Overview

overview

8

Static

static

3

OCCT.exe

windows10-2004-x64

7

OCCT.exe

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    527s
  • max time network
    540s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    06/08/2026, 00:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    OCCT.exe
  • Size 205.6MB
  • Sample260806-axpy9azdma
  • SHA256 faa46009ef778ccb88fc286ec817fe103b102ef0e65323b56fe2a9be04fd93ef
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarediscoverypersistenceprivilege_escalationransomwarespywareupx

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 12 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 54 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: LoadsDriver 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 61 IoCs
  • Suspicious use of FindShellTrayWindow 55 IoCs
  • Suspicious use of SendNotifyMessage 40 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\OCCT.exe
    "C:\Users\Admin\AppData\Local\Temp\OCCT.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:4296
    • C:\Users\Admin\AppData\Local\Temp\OCCT\Resources\OCCTGUI.exe
      C:\Users\Admin\AppData\Local\Temp\OCCT\Resources\OCCTGUI.exe --temp-path="C:\Users\Admin\AppData\Local\Temp\OCCT" --launcher-exe-path="C:\Users\Admin\AppData\Local\Temp\OCCT.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:268
    • C:\Users\Admin\AppData\Local\Temp\OCCT\Resources\GPUUNREAL\prereq\dx\DXSETUP.exe
      C:\Users\Admin\AppData\Local\Temp\OCCT\Resources\GPUUNREAL\prereq\dx\DXSETUP.exe /silent
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3244
      • C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\infinst.exe
        C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\infinst.exe xinput1_3_x64.inf, Install_Driver
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        PID:5344
      • C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\infinst.exe
        C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\infinst.exe X3DAudio1_7_x64.inf
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        PID:3208
      • C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\infinst.exe
        C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\infinst.exe D3DX9_43_x64.inf
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        PID:3364
      • C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\infinst.exe
        C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\infinst.exe d3dx10_43_x64.inf
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        PID:252
      • C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\infinst.exe
        C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\infinst.exe d3dx11_43_x64.inf
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        PID:808
      • C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\infinst.exe
        C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\infinst.exe d3dcsx_43_x64.inf
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        PID:4756
      • C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\infinst.exe
        C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\infinst.exe D3DCompiler_43_x64.inf
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        PID:2964
      • C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\infinst.exe
        C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\infinst.exe XACT3_7_x64.inf
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        PID:1084
      • C:\Windows\system32\regsvr32.exe
        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_7.dll
        3⤵
        • Loads dropped DLL
        • Modifies registry class
        PID:3512
      • C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\infinst.exe
        C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\infinst.exe XAudio2_7_x64.inf
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        PID:5588
      • C:\Windows\system32\regsvr32.exe
        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_7.dll
        3⤵
        • Loads dropped DLL
        • Modifies registry class
        PID:1588
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:3152
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:5116
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4132
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:3664
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:804
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3428

