0203b36b13805abaaa2f24376cf70247022b8c6449a573cb8c0d12ce3c1a3dfb

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
94s
max time network
108s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-de
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-delocale:de-deos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OCCT.exe
Size 212.6MB
Sample260714-sd17aafs8p
SHA256 0203b36b13805abaaa2f24376cf70247022b8c6449a573cb8c0d12ce3c1a3dfb
MD5 3f9e84de3e78feb18e8ec91dd69b66f5
SHA1 329362a2278cb007ad144de03180957c80e4e098
SHA512 4fd654acc1595df8478168823578f25176070d5a43a359e42e094da519986b695752eec2cc470b64f2a981cc1b5198643d2cca17cbdc9a4a0799201c75c07a8b
SSDEEP 6291456:homs+NjrKMXNG4m3qCsjAAWGhmJq+S0yV+dYs8AvTJhou:nLjeuG4m3LyF4q+S0yU8u0u
TLSH
T121B833625D888D85E57BC078E696AA44D4FF3025B2BD98CF4F5E71613B43AE32738708
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation ransomware upx

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 11 IoCs

pid	Process
2744	OCCTGUI.exe
3604	DXSETUP.exe
6204	infinst.exe
7032	infinst.exe
1432	infinst.exe
3224	infinst.exe
2848	infinst.exe
1032	infinst.exe
5812	infinst.exe
6316	infinst.exe
6460	infinst.exe

Loads dropped DLL 15 IoCs

pid	Process
3556	OCCT.exe
2744	OCCTGUI.exe
3604	DXSETUP.exe
2744	OCCTGUI.exe
3604	DXSETUP.exe
3604	DXSETUP.exe
3604	DXSETUP.exe
3604	DXSETUP.exe
3604	DXSETUP.exe
3604	DXSETUP.exe
3604	DXSETUP.exe
6268	regsvr32.exe
3604	DXSETUP.exe
6496	regsvr32.exe
2744	OCCTGUI.exe

Drops file in System32 directory 54 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\D3DCompiler_43.dll	DXSETUP.exe
File created	C:\Windows\system32\SETFD52.tmp	infinst.exe
File opened for modification	C:\Windows\system32\XAPOFX1_5.dll	infinst.exe
File created	C:\Windows\system32\SETF5C0.tmp	infinst.exe
File opened for modification	C:\Windows\system32\D3DX9_43.dll	infinst.exe
File opened for modification	C:\Windows\SysWOW64\SETF880.tmp	DXSETUP.exe
File created	C:\Windows\system32\SETFB3E.tmp	infinst.exe
File created	C:\Windows\SysWOW64\SETFC2D.tmp	DXSETUP.exe
File opened for modification	C:\Windows\system32\SETFCC5.tmp	infinst.exe
File opened for modification	C:\Windows\system32\SETFD52.tmp	infinst.exe
File created	C:\Windows\SysWOW64\SETFE04.tmp	DXSETUP.exe
File opened for modification	C:\Windows\system32\SETF6BA.tmp	infinst.exe
File opened for modification	C:\Windows\system32\SETF94A.tmp	infinst.exe
File created	C:\Windows\SysWOW64\SETF97B.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\SETFCF9.tmp	DXSETUP.exe
File created	C:\Windows\SysWOW64\SETFE05.tmp	DXSETUP.exe
File opened for modification	C:\Windows\system32\XAudio2_7.dll	infinst.exe
File created	C:\Windows\system32\SETFE9B.tmp	infinst.exe
File created	C:\Windows\SysWOW64\SETF728.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\d3dx10_43.dll	DXSETUP.exe
File opened for modification	C:\Windows\system32\SETFA25.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\d3dcsx_43.dll	DXSETUP.exe
File opened for modification	C:\Windows\system32\SETFB3E.tmp	infinst.exe
File opened for modification	C:\Windows\system32\xactengine3_7.dll	infinst.exe
File created	C:\Windows\system32\SETFE9A.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\D3DX9_43.dll	DXSETUP.exe
File opened for modification	C:\Windows\system32\SETFE9B.tmp	infinst.exe
File opened for modification	C:\Windows\system32\SETF5C0.tmp	infinst.exe
File opened for modification	C:\Windows\system32\X3DAudio1_7.dll	infinst.exe
File created	C:\Windows\system32\SETF6BA.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\SETF728.tmp	DXSETUP.exe
File opened for modification	C:\Windows\system32\d3dx10_43.dll	infinst.exe
File opened for modification	C:\Windows\SysWOW64\SETFA96.tmp	DXSETUP.exe
File created	C:\Windows\SysWOW64\SETFA96.tmp	DXSETUP.exe
File opened for modification	C:\Windows\system32\D3DCompiler_43.dll	infinst.exe
File opened for modification	C:\Windows\system32\xinput1_3.dll	infinst.exe
File opened for modification	C:\Windows\SysWOW64\SETF97B.tmp	DXSETUP.exe
File opened for modification	C:\Windows\system32\d3dcsx_43.dll	infinst.exe
File created	C:\Windows\system32\SETFCC5.tmp	infinst.exe
File created	C:\Windows\SysWOW64\SETFCF9.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\xactengine3_7.dll	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\XAudio2_7.dll	DXSETUP.exe
File opened for modification	C:\Windows\system32\SETFE9A.tmp	infinst.exe
File opened for modification	C:\Windows\system32\SETF822.tmp	infinst.exe
File created	C:\Windows\SysWOW64\SETF880.tmp	DXSETUP.exe
File created	C:\Windows\system32\SETF94A.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\d3dx11_43.dll	DXSETUP.exe
File created	C:\Windows\system32\SETFA25.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\SETFE04.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\SETFE05.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\XAPOFX1_5.dll	DXSETUP.exe
File created	C:\Windows\system32\SETF822.tmp	infinst.exe
File opened for modification	C:\Windows\system32\d3dx11_43.dll	infinst.exe
File opened for modification	C:\Windows\SysWOW64\SETFC2D.tmp	DXSETUP.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2744-1803-0x0000000180000000-0x00000001806A3000-memory.dmp	upx
behavioral1/memory/2744-1818-0x0000000180000000-0x00000001806A3000-memory.dmp	upx

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DirectX.log	DXSETUP.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DXSETUP.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ad3b1fc6af0fc0350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ad3b1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ad3b1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ad3b1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ad3b1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies registry class 40 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_7.dll"	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{bcc782bc-6492-4c22-8c35-f5d72fe73c6e}\ = "XACT Engine"	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{bcc782bc-6492-4c22-8c35-f5d72fe73c6e}\InProcServer32\ = "C:\\Windows\\SysWow64\\xactengine3_7.dll"	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cac1105f-619b-4d04-831a-44e1cbf12d57}\InProcServer32\ThreadingModel = "Both"	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cac1105f-619b-4d04-831a-44e1cbf12d57}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_7.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cac1105f-619b-4d04-831a-44e1cbf12d57}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_7.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{bcc782bc-6492-4c22-8c35-f5d72fe73c6e}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{bcc782bc-6492-4c22-8c35-f5d72fe73c6e}\InProcServer32\ = "C:\\Windows\\system32\\xactengine3_7.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{bcc782bc-6492-4c22-8c35-f5d72fe73c6e}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}\InProcServer32\ThreadingModel = "Both"	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_7.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}\ = "AudioReverb"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{bcc782bc-6492-4c22-8c35-f5d72fe73c6e}\InProcServer32\ThreadingModel = "Both"	DXSETUP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{bcc782bc-6492-4c22-8c35-f5d72fe73c6e}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cac1105f-619b-4d04-831a-44e1cbf12d57}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_7.dll"	DXSETUP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cac1105f-619b-4d04-831a-44e1cbf12d57}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}\InProcServer32	DXSETUP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}	DXSETUP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}\InProcServer32	DXSETUP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{bcc782bc-6492-4c22-8c35-f5d72fe73c6e}	DXSETUP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cac1105f-619b-4d04-831a-44e1cbf12d57}	DXSETUP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cac1105f-619b-4d04-831a-44e1cbf12d57}\ = "AudioVolumeMeter"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cac1105f-619b-4d04-831a-44e1cbf12d57}\ = "AudioVolumeMeter"	DXSETUP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cac1105f-619b-4d04-831a-44e1cbf12d57}\InProcServer32	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}\InProcServer32\ThreadingModel = "Both"	DXSETUP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{bcc782bc-6492-4c22-8c35-f5d72fe73c6e}\InProcServer32	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{bcc782bc-6492-4c22-8c35-f5d72fe73c6e}\ = "XACT Engine"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}\ = "AudioReverb"	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_7.dll"	DXSETUP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}\ = "XAudio2"	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}\ = "XAudio2"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cac1105f-619b-4d04-831a-44e1cbf12d57}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}	regsvr32.exe

