb1bb4676ab922ffb9204f7d587475477fa2f51be4a
- MD5 570fdae7041775de0c67747bb7081939
- SHA1 45d29a908817c835099ed6bbb6af744b2f001cba
- SHA512 c4c2627d3667e1080dbbe5ab0b6d252bd2c52e39d2ec0540b4103359ea9bc223a9645f971d79683db04b0419ffb750e1e49e5ac8e10dff8176a88d422f169909
- SSDEEP 6144:g1iLcDM3cvjZELdY220pOqFdY3xkSfcnOyqsYFtXBGXEqu31yofOze+JM+aM:gQ73cLZFRTq1OyqdqFfaM
- TLSH T181B44A41B2B5C1EAF13E653CB0D5F11BF93134100B2046CB97A4866AEBA7AD44EFB752
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64d3dx10_37.dll
- Size 517KB
- SHA256 3bb17715d9de0878f65a3a006b8614532a6133f56e12ef5fa392a63337c0c275
- MD5 a8c5688bba00c1630550f26260ab5cae
- SHA1 361840d4c0ba745f6d3c10982d9a9040f34f62fb
- SHA512 e53ad3d7d4f7a2bd2dfd23d5bb6df897dbd2043ee681b3959ca3d36129a9e547b7b1b1f0b896d4f07183c0e2b981c5c899638551c5d93f4a233badad7f0e7c33
- SSDEEP 6144:gmtk+kVU7EjBxAvB/Iphnho672lmmrKfDFupmIe6JuD1yofWQnuJfe7aRzS:gvUAC2pZhSKfu+ug7aRzS
- TLSH T1B2B45A41B2BAC2EAF13E653CB0D5F11FF97134140B2406CB97A4456ADBA7AD04DBB722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64d3dx10_38.dll
- Size 528KB
- SHA256 1274a3902a0a8ce9309d2b636eec3d42048ac90a68a0add0e372027b3f000104
- MD5 72cb653cecf4ea670e7f5a8d74358423
- SHA1 e3ca79e889df81e6fc3bb1e0805e73b726e883a4
- SHA512 7d3419face3ee9f53071277510fd5a03fa8b13d9f00afe52fa1e1ad078b96a4a17c6dea0999c342827d81b1385951579e5a3ce0bb464d1b7b2c3315c97d2d8ba
- SSDEEP 6144:lBnpDJ3az0dyLa440UEgCrttgrks4lH280ttlNKO1FPp2dg:lBnpD1yLaaUEgC5iL4lH280xffR2dg
- TLSH T1AAB44B57F2B6C2E9E039A47C6295F22BF931B4440B2556C763A1421DEFB1FD04EF6222
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64d3dx10_39.dll
- Size 528KB
- SHA256 1ec45bdb37e9f8bf7b6684deff6799b06d4bc2e2ef72b5f278d6c4b3a7597b13
- MD5 eaa692fdc990ed0407df957316da33c2
- SHA1 22f313b0f533c483a726fe5b8d3b0bd1e194081a
- SHA512 cecf719e933df47575142316c617e9895882309823f0861dc7b689f31b237c688ef027f560abde84c5da0d9b2cde19c0201f27f1887557845d5d914439e73060
- SSDEEP 6144:p+nmDJ3az0dyLj440UEgCrttgrks4lH280ttlNKO1FPM2Xg:p+nmD1yLjaUEgC5iL4lH280xffE2Xg
- TLSH T191B44B57F2B6C2E5E039A47C6295F22BF931B4440B2556C763A1421DEFB1FE04EF6222
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64d3dx10_40.dll
- Size 506KB
- SHA256 48af3a1834640969660a37899a4cb17677fd499c26185ac940d284a0b4212fb3
- MD5 862586ad4b1355f7dcde111ee0aaf350
- SHA1 aadb69f932065dc3ce8641e575e6a5d1dbb49d64
- SHA512 2895b6a58f65c62807d48dd338e51879131c09e4bd267e43c3250fdd6fe1319d6ba2070535a71f65dac9e33bc64166189c834d9a2e6acd0b07fefb7641414429
- SSDEEP 6144:y9lGyLqJvHxF+09MigRbia7HcpLYlOjWgiGVd8SQEhdGmHu71yofc6nWdJtNsHr:SFqV6KfgRdgiGH8SQEh/dHNsHr
- TLSH T188B43840B2B9C2E6F12D653CB096F51BFA7134150B2046CB93A0456AEFA7BD04EFB716
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64d3dx10_41.dll
- Size 508KB
- SHA256 464653c6c52e16d53b87c1f199c693f748fa48228f7690f086350b0f7bec581d
- MD5 e730967811e3702499446ffc8a432607
- SHA1 9e6a7c58b2931206229255f703ef3a716e9aa9da
- SHA512 7a15336c3da0e38b6bc4e28be1c752553be23e34a0ee9d71a92fada0895609c73a082c3f3766c36541238841bf315e18df7e4dc1379af0c809f9f6134c67bc9c
- SSDEEP 6144:SDEg/iZr5IoR/1lmgd7LqS1cZAaKKN7Cmm2vRoQc+9ATKuWvOeJut1yofeNDr5S6:zaY5IoJ1lmgdydfRoQP9ATFWL86
- TLSH T1B5B43841B2B9C2E6F13D653CB096F51BFA3034140B2046CB97A0456AEFA7BD44EBB716
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64d3dx10_42.dll
- Size 510KB
- SHA256 dfb4baaa5f06467183839f14f5d28466e7c6e7eaa90f292c4516ed6926f5da8a
- MD5 b739c423276ae62d7ac91773226ec13b
- SHA1 42ddf7bd846a87c428629191592ea79144e5d541
- SHA512 9280987b4f95940a2160d453d29fad6f4db4590ca86351fb153913ba12f443e220b3837f07eba2b4017c528905e7a0f19e7141dad33563114b726267ba6369a1
- SSDEEP 6144:DzvRFQFzvy5kPGDqSmErUpq69hgg/BSA8Nvuu1yofb5m9j5rOloz:HcFzvy5kPQopq6jgg/BSulRz
- TLSH T183B44941B2B9D2E6F03D653CB096F11BFA3034190B2046C797A4456AEFA7BD04EBB716
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64d3dx10_43.dll
- Size 499KB
- SHA256 9bffa1ea073d79e9954cb398fc91b93ed9dc79ed2205995d4b949f1cc2ad3bd1
- MD5 ad7fa9485059f4dc53c98b49cab13f0b
- SHA1 eecc2f4b2fe17d9d8b9e3abd7160503d10c0d14c
- SHA512 ad703a57490a01f4e92201fafaeefa8bc60748aeb18be8c527ac0918b2a35f2a7884c9fbc4b23a3da03ad66954653f3e4314399ae1d9dd4509efce9b355e212b
- SSDEEP 12288:4NFoet8lzbv17VPfkKS78zBN8LgIappk:4v9t8lzbBVPfkKS789AZmpk
- TLSH T1DAB4484132B8D2E6F13D653CB0AAF60BFA7135180B2046CB56B48069EF66BD44EFE715
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64d3dx11_42.dll
- Size 278KB
- SHA256 fedb54eef0fb7a61514fd4273f5f13535de1082f55bfb5f7b05a1016f495dcdb
- MD5 522749761b6cc69f8630f4b472dca623
- SHA1 f454df63abd6832cfa591878c9132f78a1ec58ce
- SHA512 8b45983738aaa6dd061472b09363c4581fea40f2bdddfd813ad9a7b39d7f2a75cb8379309602132f1e6fa20e87b1cc3d9f59797e85f5f192575d28f72fd51a85
- SSDEEP 3072:oMiKOmW+1HmREMUeT8PGw+0YYUtbzxtjR/kisVhVRUqSQlzegP/HzaIYGoWTa/BM:A3WmRED9MR/WVhVRUqSQZOIYZ0ZvpZu
- TLSH T175545A41B7A68CEAE079B93DA093B657E3B0B9040F64C6C74790875F4EB77D09A36321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64d3dx11_43.dll
- Size 270KB
- SHA256 981e42629df751217406e7150477cddc853b79abd6a8568a1566298ed8f7bd59
- MD5 9d6429f410597750b2dc2579b2347303
- SHA1 e35acb15ea52f6cd0587b4ca8da0486b859fd048
- SHA512 46cbfb1e22c3f469bdc80515560448f6f83607fd6974bb68b9c7f86ca10c69878f1312b32c81c0f57b931c43bad80bd46bdf26ab4ffb999abb0b73de27ad7c56
- SSDEEP 3072:iCWVWFOaVgP7BzvjYlTc91N6Vkg4eK6DvDBcMqpcJbMYBu1+Iz54+vJq9o:EWw4gPdz7YlTc91i1DLopYMvIIO
- TLSH T1F6446B5237899CDBE4B9A83CD0EBA603E3F1F5940B60D6CB0260455DAE7B7D09E7A311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64d3dx9_24.dll
- Size 3.4MB
- SHA256 1ec422bd6421c741eef57847260967f215913649901e21dd9c46eb1b3bb10906
- MD5 b165df72e13e6af74d47013504319921
- SHA1 c45b192cf8904b7579bbc26c799aa7ffa5cbb1d4