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        prep_Activatable Class_Hermes_perf.cache
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
        • Size 607B
        • SHA256 7c21835f01895c1ee4e12f81e71ef06a0f6e2b9281de493ff8ec95f913e9680d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        prep_Activatable Class_Hermes_perf.cache
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
        • Size 595B
        • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        libHarfBuzzSharp.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\OCCTGUI\gedzzfek.s4c\libHarfBuzzSharp.dll
        • Size 1.7MB
        • SHA256 eb76238c9e8e41d44b5a5b18167c4c5b39ca5db4277af5dbe92d730f0fc14a7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libSkiaSharp.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\OCCTGUI\gedzzfek.s4c\libSkiaSharp.dll
        • Size 9.0MB
        • SHA256 9a0d95e8caaa852c70d085af6a40a744242172ad9ea3fd6bc7599875a8a1dbcd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        D3DCompiler_43.dll
        • Path C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\D3DCompiler_43.dll
        • Size 2.4MB
        • SHA256 44c3a7e330b54a35a9efa015831392593aa02e7da1460be429d17c3644850e8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        D3DCompiler_43.dll
        • Path C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\D3DCompiler_43.dll
        • Size 2.0MB
        • SHA256 2f23182ec6f4889397ac4bf03d62536136c5bdba825c7d2c4ef08c827f3a8a1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        D3DCompiler_43_x64.inf
        • Path C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\D3DCompiler_43_x64.inf
        • Size 683B
        • SHA256 112ec71e22f87bf8d54b12836a85e168fabed8dde3ffe7eda9eb444ab9fb8348
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        D3DX9_43.dll
        • Path C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\D3DX9_43.dll
        • Size 2.3MB
        • SHA256 84b900dbd7fa978d6e0caee26fc54f2f61d92c9c75d10b35f00e3e82cd1d67b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        D3DX9_43_x64.inf
        • Path C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\D3DX9_43_x64.inf
        • Size 667B
        • SHA256 71bd128262424567380c63c9c23eb819212222317026ad44e965ecac2224b848
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        FEB2010_X3DAudio_x64.inf
        • Path C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\FEB2010_X3DAudio_x64.inf
        • Size 815B
        • SHA256 68351f03f4ef83e4b8c359e3e130441081690a1866b838a1b35d64674ef3abbf
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        JUN2010_D3DCompiler_43_x64.inf
        • Path C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\JUN2010_D3DCompiler_43_x64.inf
        • Size 830B
        • SHA256 3e779533a273e3395109c7efac13ba1c804c01b3ddb16938406fbdf90d851216
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        JUN2010_D3DCompiler_43_x86.inf
        • Path C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\JUN2010_D3DCompiler_43_x86.inf
        • Size 1KB
        • SHA256 5dd568919e1b3cbcb23ab21d0f2d6c1a065070848aba5d2a896da39e55c6cbbf
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        JUN2010_XACT_x64.inf
        • Path C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\JUN2010_XACT_x64.inf
        • Size 920B
        • SHA256 f3c288d84db29f7bc4d2c771341f765b5e1940a4827fcb55a65b48eec83c71d3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        JUN2010_XACT_x86.inf
        • Path C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\JUN2010_XACT_x86.inf
        • Size 1KB
        • SHA256 ca604ce9d2ee43a09b39b23a6a2a048b1a79d85c7d78679cc73aacc75cf7a62e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        JUN2010_XAudio_x64.inf
        • Path C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\JUN2010_XAudio_x64.inf
        • Size 923B
        • SHA256 1a0f1b929724f8b71d5ce922f19b9d539d2d804c89af947d5927b049ef0fd3d8
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        JUN2010_XAudio_x86.inf
        • Path C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\JUN2010_XAudio_x86.inf
        • Size 1KB
        • SHA256 d786d06a709d5dc26067132b9735fc317763fcf8064442d6f77f65012ba179da
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        JUN2010_d3dcsx_43_x64.inf
        • Path C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\JUN2010_d3dcsx_43_x64.inf