Suspicious behavior: LoadsDriver 5 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	2744	OCCTGUI.exe
Token: SeBackupPrivilege	5888	vssvc.exe
Token: SeRestorePrivilege	5888	vssvc.exe
Token: SeAuditPrivilege	5888	vssvc.exe
Token: SeLoadDriverPrivilege	2744	OCCTGUI.exe
Token: SeLoadDriverPrivilege	2744	OCCTGUI.exe
Token: SeLoadDriverPrivilege	2744	OCCTGUI.exe
Token: SeBackupPrivilege	2936	srtasks.exe
Token: SeRestorePrivilege	2936	srtasks.exe
Token: SeSecurityPrivilege	2936	srtasks.exe
Token: SeTakeOwnershipPrivilege	2936	srtasks.exe
Token: SeBackupPrivilege	2936	srtasks.exe
Token: SeRestorePrivilege	2936	srtasks.exe
Token: SeSecurityPrivilege	2936	srtasks.exe
Token: SeTakeOwnershipPrivilege	2936	srtasks.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2744	OCCTGUI.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3556 wrote to memory of 2744	3556	OCCT.exe	87
PID 3556 wrote to memory of 3604	3556	OCCT.exe	88
PID 3604 wrote to memory of 6204	3604	DXSETUP.exe	96
PID 3604 wrote to memory of 7032	3604	DXSETUP.exe	97
PID 3604 wrote to memory of 1432	3604	DXSETUP.exe	98
PID 3604 wrote to memory of 3224	3604	DXSETUP.exe	99
PID 3604 wrote to memory of 2848	3604	DXSETUP.exe	100
PID 3604 wrote to memory of 1032	3604	DXSETUP.exe	101
PID 3604 wrote to memory of 5812	3604	DXSETUP.exe	103
PID 3604 wrote to memory of 6316	3604	DXSETUP.exe	104
PID 3604 wrote to memory of 6268	3604	DXSETUP.exe	105
PID 3604 wrote to memory of 6460	3604	DXSETUP.exe	106
PID 3604 wrote to memory of 6496	3604	DXSETUP.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\OCCT.exe
"C:\Users\Admin\AppData\Local\Temp\OCCT.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3556
- C:\Users\Admin\AppData\Local\Temp\OCCT\Resources\OCCTGUI.exe
  C:\Users\Admin\AppData\Local\Temp\OCCT\Resources\OCCTGUI.exe --temp-path="C:\Users\Admin\AppData\Local\Temp\OCCT" --launcher-exe-path="C:\Users\Admin\AppData\Local\Temp\OCCT.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2744
- C:\Users\Admin\AppData\Local\Temp\OCCT\Resources\GPUUNREAL\prereq\dx\DXSETUP.exe
  C:\Users\Admin\AppData\Local\Temp\OCCT\Resources\GPUUNREAL\prereq\dx\DXSETUP.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3604
- - C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\infinst.exe xinput1_3_x64.inf, Install_Driver
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    PID:6204
- - C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\infinst.exe X3DAudio1_7_x64.inf
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    PID:7032
- - C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\infinst.exe D3DX9_43_x64.inf
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    PID:1432
- - C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\infinst.exe d3dx10_43_x64.inf
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    PID:3224
- - C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\infinst.exe d3dx11_43_x64.inf
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    PID:2848
- - C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\infinst.exe d3dcsx_43_x64.inf
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    PID:1032
- - C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\infinst.exe D3DCompiler_43_x64.inf
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    PID:5812
- - C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\infinst.exe XACT3_7_x64.inf
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    PID:6316
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_7.dll
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    PID:6268
- - C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\infinst.exe XAudio2_7_x64.inf
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    PID:6460
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_7.dll
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    PID:6496

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5888

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2936

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

libHarfBuzzSharp.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\OCCTGUI\za4aqpfh.arj\libHarfBuzzSharp.dll
Size 1.7MB
SHA256 eb76238c9e8e41d44b5a5b18167c4c5b39ca5db4277af5dbe92d730f0fc14a7d
MD5 e0c86bbd88d6b8f5643c1ab1c050a4ee
SHA1 f6c72b1fd89d0f9e3d7825a0450ae0c0af092c5a
SHA512 023a1054d7516ebb99b46ca3f9a17b1ee00e55a46356586513fdd45c42bd6ccca16139a8e93e7a9bc533afa5abed121cb5fd40474bfb27bca22da3598ebef694
SSDEEP 49152:MG+tDvarn9O+3KVv/s0upzEpOqw8k25Pj4LneMdTaGVW:FS2be5Pp
TLSH
T1E3859E4AF2AA10E9D9BFC074C666950BE7A274050314DFEF65E08A95EF23EF5167E300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libSkiaSharp.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\OCCTGUI\za4aqpfh.arj\libSkiaSharp.dll
Size 9.0MB
SHA256 9a0d95e8caaa852c70d085af6a40a744242172ad9ea3fd6bc7599875a8a1dbcd
MD5 ef1fabce43fe32ca83260481253f5476
SHA1 ad988af9826e5aacc7b8e5ed6d220b229d70060e
SHA512 f73b56742e43b169177ff49f639c50f98a417f91175c70f7348bde1c7570c2838c181a59b628b003eb2618d75da920a449a724cccaec1dae8b9a80d5aac386f6
SSDEEP 98304:4GKXmtfLM9j2KAdTzwlrdyc8HgGTngmY6+o/:cXmlLMvGsIaGjb
TLSH
T19B964A03B66B64ACC04AC474834B99665E2038CB0B35BCEF52C5A1393FB9BF46F79615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D3DCompiler_43.dll

Path C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\D3DCompiler_43.dll
Size 2.0MB
SHA256 2f23182ec6f4889397ac4bf03d62536136c5bdba825c7d2c4ef08c827f3a8a1c
MD5 1c9b45e87528b8bb8cfa884ea0099a85
SHA1 98be17e1d324790a5b206e1ea1cc4e64fbe21240
SHA512 b76d780810e8617b80331b4ad56e9c753652af2e55b66795f7a7d67d6afcec5ef00d120d9b2c64126309076d8169239a721ae8b34784b639b3a3e2bf50d6ee34
SSDEEP 49152:DpX9JVeE9HP6Zpy9KyhMI50Du8LljslNsHSHFUq9OiapbbO5Akb:H3P9HP6Zpy9KyhMI50Du8LljslNsyHiS
TLSH
T1FBA59E11E705D0B2CCCB00B16A5DB7A6647C9F30432096C7B2947EA95D72AF35F3AB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D3DX9_43.dll

Path C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\D3DX9_43.dll
Size 2.3MB
SHA256 84b900dbd7fa978d6e0caee26fc54f2f61d92c9c75d10b35f00e3e82cd1d67b4
MD5 7160fc226391c0b50c85571fa1a546e5
SHA1 2bf450850a522a09e8d1ce0f1e443d86d934f4ad
SHA512 dfab0eaab8c40fb80369e150cd36ff2224f3a6baf713044f47182961cd501fe4222007f9a93753ac757f64513c707c68a5cf4ae914e23fecaa4656a68df8349b
SSDEEP 49152:dbCJsk4VlPXA+15Om5wxw9Qsi55K+31BhZ64nW:YIIBnW
TLSH
T17CB5486172F4C1E4E32A9039B597B20BFAB1304907188BC793E04D9A5FE6BD46CFA355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D3DX9_43_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\D3DX9_43_x64.inf
Size 667B
SHA256 71bd128262424567380c63c9c23eb819212222317026ad44e965ecac2224b848
MD5 654ec3755dd6ff76c3e200c445ee4956
SHA1 916a8a1419bf59c19913b74e053e9bd8ffd9197d
SHA512 65eebb20e9fb3cca1bdce2041f306fd9ae53727b298fba202722217c49c58682871513f0a0714a246f1f9e75870c8c7ccf9a77b7b1d33314ea168bcc747d5f58
TLSH
T14B012D2CAA257BC8F1D3794025018583687A2284A38270CB78ED8685FBE2704D3BC1FB
MD5 SHA1 SHA512 TLSH

Submit Download

FEB2010_X3DAudio_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\FEB2010_X3DAudio_x64.inf
Size 815B
SHA256 68351f03f4ef83e4b8c359e3e130441081690a1866b838a1b35d64674ef3abbf
MD5 49460e9297b0faab5a5d73e7aa2caa67
SHA1 a7e211f3d4ae808f67a798924c4d3314183df873
SHA512 92c4c0751e9123e1eb09da312bc44041d13262e26cefb807dcd1b354c5bd12c0d7197f1d3d457ddef89714b77ffe45db9c717332963c6daa507ae02a6d5fc941
TLSH
T13401829ACC03D5327689F1F17BCB2BCB5B27041AEA316518B68A04C8BB7310051AC1FD
MD5 SHA1 SHA512 TLSH

Submit Download

JUN2010_D3DCompiler_43_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\JUN2010_D3DCompiler_43_x64.inf
Size 830B
SHA256 3e779533a273e3395109c7efac13ba1c804c01b3ddb16938406fbdf90d851216
MD5 6494a3b568760c8248b42d2b6e4df657
SHA1 700f27ee4c74e9b9914f80b067079e09ec7c6a7f
SHA512 2bf68b123d7823ad7182e132d9e55f8de7580229e8e1b3b40030da50bb9bdeaf67bb9727ce2171fa83b7f804c24d9728ffabb44cb5017b16b771bb19e62b1b42
TLSH
T1B901AB9DCC02D43277ABA5F23B87674B1763084AED1125487D9900D4EF63304117D6FC
MD5 SHA1 SHA512 TLSH

Submit Download

JUN2010_D3DCompiler_43_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\JUN2010_D3DCompiler_43_x86.inf
Size 1KB
SHA256 5dd568919e1b3cbcb23ab21d0f2d6c1a065070848aba5d2a896da39e55c6cbbf
MD5 1a86443fc4e07e0945904da7efe2149d
SHA1 37a6627dbf3b43aca104eb55f9f37e14947838ce
SHA512 c9faa6bb9485b1a0f8356df42c1efe1711a77efa566eee3eb0c8031ece10ffa045d35adb63e5e8b2f79f26bf3596c54c0bd23fea1642faae11baf2e97b73cf5e
TLSH
T1883114ED8916943077D5B2B2BF8F264F67674406ED65214CBBC908A4EBB3701126D1FC
MD5 SHA1 SHA512 TLSH

Submit Download

JUN2010_XACT_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\JUN2010_XACT_x64.inf
Size 920B
SHA256 f3c288d84db29f7bc4d2c771341f765b5e1940a4827fcb55a65b48eec83c71d3
MD5 dc506eaa8bdc02b0918e8ce956b505ce
SHA1 9bfa75f2b2d7ba26a778623c8505e10428a1f6cc
SHA512 9938b821370919a25e801cc19841e951ef4523fa62eeccade6825e74c43319e9bad2f76e5971ce5d26ec2fe55258f7c9390626bc3b934c84b70f7a2870976b89
TLSH
T1611190D9CC03C1337689B1F17F8B3A8AE7670407E91123087AD915CE6BA3141919D2F9
MD5 SHA1 SHA512 TLSH

Submit Download

JUN2010_XACT_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\JUN2010_XACT_x86.inf
Size 1KB
SHA256 ca604ce9d2ee43a09b39b23a6a2a048b1a79d85c7d78679cc73aacc75cf7a62e
MD5 dbef26a0b937dc1859e9582aa88bf928
SHA1 25f85650c6f62e59c11f7234be22d34e890793b3
SHA512 4259193cd51168020b3b02ffaae89d7b4a972273b227cc3116c8cac3874b7c329e66c989ad200f93b05d1e4f90657b5391f37d6d128108db66ad7d6a758aa34c
TLSH
T15D31BCD9D802D1317689B271BF4F368E96774407E860260873CA1E9E6BA3241528E4FA
MD5 SHA1 SHA512 TLSH