- SHA512 859b6cd538735e5cc1c44f63d66b25588ad1ad32202cae606ff95b8c4a80f6a66db9ef7c5d43820010de9334b8bbbfb079939ce89ba0b760f5d651d7fa8268ed
- SSDEEP 49152:oKcfEwqx3mAEXywKYlip1rq1UzMYdBf4Uhn6bZy4rW4uosdBxn7LFU:O8f3R4YN6SrhBpLFU
- TLSH T1B7F53982F1F1C1E4D2269038B596B613EA717408071857D797E08E6A2FE7BD86DFE384
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64d3dx9_25.dll
- Size 3.6MB
- SHA256 10b09474bfe4e2bb395472628646bc5f353fbfbec976575c45eeff49984ebaa6
- MD5 4c56e7c5b2a61353e534c7d15d05856d
- SHA1 e6e0a59a1e8217ae06cda29942537bc4be25d5a1
- SHA512 6f630ea0764b4551d80a96f6c2b9391ed5741f14431eec951699c0e42b9434a45841d71bea5576b285cc20d38fd082b4cfc8062e4aa61f80aed9e57869cdd5d2
- SSDEEP 49152:AKQ10YCKK2mt+mxTuzXZO0jDKn+A7EaLSlrBzl0uN+xEoz81MABT0zBca3fNHWl8:CfCt26L1+l4IRYu+i
- TLSH T142064A82F1F1C1E5D2269038B596B213E6717408071857DB97E08E6A2BF3BD86DFE394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64d3dx9_26.dll
- Size 3.6MB
- SHA256 30b06dbbd202494bae3b87487e7273adcffd17a9d2c29977030fde0570aa841b
- MD5 44f5c5e27d6825e4e62420bc29b8b533
- SHA1 046455294e199af99c7c2d9174d25b230e6fd0e6
- SHA512 0c9adca329c386cb2caf0f36d672ba326929f02c29748b13188bb7ade3fbec9131ce86a6bf1b3064a2fbb8de6b8adc34208f667df31c5db182918e79744a830b
- SSDEEP 49152:9BXoUljd4Wz6ybt+VkfhmHXv70Zx48Yrb0/oIsl0xekkRveqpuByEieKKciGNI74:9TgW2VhX8YX0Ql05JiOPP9+
- TLSH T1AE064A83F2B181F5D266C038A6566213FB71B408071897C797E08E6A2BE7BD46DFE354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64d3dx9_27.dll
- Size 3.6MB
- SHA256 f9dd288c9895973f8db1856d172779041c6dee173ad1ef53b1727fc85cb6b75f
- MD5 914c3237e4d145a18dcd1d0d4c8659e1
- SHA1 32503c8f8d80551c896bc2dbf2c8ae3c490f0ec4
- SHA512 c760b5b0b5507da8f2336b2b0625f344f28fac33da16a7d8771a122b0ba54ebf5d2a2f702f4ebb83ded746f38d63abd378a9aa3b3e50579fab7c047fe38e2c02
- SSDEEP 49152:HQIxo8+trLOQn0MYiZjLoVN4/FsDlcbhstiE46C+VQIqZFCpPvtek6Biiw8z7Z:DV+Tf/FHbhd90pdTi
- TLSH T1BC064983F2B181F5D266C038A5566213FB71B408071897C797E08E6A2BE7BD46DFE394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64d3dx9_28.dll
- Size 3.6MB
- SHA256 a2870f86e2f1b11646ff3f404bdbde10520c481c1400b20d25fdf56e66fb0a17
- MD5 88bac8306d4ec79a82b1ffa17dc8cf4a
- SHA1 0a0ab361f04ccba8268418ebff098d3da1ac26a9
- SHA512 b664033e270d71ff88139bb3e71fcdfc8417f65d7c80a12f921a60b0d825ebfe26a14bf16f9d23a10af5c866c1715e21c879993f9be1c54261c376a7cbbe511f
- SSDEEP 49152:DfYxRFd8pU9b+GwWvDKOwB/7dEAArOvkTGeXzR9Ck/E0juAvHH1lv+piF8zbs5Uj:MndAdESvkYfAv1xp55v
- TLSH T15E065983F2B181F5D266C038A6566213FB71B408071897C797E08E6A2BE7BD46DFE354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64d3dx9_29.dll
- Size 3.7MB
- SHA256 d496c31a6b0f41398ecad7698987c55c2cb88eb6568976ba9b01a197879dd9dc
- MD5 68b35cbdb4a8cc424718bbcc894feeea
- SHA1 c1874de5c76a55a1c42c5da20d7204201586ca4c
- SHA512 da3b8251417b63d086e4223219309faea6faf3ed9f70f0345ad77f6843fc8c121ed36403aa50601434962d3089d529baa1faef0bc29602567fa3f91749d8625f
- SSDEEP 49152:YPZu/HlUvfYFErLv5ON+TXpnF8UE7VLuNHLICkyXibnlNWYdaSIo54NdPqCU8zHp:fflteyUEELTkHGoyf
- TLSH T1E1065983F2B181F5D2269038A6567213FB71B408071897C797E08E6A2BE7BD46DFE354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64d3dx9_30.dll
- Size 3.7MB
- SHA256 7d1374e3b921a70b5028472ab164d9e582e3c3525334235d642664189da9b157
- MD5 e09a9cf383acf4a28038561e62277377
- SHA1 131060defdee3648bc43d35830d9409ff921bd85
- SHA512 6350b6931504bd37886fcbf577436b2c5b0cdb1c4b5b3027c4ae03dbb36edf7674f10fc457115b0d8e913b693af2666b5dd4b97b843aa7eb379940c780ea6ac9
- SSDEEP 49152:DHvQBx1xEwsigeqSD1GkqA5PRay1Rr12cb98hSCkKInOKwGUmZSFbh1ZratM8zH4:MP1JXky1RVbGh2v4rCnA
- TLSH T176065A83F1B181F5D2268038A2967213EB71B408171897D797E08E6A2FE7BD46DFE354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64d3dx9_31.dll
- Size 3.8MB
- SHA256 84167b7df7e97c63f0cc15c1d272cdc7bba942f6f36a8801aec9840825891d0d
- MD5 faaa0bb9cd2905b25334132e5ba093eb
- SHA1 d31aa0bd82d6c968b882c57091252190d74458a3
- SHA512 dee1fccd5af1d0dbd470f94efb7fd18776b3fc9bba3f977c0b401cc8fa25776367b7eb3acb585b790b27765b9daf88379712d967f3b56410b2db5ad3292319f2
- SSDEEP 49152:8X4iEI762U0FxDcLwU/WlKHfcXPh+Kp1B9sub/fJ/CkgUVt6zHAl1H6Fy0TUT8zp:YEe3ziM+KLsubw41GeS
- TLSH T198065A93F1F181F4D2268038A6967213EB71B408171897C797E08E6A2BE7BD46DFE354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64d3dx9_32.dll
- Size 4.2MB
- SHA256 7c723479e3720a52f286d2e9e044f19ed893a34e6819d53e4de6991048febad1
- MD5 a4ddfe5dc4e73d1fed9b1b3a3d885612
- SHA1 318efd256f0e7e717ed215ba6c95214d212e29a4
- SHA512 0734f7dc4292371def99e66a0787260577d307010e1a22190d5e78d9f2cfd562e85c03e4a1e56130d793e41115171f9cc8d921e8e8038240cdda2960cb7e723e
- SSDEEP 49152:NLKu3QUd8LzNzIojqhgCowD2exoLlznFTZxhykdcGDu8gl8OYeE:YzZIFgZZ+yYE
- TLSH T19A166B52F2B181E9C5278078A693B317FB717809071857C793E0AE5A1FB37E0ADBA315
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64d3dx9_33.dll
- Size 4.3MB
- SHA256 7338b1d039d0c08e45f24874e4918ffa642ebfe5967c96035f66f509265fa33e
- MD5 3172c3cac8ea7ca1b5d5af6699c037d6
- SHA1 e1e2d11a96072a414a710b93f0b4f6825992c374
- SHA512 6f27d7a388675137d22d6a84449a42b53530b4b07b217e93367eda580f44315c24d520b58b094757ccd02a7690437f173e266fd0df0521dab6ade1e6fb2b4a3d
- SSDEEP 49152:kAjJO1iZRCzAUgCdG0DUJPH58KKfaCVJJq85uxZinys0Us+SrvTTs:vIzJgsJ18C0UmrvTTs
- TLSH T10F266B52F2B181E9C5278038B993B317FA71B808071857C793E0AE5A5FB77E06DBA315
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64d3dx9_34.dll
- Size 4.3MB
- SHA256 715fa6d4931324cca594c4fdfc60274ed29d296bb4592d102b36bc976c8b8ada
- MD5 ae5d5439525b4a4cbf206058d493685d
- SHA1 c7cbfc4b7140852fc907aa22a48815745fb2047c
- SHA512 f947d654c1a40ee916746a97a128515b18d08a169b8cdffd50b8473611e9f9938ddf439905cf02bba01f5c07066b52162af8e5498bff593bbaa4d5741da8667f
- SSDEEP 49152:RpGq9Ts8+f0zzuQnKdm87PqvYocA+SnyX5emyoBLGnEBaxdk+otJxP5O2/l:RzXnQo48myrx8x5OS