        • Size 815B
        • SHA256 5289b5ad22146d7cc0c35cdb2c9662742693550de8f013d1ec40e944288d155a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        JUN2010_d3dcsx_43_x86.inf
        • Path C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\JUN2010_d3dcsx_43_x86.inf
        • Size 1KB
        • SHA256 d5200b332caf4fff25eb3d224527a3944878c5c3849512779a2afcfeae4c3ca1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        JUN2010_d3dx10_43_x64.inf
        • Path C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\JUN2010_d3dx10_43_x64.inf
        • Size 815B
        • SHA256 a65f370a741d62c2be0ca588758d089dd976092cb910bb6b1b7d008741e18377
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        JUN2010_d3dx10_43_x86.inf
        • Path C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\JUN2010_d3dx10_43_x86.inf
        • Size 1KB
        • SHA256 4d4263cbb11858c727824c4a071f992909675719be3076b4a47852bf6affd862
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        JUN2010_d3dx11_43_x64.inf
        • Path C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\JUN2010_d3dx11_43_x64.inf
        • Size 815B
        • SHA256 2c4cf75b76203cba6378693668c8c00b564871c8bfd7fbda01e1e841477b2a3b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        JUN2010_d3dx11_43_x86.inf
        • Path C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\JUN2010_d3dx11_43_x86.inf
        • Size 1KB
        • SHA256 3925c924eb4ec4f5a643b2d14d2eda603341fbbd22118cdd8ae04aaa96f443c0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        JUN2010_d3dx9_43_x64.inf
        • Path C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\JUN2010_d3dx9_43_x64.inf
        • Size 812B
        • SHA256 272650a2d9b1cfea17021f4bf941b21f2206791e279070d4e906ce0ce56ac16f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        JUN2010_d3dx9_43_x86.inf
        • Path C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\JUN2010_d3dx9_43_x86.inf
        • Size 1KB
        • SHA256 6b33d32da02f664092d44b05237990f825b4062c105a063badcf978648b5e95b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        X3DAudio1_7.dll
        • Path C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\X3DAudio1_7.dll
        • Size 24KB
        • SHA256 9460709339701ad471a5cabe6365355f4d586dc4fcb86507c1331839dc555446
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        X3DAudio1_7_x64.inf
        • Path C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\X3DAudio1_7_x64.inf
        • Size 689B
        • SHA256 1da8585eb518801a26ce5a535620ad7bb4177dfccc8e468c8a003db064849d04
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        XAPOFX1_5.dll
        • Path C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\XAPOFX1_5.dll
        • Size 72KB
        • SHA256 becfdcd6b16523573cb52df87aa7d993f1b345ba903d0618c3b36535c3800197
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        XAudio2_7.dll
        • Path C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\XAudio2_7.dll
        • Size 514KB
        • SHA256 d1690b602cb317f7f1e1e13e3fc5819ad8b5b38a92d812078afb1b408ccc4b69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        apr2007_xinput_x64.inf
        • Path C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\apr2007_xinput_x64.inf
        • Size 860B
        • SHA256 0d6e1c0e961d878b319ac30d3439056883448dcf26774003b73920f3377ecac8
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        d3dcsx_43.dll
        • Path C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\d3dcsx_43.dll
        • Size 1.8MB
        • SHA256 b46a44b6fce8f141c9e02798645db2ee0da5c69ea71195e29f83a91a355fa2ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        d3dcsx_43.dll
        • Path C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\d3dcsx_43.dll
        • Size 1.8MB
        • SHA256 3c9e1b87f2763f58402b5104d21e0d9d5db352fcccf7801eaa4cd1f5dbc20945
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        d3dcsx_43_x64.inf
        • Path C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\d3dcsx_43_x64.inf
        • Size 663B
        • SHA256 8a623bac05c6508042dd01fccd53f2771306cbb9b339404b91fe106c3c7dbaf2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        d3dx10_43.dll
        • Path C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\d3dx10_43.dll
        • Size 459KB