Submit Download

JUN2010_XAudio_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\JUN2010_XAudio_x64.inf
Size 923B
SHA256 1a0f1b929724f8b71d5ce922f19b9d539d2d804c89af947d5927b049ef0fd3d8
MD5 dd987135dcbe7f21c973077787b1f4f8
SHA1 ed8c2426c46c4516e37b5f9aac30549916360f7e
SHA512 f0469c94219b4df99d7b9b693161a736fa8eec88a3f6c7f2cf92fab2ade048dfe61fcde3a4cf4f7a2aaf841d079a46b17259dea22cfb02831983f55bd7f61899
TLSH
T1B5117D85CC4382337789B0F2BF872E8A97570416ED212248BA9A15CD9BA310652AC1E9
MD5 SHA1 SHA512 TLSH

Submit Download

JUN2010_XAudio_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\JUN2010_XAudio_x86.inf
Size 1KB
SHA256 d786d06a709d5dc26067132b9735fc317763fcf8064442d6f77f65012ba179da
MD5 31d8732ac2f0a5c053b279adc025619f
SHA1 c8d6d2e88b13581b6638002e6f7f0c3a165fff3c
SHA512 abc37922307f081a1ffdc956ce59598c19ad1939ecfb6ea3280aa6aa7a99c3eba5462731586ca262f7d7257d7d2a74ff57a45abf6b93521eb6f1c9f22f8eb244
TLSH
T1D7317CC9DC0293717784B1B27F5F3A8F57670416ED61210873D65E9DABA3202216C1FD
MD5 SHA1 SHA512 TLSH

Submit Download

JUN2010_d3dcsx_43_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\JUN2010_d3dcsx_43_x64.inf
Size 815B
SHA256 5289b5ad22146d7cc0c35cdb2c9662742693550de8f013d1ec40e944288d155a
MD5 e1f150f570b3fc5208f3020c815474c8
SHA1 7c75fc0cf3e3c4fd5045a94b624171d4e0d3b25c
SHA512 a53618ed6ebcd50ef074b320eb3ebd38af4770a82caa808e47cba6a81982ced46cf954a1c5a383f171006e727d8211b4fce54c9faf27b4c14a770a45a09037b8
TLSH
T16001CE99CC03D03276CAF5B23B97674B2723081AED12258939D900D4EB63344516D6FC
MD5 SHA1 SHA512 TLSH

Submit Download

JUN2010_d3dcsx_43_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\JUN2010_d3dcsx_43_x86.inf
Size 1KB
SHA256 d5200b332caf4fff25eb3d224527a3944878c5c3849512779a2afcfeae4c3ca1
MD5 cf70b3dd13a8c636db00bd4332996d1a
SHA1 48dd8fc6fa3dae23cb6ca8113bc7ad837b4570d7
SHA512 ae31a9e20743a2052deec5d696a555460a03d400720679ed103759241b25d55e2fbc247170da3c0c0891f32b131ab6a6845de56c2d3387ad233aa11db970b313
TLSH
T17E3106D9C812E430B6C5B2F2BB9F674F6737041BE955214D77C908A0ABB3751125D1F8
MD5 SHA1 SHA512 TLSH

Submit Download

JUN2010_d3dx10_43_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\JUN2010_d3dx10_43_x64.inf
Size 815B
SHA256 a65f370a741d62c2be0ca588758d089dd976092cb910bb6b1b7d008741e18377
MD5 13c1907a2cd55e31b7d8fb03f48027ec
SHA1 ca37872b9372543f1dbe09b8aa4e0e211a8e2303
SHA512 545aaf268d141e2aae6800e095a1ae4eafe6bfe492d95dfe03789ccb245cc3ef3f50f43b10a41a3b0efdc7f8c63621b437323e133ba881f90a3b940095b80208
TLSH
T1F5018E9DCC03D436768AF5B27787674B1B271806EE5265A87DD904C4EB63204516C2FD
MD5 SHA1 SHA512 TLSH

Submit Download

JUN2010_d3dx10_43_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\JUN2010_d3dx10_43_x86.inf
Size 1KB
SHA256 4d4263cbb11858c727824c4a071f992909675719be3076b4a47852bf6affd862
MD5 53a24faee760e18821ef0960c767ab04
SHA1 4548db4234dbacbfb726784b907d08d953496ff9
SHA512 8371471624f54db0aca3ea051235937fc28575c0f533b89f7d2204c776814d4cd09ee1a37b41163239885e878fb193133ad397fe3c18232ad3469626af2d2ed1
TLSH
T1D83106DD89129430B6C5B2B2BB8F374F6B371407EA51216C7BC90CA0ABB3751125D1F9
MD5 SHA1 SHA512 TLSH

Submit Download

JUN2010_d3dx11_43_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\JUN2010_d3dx11_43_x64.inf
Size 815B
SHA256 2c4cf75b76203cba6378693668c8c00b564871c8bfd7fbda01e1e841477b2a3b
MD5 590fe1ea1837b4bfb80dc8cb09e7815f
SHA1 792b5b0521c34c6b723a379dd6b3acf82f8afb1f
SHA512 80bee8f1ad5bfaba6b3ac5a39302a1427dbaa5919d76c89b279dc753170ec443924eadf454746ce331a6682ee729ab79bd390a5d3b55db8d08fd6f4869101f53
TLSH
T188018E9DCC43D436768AF5B27787674B1B270806EF21659C79DA00C4EB63204516C2FD
MD5 SHA1 SHA512 TLSH

Submit Download

JUN2010_d3dx11_43_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\JUN2010_d3dx11_43_x86.inf
Size 1KB
SHA256 3925c924eb4ec4f5a643b2d14d2eda603341fbbd22118cdd8ae04aaa96f443c0
MD5 fb5d27c88b52dcbdbc226f66f0537573
SHA1 2cbf1012fbdcbbd17643f7466f986ecd3ce2688a
SHA512 8aa2200f91eca91d7ee3221bc7c8f2a9c8d913a5d633aa00835d5fb243d9cb8afa60fe34a4c3daa0731a21914bc52266d05d6b80bfc30b2a255d7acdf0d18eb5
TLSH
T1E93137DDC952A431B6C5B2B2BB8F374F6B370407EA21215C77DA08A4ABB3711125D1F9
MD5 SHA1 SHA512 TLSH

Submit Download

JUN2010_d3dx9_43_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\JUN2010_d3dx9_43_x64.inf
Size 812B
SHA256 272650a2d9b1cfea17021f4bf941b21f2206791e279070d4e906ce0ce56ac16f
MD5 ce097963fc345e9baa1c3b42f4bfa449
SHA1 e7624afc3a7718b02533b44edfe4f90d1afda62a
SHA512 f3c4f00eebd9d465bc2415d59c417bca0f5a07c8e13880b28704f770763609a653d4b06f53d98325b66c2c7094895190900c47980f81463215e919f00966ee7b
TLSH
T19A016B99CC02D43677DAE9B27B8B274A2767050AFA127198799A01C4AF63240116C6EC
MD5 SHA1 SHA512 TLSH

Submit Download

JUN2010_d3dx9_43_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\JUN2010_d3dx9_43_x86.inf
Size 1KB
SHA256 6b33d32da02f664092d44b05237990f825b4062c105a063badcf978648b5e95b
MD5 a11deb327119b65bacce49735edc4605
SHA1 0be2d7fa6254b138aa53d9146cda8fedbba93764
SHA512 b0134a3d6f2d576e5fafb601014ab66fef91d661013acc8a7a9129940369a1d9ed5c0f228bb1666a4e891f09b4b18e83f0cb2080047aa84fa45ab663e5739a31
TLSH
T1A73146DD8C02E4307B94B6B27B9F364F2727450BEA61314D77C90990ABB3341115D2F8
MD5 SHA1 SHA512 TLSH

Submit Download

X3DAudio1_7.dll

Path C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\X3DAudio1_7.dll
Size 24KB
SHA256 9460709339701ad471a5cabe6365355f4d586dc4fcb86507c1331839dc555446
MD5 b4ff2a39685c1a6d43f0e56eb350af3a
SHA1 466f80be26352f8331900a6da5b0a18dc7b39c0e
SHA512 cef31793e1b1714826aa95d256ebbec457e8cf9003767db46909bf879af86f954f475ac84e1ee8cccf1dcfe4a52624e3d7e8bfaff5f567e97cab19207db7f913
SSDEEP 384:9Yr0knT15SFM0kVqvgH5kwA3fV92aO9PFnIyaWZuWeLXci2jXHUpvg3Yl:InT15SFDIH5kwAOFnIKeMi2jXHUy3Yl
TLSH
T1BEB23A94FA7CC18DF42668F4A2E1F853BD3533814B1485CF13E1A9D8166B3C18BB6726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

X3DAudio1_7_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\X3DAudio1_7_x64.inf
Size 689B
SHA256 1da8585eb518801a26ce5a535620ad7bb4177dfccc8e468c8a003db064849d04
MD5 d2f7a179d3b79547d18a4157f71666ef
SHA1 9b83f1dd7fabf1982cf0f317061d24a52c6fd2f9
SHA512 5976d6ac22745a61b726426c65768594282af5b560575f718b588609c8f4fe02b0c1426297b775df241f4110f2bb1f37e2df30e94489a3d957319bc738262cee
TLSH
T15401F46EE5119BD8E08337C0374285C3ED7912589251245BB5EE8549FB62104D9E90BB
MD5 SHA1 SHA512 TLSH

Submit Download

XAPOFX1_5.dll

Path C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\XAPOFX1_5.dll
Size 72KB
SHA256 becfdcd6b16523573cb52df87aa7d993f1b345ba903d0618c3b36535c3800197
MD5 8a4cebf34370d689e198e6673c1f2c40
SHA1 b7e3d60f62d8655a68e2faf26c0c04394c214f20
SHA512 d612e2d8a164408ab2d6b962f1b6d3531aed8a0b1aba73291fa5155a6022d078b353512fb3f6fff97ee369918b1802a6103b31316b03db4fa3010b1bf31f35fb
SSDEEP 1536:YGrYa/nsaXTeizHgMK7DaCsVtqqXtF9rHU8:pY8saCizgMKXaCezXL9o8
TLSH
T1D3734C01A8E9C2F6E45828F5E4AE39973C38CE984B2085C3635845D5DDB47E07AF93F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XAudio2_7.dll