- TLSH T140266B52F2B181E5C5279038B993B317FA71B808071857C793E09E9A5FB77E0ADBA314
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64d3dx9_35.dll
- Size 4.8MB
- SHA256 ca195b7ee7aee29e6417acf0e6c1736d9aac76890a622eb62ed137394fc6f2b9
- MD5 1b3af16a27d390096925576202a64037
- SHA1 1290b2e2e6b68366287eb5e79d7433f2a756a062
- SHA512 db0b9e847eff021f4d65148862fa376340dec88e7ff2d0e4a74ece5017f6337d3c73fc4fa35491efa90d239a2bd9b6c7f1752e95fda00db1bc60ccac2648ea3c
- SSDEEP 49152:ld7reReK+/yRKzX4+U5z5qTZDCMxe8tS+zJdXtWilCj00SFqt4d8yv0A6w0d0k2C:XNzo+UefdIss4dEAIakT
- TLSH T1E5365C52F2B1C1E9C176C138AA96A313FA71B848071857CB53E09E6A1FB77D06DBE314
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64d3dx9_36.dll
- Size 4.8MB
- SHA256 c683e8e543bdd678dfdea0b325a3de04a419eeb053e2f32702d8b472aaf54c6d
- MD5 bbb6c6833c30e323b41860d6df61972d
- SHA1 71004a6c62bbbc008b507eaf04768e4b4955a485
- SHA512 7749ec296517871873dda1df0ad0cdd7101cd26d77dc15f2fd3425c0fdd777392d3842fb508425274890d9c25f62a6d641cf31c87f39e0c98edd15fd07cc6b06
- SSDEEP 49152:/JPSJAbvW2c9izoZQg3YniYjI6D1+oHrQxdQgyBfOHwtq1neFud4nNCn3d8sdVc:/5zIQg3xly8QgG6dNY
- TLSH T14E365C52F2B1C1E9C176C134AA96B313FA71B848071857CB53E09A6A1FB7BD06DBE314
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64d3dx9_37.dll
- Size 4.7MB
- SHA256 8c1d75b01208b59fcabfb389df296e00a58713322f00112fbe80aa7b6221708a
- MD5 8a10974dc6e1e42bdc635c2c2afbd2cc
- SHA1 d95971e1df5d1438600f0787e1b76a8284e25af0
- SHA512 f7c134cbee9d1c82522fd1662fb34f415ae555c520375595337f82b4d6dece4b501194d6295979b6dba721b14d5486da82a95fde9cf2cc2418166401f566f2b0
- SSDEEP 49152:Z8DlYPS/sVrPjNP+aS4KfAC1JcJNuIW24TyKCOaNFOa2HeShxVlFIZs2rsp5dOdk:brxrnC1S6qca2HlVlFIZIn
- TLSH T125365B52F3B180E9D266C038A997B217FA717C08072457D797E09A562FB3BE05EBB314
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64d3dx9_38.dll
- Size 4.8MB
- SHA256 b54e832bd8d7e94772c680f49c31b86f9c5db456f8e5cac66720d533896f1cfe
- MD5 e5ec2ab7156a752f9614cda4be66efe8
- SHA1 08be46f96fb866b3b0bfee3bf204c4240344db5a
- SHA512 f739b39925500498557cb3082c10629fd8a96f158e8846371e19446990a550b68ebacf7c118d0468cbc17869d72b48f7b6ed8d6bb3dc783e32716969ed7f935d
- SSDEEP 49152:wXTY5IqEze+lMHiYSTlu6hs88Y6bdEMDSgEymuRY8y3mLK/klK124XZMpzLyNbZJ:O+CJe8A9rLLK/p24XZMNygY
- TLSH T197366B52F3B180E9D226C038A597B317FA717808071457D797E09A662FB7BE09DBB324
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64d3dx9_39.dll
- Size 4.8MB
- SHA256 aecbe2965f7c9aa60257670114c06b21a3de914b03e20ff569c5cb44ec4807fd
- MD5 7505c133fc704b40cfddfd38777baac3
- SHA1 34fcfe7be4a9ea08c63b6f5392ac8cd10a05827a
- SHA512 8ca2d8be9dd148587906b154ec9d3ca0d1d7cd781c2bf307011407303fce981acce63d28329083a6a731442743732789aaea0a7bbd4e2d2a57d4f3e284f7b471
- SSDEEP 49152:RPCvau58R2Rr3DnyPD81PDWdlFiyPbznxZRjhLcvRVFQHgIkNn0QwdyQKZwGUfcA:RapzyPFdBv6XFQH4Nn0FdMq0nA
- TLSH T112366B52F3B180E9C266C138A597B317FA717808071457D797E09A662FB3BE09DBB324
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64d3dx9_40.dll
- Size 5.4MB
- SHA256 8a9ea8bc06786d342af4e7d171abbe6640cf31d9d01afb86dbf63f26302077db
- MD5 29a79f0b607faf5722d7baf2485f632a
- SHA1 ae2071ab9376c13c6c7af6c1cbc5a246cd065c08
- SHA512 ce435c8504ba7516f982104cc145d1a63c2d067b4be9eaecf9e25e889704b34b03de839d849d4fc16f2796a4b6b1889147bfc464996966cebf116f70ecd5bbfa
- SSDEEP 49152:H2NuC6AAQ48TpW+Ysgzi8MiH+TE2yi7TtZQrdkMMVxTdxVZiRJgu1GC5ovxk1TWt:H5pj3+vp6RBoB
- TLSH T1A3464952F3F3C0F9C266C038A5A7A217FB717808071457D7A7A09A566FB3BD099BA314
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64d3dx9_41.dll
- Size 5.2MB
- SHA256 33fd649d5b6e90bd7b7f51d1431ef3501772ae985e320442e5fd750e4368669a
- MD5 ecddb13bc805b9f3ef3a855e6fd85c69
- SHA1 d4f348defccee8e8a0a8e927081dff1f4c803dcc
- SHA512 4fda199679141fc6c7f77754aa55cd94f6690708916053f98933bb6f40121a371dde61fc8934d8639a564d39b6eb0ec5ab3502fb72c68959de1cbbaf43aa3bc4
- SSDEEP 49152:NgeaDV2CfTqZsNbrHEn0dp+475Ffrcvs4P2kZIpbQBF3X8pUm3MNnTokp136fNWl:NFekn45Ffrcvs43dVMymA6xtK
- TLSH T130467C46F3B180E9C267C038A697B217FB713808472457DB97A09E5A1FB3BE159BB314
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64d3dx9_42.dll
- Size 2.4MB
- SHA256 1d6f5aa25ac2f1e55d3fd89cd5b33edd4de3709bf0353c75ab8645cebc087fa5
- MD5 1af7ae1fde027a30b9097280819a0a86
- SHA1 79e158e4b9b04bc5b69537343f244fc2d12db1af
- SHA512 92cf7ae0dfe1437227f8be37f50d84a6b18876485cb953c6a972a2f0c9f10d940941f34e8c8188559523b69bf2f6ad463526f87de52f8f142337031e753f6f0d
- SSDEEP 24576:tGvy5sSUvEa7i5Y1rfEucPAm+hYSIh9lCm88ShZtZJB69sncQolAD1CNGQ4cBx0n:ZzRe6bwBoQUGQd6p
- TLSH T1CAB51622F2F1C1E8E3269438B197B217EB71380907184BD797E04E95AFE27D469FA315
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64d3dx9_43.dll
- Size 2.3MB
- SHA256 84b900dbd7fa978d6e0caee26fc54f2f61d92c9c75d10b35f00e3e82cd1d67b4
- MD5 7160fc226391c0b50c85571fa1a546e5
- SHA1 2bf450850a522a09e8d1ce0f1e443d86d934f4ad
- SHA512 dfab0eaab8c40fb80369e150cd36ff2224f3a6baf713044f47182961cd501fe4222007f9a93753ac757f64513c707c68a5cf4ae914e23fecaa4656a68df8349b
- SSDEEP 49152:dbCJsk4VlPXA+15Om5wxw9Qsi55K+31BhZ64nW:YIIBnW
- TLSH T17CB5486172F4C1E4E32A9039B597B20BFAB1304907188BC793E04D9A5FE6BD46CFA355
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64x3daudio1_0.dll
- Size 16KB
- SHA256 77cc09cea6de69f12106e6dd9df1c0446a525a54c3953d69d64711b9394cc38f
- MD5 f77d5ab654881e683cff6650916c424e
- SHA1 56d8f090755f1ec60b13e748b040069ea8759b5b
- SHA512 dcd1273673f4088e854057e47484bb363e1e7ce094bc2c98ad7cc9112877892c1d6fd591dd9cfb325d6c451f2d03a4cdcc238af1ffb5382b7153f079cbe13abd
- SSDEEP 384:8EMlkHIlR1c/xMa2H7ajSRWMpWeLCcMe/oTCuY:qiHIlROJ42qfL3d/o+u
- TLSH T157724B41CA3C44C5F8126EF232AAF987BC36F7818F5899DB1276C1881C933D4AEB155E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64x3daudio1_1.dll
- Size 17KB
- SHA256 fac23787e7c199c1969806850b5a9652f66f6dcac86f48f6f834abc253848a55