        • SHA256 56fcd13650fd1f075743154e8c48465dd68a236ab8960667d75373139d2631bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        d3dx10_43.dll
        • Path C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\d3dx10_43.dll
        • Size 499KB
        • SHA256 9bffa1ea073d79e9954cb398fc91b93ed9dc79ed2205995d4b949f1cc2ad3bd1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        d3dx10_43_x64.inf
        • Path C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\d3dx10_43_x64.inf
        • Size 663B
        • SHA256 e36537b28026f4bf193788fe45605e9b5715117cbe4f638a9384aa3964768855
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        d3dx11_43.dll
        • Path C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\d3dx11_43.dll
        • Size 270KB
        • SHA256 981e42629df751217406e7150477cddc853b79abd6a8568a1566298ed8f7bd59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        d3dx11_43.dll
        • Path C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\d3dx11_43.dll
        • Size 242KB
        • SHA256 492e960cb3ccfc8c25fc83f7c464ba77c86a20411347a1a9b3e5d3e8c9180a8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        d3dx11_43_x64.inf
        • Path C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\d3dx11_43_x64.inf
        • Size 663B
        • SHA256 8572aa222c39fa63c22354da8114d95d06fb1f0c6a91bfbb489105deeabd6a83
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        d3dx9_43.dll
        • Path C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\d3dx9_43.dll
        • Size 1.9MB
        • SHA256 0b28546be22c71834501f7d7185ede5d79742457331c7ee09efc14490dd64f5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dxdllreg_x86.inf
        • Path C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\dxdllreg_x86.inf
        • Size 724B
        • SHA256 54e098294ef0ad3b14b9c77642838b5992fe4573099d8397a1ef566d9e36da40
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        dxupdate.dll
        • Path C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\dxupdate.dll
        • Size 173KB
        • SHA256 fb4f297e295c802b1377c6684734b7249d55743dfb7c14807bef59a1b5db63a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dxupdate.inf
        • Path C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\dxupdate.inf
        • Size 12KB
        • SHA256 93f5589499ee4ee2812d73c0d8feacbbcfe8c47b6d98572486bc0eff3c5906ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        infinst.exe
        • Path C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\infinst.exe
        • Size 74KB
        • SHA256 d808bb408a4bd695a9793e70b1c61637e008ac11174dbe1373481e2bdb0c9299
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        infinst.exe
        • Path C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\infinst.exe
        • Size 81KB
        • SHA256 8c62fe8466d9a24a0f1924de37b05d672a826454804086cddc7ed87c020e67ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        infinst.exe
        • Path C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\infinst.exe
        • Size 68KB
        • SHA256 34ab99536ea59ad60ba6efda3ea6d18291ef096a0bab3664248d6045805da0ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xactengine3_7.dll
        • Path C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\xactengine3_7.dll
        • Size 234KB
        • SHA256 d7b1cf58898046c430d49cf8f778e4898280f4709340c3938d3139894166fe8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xinput1_3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\xinput1_3.dll
        • Size 104KB
        • SHA256 756cad002e1553cfa1a91ebe8c1b9380ffabe0b4b1916c4a4db802396ddfbef8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xinput1_3_x64.inf
        • Path C:\Users\Admin\AppData\Local\Temp\DXE14E.tmp\xinput1_3_x64.inf
        • Size 669B
        • SHA256 0d411d9424128f19fed2daa95a2983b4b29197f022a754f59d0c7740ad654cca
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        HWiNFO_x64_215.sys
        • Path C:\Users\Admin\AppData\Local\Temp\HWiNFO_x64_215.sys
        • Size 58KB
        • SHA256 cc9d399816d0f04548545fa2cc4bb9e8d141624601ac271315cbe92f6e763a1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Apr2007_xinput_x64.cab
        • Path C:\Users\Admin\AppData\Local\Temp\OCCT\RESOUR~1\GPUUNR~1\prereq\dx\Apr2007_xinput_x64.cab
        • Size 94KB