Path C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\XAudio2_7.dll
Size 514KB
SHA256 d1690b602cb317f7f1e1e13e3fc5819ad8b5b38a92d812078afb1b408ccc4b69
MD5 81dfddfb401d663ba7e6ad1c80364216
SHA1 c32d682767df128cd8e819cb5571ed89ab734961
SHA512 7267db764f23ad67e9f171cf07ff919c70681f3bf365331ae29d979164392c6bc6723441b04b98ab99c7724274b270557e75b814fb12c421188fb164b8ca837c
SSDEEP 12288:Tcn8HWZeKA6SKE8bZiCENnOgQs/WIOPtm:T98+hIBENODs/WNtm
TLSH
T145B42A12B0418275C5F726F185AE333B27388B8557411AD753E899F9EEE22E07EB01DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

apr2007_xinput_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\apr2007_xinput_x64.inf
Size 860B
SHA256 0d6e1c0e961d878b319ac30d3439056883448dcf26774003b73920f3377ecac8
MD5 94563a3b9affb41d2bfd41a94b81e08d
SHA1 17cad981ef428e132aa1d571e0c77091e750e0dd
SHA512 53cac179d7e11c74772e7b9bd7dd94ffbc810cfc25e28326e4d0844f3f59fd10d9089b44a88358ac6dbd09fb8b456a0937778f78ecc442645764f693ccd620b8
TLSH
T1CC118CCCCC0290327789E2B17B8B3BCA5B6B0417E961225C35DF4588EB67145A27C6FD
MD5 SHA1 SHA512 TLSH

Submit Download

d3dcsx_43.dll

Path C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\d3dcsx_43.dll
Size 1.8MB
SHA256 b46a44b6fce8f141c9e02798645db2ee0da5c69ea71195e29f83a91a355fa2ca
MD5 83eba442f07aab8d6375d2eec945c46c
SHA1 c29c20da6bb30be7d9dda40241ca48f069123bd9
SHA512 288906c8aa8eb4d62440fe84deaa25e7f362dc3644dafc1227e45a71f6d915acf885314531db4757a9bf2e6cb12eaf43b54e9ff0f6a7e3239cabb697b07c25ea
SSDEEP 24576:/j0ZXvi+of1/z+uQ5Da3Qx1fF4dEQMtqVC43ux:/A9i/f1/z+Zce4dpMATe
TLSH
T13885F515CB115AFBD5FD02B249E31B24777290A37EF312B3CF0946255CAE388A6319B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcsx_43.dll

Path C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\d3dcsx_43.dll
Size 1.8MB
SHA256 3c9e1b87f2763f58402b5104d21e0d9d5db352fcccf7801eaa4cd1f5dbc20945
MD5 5f1da86286a2dfb01c4fed55c2dd1d61
SHA1 c28525d941f1db5169cd56839559a3e9c0bb0c13
SHA512 9099faded2fc4909ce43dfe1ac804eaa97bab747889b7f437b69c1624d78f59ee3575ed2849cb75b707eb00b6775c4780b96d856023c498309acd690b0bcd8a7
SSDEEP 24576:lUZXPi+If1/TeOB4e4dEQMtqVC43uFx1fr8:Gdiff1/TeAH4dpMATe
TLSH
T10795F516CB155AFBD5BD027249E30B24B77290A37EF312B3CF0946255CAE3D8A5319B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcsx_43_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\d3dcsx_43_x64.inf
Size 663B
SHA256 8a623bac05c6508042dd01fccd53f2771306cbb9b339404b91fe106c3c7dbaf2
MD5 11f8fdb8caaf90f60830f7e83ac8f915
SHA1 a38e9ad249646104f781c1992065dd2bf3056cb7
SHA512 de7906ad80e80a55f92e45d7d36c3ced5ebf5d5d51d8d02587f27928d5f129f96cd36e96585c1648a7cef63062f05b79a1dfdceb16c0849cebbeaf46cc6295f1
TLSH
T150012D6CE220BB48F0D736402514C5837879126CA38B20CB38FD8654FBB2248D6BA5BB
MD5 SHA1 SHA512 TLSH

Submit Download

d3dx10_43.dll

Path C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\d3dx10_43.dll
Size 459KB
SHA256 56fcd13650fd1f075743154e8c48465dd68a236ab8960667d75373139d2631bf
MD5 20c835843fcec4dedfcd7bffa3b91641
SHA1 5dd1d5b42a0b58d708d112694394a9a23691c283
SHA512 561eb2bb3a7e562bab0de6372e824f65b310d96d840cdaa3c391969018af6afba225665d07139fc938dcff03f4f8dae7f19de61c9a0eae7c658a32800dc9d123
SSDEEP 12288:cFUDOgwNvArf8r3bK9s3kW3CG3vQ3sad/QNbubxu:5DOgw6fYbK9s3kW3CG3vQ3snputu
TLSH
T1C5A46A91D5505135ECDBD2B4500D31B626AEDA7353A1B2C72F5C6AEABE38BC01A343C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dx10_43.dll

Path C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\d3dx10_43.dll
Size 499KB
SHA256 9bffa1ea073d79e9954cb398fc91b93ed9dc79ed2205995d4b949f1cc2ad3bd1
MD5 ad7fa9485059f4dc53c98b49cab13f0b
SHA1 eecc2f4b2fe17d9d8b9e3abd7160503d10c0d14c
SHA512 ad703a57490a01f4e92201fafaeefa8bc60748aeb18be8c527ac0918b2a35f2a7884c9fbc4b23a3da03ad66954653f3e4314399ae1d9dd4509efce9b355e212b
SSDEEP 12288:4NFoet8lzbv17VPfkKS78zBN8LgIappk:4v9t8lzbBVPfkKS789AZmpk
TLSH
T1DAB4484132B8D2E6F13D653CB0AAF60BFA7135180B2046CB56B48069EF66BD44EFE715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dx10_43_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\d3dx10_43_x64.inf
Size 663B
SHA256 e36537b28026f4bf193788fe45605e9b5715117cbe4f638a9384aa3964768855
MD5 4f948e2a08b497b0aa470baa849f9746
SHA1 7a144e39849592f84beaaaae6fdeefed09a8e43d
SHA512 d93c0cd53140351f295bddbb258b1c2646b14980827c6697fb68b5f9811f604f0a1028abd08441bff93c0f15778b60b09aedd49be9de60ce70adfdf047a95f58
TLSH
T1C2012D2CA3605B48B0D736423002C5836C6A2298A3C328FA7CEC8D45FBB2504D7E91FB
MD5 SHA1 SHA512 TLSH

Submit Download

d3dx11_43.dll

Path C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\d3dx11_43.dll
Size 242KB
SHA256 492e960cb3ccfc8c25fc83f7c464ba77c86a20411347a1a9b3e5d3e8c9180a8d
MD5 8e0bb968ff41d80e5f2c747c04db79ae
SHA1 69b332d78020177a9b3f60cb672ec47578003c0d
SHA512 7d71cb5411f239696e77fe57a272c675fe15d32456ce7befb0c2cf3fc567dce5d38a45f4b004577e3dec283904f42ae17a290105d8ab8ef6b70bad4e15c9d506
SSDEEP 6144:8K0GaAtQlDJCSB4MvfIeDRI9Z7IJItblSwJ7FnH4fa1wlMjb5:eGjQlDkSB4MvfIeDRI9Z7IJIRlfJ7N4w
TLSH
T1C7345BA1EA00513AE8F6D2B4211D732151F9DE3007F2E3CB165CABDAACB56D18A347D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dx11_43.dll

Path C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\d3dx11_43.dll
Size 270KB
SHA256 981e42629df751217406e7150477cddc853b79abd6a8568a1566298ed8f7bd59
MD5 9d6429f410597750b2dc2579b2347303
SHA1 e35acb15ea52f6cd0587b4ca8da0486b859fd048
SHA512 46cbfb1e22c3f469bdc80515560448f6f83607fd6974bb68b9c7f86ca10c69878f1312b32c81c0f57b931c43bad80bd46bdf26ab4ffb999abb0b73de27ad7c56
SSDEEP 3072:iCWVWFOaVgP7BzvjYlTc91N6Vkg4eK6DvDBcMqpcJbMYBu1+Iz54+vJq9o:EWw4gPdz7YlTc91i1DLopYMvIIO
TLSH
T1F6446B5237899CDBE4B9A83CD0EBA603E3F1F5940B60D6CB0260455DAE7B7D09E7A311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dx11_43_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\d3dx11_43_x64.inf
Size 663B
SHA256 8572aa222c39fa63c22354da8114d95d06fb1f0c6a91bfbb489105deeabd6a83
MD5 d29c07bd1c7b9be7791554cad4d6d667
SHA1 49b2cd13650fa05dafab919e5ba1d37d137313cf
SHA512 0d16abb12b064f792ce504a69697817c2c7e54fb63feb3406f4f2028cdd19207adfa3147597c3be41d5e196fcc6f7c133d4d32e77e3263461683b2366bed18ef
TLSH
T1AF012D6CF7647B4AB0C33640200295836CA91288935624FE78FE8949FBB2904D7B91FB
MD5 SHA1 SHA512 TLSH

Submit Download

d3dx9_43.dll

Path C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\d3dx9_43.dll
Size 1.9MB
SHA256 0b28546be22c71834501f7d7185ede5d79742457331c7ee09efc14490dd64f5f
MD5 86e39e9161c3d930d93822f1563c280d
SHA1 f5944df4142983714a6d9955e6e393d9876c1e11
SHA512 0a3e311c4fd5c2194a8807469e47156af35502e10aeb8a3f64a01ff802cd8669c7e668cc87b593b182fd830a126d002b5d5d7b6c77991158bffdb0b5b997f6b3
SSDEEP 24576:8UtU6OIyl2Wy9M3bJ45fPS0zFZghQ6aOiFaKOE31GrvFXl74YZ29X1MDd6olmrBs:8566l2u45BiNYFrz31Cv3D29kd6kWa
TLSH
T14895AF51C5191075FDE69030110D32B2219C9B316391ABCF665E2ED9FFB8BE1EAB8387
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxdllreg_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\dxdllreg_x86.inf
Size 724B
SHA256 54e098294ef0ad3b14b9c77642838b5992fe4573099d8397a1ef566d9e36da40
MD5 8272579b6d88f2ee435aeea19ec7603d
SHA1 6d141721b4b3a50612b4068670d9d10c1a08b4ac
SHA512 9f1311803db1607e079b037f49d8643daa43b59ce6eafb173b18d5a40239a5515091c92b244ffe9cfef2da20530fb15deb6cf5937633b434c3262e765d5a3b21
TLSH
T15A014094CC039474B689F1B2B76B774F3AEB0917E9112308B3CD04499F6361021AD1BD
MD5 SHA1 SHA512 TLSH