- MD5 489e5b8bb1bd1028ff1c798eaaec65e4
- SHA1 da9c385c48a6f590347581c5c3dea67502b99837
- SHA512 33e3c28d60c7063d76c6959ef18dbb0227466766c4be9ce920911e192b75c18d11943a2eb0bef2caa920a6efa29162acf9f6c9c07ed5ddf5858420b240e0c0cc
- SSDEEP 384:9aEDn7U4mXTtLgfbZMpZvHEyWfoWtLCcM4aeW1:ln7U4mjtsf2/ijL3baei
- TLSH T17B825B41CA7C44C5FD566EF1B1A5E883BC35B3C08B199AE312B7D1490C9B3E4AEB056D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64x3daudio1_2.dll
- Size 20KB
- SHA256 7a34a7a8af47c6b2cf890ecb56bad2454ba5eb1ef2df6fad9ee53c4770e941cc
- MD5 bc78d5328541410510dde06b9fa92024
- SHA1 f6123294896cc3c3d3cf5a9e0e03319f58da7cf3
- SHA512 5284d695216aa4f70abafdea130326d8ee3c6d9a9858dfa3f5b184c6b8b185adebcbc92adb8a7530f9127ae1de30561986bf9c85bfb8b474a9812151a7843c59
- SSDEEP 384:4JBq2lmGhBtgVBWbPdcDvp5EfSgf2AtmfgRp/HiWJrWNnELKt8Cy/jQ8:52k2f2+PdcDh5ctfzqGDU8Cy/j3
- TLSH T1EC923BC0D67C8186F9562DF062E8E983BC79B3C28B2DC6D713A6C1C808A77D4DAB555C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64xactengine2_0.dll
- Size 347KB
- SHA256 a00ad310f3d7b2d4de2f5a4c081359fa443ce0baecc72ebf39d6b30ccf7babce
- MD5 ce5753f9a27837259eb52f3f47f39593
- SHA1 2eb60f397eff937249521fe0bf5fe89eccee4914
- SHA512 93fa47262f1b1ed9b284337f7225bdc06b6931931f385eeb30faaba25f1ccc483d633a40831471da70077d6a1f6a84c21a909daea059ecf316534b1994467230
- SSDEEP 6144:BvnslzitCv8MJC55O2UKT1gX3EIGKxm+:BvnsFitWlETOX3p5m+
- TLSH T1CF747D93B0E499E2E2BBA039D6D59A47D7B578540711D3CB2391521A2307EECBB7F320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64xactengine2_1.dll
- Size 344KB
- SHA256 3ca31f274ea55cb966ec0b49addf72e1e21269406ae5fc44de3d5bbc884a6ce4
- MD5 0cc809422ab40974dff8078392e4d507
- SHA1 c20b6ff4216095890432a74c4b59405921657c64
- SHA512 07dbe11583c7c83fe5d0a1fd73d59f2d706198323058664d167e280127adcb29b20597abee17800b140de3c41eb3b684abd516290e62c65f72eee313dfb76be8
- SSDEEP 6144:cfqNhYVOMopyOkiX+cy3300NXHd/NXrX0Qh3EYrp5YS:cfqneOMoFQ37HdFXrXRBpv
- TLSH T187747D93B1E099E2E2BBA039D6D59647DBB574940711D7C72290521A2307FFCBABF320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64xactengine2_10.dll
- Size 402KB
- SHA256 3fcc50623a5da6b23788dbde6eb10418b414865b12c84247ddb3024fda59a8ab
- MD5 e8932af24786765859558cb79e385ac2
- SHA1 68cde2e238460be604a49b5f700620830425174b
- SHA512 136dd820898ad64963a419f4d7baa118e63f8c28cc7aa538cf9d6bc60d30372d585f75ceaf03055d965451a7dc2dec965950a68983e30f1373e303f5899344dc
- SSDEEP 12288:tiqO+x59ooXAV7D2bIQOxNmyHMKFQwlVgF:D2/7hxNmyZBwF
- TLSH T1AA947C93F1E49DE2E1BFA039C6A59A53D7B17494070097C723D0522A1757FECAABE320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64xactengine2_2.dll
- Size 345KB
- SHA256 7b4e5938f1f69e5b8aaa8ecb479245b5773786192a47f9fdf6bd8eccfb109b83
- MD5 dc5a914c34eb12056531777d4dd0f44e
- SHA1 cd77b5c8485fbcdb8bd3db5ab1c66006d3904686
- SHA512 07c56e7754f179f72d5193a826221a02c6502803437cebaa8ca0dfa9f3c3488a28b4b45b551943c7094a6de402979c37f477b8bd5e19cbe63cba7197086b5ed3
- SSDEEP 6144:pwo1GoMNOtHzOjUXxSO0V8GafzcN4rpCJXbxwqP+Scb:pwo1DYOtHzKYrzVp8X9zxcb
- TLSH T1BC748D93B1E0A9F2E2BBA03DD6D59647DBB57464071093C7229042262757EFCBA7F320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64xactengine2_3.dll
- Size 354KB
- SHA256 1cf72300e03b4b6fc48e1d9e79d93c42d657ee1f87153035d1578d1af8616ad5
- MD5 0396d2a98b0ccd4419b572ebf618e81e
- SHA1 48583c8a4573709502266fb3d42c43de66595807
- SHA512 6e3168ef8035f6ab56012c64c6cd40adfd4caba391162f856c436555624ffa845321ec95147af35ba9bc969779b44f052818583352b5192de4529e18ca51ee4c
- SSDEEP 6144:fEOVNfeWm9jE+Tb5kJ7E5fLhQALC1yubaQwXlbqyJ6Zz/1W3F:fEOHzm9jE8kc+ASyqa/XEyuE3F
- TLSH T1C6747D93B1E0A9E2E2BBA03DD6D59A47DBB57458071193C7279042261743EFCBA7F320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\64xactengine2_4.dll
- Size 356KB
- SHA256 2bfa6e7b793299a306a554b60a39d001e493937e88dca403d9f0dd1ea0de1aa0
- MD5 58bb51253427a834a8807b9245cc5965
- SHA1 7af8cd08c318b81721242fa2ed472ce86be13caf
- SHA512 8adcde6a765e65c8684e339e65e0d3eda1df3f26665e62798c6fe9579ad65a235cecd95661cf39fe7a0b82912224ca1d6d6c66d5728e3ac2ffdd56b20313dadb
- SSDEEP 6144:pWZ1EPSmbopYsRG1AtavL4Aalw5BkZxNlxL+0CYgzL0g:pWZyPSmkt5eyHxq0PVg
- TLSH T107747C93B1E099F2E2BBA03DD6D59A47DBB57494071193C7229082261747EFCBA7F320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\DXeurt.inf
- Size 45KB
- SHA256 45355149c4ae142593d5649e6678b67bc9e7a1b4baf2374a5c7997ca05d84126
- MD5 808ed78616d3078aaa3096d9b8d90b95
- SHA1 12263f1f12f9ff339b9cda18c7322dc31bc67aeb
- SHA512 95ac0be7f215547c79fe60ad84fa4961cc07e202a77b8d741f0800d9b082f38d8317419a39a66586f3d3d4d98231ee926757716790efbd7159df51e1a232543c
- SSDEEP 384:jl+s4PleM2lEryJ4U1i7PWxojK98Hue3wB/GARuH89fmpYT6ts3eOngxmfYJazMx:jDJs7N3U9of
- TLSH T1F323028C4426F6BAD9A39306E5007B9BF69D30AF98D0E74AFFBC01477F185EA3525421
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\LaunchINFSectionEx64.exe
- Size 2KB
- SHA256 1d5835cb65a6cb0439c26de8aa46e9f926c6b79a1df87d109a507b703168b742
- MD5 907617f1773ac713d33b44666ecaec6e
- SHA1 c87046a315d854e04561af4fd23df08930b05b83
- SHA512 99a2486183831e9be20dbc48e8807f7fccb0922a379951275f9d76eaefc5e2b99e5440b8370c69a93b7c2271b7e6ad0ad759e95f889703d8a3b592b817a48d77
- TLSH T1BB4146174B95EFB2C11D03316196401E32B8051D23A7D6820BA7D9BA5A6628C3BBAB1E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-ucrt_31bf3856ad364e35_6.3.9600.18144_none_9caaa3a5ed56b92c\ucrtbase.dll
- Size 971KB
- SHA256 24968e69daf49f58e812ada3e4cb24a66d6fb9ef14fc211538dd992b08ed1c3b
- MD5 1eb17f650462eea820f4cd727d2d3ab1
- SHA1 688f59160589ffa293502bffcd5c0e62e1993903
- SHA512 4b2fd6f202d2c697d10e0a2751ec05128071c7a3f1296c9f41fdbf07b334d8eb48dad674d91150966e0ea925c8e2aeceff904bb3d055989de2e1f94dd7d4bf18
- SSDEEP 24576:JdX8vuNxBoVnCBuwJBNMsSLvZCRX3fp8di8DmxvSZX0ypnB/:/+quw5pKZC9B8BB/