        • SHA256 e7a09f8235cc587cc63f583e39fbc75008d9677c8bb4dcc11cb8d0178a5153ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Feb2010_X3DAudio_x64.cab
        • Path C:\Users\Admin\AppData\Local\Temp\OCCT\RESOUR~1\GPUUNR~1\prereq\dx\Feb2010_X3DAudio_x64.cab
        • Size 53KB
        • SHA256 832b6d48e169b4725ae482ea4d1c3360a09631a89b2fac3aba81a50805a50adc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Jun2010_D3DCompiler_43_x64.cab
        • Path C:\Users\Admin\AppData\Local\Temp\OCCT\RESOUR~1\GPUUNR~1\prereq\dx\Jun2010_D3DCompiler_43_x64.cab
        • Size 922KB
        • SHA256 213ad66ab9e469db1e6a49a646d082bfc3700db94172984e7e36801612af50c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Jun2010_D3DCompiler_43_x86.cab
        • Path C:\Users\Admin\AppData\Local\Temp\OCCT\RESOUR~1\GPUUNR~1\prereq\dx\Jun2010_D3DCompiler_43_x86.cab
        • Size 909KB
        • SHA256 417eebd5b19f45c67c94c2d2ba8b774c0fc6d958b896d7b1ac12cf5a0ea06e0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Jun2010_XACT_x64.cab
        • Path C:\Users\Admin\AppData\Local\Temp\OCCT\RESOUR~1\GPUUNR~1\prereq\dx\Jun2010_XACT_x64.cab
        • Size 121KB
        • SHA256 06251ab76450feb7dc2ffb9be7615f5eb56960cefa4c990ef560f2c6f2a7551b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Jun2010_XACT_x86.cab
        • Path C:\Users\Admin\AppData\Local\Temp\OCCT\RESOUR~1\GPUUNR~1\prereq\dx\Jun2010_XACT_x86.cab
        • Size 91KB
        • SHA256 354c2e579ed00b391dd5d8be91b0f45115e7c232ed1b842747830be0fd26e915
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Jun2010_XAudio_x64.cab
        • Path C:\Users\Admin\AppData\Local\Temp\OCCT\RESOUR~1\GPUUNR~1\prereq\dx\Jun2010_XAudio_x64.cab
        • Size 270KB
        • SHA256 51500283f69e97f5beddb073ba2a9017de3d30379c0dcc4d11dd2236ce07b317
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Jun2010_XAudio_x86.cab
        • Path C:\Users\Admin\AppData\Local\Temp\OCCT\RESOUR~1\GPUUNR~1\prereq\dx\Jun2010_XAudio_x86.cab
        • Size 271KB
        • SHA256 7b4332207563beba1103744b6db5399ad150e9e6838f9d5a71497e7eb3645ebf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Jun2010_d3dcsx_43_x64.cab
        • Path C:\Users\Admin\AppData\Local\Temp\OCCT\RESOUR~1\GPUUNR~1\prereq\dx\Jun2010_d3dcsx_43_x64.cab
        • Size 735KB
        • SHA256 cdbec7e3a5a0fef016eb294b036f93c75e45c6ead8d99397f859a32d23fe20cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Jun2010_d3dcsx_43_x86.cab
        • Path C:\Users\Admin\AppData\Local\Temp\OCCT\RESOUR~1\GPUUNR~1\prereq\dx\Jun2010_d3dcsx_43_x86.cab
        • Size 744KB
        • SHA256 e2c5a2cbba7f211b6ca72ff8e5f69cba1f83be06357311b19e64f582fd3d14e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Jun2010_d3dx10_43_x64.cab
        • Path C:\Users\Admin\AppData\Local\Temp\OCCT\RESOUR~1\GPUUNR~1\prereq\dx\Jun2010_d3dx10_43_x64.cab
        • Size 230KB
        • SHA256 efce48d425c07f1faad4a55d7061a01ed6245aac17f43163cf2a23cbc9a3054b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Jun2010_d3dx10_43_x86.cab
        • Path C:\Users\Admin\AppData\Local\Temp\OCCT\RESOUR~1\GPUUNR~1\prereq\dx\Jun2010_d3dx10_43_x86.cab
        • Size 192KB
        • SHA256 a8cf71ffb80b683616d0621be96d3795b0ffda3877ed2d80cd958bfa393ddcfc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Jun2010_d3dx11_43_x64.cab
        • Path C:\Users\Admin\AppData\Local\Temp\OCCT\RESOUR~1\GPUUNR~1\prereq\dx\Jun2010_d3dx11_43_x64.cab
        • Size 134KB
        • SHA256 c1d0d56b83bfb09a5e1a89e1898bb74446a847b30a968f3664ec2d87368eb63e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Jun2010_d3dx11_43_x86.cab
        • Path C:\Users\Admin\AppData\Local\Temp\OCCT\RESOUR~1\GPUUNR~1\prereq\dx\Jun2010_d3dx11_43_x86.cab
        • Size 106KB
        • SHA256 a58cefe822e371d078eaf89319f832693352ba7d62079320074397f0f3425961
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Jun2010_d3dx9_43_x64.cab
        • Path C:\Users\Admin\AppData\Local\Temp\OCCT\RESOUR~1\GPUUNR~1\prereq\dx\Jun2010_d3dx9_43_x64.cab
        • Size 915KB
        • SHA256 9b98a1269af7f3a0007bfdc73206a47a6ee158d34ba8a87009396c18186bb06a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Jun2010_d3dx9_43_x86.cab
        • Path C:\Users\Admin\AppData\Local\Temp\OCCT\RESOUR~1\GPUUNR~1\prereq\dx\Jun2010_d3dx9_43_x86.cab
        • Size 750KB
        • SHA256 fcc6cf0966b4853d6fa3d32ab299cde5a9824feaecb0d4f34ea452fb9fd1c867
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dxdllreg_x86.cab
        • Path C:\Users\Admin\AppData\Local\Temp\OCCT\RESOUR~1\GPUUNR~1\prereq\dx\dxdllreg_x86.cab
        • Size 43KB
        • SHA256 4afe0249a13868b7c4a92b4d53c998adf6053eb5e2c47fd81020fd8d4bb11150
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dxupdate.cab
        • Path C:\Users\Admin\AppData\Local\Temp\OCCT\RESOUR~1\GPUUNR~1\prereq\dx\dxupdate.cab
        • Size 94KB
        • SHA256 e18a5404b612e88fa8b403c9b33f064c0a89528db7ef9a79aa116908d0e6afed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DSETUP32.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\OCCT\Resources\GPUUNREAL\prereq\dx\DSETUP32.DLL
        • Size 1.5MB
        • SHA256 fb0e534f9b0926e518f1c2980640dfd29f14217cdfa37cf3a0c13349127ed9a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DXSETUP.exe
        • Path C:\Users\Admin\AppData\Local\Temp\OCCT\Resources\GPUUNREAL\prereq\dx\DXSETUP.exe
        • Size 505KB
        • SHA256 8f47d7121ef6532ad9ad9901e44e237f5c30448b752028c58a9d19521414e40d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dsetup.dll
        • Path C:\Users\Admin\AppData\Local\Temp\OCCT\Resources\GPUUNREAL\prereq\dx\dsetup.dll
        • Size 93KB
        • SHA256 2a61679eeedabf7d0d0ac14e5447486575622d6b7cfa56f136c1576ff96da21f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ORingLib.dll
        • Path C:\Users\Admin\AppData\Local\Temp\OCCT\Resources\ORING\ORingLib.dll
        • Size 290KB
        • SHA256 fbd82e30bc522e7a648bc27d7627b85fd1c3400373b6e5c911e69cb584053fcb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DirectX.log
        • Path C:\Windows\Logs\DirectX.log
        • Size 64KB
        • SHA256 5250a23bb4fd053e03b7ad9be9d8cc9b7a285a46bb33773d43aa41982f276d5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DirectX.log
        • Path C:\Windows\Logs\DirectX.log
        • Size 65KB
        • SHA256 b797ec9c2412aaa98b96f2e20f1800b013280f273c7374f5d009476ac4f4bf86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DirectX.log
        • Path C:\Windows\Logs\DirectX.log
        • Size 67KB
        • SHA256 07f1e59ff826a3e5111f4fa1292eee93c68b8446e155a382f4bcbfccd5d306f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DirectX.log
        • Path C:\Windows\Logs\DirectX.log
        • Size 68KB
        • SHA256 c778500a33332fb2fd07caa232b84eec418a903216a2b06a55873b17dbde6c5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DirectX.log
        • Path C:\Windows\Logs\DirectX.log
        • Size 70KB
        • SHA256 f5c0342ab6fb45f99313d73d53b0a46bd78d15da4ca7f4181a32acc55ca27659
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DirectX.log
        • Path C:\Windows\Logs\DirectX.log
        • Size 71KB
        • SHA256 0045991c4fa983c325734ceebf4e62ee15c081db62f5808676ec4ecab5fea14d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DirectX.log
        • Path C:\Windows\Logs\DirectX.log
        • Size 74KB
        • SHA256 e653977a4e50f35ebf57b2724feb5dc448b642959664084af9471ef162de3680
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DirectX.log
        • Path C:\Windows\Logs\DirectX.log
        • Size 12KB
        • SHA256 dfe616814eee6563bb3770f04834b932a603aca4f35b4d29389797cbe944a72c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DirectX.log
        • Path C:\Windows\Logs\DirectX.log
        • Size 77KB
        • SHA256 1e1118738e1c96bbf3e62d76babbf85284447ff411726e18b9734f9b50ed8293
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DirectX.log
        • Path C:\Windows\Logs\DirectX.log
        • Size 81KB
        • SHA256 d1c0bf2599fdd386109993487d4033866cc4ff7a52104dfd80030886381ef6bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DirectX.log
        • Path C:\Windows\Logs\DirectX.log
        • Size 474B
        • SHA256 c20a1d2aed58e0bd4ac267a47268f57258f864e189f3808d8409b0d2fd7b59cf
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/268-1796-0x0000000180000000-0x00000001806AA000-memory.dmp
        Download

        memory/268-1811-0x0000000180000000-0x00000001806AA000-memory.dmp
        Download

        memory/804-1833-0x000002BB801E0000-0x000002BB802E0000-memory.dmp
        Download

        memory/804-1879-0x000002BB84670000-0x000002BB84690000-memory.dmp
        Download

        memory/804-1845-0x000002BB81E40000-0x000002BB81F40000-memory.dmp
        Download

        memory/804-1865-0x000002BB81C60000-0x000002BB81C80000-memory.dmp
        Download

        memory/804-1843-0x000002BB81900000-0x000002BB81920000-memory.dmp
        Download