Submit Download

dxupdate.dll

Path C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\dxupdate.dll
Size 173KB
SHA256 fb4f297e295c802b1377c6684734b7249d55743dfb7c14807bef59a1b5db63a2
MD5 7ed554b08e5b69578f9de012822c39c9
SHA1 036d04513e134786b4758def5aff83d19bf50c6e
SHA512 7af5f9c4a3ad5c120bcdd681b958808ada4d885d21aeb4a009a36a674ad3ece9b51837212a982db6142a6b5580e5b68d46971b802456701391ce40785ae6ebd9
SSDEEP 3072:KU6LKKnw8i/9S7BLGKm/nuFV3uNgosUBxr+2y97CqGIpHtWMeJnQRLj+bTHyKaY:Iw8aIMrfuFVeNgosUBxra4rIZsqq
TLSH
T133047C19F640E871D4D20178311C6B3119FEA87017A980CBF3472BCEE9A97D5A67E36B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxupdate.inf

Path C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\dxupdate.inf
Size 12KB
SHA256 93f5589499ee4ee2812d73c0d8feacbbcfe8c47b6d98572486bc0eff3c5906ca
MD5 e6a74342f328afa559d5b0544e113571
SHA1 a08b053dfd061391942d359c70f9dd406a968b7d
SHA512 1e35e5bdff1d551da6c1220a1a228c657a56a70dedf5be2d9273fc540f9c9f0bb73469595309ea1ff561be7480ee92d16f7acbbd597136f4fc5f9b8b65ecdfad
SSDEEP 384:eXTiDxtV0xxmBxbD6Ys7s6xHOJYwYdDxAp8xXZyUxIJM:eXiM
TLSH
T121429976B5168259F40EB3A016AF3EC95E3B008FB53164CD79EF11B0572E1ACA2FE464
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

infinst.exe

Path C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\infinst.exe
Size 74KB
SHA256 d808bb408a4bd695a9793e70b1c61637e008ac11174dbe1373481e2bdb0c9299
MD5 730e5493910e5693499485e352381c6a
SHA1 2871488c24d069e677868e0a590e7e74f1f19b12
SHA512 62fb2a2ddfd62d48ca8a709426c07e1cda0e66df5b977c3bfdc3b191d15c3a139a5c6180ed7a66b2418a5436273d713f2af1cb21f7dc77df78e0743d6a18e176
SSDEEP 1536:dlXfyLmGfmXJu7jiwgQ87Nl5LJw3xzFtmQVbSt5RuY:dlXfyLm/XJuUT7z5L8xzFIQVbSt5Z
TLSH
T1D6736B98B39450B9C46AC17DC9C29715E7B2F81A037643CF072886AA5F737E5693F322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

infinst.exe

Path C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\infinst.exe
Size 81KB
SHA256 8c62fe8466d9a24a0f1924de37b05d672a826454804086cddc7ed87c020e67ff
MD5 a7ba8b723b327985ded1152113970819
SHA1 50be557a29f3d2d7300b71ab0ed4831669edd848
SHA512 60702f08fb621bf256b1032e572a842a141cf4219b22f98b27cb1da058b19b44cc37fb8386019463a7469961ca71f48a3347aaf1c74c3636e38d2aea3bca9967
SSDEEP 1536:uOPXfyLm7r2P25504T+kGvNcD9QeZu/FOfNlpaJrxO1wh:usXfyLm7rGo504TzucD9HoIfND8xO1wh
TLSH
T182836B9933A410B9D1AB927CC8E24B05E7B2B496473693CF0368469A5F23BC55D3E733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

infinst.exe

Path C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\infinst.exe
Size 68KB
SHA256 34ab99536ea59ad60ba6efda3ea6d18291ef096a0bab3664248d6045805da0ec
MD5 45d4dac07aa361bcd77aa815d1724a16
SHA1 3bbdf7da5d51211ae269572961b5ebf508ada28d
SHA512 d940002a8e0112a3b56a909008403b447e9cbb80e38b9bbd508f40aa68224f7e5d9681e1039e747ae939e0829a25be2319b9f9d0862cebb042e4c525ccbc20be
SSDEEP 1536:dSKL6bzRYK/ixmu3XyhJRxjWhKfLXJ/y/Fae:dSKL62K/u3XmxCAfLXJ/y/E
TLSH
T1E8637DC3A648407AE0BFA53486F15B23F7F5F854033953DF1A1489290A67BDC2A3D74A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xactengine3_7.dll

Path C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\xactengine3_7.dll
Size 234KB
SHA256 d7b1cf58898046c430d49cf8f778e4898280f4709340c3938d3139894166fe8d
MD5 4fd7bcb9d8af6a165e9ba0c2eb702e7c
SHA1 a90863632c2d54dd06e01537744a7b65bb3d0db2
SHA512 7fcc435d07c434ec392bb9bfa98aee20b0b1cd2ad6a31f073af80f6f37639336349728c9b0fcd967c4c395fc40c0efad1e36142fe7632512b0f26aca1b1c4bea
SSDEEP 6144:Vk3x25EondaupoSRLZzv9WUpud8Mj3pHB2:Vk3xQEodaIoSRLZzv9W1dljph2
TLSH
T16034A4009541A27ACCF77AF90AEE307DB65C9BC1530460D757D8BAFBDA166E13A3018E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xinput1_3.dll

Path C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\xinput1_3.dll
Size 104KB
SHA256 756cad002e1553cfa1a91ebe8c1b9380ffabe0b4b1916c4a4db802396ddfbef8
MD5 bfb3091b167550ec6e6454813d3db244
SHA1 87e86a7c783f607697a4880e7e063ab87bf63034
SHA512 ce2ead2480a3942081af4df4baee32de18862b5f0288169b9e8135cc710eb128f9a2b8a36bda87212c53fd4317359349c94d38b5da082638230dcb5669efede9
SSDEEP 1536:S1ea+pg4i1fprOwSGiExJ70MBzLrPbYMGsJ0OXrLSkfmrxy/Fae:S1nz1UrGiEPg0LH7GNO7LSkfaxy/E
TLSH
T15DA3299AF25991F9D47BC07886D3BB26F6B2B450073487CB2764466A0F13BD89E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xinput1_3_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXE853.tmp\xinput1_3_x64.inf
Size 669B
SHA256 0d411d9424128f19fed2daa95a2983b4b29197f022a754f59d0c7740ad654cca
MD5 c9635b7617d68d95f9113282472218c9
SHA1 e3da3f2600a0f5cd0e28722ee313e04fc29dfc60
SHA512 0481e008619d3b3a45d0a90825b576e4c03f27668b0792762cb9165b15955645667392f23eac5e5c4eb8a7fe6fa47cae4c319323b02225289af0cffaf1ca8c83
TLSH
T1A301FE6C93910B88F4CBBA00244599C3A5AE01405685209A75FE8A84FB72284D7BC4BB
MD5 SHA1 SHA512 TLSH

Submit Download

HWiNFO_x64_215.sys

Path C:\Users\Admin\AppData\Local\Temp\HWiNFO_x64_215.sys
Size 58KB
SHA256 cc9d399816d0f04548545fa2cc4bb9e8d141624601ac271315cbe92f6e763a1e
MD5 8883d3b198ad93115fe3f5a798a7a09b
SHA1 dcd2e82df8a43c320a0ba8ce6acaf677531f18ff
SHA512 b6ba6e51a315901aee7258b381410aede0f34528e73d93bb56d5c89a61aa28c72e69fed2e58832fbbd39038c663bd2ed74cdd78a9a2a16e9587c02646657c207
SSDEEP 768:Upy4TF+6FVXr4bloDf63rR7Gb4xc5FxCa2F439FlyLGxAaiqg+kJsZK3C09zQ:h4xVFVXr4blobg7vzzBsZKSczQ
TLSH
T163438EA622E840FADD2290B1469E9277F8F570862725FDCF43B4C67C6B037D191383A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Apr2007_xinput_x64.cab

Path C:\Users\Admin\AppData\Local\Temp\OCCT\RESOUR~1\GPUUNR~1\prereq\dx\Apr2007_xinput_x64.cab
Size 94KB
SHA256 e7a09f8235cc587cc63f583e39fbc75008d9677c8bb4dcc11cb8d0178a5153ac
MD5 743b333c2db3d4cf190fb39c29f3c346
SHA1 26b3616d7321978bd45656391a75ee231196a4a2
SHA512 77fbdb86c79d7228bca2982a3285a417a365af980488a5ac2d470b532fa59fcc15e0e8dbee6eb1a3a5256fc29e0e3391529cd2ac13e0f72987ee0da136000957
SSDEEP 1536:CEDWhtT9OVcSEbv2sSXSf2rGrqZj64W/msrR2rKg+Yy9bMP+rGb2HtDZzmwG9rHR:It5OSvuXSf2rbZu4Kmsr4eLRwPC5B9G3
TLSH
T1449302D96E7BDA03EF0B5EFDA7D6A4087824DF6684E1701627EEA29C0C143C46532F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Feb2010_X3DAudio_x64.cab

Path C:\Users\Admin\AppData\Local\Temp\OCCT\RESOUR~1\GPUUNR~1\prereq\dx\Feb2010_X3DAudio_x64.cab
Size 53KB
SHA256 832b6d48e169b4725ae482ea4d1c3360a09631a89b2fac3aba81a50805a50adc
MD5 db47136a200e326174ce790359596eb6
SHA1 fabca8c0aa28164ef4fdb7ee4ae8942a275b1713
SHA512 f3b04168ca14ad4586493ea985417cce43ee11f37aa1856e714f44e132a31dbb84934943b947cf0b2aa39344e183cba8b6f49431b4471bd0e623926def94cb8f
SSDEEP 1536:Tiqitrhuwa0YCXOt4IBAIZt7bwf/S7LkDVJoTYA95QT:TipluZ01Om+vwfZy95QT
TLSH
T1EC33F297AE89A80BFA3E9D30230CCFE36D30D683991AD515793FBD40128A7F089D555A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jun2010_D3DCompiler_43_x64.cab