- TLSH T1AB259E79FB5C09AAC57BE07CC95B160AE5B63402437086CB03E64BB97E2BBD91637311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-ucrt_31bf3856ad364e35_6.3.9600.18144_none_408c082234f947f6\ucrtbase.dll
- Size 900KB
- SHA256 a134a1d4e9143bce04a4bbefe4f7ee5ad677da1913c1186e021623df01ba28bf
- MD5 3df1d7da8c1493a5a00c0474323fef20
- SHA1 f771c2f2cc1b0fc8534c7670f1633e8316f62092
- SHA512 fde8e6a06b13ebc64e42e09583e1466d32812b907274fdae8a5e04ee27f108aa311646e62b65aec30db5a9c150fdfe478b1586a7c413101377de50899af36582
- SSDEEP 24576:mAqW/e5NMe7KtlQzn4pz+xJlEIngFmcvIZPoy4zkkq:r/efF54prq
- TLSH T168156A617885C171C8FA71F81AAEB232057EB5944F70A8C337D40FFEE5651E02A3B65A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vbc\vcrun.msi
- Size 32KB
- SHA256 3da519da4d4426edd1418bb51e8c437872a30e770e655073c06689061f7d0677
- MD5 a0710c5aa0de7091d6db172127c937d1
- SHA1 7c736565e307c24ae5bfd9efc255881bf5ce67a0
- SHA512 0d991e6a21acbdfdaa0384a966db0e1f774f6702f9ec430c85d213fd9455695b5281d056dfce1d1e8340d3739e78a9a08bd35867c2cf4a87262920b68b6d3dba
- SSDEEP 384:bBzid9J8w0vFJ0Qpag5vymM5IC0iwXBa:9zkoNhMmC
- TLSH T122E2E81A7A04A722C40203325E2FD7E85F35AC549F2A0A1776E7B34C3EB25D4767ABD1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\logo.png
- Size 1KB
- SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
- MD5 d6bd210f227442b3362493d046cea233
- SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
- SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
- TLSH T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{61087a79-ac85-455c-934d-1fa22cc64f36}\.ba1\thm.wxl
- Size 2KB
- SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
- MD5 fbfcbc4dacc566a3c426f43ce10907b6
- SHA1 63c45f9a771161740e100faf710f30eed017d723
- SHA512 063fb6685ee8d2fa57863a74d66a83c819fe848ba3072b6e7d1b4fe397a9b24a1037183bb2fda776033c0936be83888a6456aae947e240521e2ab75d984ee35e
- TLSH T11F519B6778CF639028335125EAD2966A6920C5DC923F2DF1FC4A914B838D522A373F57
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{61087a79-ac85-455c-934d-1fa22cc64f36}\.ba1\thm.xml
- Size 5KB
- SHA256 6b1ba0dea830e556a58c883290faa5d49c064e546cbfcd0451596a10cc693f87
- MD5 0056f10a42638ea8b4befc614741ddd6
- SHA1 61d488cfbea063e028a947cb1610ee372d873c9f
- SHA512 5764ec92f65acc4ebe4de1e2b58b8817e81e0a6bc2f6e451317347e28d66e1e6a3773d7f18be067bbb2cb52ef1fa267754ad2bf2529286cf53730a03409d398e
- SSDEEP 96:wHdQG+3VzHfz96zYFJKFBiUxn7s82rf3nswO:wHAz8
- TLSH T193C179B546DDB801C133EB1166F231D27F126972C0C86E99F94C3AFA4FE1150A87B2AD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\.ba1\license.rtf
- Size 6KB
- SHA256 8518f0420972c1dbe8a323ffc6f57863af0b80c6a3b27fd0c6fc9bdabb7e2d13
- MD5 1e47ee7b71b22488068343df4ce30534
- SHA1 deaee13f21ab70b57f44f0aa3128ec7ad9e3816a
- SHA512 c4c653bfd1fc493b0efd8f9c75495287818179dc35969d1fb1927faac3ff9189fde1131c5abbcc3963f707412a7f8ad05a9e6855b7d47d6df1f80d25d67be9ed
- SSDEEP 192:qMIJdg+CSWA2NLtMqAEwRceNlC8xiYOlTGyDtsFSpM52:IIATECl1i95Zw2
- TLSH T194E1C6FD2243DAE0069F1399194194C6FB0F0F79DDBF7E50B5B69110126291C727EAD8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\.ba1\wixstdba.dll
- Size 117KB
- SHA256 e7c8e7edd9112137895820e789baaaeca41626b01fb99fede82968ddb66d02cf
- MD5 a52e5220efb60813b31a82d101a97dcb
- SHA1 56e16e4df0944cb07e73a01301886644f062d79b
- SHA512 d6565ba18b5b9795d6bde3ef94d8f7cd77bf8bb69ba3fe7adefb80fc7c5d888cdfdc79238d86a0839846aea4a1e51fc0caed3d62f7054885e8b15fad9f6c654e
- SSDEEP 1536:hwWD51FEDj4FBanDsDS7uO+Y3HBfPGST4BetdSnIDnDWZykftV4bvPbkYI9:NGDjrL7f35FTvtdJOZptV4bbkYS
- TLSH T1F8C36D113BF49071E1E6163D4929A3215B7FBA3199B0E8CF6B484A5E2E711C1DF7A323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI24BB.tmp
- Size 97KB
- SHA256 8178c4a2b71ed1d6887df8e0ee4a6613f96a518c43d27b38dbcf8a3d447a38e5
- MD5 d36a56e88a78b4d3c7ee1f4f804e17d6
- SHA1 a520426523be085ec67291241f4219ab13f4d4b8
- SHA512 def633644549d1bc92b28e8e577ad48391f774551091060b393283940ea53b22a612b3d8648640ff3bb436d36ac2edd704cfd3768a7014b01fb8fd438c51edca
- SSDEEP 1536:PpK0p0Chu240kmktdDMKVDo9PkzcGzFukFqbbffCfBX5a3/L6F5De:PQChu2VksKCM4GzFubfqfBX5avuF5K
- TLSH T1C0A36C5463E8107AE467827ECDE65A4AFB31B4050779A3CF032586991F33BD5AF3A312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI2C6A.tmp
- Size 93KB
- SHA256 fb13d67c05d0e3c693701d782a55bc002ab62e972e4f018bd6b1717493bf1ae2
- MD5 186694813c3d5e33202a1a72c5079cc3
- SHA1 90a9c2bf6419be6f46999e137c2149feca62cd13
- SHA512 57bf8ef4bdc08bcd7a83f82d14556710a2ef0cc7ef63366c48b144002a5f70cd58a130011cce648dcb3e9f62eafd6b188aa908b3b8f324448fb38567e499383b
- SSDEEP 1536:NOTekneIYoT5jmIN0gaD4Prbde67Z9AlIZzxIgU9rHUD:NOTekSoT5jr0BDKEawIZzx3U9oD
- TLSH T16F934B4523E840B6E5B7927CC9F69A06E772B4411739A3CF1174829E1F63BC49E3E722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI3501.tmp
- Size 74KB
- SHA256 be2ead50c4cd94d33c7f1e7c00b47744cb4b4309dcb349236cdcd447265ecf4b
- MD5 d557e10dd63535aae79b780fbf83961d
- SHA1 67fdf4459fab259f61da7ddd342261243b916a94
- SHA512 ab7d5ec81a3e4367b51deac213da79f9b3a6f5be505f4900121b19bffee4366dabf9674753f6ea82e35a88080b85b1e0f2eca790630f879f850aa322e4068feb
- SSDEEP 1536:C/sWkKt5Qr09UcBO8IDNg3D+VYBli7woHKy5bJuR3nW+d:SJ5Qr09nGe3D+VYawa5bJc3nW
- TLSH T10B739D213651C375C19728B5E57AC2716A3E74201FE488CE7BA60B7E5E322C17A7B34B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIAD7.tmp
- Size 80KB
- SHA256 bab5c035abecdb9e89b93dc5cc688b5c3e5c6aec4000e466595ee3ebb3342ca4
- MD5 393da89078925f78e19445882c37fc59
- SHA1 1313f4e6c62670f1b10aaec77c105be275f50121
- SHA512 aea5690cc1e6decedfb963c728b880ddcccc3d15b190943a890c38d41057d3511afff2e6298c6042ad2d862abb13e95992406511356bc58bad82754954f321c0
- SSDEEP 1536:d+/OTT4YIb6rkCGoNGXbGKauVj4eKtHa/cJg95k:4OTMYRradauqCcJg95k
- TLSH T1AC832A2179E1C231E8E2777406FCA6622D7D78B14778D4CB778842ED8AA17C09B39367
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIFF8D.tmp
- Size 87KB
- SHA256 76cba690283ad7098dcab60a090fa20066e1ec0c952ce0e73dbd3f36411ef39e
- MD5 46790e2748ddb98e3d6115a5f0360ed7
- SHA1 d041d6aa45a7fd2433b46560377559e04b92f7b6
- SHA512 c1964abf5ca969a2e3e0cc7923766db5dfa999a849d54119e53730686a2b5d3e5cd28d3c375ba012c3d2c29677aa336ac6a48aaa45b466975caf045ba9dd895f
- SSDEEP 1536:DoihL9JEfu0VmWFyzIR41Moen9s2O35S5tTg6F51:Doi9JQgvJVJS5pNF51
- TLSH T1C2935B2179A0C03AECD222BD26ADA650567DB8B14778C8C7779D03EDDD207D0E73A35A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{C4B9619F-5620-458C-835C-95E3408F3C9A}\.ba\license.rtf
- Size 9KB
- SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
- MD5 04b33f0a9081c10e85d0e495a1294f83
- SHA1 1efe2fb2d014a731b752672745f9ffecdd716412
- SHA512 d1dbed00df921169dd61501e2a3e95e6d7807348b188be9dd8fc63423501e4d848ece19ac466c3cacfccc6084e0eb2f457dc957990f6f511df10fd426e432685
- SSDEEP 192:H8kZ1UVDWkiWZTIsp/4hghFF1Qf4lCfnEtHixEGx736wHqItfSpOtJ32:cM1RWZMi/zzlOnjt5HLoa2
- TLSH T13F12A7A8234783D103D213D7055294C1B71F0BF6AE7AF95C34E4D53826E2E6CB6B91E8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{C4B9619F-5620-458C-835C-95E3408F3C9A}\.ba\thm.xml
- Size 8KB
- SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
- MD5 f62729c6d2540015e072514226c121c7
- SHA1 c1e189d693f41ac2eafcc363f7890fc0fea6979c
- SHA512 cbbfbfa7e013a2b85b78d71d32fdf65323534816978e7544ca6cea5286a0f6e8e7e5ffc4c538200211f11b94373d5658732d5d8aa1d01f9ccfdbf20f154f1471
- SSDEEP 96:8L2HdQG+3VzHfz96zYFGaPSWXdhRAmImlqFQKFBiUxn7Ke5A82rkO/pWk3nswP:ZHAzZ/3
- TLSH T1D30259B546DDB801D232FB1166E231D27F126971C0C46E59F90C2AFB5FE1140A8B72BD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{C4B9619F-5620-458C-835C-95E3408F3C9A}\.ba\wixstdba.dll
- Size 191KB
- SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
- MD5 eab9caf4277829abdf6223ec1efa0edd
- SHA1 74862ecf349a9bedd32699f2a7a4e00b4727543d
- SHA512 45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
- SSDEEP 3072:OXoiFK6b0k77I+QfaIl191rSJHvlalB+8BHkY6v53EfcUzN0m6I+WxBlnKzeZuqt:OXoQNb++gDrSJdr8BHkPh3wIgnK/IU1a
- TLSH T103149E11B5D0907AE7FB1A385938B5216D7FBA201B60C99E17589D6F2DF02C0AF35B23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC\Microsoft.DirectX.AudioVideoPlayback\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.AudioVideoPlayback.dll
- Size 52KB
- SHA256 406f473429573e9f0084aae125ef8f19f59291aa4c33cf7d40e7d996995a3238
- MD5 75933586afd94ea24c5acd3dbc89a272
- SHA1 970fd4b49d1368330c10279798991b901a233c2a
- SHA512 c096f0f11fb306c6a84886826306fe9c2862c3c79b14a8991a174224b41c2a68b76e5be506494d23d354384c715c5d82a1cacffff9644de9d6b93e9478087a1d
- SSDEEP 768:/BJPuUm+QFYqG9se2k5R7vtv8+80t2TxJNdfr83A/E9t3DAsm:7u8qYqK6k5R7O+80tKxJN983aErm
- TLSH T1DB33B8054784C167D36E07B6907A13718739A1B187A6F7C3141A42E22D7B3EDEB782EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC\Microsoft.DirectX.AudioVideoPlayback\1.0.2902.0__31bf3856ad364e35\__AssemblyInfo__.ini
- Size 342B
- SHA256 d52190e7d8d80a42331d5a69a3178842b6f1c483cec436f39690fe1f1c93b87b
- MD5 04bb73c2a847b974668f8b8a6375a05b
- SHA1 e3ab03ad9714a1fc48b63c3b7602a75cf167fce6
- SHA512 5d272fc8657d1d282e12fe314cfb4c14afb3f9bcde51a01e2cb26360a4196f18b079e159e1fa00bad1721f53b512fc5a944da9f2a698df53aeb74596bfd05d56
- TLSH T1C7E0202DA0945DD6C011E993AB951A54532D178F524D7F985061531C4633F5B92810F2
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\assembly\GAC\Microsoft.DirectX.Diagnostics\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Diagnostics.dll
- Size 12KB
- SHA256 8c9685959706750091b0094522cec8644de1d1c6309e7a2fe02cef130d3a2b9c
- MD5 c0843f0f45edeef233b1e581ae75e3bb
- SHA1 04569c78868eaa8927ba64f93312720117152843
- SHA512 8fc293f5c5de65893d92c54f921c84f8a3f44fc733445dda7907ee09d062371ef05c11d014ba2017fd15908b911d0185a14b89d0a311a870fa33650c3176e442
- SSDEEP 192:9X3NgxSDOjWs65Cxa+vFeWR0TYTCCp0LASNx6fd4pG7SHQTDruA7eWFVrWS:9XdgSDOjWTCnCOp5+ICQvruA7eWFVrW
- TLSH T13042B70287ACC237ECB60A3C446706790727E696C7B2CBDB5159172958A2BD8EC71373
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC\Microsoft.DirectX.Diagnostics\1.0.2902.0__31bf3856ad364e35\__AssemblyInfo__.ini
- Size 328B
- SHA256 67452e55c30b9361fab1da0d43cf788a2912ffe524e0a3373c7ff27a51b9ca46
- MD5 12c11e5ef3905c021ea9e65a129cef70
- SHA1 cd0ece07da9533298f86f8f6d0a275b7e3d66af5
- SHA512 320b81647423a8e2b3147cd39c336051960f05cee059289e3981a8852122033f22177a9b75f57e1085ea58bd5a89a3405aec3621a5b1720fbc6e022922ccebe0
- TLSH T142E07D16F0295D9A8D02ADD36B420414A35F038B56C81F98D445771EC423D17A3870E3
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- Size 2.6MB
- SHA256 7986e3fbe05418fe5d8425f2f1b76b7a7b09952f3ec560b286dd744bf7178059
- MD5 a73e7421449cca62b0561bad4c8ef23d
- SHA1 cf51ca7d28fcdc79c215450fb759ffe9101b6cfe
- SHA512 63d24647ac5d0beb8f1284973927263cb6e05b4c399cda3912178114b42d541dd516c6d67a453ea997d9d0cd9126a1802678062f0951c2547e1b445ba50dfbe4
- SSDEEP 49152:CVtWTlcCjM1snlKtnzkXxB1xvN4gh3P9888BFtHAVYL8VTWIZaBrpdutHlx+w:lM1snlKtnzkXxB1xvN4gh3P9888BFtHs
- TLSH T170C57D05F6969136C8AB12B0119D37F821684676676123DF81849FA1BDF23D6CF383EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2902.0__31bf3856ad364e35\__AssemblyInfo__.ini
- Size 324B
- SHA256 2e573e61f8044d9b3fcf8a1c197d5ce5b7eae414d6866d58099f283ee4f6f2e9
- MD5 ef24981bc0e31dd88d7eecb311b74bb4
- SHA1 126af90a6cdb063506f06e4cffd07a96ede6cb5c
- SHA512 cfc13babc7ebcf468093f29c502047b3b0c81be286ec98186484528da9dd10682b634e9d4bf57ecdeef62c47adac633450a29cc39392a775cf7afc3b58bd99dd
- TLSH T167E02624F068B89290138A279E491C16627D029B4B9CDF1C1485571E8933D0782C90A3
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2903.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- Size 2.7MB
- SHA256 5b70f0ac40a38c903062a12ff7cd71d907e75238a044ded9b34fb51e9a9a2799
- MD5 5e2b8b8a5ed016468716b9ff82a1806f