Path C:\Users\Admin\AppData\Local\Temp\OCCT\RESOUR~1\GPUUNR~1\prereq\dx\Jun2010_D3DCompiler_43_x64.cab
Size 922KB
SHA256 213ad66ab9e469db1e6a49a646d082bfc3700db94172984e7e36801612af50c6
MD5 0109c2931c4442c8192539f1991b6985
SHA1 1b3f6cf35dc745ea8748dae910f704b124e69f73
SHA512 c60bf98a0fffbcf3966d7d8abbd12f2a7e6e85b1624d67e9c5d5bb686d41b8ad12761e6cd13439d90248d194888897d055d2d5f3fa4fa2ddd7d21f5e7070b147
SSDEEP 24576:Sww34eXR087AW7psiEut/r/eY5u6FZqLB5:24eCW7pvEut/r/eY5nFZqLj
TLSH
T1901533AE8F5A1752D01049D5E342F48226BF06D2032C48DF89F7DEA33509B9E499BDBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jun2010_D3DCompiler_43_x86.cab

Path C:\Users\Admin\AppData\Local\Temp\OCCT\RESOUR~1\GPUUNR~1\prereq\dx\Jun2010_D3DCompiler_43_x86.cab
Size 909KB
SHA256 417eebd5b19f45c67c94c2d2ba8b774c0fc6d958b896d7b1ac12cf5a0ea06e0e
MD5 f7f554aa613eccf065575b8c69717ef7
SHA1 8417886d47c19cf6892f4080ddd5aaa1a49db3e9
SHA512 618f6dbb5bd9d44a8f10d119f5ef644f168fe3d8db986994e8cce31d1f11ff9ac872b389d1f218a82ff8b397bface587f97ca21e8f77433dbadb2ac475e9e6c1
SSDEEP 24576:dOWjUzqd7URYQio4yGDUATxoWDYicd3qRbmXHphTheUB:dtx6RYQiL1DUA7EicSbUJhI0
TLSH
T1B41533B48FE9413741A6F8481B96BBC0C11DC9E574F22DD5367FF2860846B94E32E99C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jun2010_XACT_x64.cab

Path C:\Users\Admin\AppData\Local\Temp\OCCT\RESOUR~1\GPUUNR~1\prereq\dx\Jun2010_XACT_x64.cab
Size 121KB
SHA256 06251ab76450feb7dc2ffb9be7615f5eb56960cefa4c990ef560f2c6f2a7551b
MD5 3753ba8fb15e0cb624b8cf1cf36fedb6
SHA1 b39e51423debe470be4ab4e16685a928f3f12787
SHA512 465394dec0c4ecbf069216a8840b06bbc1965f3e6a6704840c3e65d5b5dde286d7709e0bd150f114959b5ee3d77196539dec74dc59ee232e445f19758fa58350
SSDEEP 3072:ziVXXLzp3+IrbjhEIyEUj32DgmryYT3l5uGKrVsz9oo:WZLzp3+KbqIpUj3WJpx5uGKJmp
TLSH
T1ECC312E9CE3DB387AD6449A1336819CA5E32A3D8B412B06B8D45D3D50682FF8D4D84CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jun2010_XACT_x86.cab

Path C:\Users\Admin\AppData\Local\Temp\OCCT\RESOUR~1\GPUUNR~1\prereq\dx\Jun2010_XACT_x86.cab
Size 91KB
SHA256 354c2e579ed00b391dd5d8be91b0f45115e7c232ed1b842747830be0fd26e915
MD5 02da71bfa4764677ffcb9dcc62714418
SHA1 afd6de1263765302c639dbff0b47fd5f3763ac3f
SHA512 34b9e16ea8e0a343081d75ec1e90645243c34158ad9fd8df7c15dad43cca2e29aa7911a478845b13223631ed14434e7fdce5046e5ecd21d69e90ac8b206125da
SSDEEP 1536:1HdIVXRXKLBnQr8M5MHytMe2bZqkn1EGVUDkGGyCMAFmr96ELYhUaUbMywkpYUq9:RdIPCdQr8CMgiEeUD7veMZjTMyw2F09R
TLSH
T11D9312308D9CC447EE5C8C045955EF53B9B987C2AA6DB21B40367DFCA1C738EA687C09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jun2010_XAudio_x64.cab

Path C:\Users\Admin\AppData\Local\Temp\OCCT\RESOUR~1\GPUUNR~1\prereq\dx\Jun2010_XAudio_x64.cab
Size 270KB
SHA256 51500283f69e97f5beddb073ba2a9017de3d30379c0dcc4d11dd2236ce07b317
MD5 edeb828a8e54a9f3851007d80bc8dd6e
SHA1 358e429ac3b125cc7fe4f9ea46cdca4583cbb1a9
SHA512 8cf68e1a09c257f7fc29991331a128c159634ea86e36b6be8c2a0caf5ef1fda8e1c79639f099ba32650a9fcb26478f113227ee7ead84bfbd728665eb1a522537
SSDEEP 6144:dWPBT7hxRbpqP16WJL+HqvCsHjmNXgekqA8+6NIUyqI5Bv0:dstxRbpQ16WJSHaOwePFtKv0
TLSH
T128441245843B4480AF5379154301EF0D6CFD5BCAD8B8C693A0A7BB5F86D2B7D66E202B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jun2010_XAudio_x86.cab

Path C:\Users\Admin\AppData\Local\Temp\OCCT\RESOUR~1\GPUUNR~1\prereq\dx\Jun2010_XAudio_x86.cab
Size 271KB
SHA256 7b4332207563beba1103744b6db5399ad150e9e6838f9d5a71497e7eb3645ebf
MD5 9d2da3b1055120af7c2995896f5d51ed
SHA1 2df40d48c69d7cfb4e0c19f07a019f5f123303fa
SHA512 deb76247b3003fc59c0a95cc2a47d6dd56e2d75aec81c3ab6ca6c0c513fb054e8025c871e97b7d7f2c823df54a2fe8202f4c0caf677251070b8bce40d2db70f5
SSDEEP 6144:3UOaoaU0vu3c22wOuy54uw1VwjMbGATPt7vQQqy/a6m:34oZAwTw01VKMzWzyzm
TLSH
T1A74423A3C484CA07FBAD3DD51370ED5150316F8A58AE626D235CE9323D89BCE5B35839
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jun2010_d3dcsx_43_x64.cab

Path C:\Users\Admin\AppData\Local\Temp\OCCT\RESOUR~1\GPUUNR~1\prereq\dx\Jun2010_d3dcsx_43_x64.cab
Size 735KB
SHA256 cdbec7e3a5a0fef016eb294b036f93c75e45c6ead8d99397f859a32d23fe20cc
MD5 850aafddfefea671a2e1bbf1b65f2a8e
SHA1 9679e7f294ca9de945b6f4f3d775d739dc2f8cd1
SHA512 d87d8d123700e02caa6562c9f22a90e86b2d8277b20089ab9d77a885094aef22bb69d60405b366ebf8cbf74f4b53a17095c3cc93b8bd3766cef7eb02bc47397b
SSDEEP 12288:nDH/lxG7YZg1tkPRZ8m4a8PAWDJRZBIS8vKU+C4+MyPBtStjea7+BjD/Ve4tEua:7RRRKy8LJRZmjysBE8aaBjDFtEua
TLSH
T19CF423F2122E331D0BD219E0223FE2D0BC7664A2D857785FDA696C7B265336E31CD919
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jun2010_d3dcsx_43_x86.cab

Path C:\Users\Admin\AppData\Local\Temp\OCCT\RESOUR~1\GPUUNR~1\prereq\dx\Jun2010_d3dcsx_43_x86.cab
Size 744KB
SHA256 e2c5a2cbba7f211b6ca72ff8e5f69cba1f83be06357311b19e64f582fd3d14e4
MD5 44dba9557f956787b66f285776c3dccb
SHA1 4560c64f8b6bbdeedd85398f2e18404c389e4d8b
SHA512 25fbc95346bac890fee8d2a0805015af1eda5e0bb17b12d4eef52ca446775d08898fe5c13239e983a0f8c8dd13f8f2a5247a70e8e785e2bae42ff5ab1cca4156
SSDEEP 12288:u8Dx0/99rEneJVyrxcsaWmeUEEBTJNCK/FcZZXlewc3/2tqCyrIUl3z82ItDwh2a:jDO19AVrRfEHNZWZrs3+ICyco3MDISTI
TLSH
T107F4236B0267C746FD9A2C07932450D718BF32D32FB8795E529537FF0202F8A5A8619B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jun2010_d3dx10_43_x64.cab

Path C:\Users\Admin\AppData\Local\Temp\OCCT\RESOUR~1\GPUUNR~1\prereq\dx\Jun2010_d3dx10_43_x64.cab
Size 230KB
SHA256 efce48d425c07f1faad4a55d7061a01ed6245aac17f43163cf2a23cbc9a3054b
MD5 2d9586b276a561924ff2335fccaee914
SHA1 3b8114a8820a8df9df2321d6c4da8ea155ce736f
SHA512 d78ad87685eb71d2eb8c68e1e2c7fd5a90250f04059dd0016e4c8ca01bf53c02dea01998fe6de9ae3a3f76b2964d14a61e694546a2e6844bb304c315ae5b80e2
SSDEEP 6144:YpUgZAjzb+OfxD+CEQrzgL9j9E+qG6nbNxcR3bN8J9E3PWoJq:afZyfxZa9EjXbwR8J2fWoJq
TLSH
T1F33423C69C69D5646C5C7D59E0AA4C830D3C578C0C6B2279112FA5EC7F243EFABB2782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jun2010_d3dx10_43_x86.cab