- SHA1 f1772121149d87745738cd471d0e504301a9ad0d
- SHA512 4620c9bafb7dfaa8d4351d0d99ae3442ceb2220201f16bd9bab4fbeb1f411fd63d4f0e79abf6e762f4d0e62d42608fbeebd13943ce338eca59ad1080ea6c2728
- SSDEEP 49152:Q+V/h3z6YuQTZ5Y21g1e5ofzhy/Y2CjxWum2oM8J+i8rrNnmiO:xVpmYuQTZ5Y21g1e5ofzhy/Y2CjxWubo
- TLSH T175D57C01F695953AC8AB1271049E37F4216C86B1272127CF45581FE5BEB63E2DF382EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2903.0__31bf3856ad364e35\__AssemblyInfo__.ini
- Size 324B
- SHA256 56816a37b38b0f3c827e5738293e7c8c460af85571fb6d6ff4e1c1f1c705c0a5
- MD5 4db0f64d23258c2d7f3dc3ef921028a7
- SHA1 98fee104b4f151b40424bb2dca98a441fbc4efc9
- SHA512 ab7407569c69d7e488d915e19cbccf3aa9e32d49e77af39cc9b2b3f3349172ca60399fe5fa3b16cd33842af6655e733694f728224ee2a153d548ad6747f782a0
- TLSH T1C0E07D22F55D99B3A81297436E051503937E05EF478C9F0C654913184A23907A5C90E3
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2905.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- Size 554KB
- SHA256 f500c350dd71df7452b92444e19b4644b04283434a6557123f1e4d9fb078c3f8
- MD5 fb3bc0754921873a65f5fbdca845e6ee
- SHA1 67cde5bc8577cd3040e275d290ac021874da9fe8
- SHA512 292b8bda44e6ff6449c4b38da9b8317491c0f0da3d1e5f7947741de27cc51bbc078fbf947c89c4be3a0b54f7066f0480990d1de57919edba3414aace77c47635
- SSDEEP 6144:Sz29sSV8QKoTT4pc5MivMFq9OnnGnsikKF7K1Gh:SaiShTgm
- TLSH T1A7C4730AB740FA2BD92F5B3254D21A60167941CA131337DB01989B707DBB3E5CE396FA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2906.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- Size 562KB
- SHA256 5e90089e69e4f7e2e42ea4a81fb62005c3710d0a4acdf207b97ed03f5641d013
- MD5 afcf5f50c632f3a5598abc28f196d77c
- SHA1 294385693592f9d6320f8b0b18f45bc194d01a4d
- SHA512 29746ffc665051e13386e452c3e41a593b6339e09a228927929be100cddb3e0e0fd3b54abe02eb7d46a3d97466ecb02bac362398b72fd8e804cbb21c8bc856d9
- SSDEEP 6144:M+1mhBubP0MqFnCo4T/vKc5MivKu/NOnn+n3PFtKIx5Q7:nM7cP0MSCXd7ZQ7
- TLSH T1EAC4A50AB740EA3BD52E1B3214D21B60127951CA635236DB05589B307CFB7E6CE396FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2906.0__31bf3856ad364e35\__AssemblyInfo__.ini
- Size 324B
- SHA256 d5369d762c5da3a119b4097202d8d39f125192d9c48a248cea8087d77ba1702c
- MD5 924341e9ecde83f82af3619b98643a89
- SHA1 a86bda0e3d69993453ec405fd5edc0e52347a7dc
- SHA512 a73e5c41935f49e8e8939f094f5c525b778021cd416306801d6648d3c70287dd5a5c31f52040f1308ca635f1a0119990e220d2b28733144e3532939734353673
- TLSH T168E07D10B45C84E2A422E71327480992B36C42DB5EDCAF2C6441072E49339174294CF3
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2908.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- Size 564KB
- SHA256 bebbc40ca25ef22e9d16b0de1123e0cb0444fe7a78b4f0b4395bdfd81618698c
- MD5 43c280c3b15ceb2472ab560d09629664
- SHA1 e3a897d7608d03c93b5c2b8aef52703452cf6696
- SHA512 5229eef9153b992684b6dcb4a32b231c63322b5e4b49ef262228c0dcca4760f97cda5d15a7fcdf77d813eb24b359101e716f72988374106ace13473f27e731c5
- SSDEEP 6144:ssMlkpJypCpNpvUPJQe2c5sivNTpNOnn+nB8FiKIwCa:sYjypCpNpchZcUa
- TLSH T112C4A50AB750FA3BC61E2B3350D25B601679518A635273DB0158AB30ACFA3D5CE356FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2908.0__31bf3856ad364e35\__AssemblyInfo__.ini
- Size 324B
- SHA256 b31491e1c90c03f220ddf65c7b4650537a42e2b8727a061ccbf41b4e8982613a
- MD5 541a7240d9b3aee04e3d5522d2cdbd9d
- SHA1 83e65dd20b64a08c604e45c317f8c7e9ca4a4272
- SHA512 e36ab19e9395373534eefe9920400ae00261a952f0e53bcd4515b67e4098cdd098f89d6131d777d1214ba009e516592e3ebc79a874cf37bb0b3c0dcda870e491
- TLSH T194E07D14F5A89C82D133E2432B011D41736E06EB96CC1F0C3802573C4823A6F92850B3
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2909.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- Size 564KB
- SHA256 36a21fc4f4c8f6ba4ad900613ee1b08ff43f2545585a2601c9fc4cf083d68a77
- MD5 490807c150b7d8be44bde871f4df8c56
- SHA1 69b68a5b8cc3f3e75aa2ba284654ca58bb62f23e
- SHA512 9442e26de55009428cc6e747637c2cb64bd2f008541ccbb37fed4e83ff66845c7cf3874d93542e0ba544e2db61f4864b665b7720568eba284beb095489f3ca64
- SSDEEP 6144:GdqM8sMlkpJypCpNpvUPUEc5sivNBpNOnn+nB8FiKI1Ky:GAM8YjypCpNpc0cpy
- TLSH T141C49609B750FA3BD61E2B3350D25AA0167951CA235273DB0154AB30ACFA3D9CE356FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2909.0__31bf3856ad364e35\__AssemblyInfo__.ini
- Size 324B
- SHA256 a3a21cd4f4991faf6e2575c77a3a0befe0f6aa3d5f2a72993f2fd5ac57eba2e0
- MD5 8bba6eb6e68ced92a316e97974d142b9
- SHA1 9e21457d2f1aa4e0ad7d4754288c2f5e6801e2f5
- SHA512 0cfa88f610eb666c63453f7b3f1925188586416da7770b984ba4f0bedaaeb148fbb3cf6ce032abc98d25e5ab74d4dd906dee68029e21f627abbb94fb7ac8cf11
- TLSH T184E07D11F0ACC6829012C7131B460E12A22D17EF56DC9F8D2491232C8523D074A860F3
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2910.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- Size 565KB
- SHA256 78d85f0e2cb7d7bde534222f4ebfea1c9e06d37ecd3bb7ebd59e35f00b94b11d
- MD5 933085360527de1b4947289ca468184e
- SHA1 d5ee5e1e3c992c7518b5ce510c627c1564131b12
- SHA512 2e22398d7cdcd6a46daf3dd3478d861bc4012ba1b54862311ae031ebcd3f908352157cbeea528f22ef1824f8924c3f217311feaf1804cf675eafc07a8d3962eb
- SSDEEP 6144:CCxSOwe+wyc5si56H0NOnn+ndgFYKICza9G5:CZ/1a9
- TLSH T1C7C4C65AB750FA3FC52E1B7254D20A601679618A635233CB0158AB30ACBF3D5CE356FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2911.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- Size 565KB
- SHA256 2ee41d4d591a39d648e90db4d47d0fa0557fd68197756ee2ee94fcde4d820cfa
- MD5 25c76c1e29d3e8e7398f0901f558a629
- SHA1 2e907c9688a025538f1b2d0cf1860a2ae49fd2e9
- SHA512 7308fd91859d00debf446bd6b594f3ea196dbe46a3583858c76d2cbb008a8698207f1ce7746afe3de4efb9a27980f5f813c77cc88e273fa82b2695d8f3d15039
- SSDEEP 6144:mCxSOw4kuc5si56s0NOnn+ndgFYKIYR09B5:mwU/B09
- TLSH T1D9C4C65AB750FA3FD91E1B7244D20A601279618A235237CB0154AB30ACFB3D9CE356FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2911.0__31bf3856ad364e35\__AssemblyInfo__.ini
- Size 324B
- SHA256 1d11038415dfdbccbad8645cbde4310c49259b11f58f4b44c922d51415f5516d
- MD5 697f9e981e5dfb6cc299be22c063d20a
- SHA1 a33617145fe904a6d438e8f87a41ac531d371a9b
- SHA512 41ec1c829f7a9fc274f36c01845fa37086ff0df3257480925a3a2a0f3b4e21d3d11a05dbcf71969149de6f872c873f4ecdeaa4492fcb42730b31b74bbb535938
- TLSH T11FE07D31F05CC1E68013D353A6050D55636D17EF9ACC5F1C212A236D5423F4762C50A7
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\assembly\GAC\Microsoft.DirectX.Direct3D\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3D.dll
- Size 462KB
- SHA256 f3359d5e41b1d4fec7230579a593e40fe44f6afdfacd1e2bbe52ee06d84686fb
- MD5 7ad4d9fabd109432eed91b359ceae430
- SHA1 c1dcddd86f9fc630cc0231acd7b732fd55dc5f63
- SHA512 bfeaba581a7aeff86bac0c184da823e4a26516a3c4f39af6b6b1bfced73117f3816c567b182f4da0df1935a6e97b6d0520cf02f518736b52fd27d37750e863fb
- SSDEEP 6144:xMffO72SLj1OY/ceynGJFzoo6sw2ZdI/MASqzcoU0NO:WO72mj1OY/cqde
- TLSH T141A4370AA701EB3FD52B6B7129E21A60663D5089631121DB45489E3478FB3DEC83DBFD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC\Microsoft.DirectX.Direct3D\1.0.2902.0__31bf3856ad364e35\__AssemblyInfo__.ini
- Size 322B
- SHA256 cf1dcdfeeb16020575481b4a16395fcda515e3d7829820059ecbde134ecd2382
- MD5 945f01925b495cfa3ecdddc1464b06e7
- SHA1 65f5b9632f394bb65b53027673515057d2e72760
- SHA512 a0ce7ec4496eee7e6e4d9ffc46e5270f53adf398867a6fec3ae05e3c0538723c7985660e22626152f576813f06a85fa926b768ad67e729fb276f3b528ac3f93a
- TLSH T11FE07D04F0584896802266276A490D09976D568F4ECC4F1C6021936E4833D2743C60F3
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\assembly\GAC\Microsoft.DirectX.DirectDraw\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectDraw.dll
- Size 142KB
- SHA256 ff4c03bbeb292317a77c86c1c81ae9564acb984b352fbef36d66e2d8bcbd79a8
- MD5 d9824a9dd107e598575112b4ff897292
- SHA1 adcc54d159f1eeead01dbd2fbc73c808ce519920
- SHA512 caa1f0411e0470a315ee8c7a62defa972ff17557bcfcf74016c64ad11b0f6fa46a126131a18e275e59e025814545e1d7ffe145377f6a0bcdb8cc93471e4c9bd4
- SSDEEP 3072:jcihYXQbdT7FoCHJOcttT7ZyqhpRi+Cs3LaJgHNxRKP:w3XAB/7Zyqbms3LaJgHNxR
- TLSH T1A3E3810A1300CA3FC12E173584E72734573B91CA535AABCB514993E57CBA3D6EA316FA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC\Microsoft.DirectX.DirectInput\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectInput.dll
- Size 155KB
- SHA256 0ee2a2c371a918cabc85143202864d0c3a4abf1b93a5029081a622e0acf17ab7
- MD5 cebd995ddeab2c525a5c4e95789bc961
- SHA1 1c98da39d7eea36d73b361ddb24054038c2b8331
- SHA512 158b3fe6e6605eb56a99b2135df529226f9af4b001ed0c2e1fd201a60054e2201dc22245ee5a02c6e7778337f1974ee21fa088e94b13a7402e61f64658de49a1
- SSDEEP 3072:ik1jSCvSueJQAJcS2c+OgBdftI2oOb72u:psueJ5J12F/
- TLSH T1AFF3D616B340D32BD51A2B3194E34A702A3B91CA536177DF82155AA878FF3C9D8391FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC\Microsoft.DirectX.DirectInput\1.0.2902.0__31bf3856ad364e35\__AssemblyInfo__.ini
- Size 328B
- SHA256 3de72c8f67c17c12dbd65f35fe1ca37c3e374b48d1585625039b195cc60c9454
- MD5 ff83332f150e4dc112fbf61ad9d090b5
- SHA1 6ead8568570e6c617096c7668882e613f14d760b
- SHA512 59c766d8363041967747e62ee6b725251408b2c730656b97de96fc4eaa2e1317588324af67d1f042b84e6dc1f99159525c8606af30d0d9196ccdc9d0eddbebb9
- TLSH T14BE07D24F06E49958502CE1377C54C05137CA6CB97DC8F5C7421175D8837957C7850F3
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\assembly\GAC\Microsoft.DirectX.DirectPlay\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectPlay.dll
- Size 356KB
- SHA256 489f65e1e00534835486e9255eec92b83edae4dade6dff867a380859ae53006a
- MD5 46f26e2bafd44960e7f13b2ef80aa0bc
- SHA1 2277bc8980e0f6c3672c2348b0494f0cc0ad611a
- SHA512 5b5147940803bccd0184b46e60560f967831541e707b5ef19781103e31235f1ba05d00e44a6f2ed061ebf5dd7013d9c696131a3edaa77d3aabb85b3255ba5489
- SSDEEP 3072:CLhR3iE5AaW6b+3sCo2FmEimEuVmnKJxjLw2ESC9378PnIJCNB0MJZc8ed:CLrbare+3C2MEw9378wYUMbcp
- TLSH T12F74534AB744EB3BD62A1B7154F31A55173A8089735231DB04688631BDBE3CEC8396FE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC\Microsoft.DirectX.DirectPlay\1.0.2902.0__31bf3856ad364e35\__AssemblyInfo__.ini
- Size 326B
- SHA256 87808098098fe44dbb9c8a04120e15b67fe1fe1ac2ea7613c167eccf4a2bae64
- MD5 e181546da60315912a9a817887d1bb99
- SHA1 7176946ff7b37932facdc49242488bdfc735bdcc
- SHA512 86246f28b72c81424a04b810cc6b8e8e3a63451064ce67c4be5fc2f44007d22b7af8680fff84378e0579d7a1e6feb5159bd33cb3f76f7754efce6e3c64c09863
- TLSH T159E07D01F4BA889641136F936B9A1548572D46CB4BCC8F0C6401131C443392B42E50E3
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\assembly\GAC\Microsoft.DirectX.DirectSound\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectSound.dll
- Size 174KB
- SHA256 2e28c8fb8b87b5ffd1e0ea27710a2e785ef4741a89e4b3c3af726ec63d15a1fa
- MD5 d035348ec8968861af585b7132fe4c7b
- SHA1 877ffdf77b9cdc1be14135cff0b756a231401617
- SHA512 94358b581510c68049ac92990674a6cb495cb8ff005f7fc03696c57ba8b4cb384c5035d9332d0ea39093ba5fa5c8082143896cd2fc7ac24a192520789c707458
- SSDEEP 1536:QP0W6HY2WLuj4eWGolnfI8srFxq1tu5uxMc7q2eFrIuQD+hDLb:2p6HTLEeWvS8Q5uxMc7qdFrIuQD0
- TLSH T12E04740D5340D63FD61E57B059C20B666639408A5322B6EF0189967578FE3CAC83AAFF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC\Microsoft.DirectX.DirectSound\1.0.2902.0__31bf3856ad364e35\__AssemblyInfo__.ini
- Size 328B
- SHA256 6bcf3be3ee184d9d983fa86681586d1069821f38ad8022060dc510536116626b
- MD5 2862c22c9212066015fde51630e148e2
- SHA1 628f72ea564dede2a6ff702ab25de509c57bba54
- SHA512 7b696d3f4f474ecf59615ff97bbac6eef6f7bf699d61d91bdc70caa80937abb1c01789a723eb8a8cf5eaf0d0fbcfb64b5cca7ee65e6290898207a66019a5b7c8
- TLSH T1C5E02624B268699981468663964E2895B31D099B19CC9F8CB5112B1C882291793810E7
- MD5 SHA1 SHA512 TLSH