Path C:\Users\Admin\AppData\Local\Temp\OCCT\RESOUR~1\GPUUNR~1\prereq\dx\Jun2010_d3dx10_43_x86.cab
Size 192KB
SHA256 a8cf71ffb80b683616d0621be96d3795b0ffda3877ed2d80cd958bfa393ddcfc
MD5 a89b98ab89e0d4ff9dae412d49e27c51
SHA1 18803d4bcc83ad39f25ff9f899baf136c89c10f1
SHA512 0b96a04663d2fbfb21901af832a5362785fb0270d1be0ef136549f07e2625653f8facd129889a5f3489fc8a1270abe474e4f1626ea630a3185a36812545b4dfd
SSDEEP 3072:ID2Fju8h1xkWCD/5e8U2LK1aQAMxVz2aoOxoY4+ApyP0EwMGvFas+8QJgdBvC09D:IwbCleyYagxVCaoV+ApcnG9aKQJadD
TLSH
T1181412DFCE488919FACEEDCE634ED8809CB816C30573D4458566F95039B13C85BE6E16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jun2010_d3dx11_43_x64.cab

Path C:\Users\Admin\AppData\Local\Temp\OCCT\RESOUR~1\GPUUNR~1\prereq\dx\Jun2010_d3dx11_43_x64.cab
Size 134KB
SHA256 c1d0d56b83bfb09a5e1a89e1898bb74446a847b30a968f3664ec2d87368eb63e
MD5 96e7847a914afcb489194940b06a5c23
SHA1 9439907a1000b9dcb8989ffbd828e6294c277fba
SHA512 638485084884fab9d8952af17b24c4aef16dd026c75256026859bfe4f24d7f11fd2240cde8c5de0dab8968885a6d344da7335be257570e947bf5da8ac06f61ad
SSDEEP 3072:1luKA472L962XjyJ1b4mBfqMlafaDxbUmDSRP7qlt+95tP:1le4A9Vjs1bVSiaylomDSRTqlo3P
TLSH
T1BDD312D6AEFAC60AFE435C5206ADD8620DBAB7C677E5980B5137F2D50943780604BC3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jun2010_d3dx11_43_x86.cab

Path C:\Users\Admin\AppData\Local\Temp\OCCT\RESOUR~1\GPUUNR~1\prereq\dx\Jun2010_d3dx11_43_x86.cab
Size 106KB
SHA256 a58cefe822e371d078eaf89319f832693352ba7d62079320074397f0f3425961
MD5 758c5a459978cb2c68a300a60da153be
SHA1 66d12509137f2b5e1a668df39e6ccce6402822c3
SHA512 f33d6fd3354310e6cc4b483eae955a9652e7f71ceef7c444bdef84251ffa6ec0b89886a2344d18e0a1ad5285123ad808904372289e1e1c8d14242483f0426588
SSDEEP 3072:hXMVzDTlrM28bEHSqgik2ono4DQQ/7cuBFbb9aDz9on:hXMxNjG4gikye5FBtB42
TLSH
T17DB302D6A260F94F8D676CC79246E79359FDCDCA4A24944B386EE1843C033A25B0BD4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jun2010_d3dx9_43_x64.cab

Path C:\Users\Admin\AppData\Local\Temp\OCCT\RESOUR~1\GPUUNR~1\prereq\dx\Jun2010_d3dx9_43_x64.cab
Size 915KB
SHA256 9b98a1269af7f3a0007bfdc73206a47a6ee158d34ba8a87009396c18186bb06a
MD5 063fa6f7061324eac1c4de0350c20e80
SHA1 daccf01b4b7493b88f04f9e50fe37c03846335ad
SHA512 3ad31100cbca4da52e46518e577dca94b595f9d47a3e9552cd764905ffc2876f9127b69a97bac44dbd754021e14ddec65480b7628a3768f03e53de8fbb08c547
SSDEEP 24576:mneqhPULh1ksCctVV+WOwy/vW09rabgcZhBeYCrrPe:1hOJY3+Lwy/vjkgcZaXO
TLSH
T1C21533859AADF8D55ABF0B0510912763267F33EB62F4F08BD5E126C05C30795438E7AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jun2010_d3dx9_43_x86.cab

Path C:\Users\Admin\AppData\Local\Temp\OCCT\RESOUR~1\GPUUNR~1\prereq\dx\Jun2010_d3dx9_43_x86.cab
Size 750KB
SHA256 fcc6cf0966b4853d6fa3d32ab299cde5a9824feaecb0d4f34ea452fb9fd1c867
MD5 7749862c307e527366b6868326db8198
SHA1 bce9f21cdb1e101c7223c9e62eca61ec22d6bb81
SHA512 b65a84535b749ade0f8ea1a8ab6239df8e82ad59cbdb07487fdbfcfcf57a565f493f56378e216859a081d23ddf7c671636f53ef821289d66452f09218080f02b
SSDEEP 12288:w0b5pTUIVIRxV+yb+HJFnXQRGr85UpzQ3VztxmHN8DMFy0BJ1lSIug3SqHAlzJYu:Z51NVO+XVLs3VztQHmYjBJb931I1NYIZ
TLSH
T10AF423432AA5348E8C523043E3669A2724B83557CEBDE77562A44B2D0CFD76F113ADB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxdllreg_x86.cab

Path C:\Users\Admin\AppData\Local\Temp\OCCT\RESOUR~1\GPUUNR~1\prereq\dx\dxdllreg_x86.cab
Size 43KB
SHA256 4afe0249a13868b7c4a92b4d53c998adf6053eb5e2c47fd81020fd8d4bb11150
MD5 4b4f83d1dd86314b65760f44f9c7a9b1
SHA1 d8d857ebbe2c0dd5b63e564bf8428c55ece55778
SHA512 91a556dee865f9a625a148556c289b287187d4a7c2814658d8b59a99afbf226dcf557094f43349ebfbd2fabc5628940cce942a22c29f5dbca086a3ddeef8e9c6
SSDEEP 768:47CbQVl8ORHNCNzUSWyEHNaNo6lc22V6yey6qoomHhPokDLmaV3QN7b6Fjpvh:47Cm1HwzUSWFU72UTHhPoknhk6F5h
TLSH
T16E13E1B4CD08ED409DBA2E992368FF363E78D99318703C5B46CAD78605883E58F6587D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxupdate.cab

Path C:\Users\Admin\AppData\Local\Temp\OCCT\RESOUR~1\GPUUNR~1\prereq\dx\dxupdate.cab
Size 94KB
SHA256 e18a5404b612e88fa8b403c9b33f064c0a89528db7ef9a79aa116908d0e6afed
MD5 d495680aba28caafc4c071a6d0fe55ac
SHA1 5885ece90970eb10b6b95d6c52d934674835929e
SHA512 a25c647678661473b99462d7433c1d05af54823d404476e35315c11c93b3f5ece92c912560af0d9efe8f07e36ae68594362d73abf5d5de409a3f0a146fe31a10
SSDEEP 1536:JvknxJRHNYzrAzRstaRGk0jzphvXdy57XwwnNb+vnaI1eYpIKxozNlmn6F5x:JvknxJpNYAzRstaRkz0BwwnNbSa+vp58
TLSH
T1BA9302EC875DCF93D5622DADA168EA0B7DBEF98E891CD42580B5F20418627DCB2F444C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DSETUP32.DLL

Path C:\Users\Admin\AppData\Local\Temp\OCCT\Resources\GPUUNREAL\prereq\dx\DSETUP32.DLL
Size 1.5MB
SHA256 fb0e534f9b0926e518f1c2980640dfd29f14217cdfa37cf3a0c13349127ed9a8
MD5 d8fa7bb4fe10251a239ed75055dd6f73
SHA1 76c4bd2d8f359f7689415efc15e3743d35673ae8
SHA512 73f633179b1340c1c14d0002b72e44cab1919d0ef174f307e4bfe6de240b0b6ef233e67a8b0a0cd677556865ee7b88c6de152045a580ab9fbf1a50d2db0673b4
SSDEEP 24576:CIQ+ddddddddddddddxOOOOOOOOOOOOOO2iWeXiWeXiWeXiWeXiWeXiWeXiWeXi+:CIQsOOOOOOOOOOOOOO2iWeXiWeXiWeXf
TLSH
T166759D31B1D40332EA7103B177128AB7F63EEB9DE119DA257DAE82552182B9CC37E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DXSETUP.exe

Path C:\Users\Admin\AppData\Local\Temp\OCCT\Resources\GPUUNREAL\prereq\dx\DXSETUP.exe
Size 505KB
SHA256 8f47d7121ef6532ad9ad9901e44e237f5c30448b752028c58a9d19521414e40d
MD5 bf3f290275c21bdd3951955c9c3cf32c
SHA1 9fd00f3bb8a870112dae464f555fcd5e7f9200c0
SHA512 d2c354ee8b6977d01f23c6d2bb4977812bf653eae25e7a75a7d0a36b588c89fcdbdc2a8087c24d6ff687afebd086d4b7d0c92203ce39691b21dab71eafd1d249
SSDEEP 3072:Qi6LKKSPluzye9iHWptICTrbusJxDO9insyH6+PJTOramZap5XVeR4zW1mFD1gbH:8UHWDICTmUxDpEa04+GU
TLSH
T103B4B05036F4D926F2F32B743ABDE26158BA7E80A934C20D2501665D1BF3B40A96CF77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dsetup.dll

Path C:\Users\Admin\AppData\Local\Temp\OCCT\Resources\GPUUNREAL\prereq\dx\dsetup.dll
Size 93KB
SHA256 2a61679eeedabf7d0d0ac14e5447486575622d6b7cfa56f136c1576ff96da21f
MD5 eb701def7d0809e8da765a752ab42be5
SHA1 7897418f0fae737a3ebe4f7954118d71c6c8b426
SHA512 6ff8433c0dadc0e87d18f04289ab6f48624c908acbda506708f5e0f3c9522e9316e587e71f568938067ba9f37f96640b793fdfaa580caedc3bf9873dc221271f
SSDEEP 1536:Bc8tBKv1HCyODN2wjIqlLmqxY3AMVI4I9okOEvc0/c/sZRYltL26VVE2S+JJqsHy:BftQv1iyODswNLmqxY3AMV71Ev54EAxM
TLSH
T113937D107694D076D9D620BD718CD7715ABEA6B41F6880CBBB461BDA8C653C0BA3E30F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ORingLib.dll

Path C:\Users\Admin\AppData\Local\Temp\OCCT\Resources\ORING\ORingLib.dll
Size 290KB
SHA256 fbd82e30bc522e7a648bc27d7627b85fd1c3400373b6e5c911e69cb584053fcb
MD5 c37959cf0fb03ab4cd0a8c3f7a1372d2
SHA1 01cd7d4e26b9201143540577135c0cc8c7b1b8f7
SHA512 de0008ab92f9b46ba82f476caa34f655c993ca84d9257479b0f5465f0ebcb3c91a0e39ddbb44c2bbad0b2c2d05c6a8306b30505a5d0b24c96e0ad243567cfa09
SSDEEP 6144:nCEqwK0Co3Dwpmfzbrf44sadkb8wIbTv/m:CxgzMorbrZXW2T
TLSH
T1BC546C0AB6A518B9E2A7857CCD534906DBF27C460761EBCF03A04AA72F337E0567E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DirectX.log

Path C:\Windows\Logs\DirectX.log
Size 499B
SHA256 1611e5b46051a787764bb89c358c689061be1774d38c2f9ecfcb791c8236c8ba
MD5 06955781760b0e69142aaeaf0dd470d4
SHA1 99531557ecbb219d7fde4b95aaffb0d25f43db9c
SHA512 b84937872091c080c820ab21ab0446cb913e7e0c81e9535d899577d00e73693f2bc08368cd24cbfcfa68e218e73b473c073fa50279493b6056e7f8531f50f867
TLSH
T106F082E56CBFE0A035401B96DDEEFBC88F18401FB1DCD66A276091009A2672FDD1E4A1
MD5 SHA1 SHA512 TLSH

Submit Download

DirectX.log

Path C:\Windows\Logs\DirectX.log
Size 64KB
SHA256 a523bc10207c969472295b4514af6b73cad2590feec2013e572424205853c307
MD5 4a89ea936b743637444e0a140e156808
SHA1 4ccc0280f82b03a6ee9ac5de19330a26560db7f3
SHA512 529610490f82413d75032cb3741cc55cce56a2a3b05c5e6bb78e58305aa63d67a243c84a68dc981e3bf13c4c1c00ef1b62ce270b1e284349484749ad497d7627
SSDEEP 192:MMgviCiCkiCiCdAudUnYinBiVB3iFqihqViQqiyZUi4qi6d4ilqiPeJi4iQiOiKp:MMgaTcT9sKF7SSKqlD5hPLPPJoP
TLSH
T1945333FC6C95CC70B8906289834DBEC46F1E028F65D54235ABDA87409B08B6A9F4F5FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DirectX.log

Path C:\Windows\Logs\DirectX.log
Size 65KB
SHA256 a4e46794ee3825545cfb2d1e032e14a0fe1b57e856f826b4db56966648e72062
MD5 eac591fa79599ee543e058728c5aef25
SHA1 44577ec4b397329b484df2c3c2f8b117e4f3d129
SHA512 74e5f05c9cf42742d29f77a5b05be6ef201e124bdcb36aee9d1476ec01458c12d250216ebe2746e499b7df5f45a370fa2aadb3c9da57e69ff591763613750b83
SSDEEP 192:MMgviCiCkiCiCdAudUnYinBiVB3iFqihqViQqiyZUi4qi6d4ilqiPeJi4iQiOiKy:MMgaTcT9sKF7SSKqlD5hPLPPJoKX
TLSH
T1B16334FC6C95CC70B8906289834DBEC46F1E028F65D54235ABDA87409B08B6A9F4F5FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DirectX.log

Path C:\Windows\Logs\DirectX.log
Size 69KB
SHA256 3e87d1b3ead61ee5c779e9302e41918ec45c981690512a4b90af5d2202a7b176
MD5 5841b041deb87e161cbae0fd88e1f788
SHA1 5b4207fd28ba79b06bc2f92cc7b0fd667a60d01c
SHA512 b6ec2bdc4c36de020835b4f1c52895089d35ea58402f85b7d4fd24e2aff671fe8161630dd104e073461f9261a56a44499eece104e0c1603c4d6140cf208d072c
SSDEEP 192:MMgviCiCkiCiCdAudUnYinBiVB3iFqihqViQqiyZUi4qi6d4ilqiPeJi4iQiOiKc:MMgaTcT9sKF7SSKqlD5hPLPPJoKoq9j
TLSH
T1BF6335FC6C95CC71B8906289C34DBEC86F1E024F65D54231ABDA87449B08B6A9F4E1FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DirectX.log

Path C:\Windows\Logs\DirectX.log
Size 71KB
SHA256 f167e6e2d1f5237d3cbf4afad9ddc1905d176e663fb4f60500fb5c8389865993
MD5 f1671cb9b48d91a44029943a8181c5d8
SHA1 3a048ae90dfb8e3b908be63cd2824e667d5e8ca3
SHA512 c5eda3c639f9d2d142731e1de3ad7cc263af875644baa018a4c25907ac0dd96474eb81e1ff103aa74da7464d6dc44790d07b6235bc2dcfbba70de5f64ef60c49
SSDEEP 384:MMgaTcT9sKF7SSKqlD5hPLPPJoKoq9mf/N:MC1N
TLSH
T1AF7335FC6CD5CC71B8906289C34DBEC85F1E024F66D54231ABDA86449B08B6A9F4E1FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DirectX.log

Path C:\Windows\Logs\DirectX.log
Size 72KB
SHA256 e126a27775f0781aa78019ece9299126bbd5ebf56130da971f38cae8c4adacc6
MD5 35579277646160019f3af8d30bef7adb
SHA1 ffb56c9567e2e68fbb220f489df6b3e75c17a302
SHA512 a61e57fdb9e039900ab035539ca927421c2a8d106b617a3de1d7fcd66c815e479933686587de41a7866383acc4a39fbbbdfd349f86af03537c52f9d9e3ed2216
SSDEEP 384:MMgaTcT9sKF7SSKqlD5hPLPPJoKoq9mf/KM:MC1KM
TLSH
T1C27325FC6CD5CC71B8906289C34DBEC85F1E024F66D54231ABDA86449B08B6A9F4E1FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DirectX.log

Path C:\Windows\Logs\DirectX.log
Size 74KB
SHA256 da6bbc6512bb256674a943ac325caae9d0ab19f476fcfb582bf5afc3344f925f
MD5 466eb5c157ab5401da77cdf7c6f9b420
SHA1 8118fabbf47c4bb7751c4ade09dc9503abcc8e17
SHA512 e166550159e6e73d767740cc1e797bf1f55446dbf09607a067cdc5b720165e064569524f1191c1847b5d44bc1831d8c04f1d2686b35708181f96e3913abc5ce6
SSDEEP 384:MMgaTcT9sKF7SSKqlD5hPLPPJoKoq9mf/Ksq:MC1Kj
TLSH
T1A87336FC6CD6CC71B8906289C34DBEC85F1E024F66D54231ABDA86449B04B6A9F4E1FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DirectX.log

Path C:\Windows\Logs\DirectX.log
Size 74KB
SHA256 9a82319c950f99838d72c38f87c36794f8ecb4e73469f44d2d96610e10d7af12
MD5 0bfecb4bcb25f56a2801f3fa6551f52f
SHA1 e66d037028fee67bae5d36e43240eb18396f28b5
SHA512 1e03c77ae98c32a1c520928dd3a6d78c5c3f10f9aa78f0d29e59e4e762c3612f695c48e5f6e9753564f8fce3c273c8ea87630bbf585ec8086c3fb03ce2f1ac3b
SSDEEP 384:MMgaTcT9sKF7SSKqlD5hPLPPJoKoq9mf/Ksl:MC1KI
TLSH
T1E47336FC6CD6CC71B8906289C34DBEC85F1E024F26D54231ABDA86449B04B6A9F5E1FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DirectX.log

Path C:\Windows\Logs\DirectX.log
Size 28KB
SHA256 0e74898eb375016fe9916f46223c8d58264a4e8b27ee5d6b88e3bcaf711d460f
MD5 26d44d5d37e83b6e3f6915699260632d
SHA1 3ebfa8d479f5de3562111ab63cb2c585083b9c78
SHA512 a01ac7f84832a40f92312ff5f3651f82c0debbf2c4749001f7d1cbeb70cce9d026f890dc601a7fd44ba8d00407b22b3b5b3bdf7b3752149818428210fd4d4817
SSDEEP 192:MMgviCiCkiCiCdAudUnYinBiVB3iFqihqVil:MMgaTcT9sKF7l
TLSH
T1B5D256BC6895CC71B8905289C34DFEC46E2E024F95D44235ABCA87909F08B678E5F9FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DirectX.log

Path C:\Windows\Logs\DirectX.log
Size 77KB
SHA256 16471d8eeebc05b7a25ac0ae4d3621a20026daafc4ccf1197822aed4c3ca50b7
MD5 f014c0e0df6e3af5fbf03cb5d79cfd91
SHA1 9a8046b7882671d4582a611e66bdf62c3ba1e805
SHA512 18fd4a6230242f4640ea8699cc83456f6560150248f3032418d1244127a5af9e19d5fd4dec6b1d0f9f9e6f19cc0284b97405ccc7638ecd1f102f21d5056179f1
SSDEEP 384:MMgaTcT9sKF7SSKqlD5hPLPPJoKoq9mf/KsiCsJ:MC1Kmg
TLSH
T1427316FCACD6CC7178906289C34DBEC85F1E024F26D54231ABDA86449B04B6A9F5E1FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DirectX.log

Path C:\Windows\Logs\DirectX.log
Size 78KB
SHA256 386a680883c4182552f007753c5fdaaf04f0cb71f589b9783160f62a1ccaadb8
MD5 e8a7e0aad471e458ab9f6345957ee78b
SHA1 e658a87e963399ad89e2dd1eb12e4ce073bfcf85
SHA512 46eb198b261179026b5b30c14ad1fa0deb0b6798482d9f19eb544add99df93567feee51e81f9557a395b80486c36105182c6cac494352a1e2eee4acf5195edf7
SSDEEP 384:MMgaTcT9sKF7SSKqlD5hPLPPJoKoq9mf/KsiCs9v:MC1KmE
TLSH
T1897316FCACD6CC7178906289C34DBEC85F1E024F26D54231ABDA86449B04B6A9F5E1FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2744-1803-0x0000000180000000-0x00000001806A3000-memory.dmp

Download

memory/2744-1818-0x0000000180000000-0x00000001806A3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads