7bda7fbb3eea3ffdced17b5679c057943464a6ecc5e5274968b728feae470b7b

Analysis

user interaction
yes
max time kernel
92s
max time network
106s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 00:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EpicInstaller-20.1.4.exe
Size 83.3MB
Sample260808-bb98qser5z
SHA256 7bda7fbb3eea3ffdced17b5679c057943464a6ecc5e5274968b728feae470b7b
MD5 cdb4b0b8b3ceb1b2b20d87fd2d31282f
SHA1 6ff3af58f7ae9353f7df5a6c74b5a7096007f557
SHA512 c6c8fe70094647d53520daf2f8bf662061f9fde06c5dee7781a4a60b6fbd5f3cd20a88dacaa7231297b4ac074214a5b3d449d6ed5d5c13ea03c5d8d30df700d9
SSDEEP 1572864:wsdiD56uaLQi5BiYutr8n0/HPJXlLAIr7x0QWWH00wtLeN/e3ULo6yYmjL:wB17aLQ4Bi/tWYv9l9r1qWHqSBeL
TLSH
T11E18332BB8A19D43C566A33B43D18712AF66787C7B1003159EF9941D2D6B2E8633F6C3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence privilege_escalation ransomware

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
12	1128	rundll32.exe
21	2276	rundll32.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4112	icacls.exe
2604	icacls.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\SET70C4.tmp	DXSETUP.exe
File created	C:\Windows\SysWOW64\SET70C5.tmp	DXSETUP.exe
File created	C:\Windows\SysWOW64\SET6E21.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\SET70C5.tmp	DXSETUP.exe
File created	C:\Windows\system32\SET712A.tmp	infinst.exe
File created	C:\Windows\system32\SET712B.tmp	infinst.exe
File opened for modification	C:\Windows\system32\SET6B1F.tmp	infinst.exe
File opened for modification	C:\Windows\system32\SET6DEE.tmp	infinst.exe
File opened for modification	C:\Windows\system32\SET6E5B.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\D3DCompiler_43.dll	DXSETUP.exe
File opened for modification	C:\Windows\system32\SET707E.tmp	infinst.exe
File opened for modification	C:\Windows\system32\XAPOFX1_5.dll	infinst.exe
File opened for modification	C:\Windows\SysWOW64\SET6AD1.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\xinput1_3.dll	DXSETUP.exe
File opened for modification	C:\Windows\system32\X3DAudio1_7.dll	infinst.exe
File opened for modification	C:\Windows\SysWOW64\d3dx11_43.dll	DXSETUP.exe
File opened for modification	C:\Windows\system32\d3dx11_43.dll	infinst.exe
File created	C:\Windows\SysWOW64\SET6EAE.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\d3dcsx_43.dll	DXSETUP.exe
File opened for modification	C:\Windows\system32\d3dcsx_43.dll	infinst.exe
File opened for modification	C:\Windows\SysWOW64\X3DAudio1_7.dll	DXSETUP.exe
File opened for modification	C:\Windows\system32\D3DX9_43.dll	infinst.exe
File created	C:\Windows\system32\SET6D61.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\d3dx10_43.dll	DXSETUP.exe
File opened for modification	C:\Windows\system32\SET6F55.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\SET6FA9.tmp	DXSETUP.exe
File created	C:\Windows\SysWOW64\SET70C4.tmp	DXSETUP.exe
File opened for modification	C:\Windows\system32\SET712A.tmp	infinst.exe
File created	C:\Windows\SysWOW64\SET6BBC.tmp	DXSETUP.exe
File created	C:\Windows\system32\SET6C09.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\SET6D93.tmp	DXSETUP.exe
File created	C:\Windows\system32\SET6DEE.tmp	infinst.exe
File created	C:\Windows\system32\SET6E5B.tmp	infinst.exe
File created	C:\Windows\system32\SET707E.tmp	infinst.exe
File opened for modification	C:\Windows\system32\SET712B.tmp	infinst.exe
File created	C:\Windows\system32\GameInputRedist.dll	GameInputSvc.exe
File opened for modification	C:\Windows\system32\SET6C09.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\SET6C79.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\SET6E21.tmp	DXSETUP.exe
File opened for modification	C:\Windows\system32\D3DCompiler_43.dll	infinst.exe
File opened for modification	C:\Windows\SysWOW64\XAudio2_7.dll	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\XAPOFX1_5.dll	DXSETUP.exe
File created	C:\Windows\SysWOW64\GameInputRedist.dll	GameInputSvc.exe
File created	C:\Windows\SysWOW64\SET6AD1.tmp	DXSETUP.exe
File opened for modification	C:\Windows\system32\xinput1_3.dll	infinst.exe
File created	C:\Windows\system32\SET6B1F.tmp	infinst.exe
File created	C:\Windows\SysWOW64\SET6C79.tmp	DXSETUP.exe
File opened for modification	C:\Windows\system32\d3dx10_43.dll	infinst.exe
File created	C:\Windows\SysWOW64\SET6FA9.tmp	DXSETUP.exe
File opened for modification	C:\Windows\system32\XAudio2_7.dll	infinst.exe
File opened for modification	C:\Windows\SysWOW64\SET6BBC.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\D3DX9_43.dll	DXSETUP.exe
File opened for modification	C:\Windows\system32\SET6D61.tmp	infinst.exe
File created	C:\Windows\SysWOW64\SET6D93.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\SET6EAE.tmp	DXSETUP.exe
File created	C:\Windows\system32\SET6F55.tmp	infinst.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ru_UA.res	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\es_EC.res	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\uz_Latn.res	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\en_KI.res	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\tzm.res	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\yue_HK.res	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\no_NO_NY.res	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Portal\Binaries\Win64\api-ms-win-core-console-l1-2-0.dll	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\yi_001.res	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Portal\Content\UI\SearchBox_DownArrow.png	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Portal\Content\New UI\NotificationClose.png	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\nn.res	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\ses.res	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Engine\Content\Slate\Starship\Insights\Tasks_20.svg	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ar_EG.res	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Engine\Content\Slate\Starship\SourceControl\SCC_DlgNotCurrent.svg	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Engine\Content\Slate\Automation\SmokeTestFilter.png	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Engine\Content\Slate\Starship\Common\color-grading-selector.svg	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Portal\Content\New UI\ArrowLeft.png	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\shi_MA.res	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\en_SZ.res	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\en_AT.res	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\km_KH.res	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\az_Cyrl.res	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\pa.res	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\ff_Latn.res	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\en_TC.res	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Engine\Content\Slate\Common\SortUpArrow.png	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ar_LB.res	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Portal\Binaries\Win64\vcruntime140_1.dll	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\th.res	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\pa.res	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\yue.res	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\uz_UZ.res	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\es_PY.res	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\yue_Hans_CN.res	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Portal\Content\UI\Button_OFF.png	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\en_SI.res	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\zh_Hans.res	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\en_NU.res	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\es_VE.res	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\uk.res	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Engine\Content\Slate\Automation\ExcludedTestsFilter.png	msiexec.exe
File created	C:\Program Files\Windows Kits\10\Catalogs\cat2efa787e78d3dcd94c85b16407b2e2ce.cat	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\en_SH.res	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\de_IT.res	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Engine\Content\Slate\Common\LightGroupBorder.png	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\zh_Hans_CN.res	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Engine\Content\Slate\Starship\Insights\AllTracks_20.svg	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Engine\Content\Slate\Starship\Common\alert-triangle-large.svg	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\en_DG.res	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Engine\Binaries\Win64\tbb.dll	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\rw.res	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Portal\Content\UI\NotificationBadge_Left.png	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\es_UY.res	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\th_TH.res	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\si.res	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\brkitr\word.brk	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\kn_IN.res	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\en_BS.res	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\zgh.res	msiexec.exe
File created	C:\Program Files\Epic Games\DirectXRedist\Jun2010_d3dx11_43_x86.cab	msiexec.exe
File created	C:\Program Files\Epic Games\DirectXRedist\Jun2010_XAudio_x86.cab	msiexec.exe
File created	C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\ee.res	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Installer\$PatchCache$\Managed\948F1707DBAB4814F9DEF03613B72E3A\1.3.193\F_CENTRAL_msvcr110_x86.F9D0B380_EB85_31D4_96AC_C6CB40086A55	msiexec.exe
File created	C:\Windows\Installer\DX5EDA.tmp\xinput1_3_x86.inf	DXSETUP.exe
File created	C:\Windows\Installer\DX5EDA.tmp\D3DCompiler_43_x64.inf	DXSETUP.exe
File opened for modification	C:\Windows\Installer\SFXCAB7696D014A450B881F8AFBF24AB6B21E\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\Installer\DX5EDA.tmp\JUN2010_d3dcsx_43_x86.inf	DXSETUP.exe
File created	C:\Windows\Installer\DX5EDA.tmp\X3DAudio1_7_x86.cat	DXSETUP.exe
File created	C:\Windows\Installer\e595fca.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA476.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\948F1707DBAB4814F9DEF03613B72E3A\1.3.193\F_CENTRAL_msvcr110_x64.4006A2C6_1BD5_3759_9C0C_17A8FFBF6E3C	msiexec.exe
File created	C:\Windows\Installer\DX5EDA.tmp\d3dx9_43.dll	DXSETUP.exe
File opened for modification	C:\Windows\Installer\DX5EDA.tmp\JUN2010_d3dx10_43_x64.inf	DXSETUP.exe
File created	C:\Windows\Installer\DX5EDA.tmp\D3DCompiler_43_x86.cat	DXSETUP.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA0DD0398E4444D7CBF8DDE9562B93DE16\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA0DD0398E4444D7CBF8DDE9562B93DE16\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\948F1707DBAB4814F9DEF03613B72E3A\1.3.193\F_CENTRAL_msvcp100_x64.1C11561A_11CB_36A7_8A47_D7A042055FA7	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\948F1707DBAB4814F9DEF03613B72E3A\1.3.193\F_CENTRAL_msvcp120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\948F1707DBAB4814F9DEF03613B72E3A\1.3.193\F_CENTRAL_msvcr120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA41CEC406114643CAFB7D94EBA49B3886\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\Installer\DX5EDA.tmp\infinst.exe	DXSETUP.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\948F1707DBAB4814F9DEF03613B72E3A\1.3.193\F_CENTRAL_vccorlib110_x64.4006A2C6_1BD5_3759_9C0C_17A8FFBF6E3C	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\948F1707DBAB4814F9DEF03613B72E3A\1.3.193\F_CENTRAL_vccorlib120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCACBD8C69B4240ED9A18DC16B7EC7C9D47\CustomAction.config	rundll32.exe
File created	C:\Windows\Installer\DX5EDA.tmp\JUN2010_d3dx9_43_x64.inf	DXSETUP.exe
File created	C:\Windows\Installer\DX5EDA.tmp\JUN2010_XAudio_x64.inf	DXSETUP.exe
File created	C:\Windows\Installer\DX5EDA.tmp\d3dx10_43_x64_xp.inf	DXSETUP.exe
File opened for modification	C:\Windows\Installer\DX5EDA.tmp\JUN2010_d3dx11_43_x86.inf	DXSETUP.exe
File created	C:\Windows\Installer\DX5EDA.tmp\D3DCompiler_43.dll	DXSETUP.exe
File created	C:\Windows\Installer\DX5EDA.tmp\JUN2010_d3dcsx_43_x64.inf	DXSETUP.exe
File created	C:\Windows\Installer\DX5EDA.tmp\JUN2010_D3DCompiler_43_x64.inf	DXSETUP.exe
File created	C:\Windows\Installer\DX5EDA.tmp\d3dx10_43_x86.cat	DXSETUP.exe
File created	C:\Windows\Installer\DX5EDA.tmp\d3dcsx_43_x64.inf	DXSETUP.exe
File opened for modification	C:\Windows\Installer\DX5EDA.tmp\JUN2010_D3DCompiler_43_x64.inf	DXSETUP.exe
File created	C:\Windows\Installer\DX5EDA.tmp\D3DCompiler_43_x64.cat	DXSETUP.exe
File opened for modification	C:\Windows\Installer\DX5EDA.tmp\JUN2010_XAudio_x86.inf	DXSETUP.exe
File created	C:\Windows\Installer\DX5EDA.tmp\XAudio2_7_x64.cat	DXSETUP.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\948F1707DBAB4814F9DEF03613B72E3A\1.3.193\F_CENTRAL_msvcp120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C	msiexec.exe
File created	C:\Windows\Installer\DX5EDA.tmp\X3DAudio1_7_x86_xp.inf	DXSETUP.exe
File created	C:\Windows\Installer\DX5EDA.tmp\X3DAudio1_7_x64_xp.inf	DXSETUP.exe
File created	C:\Windows\Installer\DX5EDA.tmp\d3dx9_43_x86.inf	DXSETUP.exe
File created	C:\Windows\Installer\DX5EDA.tmp\d3dx11_43_x64_xp.inf	DXSETUP.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\948F1707DBAB4814F9DEF03613B72E3A\1.3.193\F_CENTRAL_msvcp110_x64.4006A2C6_1BD5_3759_9C0C_17A8FFBF6E3C	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\948F1707DBAB4814F9DEF03613B72E3A\1.3.193\F_CENTRAL_msvcp110_x86.F9D0B380_EB85_31D4_96AC_C6CB40086A55	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\948F1707DBAB4814F9DEF03613B72E3A\1.3.193\F_CENTRAL_vccorlib110_x64.4006A2C6_1BD5_3759_9C0C_17A8FFBF6E3C	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA41CEC406114643CAFB7D94EBA49B3886\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\Installer\DX5EDA.tmp\dxupdate.cif	DXSETUP.exe
File created	C:\Windows\Installer\DX5EDA.tmp\d3dx10_43_x64.inf	DXSETUP.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File created	C:\Windows\Installer\DX5EDA.tmp\d3dx11_43_x86.inf	DXSETUP.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\948F1707DBAB4814F9DEF03613B72E3A	msiexec.exe
File opened for modification	C:\Windows\Installer\DX5EDA.tmp\apr2007_xinput_x64.inf	DXSETUP.exe
File opened for modification	C:\Windows\Installer\DX5EDA.tmp\JUN2010_d3dx10_43_x86.inf	DXSETUP.exe
File opened for modification	C:\Windows\Installer\DX5EDA.tmp\JUN2010_d3dx11_43_x64.inf	DXSETUP.exe
File created	C:\Windows\Installer\DX5EDA.tmp\d3dcsx_43_x86_xp.inf	DXSETUP.exe
File created	C:\Windows\Installer\DX5EDA.tmp\XAudio2_7_x86.cat	DXSETUP.exe
File created	C:\Windows\Installer\DX5EDA.tmp\XAudio2_7_x64.inf	DXSETUP.exe
File opened for modification	C:\Windows\Installer\SFXCA6238FA7DAD45B8FA5C476D1CAB8A0F53\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\SystemTemp\~DF834B9B1B237BD181.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\948F1707DBAB4814F9DEF03613B72E3A\1.3.193	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\948F1707DBAB4814F9DEF03613B72E3A\1.3.193\F_CENTRAL_msvcp110_x64.4006A2C6_1BD5_3759_9C0C_17A8FFBF6E3C	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\948F1707DBAB4814F9DEF03613B72E3A\1.3.193\F_CENTRAL_msvcp120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\948F1707DBAB4814F9DEF03613B72E3A\1.3.193\F_CENTRAL_msvcr100_x86.DF495DFD_79F6_34DF_BB1E_E58DB5BDCF2C	msiexec.exe
File opened for modification	C:\Windows\Installer\DX5EDA.tmp\apr2007_xinput_x86.inf	DXSETUP.exe
File created	C:\Windows\Installer\DX5EDA.tmp\d3dx9_43_x86_xp.inf	DXSETUP.exe

Executes dropped EXE 13 IoCs

pid	Process
2656	DXSETUP.exe
2812	infinst.exe
240	infinst.exe
3816	infinst.exe
768	infinst.exe
1480	infinst.exe
3356	infinst.exe
5960	infinst.exe
1788	infinst.exe
5824	EpicGamesUpdater.exe
1308	EpicGamesUpdater.exe
4256	InstallChainer.exe
4968	GameInputRedistService.exe

Loads dropped DLL 64 IoCs

pid	Process
2468	MsiExec.exe
2468	MsiExec.exe
2468	MsiExec.exe
1128	rundll32.exe
1128	rundll32.exe
1128	rundll32.exe
1128	rundll32.exe
1128	rundll32.exe
2468	MsiExec.exe
588	rundll32.exe
588	rundll32.exe
588	rundll32.exe
588	rundll32.exe
588	rundll32.exe
2468	MsiExec.exe
2412	rundll32.exe
2412	rundll32.exe
2412	rundll32.exe
2412	rundll32.exe
2412	rundll32.exe
5408	MsiExec.exe
6048	rundll32.exe
6048	rundll32.exe
6048	rundll32.exe
6048	rundll32.exe
6048	rundll32.exe
5408	MsiExec.exe
8	rundll32.exe
8	rundll32.exe
8	rundll32.exe
8	rundll32.exe
8	rundll32.exe
2656	DXSETUP.exe
2656	DXSETUP.exe
2656	DXSETUP.exe
2656	DXSETUP.exe
2656	DXSETUP.exe
5896	regsvr32.exe
5408	MsiExec.exe
4724	rundll32.exe
4724	rundll32.exe
4724	rundll32.exe
4724	rundll32.exe
4724	rundll32.exe
5824	EpicGamesUpdater.exe
5824	EpicGamesUpdater.exe
5824	EpicGamesUpdater.exe
5408	MsiExec.exe
1308	EpicGamesUpdater.exe
1308	EpicGamesUpdater.exe
1308	EpicGamesUpdater.exe
5408	MsiExec.exe
2468	MsiExec.exe
2468	MsiExec.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2468	MsiExec.exe
4256	InstallChainer.exe
4256	InstallChainer.exe
2468	MsiExec.exe
5408	MsiExec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DXSETUP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallChainer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Checks SCSI registry key(s) 3 TTPs 11 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000067831fc6f5c7bf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380167831fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410167831fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e367831fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e667831fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DXSETUP.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\urlmon.dll,-4200 = "Open File - Security Warning"	DXSETUP.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DXSETUP.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DXSETUP.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DXSETUP.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)"	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	DXSETUP.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DXSETUP.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption"	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DXSETUP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\948F1707DBAB4814F9DEF03613B72E3A	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\948F1707DBAB4814F9DEF03613B72E3A\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}\InProcServer32\ThreadingModel = "Both"	DXSETUP.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.Windows.GameInput3Redist.x64.10	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\948F1707DBAB4814F9DEF03613B72E3A	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\948F1707DBAB4814F9DEF03613B72E3A\PackageCode = "AC0D8F3C03BFF3445832584A1EDD9051"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\948F1707DBAB4814F9DEF03613B72E3A\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}\InProcServer32	DXSETUP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cac1105f-619b-4d04-831a-44e1cbf12d57}\InProcServer32	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.Windows.GameInput3Redist.x64.10\ = "{ECB4BDD1-984C-9F25-299C-A9EF75C14197}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{501FB925-9428-47FF-A5C6-E267C26FFEEE}\ = "GameInput Redist Service"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.launcher\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cac1105f-619b-4d04-831a-44e1cbf12d57}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_7.dll"	DXSETUP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cac1105f-619b-4d04-831a-44e1cbf12d57}	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{B773D0F8-01F8-41E7-9F23-6871DA0AACFF}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6F64F9F3-42D4-4D3B-90D5-1FAFECB8D53B}\InProcServer32\ThreadingModel = "Free"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\948F1707DBAB4814F9DEF03613B72E3A\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.Windows.GameInput3Redist.x64.10\Version = "10.1.26100.6879"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{501FB925-9428-47FF-A5C6-E267C26FFEEE}\LaunchPermission = 01001480a4000000b4000000140000003000000002001c000100000011001400040000000101000000000010001000000200740005000000000018000b000000010200000000000f0200000001000000000014001f000000010100000000000512000000000018001f00000001020000000000052000000020020000000014001f000000010100000000000504000000000014000b0000000101000000000005130000000102000000000005200000002002000001020000000000052000000020020000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{52AD8B46-10E9-4724-AE93-116BB850CAED}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6F64F9F3-42D4-4D3B-90D5-1FAFECB8D53B}\InProcServer32	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\948F1707DBAB4814F9DEF03613B72E3A\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.launcher	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\948F1707DBAB4814F9DEF03613B72E3A\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\948F1707DBAB4814F9DEF03613B72E3A\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\EpicInstallerTemp\\7fd6c6725f4c45f3929fb034b1ec76b1\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}\ = "XAudio2"	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{56032ADD-4E48-40B6-8A09-E7EBC026AB29}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\com.epicgames.launcher\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\948F1707DBAB4814F9DEF03613B72E3A\ProductName = "Epic Games Launcher"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}	DXSETUP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}\ = "AudioReverb"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{501FB925-9428-47FF-A5C6-E267C26FFEEE}\AccessPermission = 01001480b8000000c8000000140000003000000002001c0001000000110014000400000001010000000000100010000002008800060000000000180003000000010200000000000f0200000001000000000014000700000001010000000000050a000000000014001f0000000101000000000005120000000000140003000000010100000000000513000000000018001f00000001020000000000052000000020020000000014001f0000000101000000000005040000000102000000000005200000002002000001020000000000052000000020020000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{52AD8B46-10E9-4724-AE93-116BB850CAED}\NumMethods	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{56032ADD-4E48-40B6-8A09-E7EBC026AB29}\ProxyStubClsid32\ = "{6F64F9F3-42D4-4D3B-90D5-1FAFECB8D53B}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.launcher\shell\ = "open"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\948F1707DBAB4814F9DEF03613B72E3A\ProductIcon = "C:\\Windows\\Installer\\{7071F849-BABD-4184-9FED-0F63317BE2A3}\\Installer.ico"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{56032ADD-4E48-40B6-8A09-E7EBC026AB29}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.launcher\ = "Epic Games Launcher Link"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\948F1707DBAB4814F9DEF03613B72E3A\Version = "16974017"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_7.dll"	DXSETUP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\948F1707DBAB4814F9DEF03613B72E3A\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\com.epicgames.launcher\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.launcher\DefaultIcon\ = "C:\\Program Files\\Epic Games\\Launcher\\Portal\\Binaries\\Win64\\EpicGamesLauncher.exe,0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.launcher\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\44F9670D954DF0540B48AC3E08267CB5	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\948F1707DBAB4814F9DEF03613B72E3A\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_7.dll"	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_7.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\948F1707DBAB4814F9DEF03613B72E3A\GameInputRedistFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\44F9670D954DF0540B48AC3E08267CB5\948F1707DBAB4814F9DEF03613B72E3A	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\948F1707DBAB4814F9DEF03613B72E3A\SourceList\PackageName = "EpicInstaller-20.1.4.msi"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\948F1707DBAB4814F9DEF03613B72E3A\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}\InProcServer32\ThreadingModel = "Both"	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cac1105f-619b-4d04-831a-44e1cbf12d57}\ = "AudioVolumeMeter"	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}\ = "XAudio2"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6F64F9F3-42D4-4D3B-90D5-1FAFECB8D53B}\ = "PSFactoryBuffer"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\948F1707DBAB4814F9DEF03613B72E3A\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AppID\{501FB925-9428-47FF-A5C6-E267C26FFEEE}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{52AD8B46-10E9-4724-AE93-116BB850CAED}\NumMethods\ = "5"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{52AD8B46-10E9-4724-AE93-116BB850CAED}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\com.epicgames.launcher	msiexec.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
5656	EpicInstaller-20.1.4.exe
2468	MsiExec.exe
2468	MsiExec.exe
2468	MsiExec.exe
2468	MsiExec.exe
2468	MsiExec.exe
2468	MsiExec.exe
2884	msiexec.exe
2884	msiexec.exe
2884	msiexec.exe
2884	msiexec.exe
2884	msiexec.exe
2884	msiexec.exe
2884	msiexec.exe
2884	msiexec.exe
2884	msiexec.exe
2884	msiexec.exe
2884	msiexec.exe
2884	msiexec.exe
2884	msiexec.exe
2884	msiexec.exe
2884	msiexec.exe
5896	GameInputSvc.exe
5896	GameInputSvc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5656	EpicInstaller-20.1.4.exe
Token: SeShutdownPrivilege	380	msiexec.exe
Token: SeIncreaseQuotaPrivilege	380	msiexec.exe
Token: SeSecurityPrivilege	2884	msiexec.exe
Token: SeCreateTokenPrivilege	380	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	380	msiexec.exe
Token: SeLockMemoryPrivilege	380	msiexec.exe
Token: SeIncreaseQuotaPrivilege	380	msiexec.exe
Token: SeMachineAccountPrivilege	380	msiexec.exe
Token: SeTcbPrivilege	380	msiexec.exe
Token: SeSecurityPrivilege	380	msiexec.exe
Token: SeTakeOwnershipPrivilege	380	msiexec.exe
Token: SeLoadDriverPrivilege	380	msiexec.exe
Token: SeSystemProfilePrivilege	380	msiexec.exe
Token: SeSystemtimePrivilege	380	msiexec.exe
Token: SeProfSingleProcessPrivilege	380	msiexec.exe
Token: SeIncBasePriorityPrivilege	380	msiexec.exe
Token: SeCreatePagefilePrivilege	380	msiexec.exe
Token: SeCreatePermanentPrivilege	380	msiexec.exe
Token: SeBackupPrivilege	380	msiexec.exe
Token: SeRestorePrivilege	380	msiexec.exe
Token: SeShutdownPrivilege	380	msiexec.exe
Token: SeDebugPrivilege	380	msiexec.exe
Token: SeAuditPrivilege	380	msiexec.exe
Token: SeSystemEnvironmentPrivilege	380	msiexec.exe
Token: SeChangeNotifyPrivilege	380	msiexec.exe
Token: SeRemoteShutdownPrivilege	380	msiexec.exe
Token: SeUndockPrivilege	380	msiexec.exe
Token: SeSyncAgentPrivilege	380	msiexec.exe
Token: SeEnableDelegationPrivilege	380	msiexec.exe
Token: SeManageVolumePrivilege	380	msiexec.exe
Token: SeImpersonatePrivilege	380	msiexec.exe
Token: SeCreateGlobalPrivilege	380	msiexec.exe
Token: SeRestorePrivilege	2884	msiexec.exe
Token: SeTakeOwnershipPrivilege	2884	msiexec.exe
Token: SeRestorePrivilege	2884	msiexec.exe
Token: SeTakeOwnershipPrivilege	2884	msiexec.exe
Token: SeRestorePrivilege	2884	msiexec.exe
Token: SeTakeOwnershipPrivilege	2884	msiexec.exe
Token: SeRestorePrivilege	2884	msiexec.exe
Token: SeTakeOwnershipPrivilege	2884	msiexec.exe
Token: SeDebugPrivilege	1128	rundll32.exe
Token: SeRestorePrivilege	2884	msiexec.exe
Token: SeTakeOwnershipPrivilege	2884	msiexec.exe
Token: SeRestorePrivilege	2884	msiexec.exe
Token: SeTakeOwnershipPrivilege	2884	msiexec.exe
Token: SeRestorePrivilege	2884	msiexec.exe
Token: SeTakeOwnershipPrivilege	2884	msiexec.exe
Token: SeRestorePrivilege	2884	msiexec.exe
Token: SeTakeOwnershipPrivilege	2884	msiexec.exe
Token: SeRestorePrivilege	2884	msiexec.exe
Token: SeTakeOwnershipPrivilege	2884	msiexec.exe
Token: SeRestorePrivilege	2884	msiexec.exe
Token: SeTakeOwnershipPrivilege	2884	msiexec.exe
Token: SeRestorePrivilege	2884	msiexec.exe
Token: SeTakeOwnershipPrivilege	2884	msiexec.exe
Token: SeRestorePrivilege	2884	msiexec.exe
Token: SeTakeOwnershipPrivilege	2884	msiexec.exe
Token: SeRestorePrivilege	2884	msiexec.exe
Token: SeTakeOwnershipPrivilege	2884	msiexec.exe
Token: SeRestorePrivilege	2884	msiexec.exe
Token: SeTakeOwnershipPrivilege	2884	msiexec.exe
Token: SeRestorePrivilege	2884	msiexec.exe
Token: SeTakeOwnershipPrivilege	2884	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
380	msiexec.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
380	msiexec.exe
2884	msiexec.exe
2468	MsiExec.exe
3384	MsiExec.exe
5408	MsiExec.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5656 wrote to memory of 380	5656	EpicInstaller-20.1.4.exe	89
PID 2884 wrote to memory of 2468	2884	msiexec.exe	91
PID 2468 wrote to memory of 1128	2468	MsiExec.exe	92
PID 2468 wrote to memory of 588	2468	MsiExec.exe	93
PID 2468 wrote to memory of 2412	2468	MsiExec.exe	95
PID 2884 wrote to memory of 3384	2884	msiexec.exe	96
PID 2884 wrote to memory of 5408	2884	msiexec.exe	97
PID 5408 wrote to memory of 6048	5408	MsiExec.exe	98
PID 5408 wrote to memory of 8	5408	MsiExec.exe	99
PID 8 wrote to memory of 2656	8	rundll32.exe	100
PID 2656 wrote to memory of 2812	2656	DXSETUP.exe	109
PID 2656 wrote to memory of 240	2656	DXSETUP.exe	110
PID 2656 wrote to memory of 3816	2656	DXSETUP.exe	111
PID 2656 wrote to memory of 768	2656	DXSETUP.exe	112
PID 2656 wrote to memory of 1480	2656	DXSETUP.exe	113
PID 2656 wrote to memory of 3356	2656	DXSETUP.exe	114
PID 2656 wrote to memory of 5960	2656	DXSETUP.exe	115
PID 2656 wrote to memory of 1788	2656	DXSETUP.exe	116
PID 2656 wrote to memory of 5896	2656	DXSETUP.exe	117
PID 5408 wrote to memory of 4724	5408	MsiExec.exe	118
PID 4724 wrote to memory of 5824	4724	rundll32.exe	120
PID 5408 wrote to memory of 4112	5408	MsiExec.exe	121
PID 5408 wrote to memory of 2604	5408	MsiExec.exe	125
PID 2468 wrote to memory of 2276	2468	MsiExec.exe	127
PID 2884 wrote to memory of 4256	2884	msiexec.exe	128
PID 5408 wrote to memory of 5496	5408	MsiExec.exe	129
PID 5496 wrote to memory of 1672	5496	net.exe	131
PID 5408 wrote to memory of 1492	5408	MsiExec.exe	132
PID 1492 wrote to memory of 4516	1492	net.exe	134
PID 3416 wrote to memory of 5896	3416	GameInputSvc.exe	136

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\EpicInstaller-20.1.4.exe
"C:\Users\Admin\AppData\Local\Temp\EpicInstaller-20.1.4.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5656
- C:\Windows\system32\msiexec.exe
  "C:\Windows\system32\msiexec.exe" /i "C:\ProgramData\EpicInstallerTemp\7fd6c6725f4c45f3929fb034b1ec76b1\EpicInstaller-20.1.4.msi" /qb! SKIP_AUTOLAUNCH=1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:380
- C:\Program Files\Epic Games\Launcher\Portal\Binaries\Win64\EpicGamesLauncher.exe
  "C:\Program Files\Epic Games\Launcher\Portal\Binaries\Win64\EpicGamesLauncher.exe"
  2⤵
  PID:1212

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 74C4B98EAB614602E29704C57DB33B38
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2468
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIA476.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240755859 12 CustomActionManaged!CustomActionManaged.CustomActions.TelemetrySendStart
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1128
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIBC36.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240761937 19 CustomActionManaged!CustomActionManaged.CustomActions.CheckReparsePoints
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:588
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSID174.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240767359 26 CustomActionManaged!CustomActionManaged.CustomActions.SetStartupCmdlineArgs
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2412
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI7C90.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240811156 73 CustomActionManaged!CustomActionManaged.CustomActions.TelemetrySendEnd
    3⤵
    - Badlisted process makes network request
    - Drops file in Windows directory
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2276
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 4F53CB6E5BCA26BC4050F73E8E164559
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3384
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 66C3BDAD0514ABB188867D8678510919 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5408
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI26C9.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240789328 37 CustomActionManaged!CustomActionManaged.CustomActions.MoveChainerToFolder
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:6048
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI2989.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240789921 44 CustomActionManaged!CustomActionManaged.CustomActions.InstallDirectX
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:8
  - - C:\Program Files\Epic Games\DirectXRedist\DXSETUP.exe
      "C:\Program Files\Epic Games\DirectXRedist\DXSETUP.exe" /silent
      4⤵
      Drops file in System32 directory
      Drops file in Windows directory
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2656
    - - C:\Windows\Installer\DX5EDA.tmp\infinst.exe
        
        C:\Windows\Installer\DX5EDA.tmp\infinst.exe xinput1_3_x64.inf, Install_Driver
        5⤵
        Drops file in System32 directory
        Executes dropped EXE
        
        PID:2812
    - - C:\Windows\Installer\DX5EDA.tmp\infinst.exe
        
        C:\Windows\Installer\DX5EDA.tmp\infinst.exe X3DAudio1_7_x64.inf
        5⤵
        Drops file in System32 directory
        Executes dropped EXE
        
        PID:240
    - - C:\Windows\Installer\DX5EDA.tmp\infinst.exe
        
        C:\Windows\Installer\DX5EDA.tmp\infinst.exe D3DX9_43_x64.inf
        5⤵
        Drops file in System32 directory
        Executes dropped EXE
        
        PID:3816
    - - C:\Windows\Installer\DX5EDA.tmp\infinst.exe
        
        C:\Windows\Installer\DX5EDA.tmp\infinst.exe d3dx10_43_x64.inf
        5⤵
        Drops file in System32 directory
        Drops file in Windows directory
        Executes dropped EXE
        
        PID:768
    - - C:\Windows\Installer\DX5EDA.tmp\infinst.exe
        
        C:\Windows\Installer\DX5EDA.tmp\infinst.exe d3dx11_43_x64.inf
        5⤵
        Drops file in System32 directory
        Executes dropped EXE
        
        PID:1480
    - - C:\Windows\Installer\DX5EDA.tmp\infinst.exe
        
        C:\Windows\Installer\DX5EDA.tmp\infinst.exe d3dcsx_43_x64.inf
        5⤵
        Drops file in System32 directory
        Executes dropped EXE
        
        PID:3356
    - - C:\Windows\Installer\DX5EDA.tmp\infinst.exe
        
        C:\Windows\Installer\DX5EDA.tmp\infinst.exe D3DCompiler_43_x64.inf
        5⤵
        Drops file in System32 directory
        Executes dropped EXE
        
        PID:5960
    - - C:\Windows\Installer\DX5EDA.tmp\infinst.exe
        
        C:\Windows\Installer\DX5EDA.tmp\infinst.exe XAudio2_7_x64.inf
        5⤵
        Drops file in System32 directory
        Executes dropped EXE
        
        PID:1788
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_7.dll
        5⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:5896
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI7326.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240808765 53 CustomActionManaged!CustomActionManaged.CustomActions.EpicGamesUpdaterAction
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:4724
  - - C:\Program Files\Epic Games\Launcher\Portal\Binaries\Win64\EpicGamesUpdater.exe
      "C:\Program Files\Epic Games\Launcher\Portal\Binaries\Win64\EpicGamesUpdater.exe" install
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5824
- - C:\Windows\syswow64\icacls.exe
    "icacls.exe" "C:\Program Files\Epic Games\Launcher" /remove "BUILTIN\Users"
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:4112
- - C:\Windows\syswow64\icacls.exe
    "icacls.exe" "C:\ProgramData\Epic" /grant "BUILTIN\Users":(OI)(CI)F
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:2604
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\SysWOW64\\net.exe" stop GameInputSvc
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5496
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop GameInputSvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:1672
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\SysWOW64\\net.exe" start GameInputSvc
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1492
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start GameInputSvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:4516
- - C:\Program Files\Microsoft GameInput\x64\gameinputredistservice.exe
    "C:\Program Files\Microsoft GameInput\x64\gameinputredistservice.exe" /serviceconfig
    3⤵
    PID:4576
- C:\Program Files\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exe
  "C:\Program Files\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exe" 67 "C:\Program Files\Epic Games\GameInputRedist\GameInputRedist.msi"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4256

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:5544

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:2776

C:\Program Files\Epic Games\Launcher\Portal\Binaries\Win64\EpicGamesUpdater.exe
"C:\Program Files\Epic Games\Launcher\Portal\Binaries\Win64\EpicGamesUpdater.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1308

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3416
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5896

C:\Program Files\Microsoft GameInput\x64\GameInputRedistService.exe
"C:\Program Files\Microsoft GameInput\x64\GameInputRedistService.exe"
1⤵
- Executes dropped EXE
PID:4968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e595fcd.rbs

Path C:\Config.Msi\e595fcd.rbs
Size 1.2MB
SHA256 443db5d2768a0926354fcb657dfea4567c27ab7ebea36a5cbaff12e73893ba7b
MD5 e26bafbf4cb2fb1c505321829558c643
SHA1 8b7a830ece1bf99ddc87ff5b6f9bf1e30a9657ee
SHA512 eeaa18ccb6e3c32501afa1d0c668b9d91cf096fe54426fc39644fca376b94bcc5b754d043d725473b165a133c72ded05b021276fac626080df8e666bceecc841
SSDEEP 6144:iP949/oQCNzhcEtE1pLmPK27T2Q1xz4Ug/vfRTcUQARThJ:z/SthISCcT2QLQvfRUAN7
TLSH
T139454AF64958C2E95693E3712319FA2648188C8D3B548C1C1EFC76AFD8CF6A42B35F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e595fd2.rbs

Path C:\Config.Msi\e595fd2.rbs
Size 471KB
SHA256 f6703ef479d4dc69281e2dc6f485af37fe98d268a8ace3455b9c73bfed853a03
MD5 891c48a33fea79eadcf4b1e4d90a0c3d
SHA1 a699ee60c8d936d2e852f867d427d72aa0b38064
SHA512 929e5ce204dc108d4d9693b1f3b3394b19967c873577a6a341b3279a0d33fc0a01900dd494969be76ec1be91b2348f9775c97c9f9acc1eed98fdacff8d554a31
SSDEEP 3072:/WGtgKq+pO8sIxm/3GIRJEEsczPLuLx1phzBPf59TODPrX5O6+flQ3v19E+7TgG0:/Wk9NfG5CnBPPizT5BXw+3s3qUH
TLSH
T167A4B5D49A1ACEDAD0A73DB5C47738307A74B3B356D87F66850824C92EE32D19F84A43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Apr2007_xinput_x64.cab

Path C:\PROGRA~1\EPICGA~1\DIRECT~1\Apr2007_xinput_x64.cab
Size 94KB
SHA256 e7a09f8235cc587cc63f583e39fbc75008d9677c8bb4dcc11cb8d0178a5153ac
MD5 743b333c2db3d4cf190fb39c29f3c346
SHA1 26b3616d7321978bd45656391a75ee231196a4a2
SHA512 77fbdb86c79d7228bca2982a3285a417a365af980488a5ac2d470b532fa59fcc15e0e8dbee6eb1a3a5256fc29e0e3391529cd2ac13e0f72987ee0da136000957
SSDEEP 1536:CEDWhtT9OVcSEbv2sSXSf2rGrqZj64W/msrR2rKg+Yy9bMP+rGb2HtDZzmwG9rHR:It5OSvuXSf2rbZu4Kmsr4eLRwPC5B9G3
TLSH
T1449302D96E7BDA03EF0B5EFDA7D6A4087824DF6684E1701627EEA29C0C143C46532F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Apr2007_xinput_x86.cab

Path C:\PROGRA~1\EPICGA~1\DIRECT~1\Apr2007_xinput_x86.cab
Size 52KB
SHA256 2acea6c8b9f6f7f89ec51365a1e49fbd0d8c42c53418bd0783dbf3f74a744e6d
MD5 c234df417c9b12e2d31c7fd1e17e4786
SHA1 92f32e74944e5166db72d3bfe8e6401d9f7521dd
SHA512 6cbae19794533ad9401f92b10bd9549638ba20ce38375de4f9d0e20af20d78819e46856151cc6818325af9ac774b8128e18fbebd2da5da4efbd417fc2af51dab
SSDEEP 1536:9cnwcwzHEdb27WH2SfZDNu75ddnVR+ZFaNk0ZT9rHUh:0wb+2eZonQwN9oh
TLSH
T17633F1D5880EE99EAED51EB0397DFA519C39D3C385B7211B412BE496088A3E0A304F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Feb2010_X3DAudio_x64.cab

Path C:\PROGRA~1\EPICGA~1\DIRECT~1\Feb2010_X3DAudio_x64.cab
Size 53KB
SHA256 832b6d48e169b4725ae482ea4d1c3360a09631a89b2fac3aba81a50805a50adc
MD5 db47136a200e326174ce790359596eb6
SHA1 fabca8c0aa28164ef4fdb7ee4ae8942a275b1713
SHA512 f3b04168ca14ad4586493ea985417cce43ee11f37aa1856e714f44e132a31dbb84934943b947cf0b2aa39344e183cba8b6f49431b4471bd0e623926def94cb8f
SSDEEP 1536:Tiqitrhuwa0YCXOt4IBAIZt7bwf/S7LkDVJoTYA95QT:TipluZ01Om+vwfZy95QT
TLSH
T1EC33F297AE89A80BFA3E9D30230CCFE36D30D683991AD515793FBD40128A7F089D555A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Feb2010_X3DAudio_x86.cab

Path C:\PROGRA~1\EPICGA~1\DIRECT~1\Feb2010_X3DAudio_x86.cab
Size 20KB
SHA256 acba5c4d4ac90e1df1c8404be5ff780e24238153cb410af909cd4364d213f2a9
MD5 88dfbb4c1876e80a1864265c61c7a7fd
SHA1 c6ee8cff225019a93308c896146d94b00fd5417e
SHA512 35e564aeeb6e462221a36cfa680e7e932333b0b92b0115ce5306ff59784abb13b8f7527fdd686737170425f2719f2d3a6901dc9822af4d537d9b5377b6bf89e4
SSDEEP 384:BbCiWM4cwP+niRGYZ2TrvF+q7yAfLORxNy+E1jYvzLXci2jXHUl:QE/wPRY62fFr2ADSxA+OsPMi2jXHUl
TLSH
T1C192CFD1AE3DD00EEDAE6CD592B8DC6B3E7D93C60936441F11DFE2C804A23C58B56465
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jun2010_D3DCompiler_43_x86.cab

Path C:\PROGRA~1\EPICGA~1\DIRECT~1\Jun2010_D3DCompiler_43_x86.cab
Size 909KB
SHA256 417eebd5b19f45c67c94c2d2ba8b774c0fc6d958b896d7b1ac12cf5a0ea06e0e
MD5 f7f554aa613eccf065575b8c69717ef7
SHA1 8417886d47c19cf6892f4080ddd5aaa1a49db3e9
SHA512 618f6dbb5bd9d44a8f10d119f5ef644f168fe3d8db986994e8cce31d1f11ff9ac872b389d1f218a82ff8b397bface587f97ca21e8f77433dbadb2ac475e9e6c1
SSDEEP 24576:dOWjUzqd7URYQio4yGDUATxoWDYicd3qRbmXHphTheUB:dtx6RYQiL1DUA7EicSbUJhI0
TLSH
T1B41533B48FE9413741A6F8481B96BBC0C11DC9E574F22DD5367FF2860846B94E32E99C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jun2010_d3dcsx_43_x64.cab

Path C:\PROGRA~1\EPICGA~1\DIRECT~1\Jun2010_d3dcsx_43_x64.cab
Size 735KB
SHA256 cdbec7e3a5a0fef016eb294b036f93c75e45c6ead8d99397f859a32d23fe20cc
MD5 850aafddfefea671a2e1bbf1b65f2a8e
SHA1 9679e7f294ca9de945b6f4f3d775d739dc2f8cd1
SHA512 d87d8d123700e02caa6562c9f22a90e86b2d8277b20089ab9d77a885094aef22bb69d60405b366ebf8cbf74f4b53a17095c3cc93b8bd3766cef7eb02bc47397b
SSDEEP 12288:nDH/lxG7YZg1tkPRZ8m4a8PAWDJRZBIS8vKU+C4+MyPBtStjea7+BjD/Ve4tEua:7RRRKy8LJRZmjysBE8aaBjDFtEua
TLSH
T19CF423F2122E331D0BD219E0223FE2D0BC7664A2D857785FDA696C7B265336E31CD919
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jun2010_d3dcsx_43_x86.cab

Path C:\PROGRA~1\EPICGA~1\DIRECT~1\Jun2010_d3dcsx_43_x86.cab
Size 744KB
SHA256 e2c5a2cbba7f211b6ca72ff8e5f69cba1f83be06357311b19e64f582fd3d14e4
MD5 44dba9557f956787b66f285776c3dccb
SHA1 4560c64f8b6bbdeedd85398f2e18404c389e4d8b
SHA512 25fbc95346bac890fee8d2a0805015af1eda5e0bb17b12d4eef52ca446775d08898fe5c13239e983a0f8c8dd13f8f2a5247a70e8e785e2bae42ff5ab1cca4156
SSDEEP 12288:u8Dx0/99rEneJVyrxcsaWmeUEEBTJNCK/FcZZXlewc3/2tqCyrIUl3z82ItDwh2a:jDO19AVrRfEHNZWZrs3+ICyco3MDISTI
TLSH
T107F4236B0267C746FD9A2C07932450D718BF32D32FB8795E529537FF0202F8A5A8619B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jun2010_d3dx10_43_x64.cab

Path C:\PROGRA~1\EPICGA~1\DIRECT~1\Jun2010_d3dx10_43_x64.cab
Size 230KB
SHA256 efce48d425c07f1faad4a55d7061a01ed6245aac17f43163cf2a23cbc9a3054b
MD5 2d9586b276a561924ff2335fccaee914
SHA1 3b8114a8820a8df9df2321d6c4da8ea155ce736f
SHA512 d78ad87685eb71d2eb8c68e1e2c7fd5a90250f04059dd0016e4c8ca01bf53c02dea01998fe6de9ae3a3f76b2964d14a61e694546a2e6844bb304c315ae5b80e2
SSDEEP 6144:YpUgZAjzb+OfxD+CEQrzgL9j9E+qG6nbNxcR3bN8J9E3PWoJq:afZyfxZa9EjXbwR8J2fWoJq
TLSH
T1F33423C69C69D5646C5C7D59E0AA4C830D3C578C0C6B2279112FA5EC7F243EFABB2782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jun2010_d3dx10_43_x86.cab

Path C:\PROGRA~1\EPICGA~1\DIRECT~1\Jun2010_d3dx10_43_x86.cab
Size 192KB
SHA256 a8cf71ffb80b683616d0621be96d3795b0ffda3877ed2d80cd958bfa393ddcfc
MD5 a89b98ab89e0d4ff9dae412d49e27c51
SHA1 18803d4bcc83ad39f25ff9f899baf136c89c10f1
SHA512 0b96a04663d2fbfb21901af832a5362785fb0270d1be0ef136549f07e2625653f8facd129889a5f3489fc8a1270abe474e4f1626ea630a3185a36812545b4dfd
SSDEEP 3072:ID2Fju8h1xkWCD/5e8U2LK1aQAMxVz2aoOxoY4+ApyP0EwMGvFas+8QJgdBvC09D:IwbCleyYagxVCaoV+ApcnG9aKQJadD
TLSH
T1181412DFCE488919FACEEDCE634ED8809CB816C30573D4458566F95039B13C85BE6E16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jun2010_d3dx11_43_x64.cab

Path C:\PROGRA~1\EPICGA~1\DIRECT~1\Jun2010_d3dx11_43_x64.cab
Size 134KB
SHA256 c1d0d56b83bfb09a5e1a89e1898bb74446a847b30a968f3664ec2d87368eb63e
MD5 96e7847a914afcb489194940b06a5c23
SHA1 9439907a1000b9dcb8989ffbd828e6294c277fba
SHA512 638485084884fab9d8952af17b24c4aef16dd026c75256026859bfe4f24d7f11fd2240cde8c5de0dab8968885a6d344da7335be257570e947bf5da8ac06f61ad
SSDEEP 3072:1luKA472L962XjyJ1b4mBfqMlafaDxbUmDSRP7qlt+95tP:1le4A9Vjs1bVSiaylomDSRTqlo3P
TLSH
T1BDD312D6AEFAC60AFE435C5206ADD8620DBAB7C677E5980B5137F2D50943780604BC3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jun2010_d3dx11_43_x86.cab

Path C:\PROGRA~1\EPICGA~1\DIRECT~1\Jun2010_d3dx11_43_x86.cab
Size 106KB
SHA256 a58cefe822e371d078eaf89319f832693352ba7d62079320074397f0f3425961
MD5 758c5a459978cb2c68a300a60da153be
SHA1 66d12509137f2b5e1a668df39e6ccce6402822c3
SHA512 f33d6fd3354310e6cc4b483eae955a9652e7f71ceef7c444bdef84251ffa6ec0b89886a2344d18e0a1ad5285123ad808904372289e1e1c8d14242483f0426588
SSDEEP 3072:hXMVzDTlrM28bEHSqgik2ono4DQQ/7cuBFbb9aDz9on:hXMxNjG4gikye5FBtB42
TLSH
T17DB302D6A260F94F8D676CC79246E79359FDCDCA4A24944B386EE1843C033A25B0BD4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jun2010_d3dx9_43_x64.cab

Path C:\PROGRA~1\EPICGA~1\DIRECT~1\Jun2010_d3dx9_43_x64.cab
Size 915KB
SHA256 9b98a1269af7f3a0007bfdc73206a47a6ee158d34ba8a87009396c18186bb06a
MD5 063fa6f7061324eac1c4de0350c20e80
SHA1 daccf01b4b7493b88f04f9e50fe37c03846335ad
SHA512 3ad31100cbca4da52e46518e577dca94b595f9d47a3e9552cd764905ffc2876f9127b69a97bac44dbd754021e14ddec65480b7628a3768f03e53de8fbb08c547
SSDEEP 24576:mneqhPULh1ksCctVV+WOwy/vW09rabgcZhBeYCrrPe:1hOJY3+Lwy/vjkgcZaXO
TLSH
T1C21533859AADF8D55ABF0B0510912763267F33EB62F4F08BD5E126C05C30795438E7AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jun2010_d3dx9_43_x86.cab

Path C:\PROGRA~1\EPICGA~1\DIRECT~1\Jun2010_d3dx9_43_x86.cab
Size 750KB
SHA256 fcc6cf0966b4853d6fa3d32ab299cde5a9824feaecb0d4f34ea452fb9fd1c867
MD5 7749862c307e527366b6868326db8198
SHA1 bce9f21cdb1e101c7223c9e62eca61ec22d6bb81
SHA512 b65a84535b749ade0f8ea1a8ab6239df8e82ad59cbdb07487fdbfcfcf57a565f493f56378e216859a081d23ddf7c671636f53ef821289d66452f09218080f02b
SSDEEP 12288:w0b5pTUIVIRxV+yb+HJFnXQRGr85UpzQ3VztxmHN8DMFy0BJ1lSIug3SqHAlzJYu:Z51NVO+XVLs3VztQHmYjBJb931I1NYIZ
TLSH
T10AF423432AA5348E8C523043E3669A2724B83557CEBDE77562A44B2D0CFD76F113ADB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxdllreg_x86.cab

Path C:\PROGRA~1\EPICGA~1\DIRECT~1\dxdllreg_x86.cab
Size 43KB
SHA256 4afe0249a13868b7c4a92b4d53c998adf6053eb5e2c47fd81020fd8d4bb11150
MD5 4b4f83d1dd86314b65760f44f9c7a9b1
SHA1 d8d857ebbe2c0dd5b63e564bf8428c55ece55778
SHA512 91a556dee865f9a625a148556c289b287187d4a7c2814658d8b59a99afbf226dcf557094f43349ebfbd2fabc5628940cce942a22c29f5dbca086a3ddeef8e9c6
SSDEEP 768:47CbQVl8ORHNCNzUSWyEHNaNo6lc22V6yey6qoomHhPokDLmaV3QN7b6Fjpvh:47Cm1HwzUSWFU72UTHhPoknhk6F5h
TLSH
T16E13E1B4CD08ED409DBA2E992368FF363E78D99318703C5B46CAD78605883E58F6587D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxupdate.cab

Path C:\PROGRA~1\EPICGA~1\DIRECT~1\dxupdate.cab
Size 94KB
SHA256 e18a5404b612e88fa8b403c9b33f064c0a89528db7ef9a79aa116908d0e6afed
MD5 d495680aba28caafc4c071a6d0fe55ac
SHA1 5885ece90970eb10b6b95d6c52d934674835929e
SHA512 a25c647678661473b99462d7433c1d05af54823d404476e35315c11c93b3f5ece92c912560af0d9efe8f07e36ae68594362d73abf5d5de409a3f0a146fe31a10
SSDEEP 1536:JvknxJRHNYzrAzRstaRGk0jzphvXdy57XwwnNb+vnaI1eYpIKxozNlmn6F5x:JvknxJpNYAzRstaRkz0BwwnNbSa+vp58
TLSH
T1BA9302EC875DCF93D5622DADA168EA0B7DBEF98E891CD42580B5F20418627DCB2F444C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DSETUP32.DLL

Path C:\Program Files\Epic Games\DirectXRedist\DSETUP32.DLL
Size 1.5MB
SHA256 fb0e534f9b0926e518f1c2980640dfd29f14217cdfa37cf3a0c13349127ed9a8
MD5 d8fa7bb4fe10251a239ed75055dd6f73
SHA1 76c4bd2d8f359f7689415efc15e3743d35673ae8
SHA512 73f633179b1340c1c14d0002b72e44cab1919d0ef174f307e4bfe6de240b0b6ef233e67a8b0a0cd677556865ee7b88c6de152045a580ab9fbf1a50d2db0673b4
SSDEEP 24576:CIQ+ddddddddddddddxOOOOOOOOOOOOOO2iWeXiWeXiWeXiWeXiWeXiWeXiWeXi+:CIQsOOOOOOOOOOOOOO2iWeXiWeXiWeXf
TLSH
T166759D31B1D40332EA7103B177128AB7F63EEB9DE119DA257DAE82552182B9CC37E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DXSETUP.exe

Path C:\Program Files\Epic Games\DirectXRedist\DXSETUP.exe
Size 505KB
SHA256 8f47d7121ef6532ad9ad9901e44e237f5c30448b752028c58a9d19521414e40d
MD5 bf3f290275c21bdd3951955c9c3cf32c
SHA1 9fd00f3bb8a870112dae464f555fcd5e7f9200c0
SHA512 d2c354ee8b6977d01f23c6d2bb4977812bf653eae25e7a75a7d0a36b588c89fcdbdc2a8087c24d6ff687afebd086d4b7d0c92203ce39691b21dab71eafd1d249
SSDEEP 3072:Qi6LKKSPluzye9iHWptICTrbusJxDO9insyH6+PJTOramZap5XVeR4zW1mFD1gbH:8UHWDICTmUxDpEa04+GU
TLSH
T103B4B05036F4D926F2F32B743ABDE26158BA7E80A934C20D2501665D1BF3B40A96CF77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dsetup.dll

Path C:\Program Files\Epic Games\DirectXRedist\dsetup.dll
Size 93KB
SHA256 2a61679eeedabf7d0d0ac14e5447486575622d6b7cfa56f136c1576ff96da21f
MD5 eb701def7d0809e8da765a752ab42be5
SHA1 7897418f0fae737a3ebe4f7954118d71c6c8b426
SHA512 6ff8433c0dadc0e87d18f04289ab6f48624c908acbda506708f5e0f3c9522e9316e587e71f568938067ba9f37f96640b793fdfaa580caedc3bf9873dc221271f
SSDEEP 1536:Bc8tBKv1HCyODN2wjIqlLmqxY3AMVI4I9okOEvc0/c/sZRYltL26VVE2S+JJqsHy:BftQv1iyODswNLmqxY3AMV71Ev54EAxM
TLSH
T113937D107694D076D9D620BD718CD7715ABEA6B41F6880CBBB461BDA8C653C0BA3E30F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ar_BH.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ar_BH.res
Size 144B
SHA256 dc359b3a630dab0a5b4e728806547747fc25105b70abd3b22e8bff20a3995ef5
MD5 ae6774ad1b4e487d0992d22700f9087f
SHA1 46b5c49c76a7106f33bfa9bb13ec5b0f50eff50b
SHA512 095b725d6f78b78a8f77dfa461b716a480219a969efc8246045bc0b93a18ba1377bc17bf4ff99b390038db71db3a387c4b6c658f858b735a897d41ce6c34ce79
TLSH
T1DFC09BAB2A98DFEFD4900335D0D7C50053D7CB19816B2B07446436357F617505559194
MD5 SHA1 SHA512 TLSH

Submit Download

ca_IT.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ca_IT.res
Size 76B
SHA256 d49d36962528cd70e638fe62c2a675838d5f6d13c229f6a107530d58c458d100
MD5 cf788fa9793fea6104e904fba48b9ade
SHA1 5105a53f269a6c445fe58f0ab7bb501bf5790960
SHA512 b07ced3b04e2ce33b0fa215ae03002e666d5408f31ade8fe84f46e2a7474d277b40887f090d5db6abea58b6a8df385f952dd614979ad903aaf31b524a06aa93b
TLSH
T164A0024447054176C43D637750B6C3402372D954C105220739240A4968E79142E507D7
MD5 SHA1 SHA512 TLSH

Submit Download

nl.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\nl.res
Size 100B
SHA256 bd31f37629afe5b5ca7801f26f251980f6f6a737c01c3c5be19e10b8f4840f00
MD5 74852472abc6dd63b12c4766472c9b74
SHA1 5b59504cccc2a557a39ab15bffac0270d4e4014a
SHA512 80e3f257a80030becd995377e912bcb62940c2819cee559441cd3b9a141229a7e071fa75b91b4b868dcdbfd00ac389f5250c7d49d0f8096e8cdf9b045523d0db
TLSH
T1FBB022080B03E33BC0228333000003002BB083ACC320030C8C800F803A830000C00F3C
MD5 SHA1 SHA512 TLSH

Submit Download

zh_Hant_HK.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\zh_Hant_HK.res
Size 76B
SHA256 5107405e84e52f18e47aa7071f183e499a2c325e6e4bda7fca2b59ecb55d81d7
MD5 446a3139b2628b0370b88deded4d5382
SHA1 73a290ecc02be29b6e9dedd1dde7b0633cb5d5a8
SHA512 6e6cbe46747664442464bccb8dc93dfad4a786c6ac390eda705c083498c898ff0d9083afa411e800f1dfc1db10799bee110e7c5371b3f559a806d72d42cdeb0c
TLSH
T1B7A00251471C720BC13E9331545083412325FC865111270268148B0929535401C12705
MD5 SHA1 SHA512 TLSH

Submit Download

bs_Latn_BA.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\bs_Latn_BA.res
Size 76B
SHA256 1f132ca885d786c508137e5a798dca175fdd0d486a134931fcc3803db934b735
MD5 c64f71ae20060954b9e32c5b9da51c65
SHA1 1e33967c51e09874f6a1de9a9c3539db9ca82a63
SHA512 caaad60303a93e38e881d7fc3c711d7a52acb59511a65bee549193067f88b870bff2daebddfae6d4ed366f93d3d7003ec5b0ac13890b9187f9a37d2be8831d17
TLSH
T13CA0025247514206E13EB379545182142362DC546151174268161B0564935041D10300
MD5 SHA1 SHA512 TLSH

Submit Download

en_IE.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\en_IE.res
Size 80B
SHA256 6dd348d1795c7e999a650b6cbf254544f9d62ebe48f53230334bc0d6fa44d47d
MD5 f290c99a3e9c928023e949819dfe38ee
SHA1 e24ac7970af336c9455b5211bf1b865237d46e05
SHA512 873c23e1aea6243172bd8f8efa2cb1ed8580e1def84764cc05a3638118d4c01f17f8f51967dc050c903727cb1784c4ea01d274a45c4969d9fe1e7efb881a0379
TLSH
T13DA0025E87A18347C501377A81F641047393F6B82303235B2952264170C073C6D20104
MD5 SHA1 SHA512 TLSH

Submit Download

en_LC.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\en_LC.res
Size 112B
SHA256 03ea59d7659ee65e93d76e0744b1a0497d63bc278692f2a85cfe54a1f8d7f1a9
MD5 08408c8d145ccd952dd7d40baa4853d6
SHA1 cfad7e3b03106cec4678ab39cac25fbfb34dd5df
SHA512 df6c166aeae11ba470f588f2f7fb096493c74ec973ac25a21d354f92fa775189f487ef639bb31d59de64b4fab68b4045f1e3267d029ed612feaa57f2fdb5495f
TLSH
T1ACB01293A080CB47C00637F9C873C0483752025817621F47DC01237658051843457102
MD5 SHA1 SHA512 TLSH

Submit Download

en_TC.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\en_TC.res
Size 80B
SHA256 c3dd2043cdd9a4430624cf43fe1d7c65938e1a6d029ed3ee2632796a8d4abb5a
MD5 d6186af2d25663529a1670149401c51a
SHA1 cc73aaa889e5f7da2fced52a80448c64c5756a9d
SHA512 c94e2e44c785414bf4894caece699225411498cac344f761a8a047a4f82c15bd26d9f78834d515264805ed6454bcb3ef05e7e622e241f2e2c9678cdd0376ce31
TLSH
T175A0025D87B08347C151373A81FB41147357B6782203234B192A36057080724AD10189
MD5 SHA1 SHA512 TLSH

Submit Download

sr_YU.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\sr_YU.res
Size 76B
SHA256 fd67c6594b5413b30f3d04973480904ec2179107b767666c37a8a55c90918ea6
MD5 a1a03e4ae0bb3120daa7f925f9754736
SHA1 244855f29a028c974b0e908cd8e4cee11f65e56c
SHA512 04c5b3ffb40b64422f94929e0181879cb7de1e8d07d5b2c59aca1e5e88a33503ba3a6e377c064c5675d0522c49f6853bd28e5141b9227846336f2686d551e987
TLSH
T148A0024147504287C13A737A506582643362D994519132D3B9121657AAC39042E55200
MD5 SHA1 SHA512 TLSH

Submit Download

uz_Latn.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\uz_Latn.res
Size 76B
SHA256 dcb5a6234f2f38bece4039140f59ea549c5cef8191cda68fdae9d5b6106d9b4f
MD5 1960ad3959332481f6d916f056b52339
SHA1 cea9c67afc66f20e4104cb6aa2df781bccadfd5a
SHA512 c7be9fb55877d5418afb221f94f131e02a2c88c55216e2a1b9967b3dde70b47336d8878b97cb64228a7ddda55dc4665517f1f8e8df2b997e2895afe62f9a3986
TLSH
T10EA0024A47A8434AD23A737E9075C620538AD9586501224338121A0165C77046E10108
MD5 SHA1 SHA512 TLSH

Submit Download

vai_Vaii.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\vai_Vaii.res
Size 76B
SHA256 338496ad90df4581131f024dd945f5d7455f0b9969ea0c924e9f1bc142083b18
MD5 a60e02569784ac9d5c76e3021322c822
SHA1 471960a6448f26bf0216f28f071e3860f1d6a271
SHA512 a2d57f8efbe4e5d0b50faf54c6c44ceecf0ade4577872af3cace9df64d1733a68325494694b03e3517877560bf12cc124f662aaddf8c1f68b97862e75fc0cef2
TLSH
T13CA002898FE84366D23973BE50B5C2101342D9556101128328522E0168835042D10114
MD5 SHA1 SHA512 TLSH

Submit Download

en_IM.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\en_IM.res
Size 136B
SHA256 d338e130fafe30c63a1dde8b6478a23dce8d1a3716b776c44fbf9e132a392c32
MD5 8e8f7836852a74de789dd0f4c71797db
SHA1 7509333c6d134b2bad48486057f91336dc1aa009
SHA512 4c39dd6462ea0f1f0d674bb06e8a5153a86903a91b0c04166a06c7df3b511e6ce83cbfe19d7175c010867f97dcb80723c398b4985d68ba162c30dd15b52d1fd9
TLSH
T103C02BFC7340992AC4452A319162430033F70C13800339030B10110C345358C6B9C290
MD5 SHA1 SHA512 TLSH

Submit Download

en_JM.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\en_JM.res
Size 80B
SHA256 df819c5400d36259bca9e3f7fbdafb6f2da2ffa00c5cf03695d3a1a5a20e8592
MD5 dbed6cbf5b4e215e7bc058594652c5c6
SHA1 14ff2242eb58ded4ae8da0315f21ad1894cc848d
SHA512 0312dc0174e32aba5fdc8edc21d06dd613f0bc9bb24e1e502902379b997406d4b5e2a0c17e48bf582594c5d0988fa8dd3fd9a1ccc9fc386c4e453683196f2ec8
TLSH
T1B3A0026446065377C40757B340F5C54D73735265C307328F3A64024578F5F302E505A2
MD5 SHA1 SHA512 TLSH

Submit Download

en_NA.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\en_NA.res
Size 80B
SHA256 b94b6bae10b1b207adfb721f38c9bdabf1b3619c2c82afe24c7a0f823f9ca38e
MD5 84781fb37996ae5ed3c3e0e3beb4455a
SHA1 ecd887370a4453e67a642a46bef4bb4593c0cedd
SHA512 fffc82be344acdafa125a7a9ba3d79939f695b3c8a1aa66d8c0092847b7487385c979175f37d7df39eb3334f56621df78d3b2b087e7ae5d40972dd37ed42b109
TLSH
T128A001A04A095266C40E577240F5855962725154D206228E2B640245B8A5A202E50190
MD5 SHA1 SHA512 TLSH

Submit Download

en_SX.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\en_SX.res
Size 136B
SHA256 ab6683282cd7cd5a8a819796ff415a8c97933eb2a77e5f6b8b42048dd336eb70
MD5 9195559cd1c871889bae26ad19ca0c24
SHA1 7106db267cc6f7d978d00d4a9829010b1e653375
SHA512 231cff0ae144af4382b9f869807492ece979a809f0f4a912b8b41e09ebf4cc6f173ec62a507af72c28bf825a7f74624b1ab776f293d632038e7b3590c9b885c5
TLSH
T1A9C02BF87240992EC4492A319162430033F70C13800336030B10110C349364C2B9C260
MD5 SHA1 SHA512 TLSH

Submit Download

fr_BF.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\fr_BF.res
Size 76B
SHA256 d5d3c00ca62f706f59183248bbe5fe5c6fb721e544d3a665a8bd03b4b5f73478
MD5 2e5503409ec26800fcf6a9b1d64dbe57
SHA1 5962f8204c362dfef2b60cda43363d4811d686c6
SHA512 649675774963c12d5776f5d8d12580f79acd476c21056662d5391ac262e82a56adc751807ea94f8d59979733bbed2616a8bf1bca16af5d89350aa473e21108be
TLSH
T17BA002804708817AC43D637750B5C3442372D954D105220B3B24064968EB5142E503E5
MD5 SHA1 SHA512 TLSH

Submit Download

fr_SY.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\fr_SY.res
Size 132B
SHA256 4d2bbe1d4d9d0a4266448241596bca9da40a34d96e4fd309a205350156de0134
MD5 4cf3aa31b641864ab60ef738b2b9903a
SHA1 92db1cf0b23b8d187b404b1693c3841f16152bda
SHA512 e7e01ab79ce30f51b69b1c7094c325d55e08da3703c05ed0741b05d30b2c4d662587338141aa5bf6ee9015ce1dff2094982a40ba58f4abca7cf3e8c1a954e2ec
TLSH
T1E9C09BD93105E437C00D3331A1769119B3B75656C702610359515604A5B77565574558
MD5 SHA1 SHA512 TLSH

Submit Download

en_CC.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\en_CC.res
Size 80B
SHA256 b008ddd5d12fb7008ac7f0c345e57100ef0a0b69f6f92cb34496c34386f71b7f
MD5 68ae567d0c236da786e332a837c30299
SHA1 dfeda196ef4cd20bbf63cc94d213ad031bab3dcb
SHA512 60e949b0ab3e6ac8209473f4c19bf87eba3216f1de345f93e88cbaeaf68bf6fe7ce4f2dde4eab9966e1da237f644e116ab5f5dc107d846d3fc7d3971fe380734
TLSH
T118A002A44759C35BC116177240FA97047B97F1741743671B1D6483567180B702D55686
MD5 SHA1 SHA512 TLSH

Submit Download

en_SC.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\en_SC.res
Size 80B
SHA256 673b9967e9bab1bab7bd65e184eeb02eb5e8dc38f33f0970e683b9445c967cc7
MD5 8ccd09fd382b155e658cb8e38a69d50d
SHA1 beb2f210e55b9b72116cb9ca3b5a654e7bbf3066
SHA512 26d1444ac0d0dc7bd1a5e5081bdce4831fb7768d6c93747e6bae049d88136a95d13644763aaa86e4dea7cfc40a6d2ef80506a984e650debc3c036822d881282a
TLSH
T14BA002A0476AC357C105177241E987487792F1540743771BAD64425671817702E50292
MD5 SHA1 SHA512 TLSH

Submit Download

es_BO.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\es_BO.res
Size 148B
SHA256 abbdcff69a749e45c85eb908f6228f7a2aa7626ca79a8bb34193c6c56099a41d
MD5 7694951ef25993c308c192cb7f702a4d
SHA1 65c2b02876fb4c07ef7639d251c32e3752cfe22a
SHA512 7de1eedc81ea2fbd7609014f999be352059dccebc7f14637d84f7b3e51cacd7cd17f2bb9d43d074078951c69911bc7ec8591d2330c02c73922a695763d356fd1
TLSH
T119C02B8A4E079203F007033318AE870103C76FC58123530E0F40E315BA431A131C0545
MD5 SHA1 SHA512 TLSH

Submit Download

he_IL.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\he_IL.res
Size 76B
SHA256 756032017e2d9deb9ec1508dafb605009eadf6d859ff309bbcd6e49bb2d8d9f2
MD5 a0e7f0023efe9d9da802a0c5a941f8ce
SHA1 e4522c97b99704605469449c21aeef8e03a0ad3e
SHA512 2b06564fb675f51d96e9945a303d9aadaeabb8173222ac644ac3415d5ac1aec958d70f651a5c85561cdd79e0f4b713d43117332a8536a251f4fb48800076ab01
TLSH
T1F2A0026197119106D03D63315491D2142BA5EC4541036702A9140F1624936541D60301
MD5 SHA1 SHA512 TLSH

Submit Download

pt_MO.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\pt_MO.res
Size 80B
SHA256 5ab1e574c48682e6feea216e71b16150335eea3d23af856a0e6f71ce715de137
MD5 aae879c1e1523cd47b76124dfb953f5c
SHA1 9e6f3e4d87189a381ea5ca35148e2bc4c2618686
SHA512 7ff20635476d644ccdf277a9dfdb01dc95fbb46c92c4fd119cebc16758380935f09b4dd1b6b240e9336465e637ac47cdca02c32dfc67ca0ccb170b2b17ab89df
TLSH
T197A002E04B95C357C102573244E6CA482792B15A1203631B6D74423271947703E50603
MD5 SHA1 SHA512 TLSH

Submit Download

sr_Cyrl.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\sr_Cyrl.res
Size 76B
SHA256 ddd8f7540d9a540ea6967bf394fddaf7262d47fd2484d4467cb4d2c747b6dd32
MD5 c2d04d672f4df81cff4bceead9be3750
SHA1 21413dc219200658c148c7adc2a3c47e7d4c3ffd
SHA512 6a15d00e02638fae576327c856aa81a476fb76621febf62bf1160d6afd8fd7e5ceaf12fe7cce072bb45e0d371ed5be67b3059a19a45f0e7d452564475d69b598
TLSH
T180A002D04B16816BC039673354A6DA401786F95D5103530358214A3264E76687E50202
MD5 SHA1 SHA512 TLSH

Submit Download

sr_RS.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\sr_RS.res
Size 76B
SHA256 fd32948fd9cec6e575bb7e29a4102cdbf852ec752cf47399a028d04528c489b3
MD5 522cc1a65a354bc4ac2119c3ee5177e2
SHA1 5ff152aa8dec7e82399d07d29d1dc12be874f985
SHA512 e95d63da5e61069be80017cbd7be335ec4a80d44a1acf9638c697b13817a832d8bfa7afcb562f3d9c36df13de27366c78ba0866bb9e463f5af455ae0983e385e
TLSH
T1C9A00250D7659146C139233B50B5E20017D2E9548113531368151717A683B983D6D201
MD5 SHA1 SHA512 TLSH

Submit Download

nmg_CM.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\nmg_CM.res
Size 76B
SHA256 829e57b045199ba2d82b08baae8107b9875c7a99488ff32e7c3e225ea16a8a67
MD5 8e658e24e91577b14fb18bdc90a2e1c5
SHA1 2a12c0df79a4b42f048c50ba66c942aac4a256e8
SHA512 eeed6686c5ca622dbeb27d18ac89606d55f759c8f450860adc1d5aa956aba14f5606aaee7a173846e947b7274f6be9ca039bf0838fea8d1fae08d2b6b0b386c3
TLSH
T1D1A0028057584176C43D63B7A0A5C3003363DD54D107221738282A4968EF9142E503D9
MD5 SHA1 SHA512 TLSH

Submit Download

pt_ST.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\pt_ST.res
Size 80B
SHA256 8840adebc3abc62843f8e6350f2e28528a3ca15d65fa9979bed3bf44566867a9
MD5 1ebd2cf7b1b1688edba5e6481651878d
SHA1 d7475c1e2105a5316f89bad639102a22e59e8206
SHA512 208ef55200983034d2e782b061c3c065e60832cb443d5b4cfdbe9297d338e9867089b7f26fd2a7bd7c25bdd11e8b5c7c7bdaa77a409dc679a931256ca038aa0a
TLSH
T103A0026156455377DD46577340F5852463725164C317324F3A744249B8E57352E79190
MD5 SHA1 SHA512 TLSH

Submit Download

es_GT.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\rbnf\es_GT.res
Size 96B
SHA256 59a741f29db4fd6792c6b24842f42aa8f9ef4e61c3f9085fde8b92f29c76960c
MD5 01ac728b63d66869b5a2d94a2f88b64f
SHA1 e12801ed14cb0b7bb6252a3666c9c97820f15ee9
SHA512 132080285a86e399d3f920f470fafcf39ac76d5370a492bec00af161c2c537e8368335f675e006b2ee64f6ffb02a78423a4bc7bb636342c5b92f13f4ab4c3e39
TLSH
T13AB022302BA08A3FCC328B3008B08B00BB08C0802AC2320E8C208F2038C30002838E3B
MD5 SHA1 SHA512 TLSH

Submit Download

az_Latn_AZ.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\az_Latn_AZ.res
Size 76B
SHA256 f3965e339c622c96879dee316de42f9e9f693ddeb7a52fdcebba027171f2c86a
MD5 3f209b3aa35603dcbb208a74caa36c86
SHA1 249de057005be697205333aba0433c5b04653bbb
SHA512 02411ae5728814057e0ca78d850eea85b3aca16dfdbee97a7c01860da3b82640eebe60960938c7f64b05d9e9fe8bae0b826d242e24b33c40024836f716f17e31
TLSH
T14DA0025147545346D13D63755851C2082361DE445102170369140B1624A35041D10301
MD5 SHA1 SHA512 TLSH

Submit Download

en_MG.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\en_MG.res
Size 80B
SHA256 db13f9c7b55bccf734f5c6d3c56dfed65eda9dc7976e24f0a862f2408a6e529f
MD5 7621254d9d701161592f4f0cbbf6f7bf
SHA1 d41412336a9893e9a9dd439b13a3c65435018da3
SHA512 dfe7eacc4058d1862eb6ef8305a388bd27249fe2b91df08c3102928b066454b322fb55ac7a34de0e27a87d2112b6a374e674b27b1296240efe46c5bb135d0a20
TLSH
T164A00260473D7347D04117B7C4E981446393AB6D6603320B1E102213B084B266D55301
MD5 SHA1 SHA512 TLSH

Submit Download

en_SD.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\en_SD.res
Size 80B
SHA256 4b49d73f1dacc88c3c58bdc9c73014345f9535ad76af80b72881ca618e0ab804
MD5 847e775630f25d5d30746d2aba9615c0
SHA1 a538e1d8a5acdbdec4c3fe3123a46e6311a466de
SHA512 c7a9c62d9ee17004fb9dabad8b1877d80387692b50447d1cbaf6178cba89e56fa4272f7292ba9e26bafa7585c403580093a5e022031f6d0b96e44c7ff4357bcb
TLSH
T151A00290466F6387D052177344EBC245675263E72203624B1E10561170847357D59201
MD5 SHA1 SHA512 TLSH

Submit Download

es_PA.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\es_PA.res
Size 124B
SHA256 6423a955dc8a45912dc4ca81aaa6ede3554c2dad3efe200ff97428ec88995da0
MD5 df8c1b6c2e9d796cc17fdc48cde3cb5f
SHA1 6b58526e194eb5461eb52568711cf490fc6ce325
SHA512 7c8085034258ebacda4948e6fcebce0f4d9b56da4fc6377e4cc94b042fc54f9f775d93d6efbd9877d9e453c9c31876f905e8953298c71c37cf720dee2fef9db2
TLSH
T14EB01285D975E34FC119133221FB8140C3EAC70420014FB74B60C211714B24275B0302
MD5 SHA1 SHA512 TLSH

Submit Download

pa_Guru.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\pa_Guru.res
Size 76B
SHA256 15b23903878e867c7f8638b46048ffcbb245789c344bc16986851a7227687909
MD5 7b02e28612fbff1a60da141244aef706
SHA1 78065b63c9d24feaa1f72752a39d3977449bce1e
SHA512 ea8c726496990c7fd4958181650b21b89fce23c5250e76bfc3b7d23acf827196791c312f96ff71d5fd0f90b03603646c26b3b31232d6fa2630492c4a315552f5
TLSH
T176A00240471492DAC17A27726965D2406363EE44515213872910062264975443D14206
MD5 SHA1 SHA512 TLSH

Submit Download

pt_TL.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\pt_TL.res
Size 80B
SHA256 3a85bade8a7a6db69c28c9388ef247294248df06f9d9d406198479426b31d70c
MD5 606dd5e86352cba8a2a4f4561837824b
SHA1 5c0059f5cbdd887fb652fa79ad87aac0f8865ea8
SHA512 66c908320950530c345997b522e12d7d6603df931fe32b43644a2ddfa12be7795c9582c070adb744fbde9df287816fc8584f5f1a2bc2158abd8bfc9ba4b20e0c
TLSH
T132A002B4466A63DBD0971B7344E5A184B372F7592353238B1A10431674847613D6D206
MD5 SHA1 SHA512 TLSH

Submit Download

rwk.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\rwk.res
Size 984B
SHA256 e8647fd90a97c6c221deabe0e4e4f833e3b726c9424091695e2419045d7f2b60
MD5 2dc65410add51f24840be253b3de1e6a
SHA1 555d4e6eb7c777e657dc6fa511950b6a31426ba1
SHA512 01bec81c93895a11fdb507bcfe01386d0d590e20827aad4ab59ce50e25de3074801996fd2b3ac9d8231af80049dc5ecaab8e3ad38ae8fd9b4135706cdc53f60f
TLSH
T11211848BDA23A760CC0BC3BED573D51B9166060458D212E3C9B56B60168BA8C93766F2
MD5 SHA1 SHA512 TLSH

Submit Download

sr_Cyrl_YU.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\sr_Cyrl_YU.res
Size 76B
SHA256 7d0e61f3ca3dae5bb75aaf6318bde4f128da9662fe1d75fc245f5d4b5e4188ce
MD5 5c56677a0822b6f922124f4e4ae5a625
SHA1 d1a78f3f6f949ca8c8593dfd24a8c248642bbf38
SHA512 0090c31c35af1b6718f4db3fe7aa2e6f06240b7895df417ff9500e08c66a9f9d98095378558131c2d96ea129fdc7df30be876f4b18b887872b0addfa9c3a59a8
TLSH
T10FA002909B149786C53A337295A6CA101796EA449523234319A1475164D35152D50241
MD5 SHA1 SHA512 TLSH

Submit Download

vai_Vaii.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\vai_Vaii.res
Size 76B
SHA256 825e5f4187683fe01e0fff595d7cb7cab8654c5699f0d8386e6c3625a5e3b19f
MD5 a0838e6d15b5072dc03baeb7f98ed41a
SHA1 98ab23737463e55ada302d75545a9bb32be19272
SHA512 b4f64fa488f5af2465e5f986c7b505df49c23166c022e13dbe764047833735551f67c2f3dacdfff46a30847e8303df96270471f990ac48353e6a5baacafc3d2a
TLSH
T14EA0028147549396C3392772546BC3446752DA85510252432A21062174935086E10201
MD5 SHA1 SHA512 TLSH

Submit Download

sr_CS.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\sr_CS.res
Size 76B
SHA256 2001732718d567eddb29306e39fe186be95cd30bea89a14a5cffda73c6e95539
MD5 03b4c2777b2ab020f0301b1f57b4486c
SHA1 1a8fe984f91940e6a8b86f9433bc64ce5d875b87
SHA512 d7ff5c4032bb90e9123b3054783ded9abac3b1413da8e01f80bfcf0a07169ce7992b89454c839b3f5d1d4633b5ade2ab093a68e9ff09aa825e9303c371929859
TLSH
T1A7A00288870045AED83DB33358A9C20163A3EA44E10522037819574679B75583D20211
MD5 SHA1 SHA512 TLSH

Submit Download

bas.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\bas.res
Size 76B
SHA256 68f743aec976a4117dca15a76760cac2f8580cedfa64b9c7d523a8f7bc0fe081
MD5 6134f4cd4d6c15ce86537d2613927036
SHA1 59d53b482f70551d8dea499a310e7da230219a18
SHA512 aab3c6a451737433d25e38d86d21f865d944541d8c3a1ea23d937afb33c3a06c56a436afa997d42343aae8395607819a1a79f0fcb60a8017ee4c6e4c9a140172
TLSH
T1D1A00241EB414546D0BF2377946EC3485B8BF945A10222171C100A116CDF7043E18104
MD5 SHA1 SHA512 TLSH

Submit Download

en_MU.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\en_MU.res
Size 80B
SHA256 e26840bbac4f0ed8e3601f62abb775fcc16bf38b70785540025d1818f7057881
MD5 4d8b9ed918a6a21826cf6acda10d7b8b
SHA1 dec9bb0c1333322c691b9318a9fad5e0987319e7
SHA512 7ae98d692352c530ae50ab24c00c7f0aeb6c2f74c6b77ebbbddf4bdd04b21e48816bf3f2698ee2b014d703f56f9e14958e28f298cd56027492c3a300fc4b619f
TLSH
T1ECA002644E41A747C0861B7348FB41896FD3A16682036E1F3A100311BC997203D1A204
MD5 SHA1 SHA512 TLSH

Submit Download

en_ZM.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\en_ZM.res
Size 80B
SHA256 dfecd526162a19ed0e877a733782593d1cf496e5d1435248c06bdf5386f36bbd
MD5 5c178e2fa9f7bfafd04671973597da85
SHA1 77beeb262833524ff0cb993f282abefc05b49323
SHA512 d4fad5f465b41fa87df52fb0bae6a5c4cdd48c3c43be1daae1de9b55b962f217cb666f47f7980599caaf0101aad46895f2a3f07e872a1b44146ebc64cff860b9
TLSH
T1FCA002584E414747C087177348EB4149EBD7A15642036A5F3A10071274D8B203D1E284
MD5 SHA1 SHA512 TLSH

Submit Download

es_CU.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\es_CU.res
Size 80B
SHA256 56b0002469f572cfd0cb8c8becea7a1005ea8f7ed1d3dd308e0c4ad28a88f0c6
MD5 9e46895540fd75ba1c21cc8bca9446b4
SHA1 09c5d01771b26a3f003757fd9788d13c0f10ae26
SHA512 b7b792042aba5729eb852ecda456087f05e459641f62c1bc6e951f3bd72a81b8c6d55a995fc07bffd2ce342cf87618010a4ad63271ca4518950c9b93b9b6df85
TLSH
T12DA002584E414747C097177348EB4198EB97A15692032E5F6A10061274D87203D1D184
MD5 SHA1 SHA512 TLSH

Submit Download

pa_Arab.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\pa_Arab.res
Size 80B
SHA256 f1d94fcb430e36370fa030c9d9892214dcb624289bc5282d432bf2a49378a08c
MD5 6a9273af56e5d1f6f2d24203334ddf9b
SHA1 bd7ca1cb1ba90b6036803043b8e351e6ec499da5
SHA512 066cc289321c632ca0657aac15f9f0e121c506b3ebd752e19277a5087417430e3c40525e0b410b930ef3a238328906aa64bf2a53b0febb26724918333c500508
TLSH
T167A00255AE468747C0A7177384EF414CAB9BB15652032E1F6E10421374E87203D18104
MD5 SHA1 SHA512 TLSH

Submit Download

pt_MZ.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\pt_MZ.res
Size 80B
SHA256 f963a5003bfc4bcf7a310c34bdaded866bfe24561fef032e89fecab13bc3ffbb
MD5 5e3e0a089d7bacd2f1ac2684ee9bef02
SHA1 4bd888ae18fa11258d13f8fa615d8915777ca4ee
SHA512 a65c63add4db82803f2aca5d2ca2ebdadd12faff258472d36b0f735617104c352ff28b49afc19446fcab396e1febdc9a08bd91d2ef43f96ee25658d3a216c4bf
TLSH
T181A002544E514747C08A177784EF4188BBA3A15652076E2F2A240A11F4B87203E1C504
MD5 SHA1 SHA512 TLSH

Submit Download

sr_Cyrl.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\sr_Cyrl.res
Size 76B
SHA256 939c1da1c4ed3e97227cfc94d46bacdfbbb8d2bff721ec42618b641db731ad3d
MD5 85a6974221a7807b04c9e016b6c8904c
SHA1 421c17e072a104975c29e5c4a51575c5a9542489
SHA512 eadbc62801b0d5aba4b9a2bbdf469f007493fe613e04b640aa511383a4e3d707ac0adcff3e5d80f1598090e12cd65c5985dfcdf0cf8d46af807bad00204182cc
TLSH
T19FA002408B514546D0BE237B946E93482B93E9449102622318140E01ECFF7043E18144
MD5 SHA1 SHA512 TLSH

Submit Download

sr_YU.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\sr_YU.res
Size 76B
SHA256 413c50ef83d5a3ff6c6f693e50594ff033a0301dcb807c2ad1efdeb25fcb7642
MD5 88ca5d2b5f3baa53f32d1a17affb3cc4
SHA1 b603ef247d2e23125e79c34f3695b44853a2024e
SHA512 be26d85b7ea633275de857127a7e8891fe0bd1eb66ba33e83ee6b652a76c0618bf052da6a43fb9e21394941732d9805dc2fb801a5065b7ee8cda6ea77ff3914d
TLSH
T135A002404B468556D63B2336547782047783E9C9454123031A2116067C87A08BE18104
MD5 SHA1 SHA512 TLSH

Submit Download

th_TH.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\th_TH.res
Size 76B
SHA256 f7835f43b81af073e115dcdbdd71e6d274c476853ffe6befcff4a6dd26e02cc6
MD5 c34486d88a5544f3392a4fb031eca28c
SHA1 287ae38b9011fd9bf97fac414b405f1748b748fb
SHA512 dd334e26082cd5f5b9cf2dd581930db2dcfc8ae136fea02b0a7e8376baa2c0582236086c7d973a84c14eb3f873c6f540e70fe65917d757c6fa630e56cd780c35
TLSH
T1FEA002614B418506E03E63355893820827A2EC444101170269240B0524976082E14304
MD5 SHA1 SHA512 TLSH

Submit Download

uz_Latn_UZ.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\uz_Latn_UZ.res
Size 76B
SHA256 eb0040acad7de2a57e33a3ad90fb1711651a7ff071d21653a3b6bc7aa39cec7b
MD5 f637999c3373220f35094ab85161afbb
SHA1 24891e13d210b7e6b7d0053cbf5a945566f79938
SHA512 d7b2cd72563f0a9015a2d3239d4660a3086262f633b680128b0b6f86c3ab8051838858133488768d9bd0d1db97f64c4b61172a7f6f7556c8d2295db48673708f
TLSH
T1FCA0025067444176C83E737750A5D3101362D954C21522073934464DB8E75152E743D5
MD5 SHA1 SHA512 TLSH

Submit Download

en_CM.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\en_CM.res
Size 152B
SHA256 55d9048a31ccfb28f5da7a418a221d2cf8d488da50dc7a125a7bbb0eb7bd01b4
MD5 a2fecb24b478f9a9e53e5bd8cb82947b
SHA1 3eba18a74e53bc95b39065ad1c229181284f3bde
SHA512 69a04cf483233f71dfe3e3730a11e4a5e86b57946a3bc9be823dcb7c5e0b3c26c771962242e226c82e8a72abd29133e90dcc0aefafa2ceab146ed4fb321439c1
TLSH
T17FC09B5A4D296357C14517F3B5B2518A164E5D84E243539A0B50154196128907FEDA05
MD5 SHA1 SHA512 TLSH

Submit Download

en_FM.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\en_FM.res
Size 80B
SHA256 21eda0dea9e1f55f8e7a899b005526ea9d3d08e9338b7a57524e35c0d472d903
MD5 7b933f365b0f6a04c6db118e4a5c302e
SHA1 193d872892e0be99bdeb813cf9bc6e6b9ae2022f
SHA512 91c56392f9924f26bf28a803377b5ef517a3f4d0e5dda3541c0a73ba33bce1ec6b78b325c59b4defcce830c4133e4bcaf118372067a5d9d05a0ac4e592d75980
TLSH
T13EA002944644675BC805177361F6814A2766DA5812C3239FDF504351B490F202DB5511
MD5 SHA1 SHA512 TLSH

Submit Download

en_SX.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\en_SX.res
Size 80B
SHA256 a865ec010c2680b1674f3f258f1aff7a401e7ed6459f98c0699287fc05b8c520
MD5 7c270f310229b7a3bceabd9ae3be08b8
SHA1 b4fb1a986654111beaa667e79a6ee7efd3958c21
SHA512 1967b7f33051c0e665cde999bf594921ba1376017895e2cd74b3863d8704beabe9cb4d7e44be46c038225a24c205a31310198682885e8bc7a14575860c5cc988
TLSH
T189A0029446084357C4051B7661F6814A37629A6412C3231FFB904B5175A0B202D65200
MD5 SHA1 SHA512 TLSH

Submit Download

en_ZM.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\en_ZM.res
Size 152B
SHA256 d3e4b494d598c2c08dcdbb9379b164c95158bb673aae0ad789124f46170937f3
MD5 584b7ed10634a00ed0e4f58e9404cd0f
SHA1 f167a677fbc727a61d5ac6a326cf1f2eaa8e6073
SHA512 f32c2e4fd559487d4b3e8a67392d5989ec99212453e1afa2dcbbd22ab69c3e21c589790653d357a5c048c670e2961a1810af3718823038ba9523164478468d0e
TLSH
T1BBC09B965D2D5357C14616F6B572518A168A5C80E243635B5B501D4156224503FEDA44
MD5 SHA1 SHA512 TLSH

Submit Download

es_BR.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\es_BR.res
Size 80B
SHA256 876f59b33ba2ca4dfcb619bae86da6165df4955b09ec4fc989bc4e8fd4f1df89
MD5 10e40df5115f3c4978dce4da2e0d6451
SHA1 bc28046e014f618395e2ccccc316c17ed91daa4a
SHA512 00e5df6097b58acfee5b47748856a95f4e0cd920ae9c33a4d6ed71425b1714e7f2dc6031febc5ec4ccf216a1e3e3cab2a3950999dc8343b746ee20747dbcf6ff
TLSH
T1FAA00294560C4357D0051B7661F6418A3762966502C3231FFBA00B5175A0B202D75204
MD5 SHA1 SHA512 TLSH

Submit Download

pt_ST.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\pt_ST.res
Size 176B
SHA256 c1991718a07aefc99fb6206f3bc6c99afa7ff678e9f6a01b4a475ddc2b288b23
MD5 0314889a62d29f92898f2e84fb0d88d6
SHA1 5e274dbbd7f357ad6d09b3b822a4b92d3109c8b4
SHA512 04b0c28f2ba9cc19a5a89d0946050c41874617f8ec2cb3c1f268931446af51c4b3850f4a3a627e14eb34c504435f726cc4f8b11733fcc5f2d73ef2371bacb1cd
TLSH
T13DC002AD5E7659C3E71AD1F3B4EB4C220A861F80A94423B95608410078924B5AF81933
MD5 SHA1 SHA512 TLSH

Submit Download

shi_Tfng.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\shi_Tfng.res
Size 76B
SHA256 2c7e3796404241f7ff344f6e838eb3dfb77569152bfeb1880927e4347b50c642
MD5 264c63861ceef0e1a4cc72d014aa43fc
SHA1 74b6aafbfe5d4dce23ec1950246d948a8af12cef
SHA512 a65e31c1fa603f4a893236a84d56b04a9563e8a9520100839a997c62a2d749c3a47ff862f195d8c731194f1e9ffa9d7112214e6d3c06fac5c940a26611217b9b
TLSH
T143A002804B085246D03E2332B0E683421742DD44718212175DA046516993A082D35205
MD5 SHA1 SHA512 TLSH

Submit Download

sr_Cyrl_YU.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\sr_Cyrl_YU.res
Size 76B
SHA256 028a167d99b424b29176736eafd35631bacf7a4f087e765c6e244cef0d12203e
MD5 7a74fc755d1e0d6d48cd5b4c2361592b
SHA1 f35ee9e8b2b8ad42d48265ab5f32617b664a77fe
SHA512 be38f81fe8d53b9fa2adad5d2b403dae7e6223f6aa4438f5ddd5c3be3b88795a720e90197a96263dc8251abc10f96a7c5e987dbea84a00cb88f60394278f54f6
TLSH
T1AAA002C047085247D0392332B6A68E621342DD44C253131359A14611A8935042E68100
MD5 SHA1 SHA512 TLSH

Submit Download

sr_Latn_BA.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\sr_Latn_BA.res
Size 76B
SHA256 b175f94ed5ce958a83aab63677471aa4c0b2ea04faba7c42681a5aeaef8e5530
MD5 4f880c5d6bddf339f850a87f0dc7be2d
SHA1 90f0e7728bf802b7e962db8434d1c562705f0613
SHA512 c9fc5b2f71f055d42c8501aaaaf6e6b6c290a6018cf1cfcb993735a01868850d0b3c5eaad3a611c80d456af9319dcf1f20ce4a8a0db54736ba8c8d7089b54144
TLSH
T137A0029547045206D03D63316492C2062361DC4441431712A9544B0538A35041D21201
MD5 SHA1 SHA512 TLSH

Submit Download

zh_Hans.res

Path C:\Program Files\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\zh_Hans.res
Size 76B
SHA256 968f1197df1b8b6f2ff8113b28253086818ea2c8e21c049509dc10d50adeb7f8
MD5 cbf1e43602d294e22f60cdefffbe1133
SHA1 e9b337c3ee0c3fe63b741faa70a51fb5a8475970
SHA512 66979d342beba1c32521f3797499c19fa3895e8efe74ae6e50caac65aa72b282180bb3be55ad6b4a479c393e992f88f0f12b4d2b5429fefd5681076d519041eb
TLSH
T147A002884B144246D63D237361E68B121356DF4485425307595046016D9361B2F20211
MD5 SHA1 SHA512 TLSH

Submit Download

InstallChainer.exe

Path C:\Program Files\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exe
Size 19KB
SHA256 3476ae8623d0571282bea7b42703a74deec86635790a87056c200e64eca20013
MD5 12ec07bdb162305e374b546a65b25f17
SHA1 7411f36f533571d343b006993330b5be17aa861b
SHA512 ee592872cb7bf9c83bcb9bd0ad227760b4dd5d6afe9c1b5292100c2ac940e77a289b79148e83780f28395a6fb3b021998899ae715682c95508b937605285ed85
SSDEEP 384:GRJdzxS75lQmIYiBndCkZWIy8RbmL4nNyUMW+n:H75lOYiBpN5ALDJn
TLSH
T14A926C928BE84415FDBB6F307CF14A215E71FE566CB2C2CE3085824E4F617416EAA376
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Program Files\Epic Games\Launcher\Portal\Extras\EOS\Microsoft.Deployment.WindowsInstaller.dll
Size 194KB
SHA256 79af207289e8a1af19ddc3f6e7b387ef4b6b7f2408909ad11e820a3c325e38aa
MD5 ddcadc59fbc8ac4e0803d0a087d0ee61
SHA1 3af82f0b7c635d26bdfb34de4b17c06bbd114e79
SHA512 dbfd6071f19d384d1112db63688417369e589b7df7617716942034d84356ac0ab88568846e84a306a21a2b3c90a20ef210f3fc27cc2565a0978ac56f0d8baf56
SSDEEP 3072:wGfZS7hUuK3PcbFeRRLxyR69UgoCaf8xzCnfKlRUjW01KyPJPod36:qzMRLkR6joxfKK46
TLSH
T1DB148E2953FC473ACEAF4774E2614261D7B1F2E67113DB0EAC8181BA2562780F792397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D3DCompiler_43.dll

Path C:\Windows\Installer\DX5EDA.tmp\D3DCompiler_43.dll
Size 2.0MB
SHA256 2f23182ec6f4889397ac4bf03d62536136c5bdba825c7d2c4ef08c827f3a8a1c
MD5 1c9b45e87528b8bb8cfa884ea0099a85
SHA1 98be17e1d324790a5b206e1ea1cc4e64fbe21240
SHA512 b76d780810e8617b80331b4ad56e9c753652af2e55b66795f7a7d67d6afcec5ef00d120d9b2c64126309076d8169239a721ae8b34784b639b3a3e2bf50d6ee34
SSDEEP 49152:DpX9JVeE9HP6Zpy9KyhMI50Du8LljslNsHSHFUq9OiapbbO5Akb:H3P9HP6Zpy9KyhMI50Du8LljslNsyHiS
TLSH
T1FBA59E11E705D0B2CCCB00B16A5DB7A6647C9F30432096C7B2947EA95D72AF35F3AB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FEB2010_X3DAudio_x64.inf

Path C:\Windows\Installer\DX5EDA.tmp\FEB2010_X3DAudio_x64.inf
Size 815B
SHA256 68351f03f4ef83e4b8c359e3e130441081690a1866b838a1b35d64674ef3abbf
MD5 49460e9297b0faab5a5d73e7aa2caa67
SHA1 a7e211f3d4ae808f67a798924c4d3314183df873
SHA512 92c4c0751e9123e1eb09da312bc44041d13262e26cefb807dcd1b354c5bd12c0d7197f1d3d457ddef89714b77ffe45db9c717332963c6daa507ae02a6d5fc941
TLSH
T13401829ACC03D5327689F1F17BCB2BCB5B27041AEA316518B68A04C8BB7310051AC1FD
MD5 SHA1 SHA512 TLSH

Submit Download

FEB2010_X3DAudio_x86.inf

Path C:\Windows\Installer\DX5EDA.tmp\FEB2010_X3DAudio_x86.inf
Size 1KB
SHA256 d4da3e530982812d1e2a31570b80af541fac1b13c72997d2aad7ea3bfeaf4a4a
MD5 e84adf38d499ae39090ad60fd76d76e3
SHA1 6af4d58bc04aac2723e8b97649f1b35fb1aca84c
SHA512 6714992e7aee7bd0798fbec68f92c97ee502127580e21e1b6693ed6737312b44dbc9fd9ef579fe552590e9e5a4904df94e4116334265a34699a04aa76ab87c24
TLSH
T1FD21269ACC0294707685B2B27F8F768F5B670417E9612508B3CB0E94BB73701219D1FE
MD5 SHA1 SHA512 TLSH

Submit Download

JUN2010_D3DCompiler_43_x64.inf

Path C:\Windows\Installer\DX5EDA.tmp\JUN2010_D3DCompiler_43_x64.inf
Size 830B
SHA256 3e779533a273e3395109c7efac13ba1c804c01b3ddb16938406fbdf90d851216
MD5 6494a3b568760c8248b42d2b6e4df657
SHA1 700f27ee4c74e9b9914f80b067079e09ec7c6a7f
SHA512 2bf68b123d7823ad7182e132d9e55f8de7580229e8e1b3b40030da50bb9bdeaf67bb9727ce2171fa83b7f804c24d9728ffabb44cb5017b16b771bb19e62b1b42
TLSH
T1B901AB9DCC02D43277ABA5F23B87674B1763084AED1125487D9900D4EF63304117D6FC
MD5 SHA1 SHA512 TLSH

Submit Download

JUN2010_D3DCompiler_43_x86.inf

Path C:\Windows\Installer\DX5EDA.tmp\JUN2010_D3DCompiler_43_x86.inf
Size 1KB
SHA256 5dd568919e1b3cbcb23ab21d0f2d6c1a065070848aba5d2a896da39e55c6cbbf
MD5 1a86443fc4e07e0945904da7efe2149d
SHA1 37a6627dbf3b43aca104eb55f9f37e14947838ce
SHA512 c9faa6bb9485b1a0f8356df42c1efe1711a77efa566eee3eb0c8031ece10ffa045d35adb63e5e8b2f79f26bf3596c54c0bd23fea1642faae11baf2e97b73cf5e
TLSH
T1883114ED8916943077D5B2B2BF8F264F67674406ED65214CBBC908A4EBB3701126D1FC
MD5 SHA1 SHA512 TLSH

Submit Download

JUN2010_XAudio_x64.inf

Path C:\Windows\Installer\DX5EDA.tmp\JUN2010_XAudio_x64.inf
Size 923B
SHA256 1a0f1b929724f8b71d5ce922f19b9d539d2d804c89af947d5927b049ef0fd3d8
MD5 dd987135dcbe7f21c973077787b1f4f8
SHA1 ed8c2426c46c4516e37b5f9aac30549916360f7e
SHA512 f0469c94219b4df99d7b9b693161a736fa8eec88a3f6c7f2cf92fab2ade048dfe61fcde3a4cf4f7a2aaf841d079a46b17259dea22cfb02831983f55bd7f61899
TLSH
T1B5117D85CC4382337789B0F2BF872E8A97570416ED212248BA9A15CD9BA310652AC1E9
MD5 SHA1 SHA512 TLSH

Submit Download

JUN2010_XAudio_x86.inf

Path C:\Windows\Installer\DX5EDA.tmp\JUN2010_XAudio_x86.inf
Size 1KB
SHA256 d786d06a709d5dc26067132b9735fc317763fcf8064442d6f77f65012ba179da
MD5 31d8732ac2f0a5c053b279adc025619f
SHA1 c8d6d2e88b13581b6638002e6f7f0c3a165fff3c
SHA512 abc37922307f081a1ffdc956ce59598c19ad1939ecfb6ea3280aa6aa7a99c3eba5462731586ca262f7d7257d7d2a74ff57a45abf6b93521eb6f1c9f22f8eb244
TLSH
T1D7317CC9DC0293717784B1B27F5F3A8F57670416ED61210873D65E9DABA3202216C1FD
MD5 SHA1 SHA512 TLSH

Submit Download

JUN2010_d3dcsx_43_x64.inf

Path C:\Windows\Installer\DX5EDA.tmp\JUN2010_d3dcsx_43_x64.inf
Size 815B
SHA256 5289b5ad22146d7cc0c35cdb2c9662742693550de8f013d1ec40e944288d155a
MD5 e1f150f570b3fc5208f3020c815474c8
SHA1 7c75fc0cf3e3c4fd5045a94b624171d4e0d3b25c
SHA512 a53618ed6ebcd50ef074b320eb3ebd38af4770a82caa808e47cba6a81982ced46cf954a1c5a383f171006e727d8211b4fce54c9faf27b4c14a770a45a09037b8
TLSH
T16001CE99CC03D03276CAF5B23B97674B2723081AED12258939D900D4EB63344516D6FC
MD5 SHA1 SHA512 TLSH

Submit Download

JUN2010_d3dcsx_43_x86.inf

Path C:\Windows\Installer\DX5EDA.tmp\JUN2010_d3dcsx_43_x86.inf
Size 1KB
SHA256 d5200b332caf4fff25eb3d224527a3944878c5c3849512779a2afcfeae4c3ca1
MD5 cf70b3dd13a8c636db00bd4332996d1a
SHA1 48dd8fc6fa3dae23cb6ca8113bc7ad837b4570d7
SHA512 ae31a9e20743a2052deec5d696a555460a03d400720679ed103759241b25d55e2fbc247170da3c0c0891f32b131ab6a6845de56c2d3387ad233aa11db970b313
TLSH
T17E3106D9C812E430B6C5B2F2BB9F674F6737041BE955214D77C908A0ABB3751125D1F8
MD5 SHA1 SHA512 TLSH

Submit Download

JUN2010_d3dx10_43_x64.inf

Path C:\Windows\Installer\DX5EDA.tmp\JUN2010_d3dx10_43_x64.inf
Size 815B
SHA256 a65f370a741d62c2be0ca588758d089dd976092cb910bb6b1b7d008741e18377
MD5 13c1907a2cd55e31b7d8fb03f48027ec
SHA1 ca37872b9372543f1dbe09b8aa4e0e211a8e2303
SHA512 545aaf268d141e2aae6800e095a1ae4eafe6bfe492d95dfe03789ccb245cc3ef3f50f43b10a41a3b0efdc7f8c63621b437323e133ba881f90a3b940095b80208
TLSH
T1F5018E9DCC03D436768AF5B27787674B1B271806EE5265A87DD904C4EB63204516C2FD
MD5 SHA1 SHA512 TLSH

Submit Download

JUN2010_d3dx10_43_x86.inf

Path C:\Windows\Installer\DX5EDA.tmp\JUN2010_d3dx10_43_x86.inf
Size 1KB
SHA256 4d4263cbb11858c727824c4a071f992909675719be3076b4a47852bf6affd862
MD5 53a24faee760e18821ef0960c767ab04
SHA1 4548db4234dbacbfb726784b907d08d953496ff9
SHA512 8371471624f54db0aca3ea051235937fc28575c0f533b89f7d2204c776814d4cd09ee1a37b41163239885e878fb193133ad397fe3c18232ad3469626af2d2ed1
TLSH
T1D83106DD89129430B6C5B2B2BB8F374F6B371407EA51216C7BC90CA0ABB3751125D1F9
MD5 SHA1 SHA512 TLSH

Submit Download

JUN2010_d3dx11_43_x64.inf

Path C:\Windows\Installer\DX5EDA.tmp\JUN2010_d3dx11_43_x64.inf
Size 815B
SHA256 2c4cf75b76203cba6378693668c8c00b564871c8bfd7fbda01e1e841477b2a3b
MD5 590fe1ea1837b4bfb80dc8cb09e7815f
SHA1 792b5b0521c34c6b723a379dd6b3acf82f8afb1f
SHA512 80bee8f1ad5bfaba6b3ac5a39302a1427dbaa5919d76c89b279dc753170ec443924eadf454746ce331a6682ee729ab79bd390a5d3b55db8d08fd6f4869101f53
TLSH
T188018E9DCC43D436768AF5B27787674B1B270806EF21659C79DA00C4EB63204516C2FD
MD5 SHA1 SHA512 TLSH

Submit Download

JUN2010_d3dx11_43_x86.inf

Path C:\Windows\Installer\DX5EDA.tmp\JUN2010_d3dx11_43_x86.inf
Size 1KB
SHA256 3925c924eb4ec4f5a643b2d14d2eda603341fbbd22118cdd8ae04aaa96f443c0
MD5 fb5d27c88b52dcbdbc226f66f0537573
SHA1 2cbf1012fbdcbbd17643f7466f986ecd3ce2688a
SHA512 8aa2200f91eca91d7ee3221bc7c8f2a9c8d913a5d633aa00835d5fb243d9cb8afa60fe34a4c3daa0731a21914bc52266d05d6b80bfc30b2a255d7acdf0d18eb5
TLSH
T1E93137DDC952A431B6C5B2B2BB8F374F6B370407EA21215C77DA08A4ABB3711125D1F9
MD5 SHA1 SHA512 TLSH

Submit Download

JUN2010_d3dx9_43_x64.inf

Path C:\Windows\Installer\DX5EDA.tmp\JUN2010_d3dx9_43_x64.inf
Size 812B
SHA256 272650a2d9b1cfea17021f4bf941b21f2206791e279070d4e906ce0ce56ac16f
MD5 ce097963fc345e9baa1c3b42f4bfa449
SHA1 e7624afc3a7718b02533b44edfe4f90d1afda62a
SHA512 f3c4f00eebd9d465bc2415d59c417bca0f5a07c8e13880b28704f770763609a653d4b06f53d98325b66c2c7094895190900c47980f81463215e919f00966ee7b
TLSH
T19A016B99CC02D43677DAE9B27B8B274A2767050AFA127198799A01C4AF63240116C6EC
MD5 SHA1 SHA512 TLSH

Submit Download

JUN2010_d3dx9_43_x86.inf

Path C:\Windows\Installer\DX5EDA.tmp\JUN2010_d3dx9_43_x86.inf
Size 1KB
SHA256 6b33d32da02f664092d44b05237990f825b4062c105a063badcf978648b5e95b
MD5 a11deb327119b65bacce49735edc4605
SHA1 0be2d7fa6254b138aa53d9146cda8fedbba93764
SHA512 b0134a3d6f2d576e5fafb601014ab66fef91d661013acc8a7a9129940369a1d9ed5c0f228bb1666a4e891f09b4b18e83f0cb2080047aa84fa45ab663e5739a31
TLSH
T1A73146DD8C02E4307B94B6B27B9F364F2727450BEA61314D77C90990ABB3341115D2F8
MD5 SHA1 SHA512 TLSH

Submit Download

X3DAudio1_7.dll

Path C:\Windows\Installer\DX5EDA.tmp\X3DAudio1_7.dll
Size 21KB
SHA256 288c701bdedf1d45c63dd0b7d424a752f8819f90feb5088c582f76bc98970ba3
MD5 c811e70c8804cfff719038250a43b464
SHA1 ec48da45888ccea388da1425d5322f5ee9285282
SHA512 09f2f4d412485ef69aceacc90637c90fad25874f534433811c5ed88225285559db1d981a3ab7bc3a20336e96fb43b4801b4b48a3668c64c21436ee3ea3c32f45
SSDEEP 384:hd8NTutwAV7uTOJ/jUKdiAdzJWZuW8lLXci2jXHUcwVP:hmAV7uTO7jzU8Mi2jXHUcwVP
TLSH
T14CA27C55BA7DC112E9A819F0217EFC873C3DEB944B1282E3119270DCCA653D0AFF9666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XAPOFX1_5.dll

Path C:\Windows\Installer\DX5EDA.tmp\XAPOFX1_5.dll
Size 72KB
SHA256 becfdcd6b16523573cb52df87aa7d993f1b345ba903d0618c3b36535c3800197
MD5 8a4cebf34370d689e198e6673c1f2c40
SHA1 b7e3d60f62d8655a68e2faf26c0c04394c214f20
SHA512 d612e2d8a164408ab2d6b962f1b6d3531aed8a0b1aba73291fa5155a6022d078b353512fb3f6fff97ee369918b1802a6103b31316b03db4fa3010b1bf31f35fb
SSDEEP 1536:YGrYa/nsaXTeizHgMK7DaCsVtqqXtF9rHU8:pY8saCizgMKXaCezXL9o8
TLSH
T1D3734C01A8E9C2F6E45828F5E4AE39973C38CE984B2085C3635845D5DDB47E07AF93F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XAudio2_7.dll

Path C:\Windows\Installer\DX5EDA.tmp\XAudio2_7.dll
Size 514KB
SHA256 d1690b602cb317f7f1e1e13e3fc5819ad8b5b38a92d812078afb1b408ccc4b69
MD5 81dfddfb401d663ba7e6ad1c80364216
SHA1 c32d682767df128cd8e819cb5571ed89ab734961
SHA512 7267db764f23ad67e9f171cf07ff919c70681f3bf365331ae29d979164392c6bc6723441b04b98ab99c7724274b270557e75b814fb12c421188fb164b8ca837c
SSDEEP 12288:Tcn8HWZeKA6SKE8bZiCENnOgQs/WIOPtm:T98+hIBENODs/WNtm
TLSH
T145B42A12B0418275C5F726F185AE333B27388B8557411AD753E899F9EEE22E07EB01DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

apr2007_xinput_x64.inf

Path C:\Windows\Installer\DX5EDA.tmp\apr2007_xinput_x64.inf
Size 860B
SHA256 0d6e1c0e961d878b319ac30d3439056883448dcf26774003b73920f3377ecac8
MD5 94563a3b9affb41d2bfd41a94b81e08d
SHA1 17cad981ef428e132aa1d571e0c77091e750e0dd
SHA512 53cac179d7e11c74772e7b9bd7dd94ffbc810cfc25e28326e4d0844f3f59fd10d9089b44a88358ac6dbd09fb8b456a0937778f78ecc442645764f693ccd620b8
TLSH
T1CC118CCCCC0290327789E2B17B8B3BCA5B6B0417E961225C35DF4588EB67145A27C6FD
MD5 SHA1 SHA512 TLSH

Submit Download

apr2007_xinput_x86.inf

Path C:\Windows\Installer\DX5EDA.tmp\apr2007_xinput_x86.inf
Size 1KB
SHA256 1c798cb80e9e46ce03356ea7316e1eff5d3a88ccdd7cbfbfcdce73cded23b4e5
MD5 e188f534500688cec2e894d3533997b4
SHA1 f073f8515b94cb23b703ab5cdb3a5cfcc10b3333
SHA512 332ccb25c5ed92ae48c5805a330534d985d6b41f9220af0844d407b2019396fcefea7076b409439f5ab8a9ca6819b65c07ada7bd3aa1222429966dc5a440d4f7
TLSH
T1D42126DDC8039435778AF2B27F9F7A8F663B8406E951221C73CA4994AB73341126C2F8
MD5 SHA1 SHA512 TLSH

Submit Download

d3dcsx_43.dll

Path C:\Windows\Installer\DX5EDA.tmp\d3dcsx_43.dll
Size 1.8MB
SHA256 b46a44b6fce8f141c9e02798645db2ee0da5c69ea71195e29f83a91a355fa2ca
MD5 83eba442f07aab8d6375d2eec945c46c
SHA1 c29c20da6bb30be7d9dda40241ca48f069123bd9
SHA512 288906c8aa8eb4d62440fe84deaa25e7f362dc3644dafc1227e45a71f6d915acf885314531db4757a9bf2e6cb12eaf43b54e9ff0f6a7e3239cabb697b07c25ea
SSDEEP 24576:/j0ZXvi+of1/z+uQ5Da3Qx1fF4dEQMtqVC43ux:/A9i/f1/z+Zce4dpMATe
TLSH
T13885F515CB115AFBD5FD02B249E31B24777290A37EF312B3CF0946255CAE388A6319B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dx10_43.dll

Path C:\Windows\Installer\DX5EDA.tmp\d3dx10_43.dll
Size 459KB
SHA256 56fcd13650fd1f075743154e8c48465dd68a236ab8960667d75373139d2631bf
MD5 20c835843fcec4dedfcd7bffa3b91641
SHA1 5dd1d5b42a0b58d708d112694394a9a23691c283
SHA512 561eb2bb3a7e562bab0de6372e824f65b310d96d840cdaa3c391969018af6afba225665d07139fc938dcff03f4f8dae7f19de61c9a0eae7c658a32800dc9d123
SSDEEP 12288:cFUDOgwNvArf8r3bK9s3kW3CG3vQ3sad/QNbubxu:5DOgw6fYbK9s3kW3CG3vQ3snputu
TLSH
T1C5A46A91D5505135ECDBD2B4500D31B626AEDA7353A1B2C72F5C6AEABE38BC01A343C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dx11_43.dll

Path C:\Windows\Installer\DX5EDA.tmp\d3dx11_43.dll
Size 242KB
SHA256 492e960cb3ccfc8c25fc83f7c464ba77c86a20411347a1a9b3e5d3e8c9180a8d
MD5 8e0bb968ff41d80e5f2c747c04db79ae
SHA1 69b332d78020177a9b3f60cb672ec47578003c0d
SHA512 7d71cb5411f239696e77fe57a272c675fe15d32456ce7befb0c2cf3fc567dce5d38a45f4b004577e3dec283904f42ae17a290105d8ab8ef6b70bad4e15c9d506
SSDEEP 6144:8K0GaAtQlDJCSB4MvfIeDRI9Z7IJItblSwJ7FnH4fa1wlMjb5:eGjQlDkSB4MvfIeDRI9Z7IJIRlfJ7N4w
TLSH
T1C7345BA1EA00513AE8F6D2B4211D732151F9DE3007F2E3CB165CABDAACB56D18A347D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dx9_43.dll

Path C:\Windows\Installer\DX5EDA.tmp\d3dx9_43.dll
Size 1.9MB
SHA256 0b28546be22c71834501f7d7185ede5d79742457331c7ee09efc14490dd64f5f
MD5 86e39e9161c3d930d93822f1563c280d
SHA1 f5944df4142983714a6d9955e6e393d9876c1e11
SHA512 0a3e311c4fd5c2194a8807469e47156af35502e10aeb8a3f64a01ff802cd8669c7e668cc87b593b182fd830a126d002b5d5d7b6c77991158bffdb0b5b997f6b3
SSDEEP 24576:8UtU6OIyl2Wy9M3bJ45fPS0zFZghQ6aOiFaKOE31GrvFXl74YZ29X1MDd6olmrBs:8566l2u45BiNYFrz31Cv3D29kd6kWa
TLSH
T14895AF51C5191075FDE69030110D32B2219C9B316391ABCF665E2ED9FFB8BE1EAB8387
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxdllreg_x86.inf

Path C:\Windows\Installer\DX5EDA.tmp\dxdllreg_x86.inf
Size 724B
SHA256 54e098294ef0ad3b14b9c77642838b5992fe4573099d8397a1ef566d9e36da40
MD5 8272579b6d88f2ee435aeea19ec7603d
SHA1 6d141721b4b3a50612b4068670d9d10c1a08b4ac
SHA512 9f1311803db1607e079b037f49d8643daa43b59ce6eafb173b18d5a40239a5515091c92b244ffe9cfef2da20530fb15deb6cf5937633b434c3262e765d5a3b21
TLSH
T15A014094CC039474B689F1B2B76B774F3AEB0917E9112308B3CD04499F6361021AD1BD
MD5 SHA1 SHA512 TLSH

Submit Download

dxupdate.dll

Path C:\Windows\Installer\DX5EDA.tmp\dxupdate.dll
Size 173KB
SHA256 fb4f297e295c802b1377c6684734b7249d55743dfb7c14807bef59a1b5db63a2
MD5 7ed554b08e5b69578f9de012822c39c9
SHA1 036d04513e134786b4758def5aff83d19bf50c6e
SHA512 7af5f9c4a3ad5c120bcdd681b958808ada4d885d21aeb4a009a36a674ad3ece9b51837212a982db6142a6b5580e5b68d46971b802456701391ce40785ae6ebd9
SSDEEP 3072:KU6LKKnw8i/9S7BLGKm/nuFV3uNgosUBxr+2y97CqGIpHtWMeJnQRLj+bTHyKaY:Iw8aIMrfuFVeNgosUBxra4rIZsqq
TLSH
T133047C19F640E871D4D20178311C6B3119FEA87017A980CBF3472BCEE9A97D5A67E36B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxupdate.inf

Path C:\Windows\Installer\DX5EDA.tmp\dxupdate.inf
Size 12KB
SHA256 93f5589499ee4ee2812d73c0d8feacbbcfe8c47b6d98572486bc0eff3c5906ca
MD5 e6a74342f328afa559d5b0544e113571
SHA1 a08b053dfd061391942d359c70f9dd406a968b7d
SHA512 1e35e5bdff1d551da6c1220a1a228c657a56a70dedf5be2d9273fc540f9c9f0bb73469595309ea1ff561be7480ee92d16f7acbbd597136f4fc5f9b8b65ecdfad
SSDEEP 384:eXTiDxtV0xxmBxbD6Ys7s6xHOJYwYdDxAp8xXZyUxIJM:eXiM
TLSH
T121429976B5168259F40EB3A016AF3EC95E3B008FB53164CD79EF11B0572E1ACA2FE464
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

infinst.exe

Path C:\Windows\Installer\DX5EDA.tmp\infinst.exe
Size 81KB
SHA256 8c62fe8466d9a24a0f1924de37b05d672a826454804086cddc7ed87c020e67ff
MD5 a7ba8b723b327985ded1152113970819
SHA1 50be557a29f3d2d7300b71ab0ed4831669edd848
SHA512 60702f08fb621bf256b1032e572a842a141cf4219b22f98b27cb1da058b19b44cc37fb8386019463a7469961ca71f48a3347aaf1c74c3636e38d2aea3bca9967
SSDEEP 1536:uOPXfyLm7r2P25504T+kGvNcD9QeZu/FOfNlpaJrxO1wh:usXfyLm7rGo504TzucD9HoIfND8xO1wh
TLSH
T182836B9933A410B9D1AB927CC8E24B05E7B2B496473693CF0368469A5F23BC55D3E733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xinput1_3.dll

Path C:\Windows\Installer\DX5EDA.tmp\xinput1_3.dll
Size 79KB
SHA256 8d540d484ea41e374fd0107d55d253f87ded4ce780d515d8fd59bbe8c98970a7
MD5 77f595dee5ffacea72b135b1fce1312e
SHA1 d2a710b332de3ef7a576e0aed27b0ae66892b7e9
SHA512 a8683050d7758c248052c11ac6a46c9a0b3b3773902cca478c1961b6d9d2d57c75a8c925ba5af4499989c0f44b34eaf57abafafa26506c31e5e4769fb3439746
SSDEEP 1536:TVeqvNS6T6jxeEsU6b0xZtDDVb9X8u9JA7zitdrz/R8cy/FaeBD:TVeqvNOeFgxZ9DVVtRBy/EeD
TLSH
T199835B107480D236D8E361F806FDB714763CD66513A559C32BC4BBEE9EA63C26E3069B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI677A.tmp

Path C:\Windows\Installer\MSI677A.tmp
Size 234KB
SHA256 78860e15e474cc2af7ad6e499a8971b6b8197afb8e49a1b9eaaa392e4378f3a5
MD5 8edc1557e9fc7f25f89ad384d01bcec4
SHA1 98e64d7f92b8254fe3f258e3238b9e0f033b5a9c
SHA512 d26c9dce3c3d17583ffb5dbcd3989f93b096a7f64a37a2701a474c1bf4b8c8b1e922c352d33f24e411f1c793e1b4af11a3aec1de489087d481b1b636df2050cd
SSDEEP 3072:5XiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3:5qhy8VKU3hvZUy+ppHEsuB/
TLSH
T159348D217494547EEBFF0832953AD671AE3DF2380B90C96EC384581E6D618C1A7B7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIA476.tmp

Path C:\Windows\Installer\MSIA476.tmp
Size 346KB
SHA256 f3671fcf0db330b02aab442de2b4a271db6cefc049cacdc307b5188d94218e85
MD5 8810cefad4a12bdfc5fe35f1b3e27253
SHA1 40d7671a5afa80319a1c0b266b2def5f8305bb54
SHA512 b8b87a3a01e4e67536308c609407c1eecbb520f5e031000686d9357ed0561782b330bee7168dd165c810aec05537d76f90895549c01a946f621ef3fac019bc53
SSDEEP 6144:20J39rrXzgzQICh+c1hMdc7k6otPbAKHV0xU:tJJr8Cht1aphPHVb
TLSH
T1E674BF0179D48931F9FE6A395A788A615ABF7C601F70D9CF67480D6A4D307C29A30B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIBAE6.tmp

Path C:\Windows\Installer\MSIBAE6.tmp
Size 240KB
SHA256 9fc54bdf2187c98a381b5c8fd4066bc1c919ce38f03427516bbb22812cd3c2a8
MD5 f2d15dd6c64cb90145ebd3774cf5e050
SHA1 dd939e5d4f0451676d6d4af82b389c80518e66d2
SHA512 72a2bf18a4b64a596ae10b8fdb51e5a31d9c9dd5c9bf8b9299012d5352fda459288eddd4b658e842a74dc7647017255aae27ed7c6d84c871c2fbae17cb6804d6
SSDEEP 3072:DWGtgKq+pO8sIxm/3GIRJEEsczPLuLx1phzBPf59TODPrX5O6+flQ3v19E+7TgG3:DWk9NfG5CnBPPizT5BXw+3s3qUC
TLSH
T177349E217494447EEAFA0832957AD630ADBDF2280B54C9DFC3548C1E5D61AC2B7B3B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomAction.config

Path C:\Windows\Installer\SFXCA39E70047BE4ECEFAAFDA4910FE57835B\CustomAction.config
Size 1KB
SHA256 361f2f5623b1e11403827ffd625c9edc5d7977d584393d6475fc5e6559c3edb7
MD5 3a35350940b2fa2c5a9c57bdb25aae3f
SHA1 f4d32d9e007478c80c23f7b70245d6401550ce6a
SHA512 62756d9247cd6ead152f00d5ff7627e3158e5f0beae00520510830eeb9b1ff5b3a33201bc81240bd31f066198c6b639e3f2cbceb9155c2ce994900ab3a685e8b
TLSH
T18031568E0B05B77711312753BEED90C5DB7561A73C558118349EA9293F36578137338E
MD5 SHA1 SHA512 TLSH

Submit Download

CustomActionManaged.dll

Path C:\Windows\Installer\SFXCA75F7F635C7436F29FB416A137992E5D7\CustomActionManaged.dll
Size 45KB
SHA256 346aa81abd9bdedb24275154c25f73a507c149513ffcc298a57d4cb8060e4245
MD5 f4ada2cae128eb5dd25cadc18d37d325
SHA1 370eb6a596bfb51fd959df24dd8bd8e53d7d938b
SHA512 32e76027f4f59f6534a7f99680c062931b30838dfb0160d36d589c83f2da748587d54d67f6324723aaec531a2562393558aeb497e65abfb7897a450082d82315
SSDEEP 768:TYwGwqKZBbxuoNvPhBYNIl9344gQMMRsz+HTb6:kwq8BbHNHR24gl+sSHTu
TLSH
T19623744267E81A58F2FB5BB96F7A05214B73FC495836D15D044C698E0FBBB808E50B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WixToolset.Dtf.WindowsInstaller.dll

Path C:\Windows\Installer\SFXCA75F7F635C7436F29FB416A137992E5D7\WixToolset.Dtf.WindowsInstaller.dll
Size 193KB
SHA256 dd4120702e4cc794705c0ad23ce1eaa265310ab96064fd23947f6dff38e8e680
MD5 599912457191503b65184f0d35a9dbc9
SHA1 60790092e6249b194732a606ac9dd7ac291f66ce
SHA512 cc07ae732a4cd1ba296a0f388b924c0b0280f2fde201409719087cae0c25fdcaec2af771d1734c64daa80c394832d3261e1675001e90a2fc046fda801833d60f
SSDEEP 3072:UOf7tVL6+Yvj12FuDHYQj69UgoTqddHYCnfKlRUjW01Kyqx3GR8UQQ:UgTex224Qj6jomdT8x2R2Q
TLSH
T166149C2657F8473ECEFF8B78E2A14212C7B1F1E67203D71D5D8281A62163784B692397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Windows\Installer\SFXCACBD8C69B4240ED9A18DC16B7EC7C9D47\Microsoft.Deployment.WindowsInstaller.dll
Size 183KB
SHA256 791da16b0df6956e88b04dab8b543b99dc2abd9af24aa25208fe5a0981e811b3
MD5 c2c83128276cc7c9cccc399bb5d76031
SHA1 776f9ca8175d95d0bc7c44847d60091bdf415041
SHA512 c8651107f699daa299182dbe594da76cd794ba0d7661a483aaa932f0967a3af5761c8e8a3250cb501019d39b483d09427ac75aa7fa3a191a090e226d8d9fd515
SSDEEP 3072:pGfZS7hUuK3PcbFeRRLxyR69UgoCaf8xzCnfKlRUjW01KyPePc:lzMRLkR6joxfKK3
TLSH
T1CC047D2953FC473ACAEF4778E2614261D7B1F2E67117DB0E9C8181BA2522780F792397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e595fd3.msi

Path C:\Windows\Installer\e595fd3.msi
Size 1.2MB
SHA256 18868e9bfc68ba0094a80de498e36d6eeb74abf988ea68104e7458c709e916e6
MD5 be3c47d9947a73bee1ea74e0a216d5ca
SHA1 18cc05d980511e663a97ac6bc6f2ef1cd199c20e
SHA512 7c5da80deb1207fe2600023fd1e7c3df3bc5c4550718daa271d21b70c259561aa0ea5abb805f67053f650ec503865921d226ea3525fa0c5b5b28758b8b053ffd
SSDEEP 24576:TnVz9JHPLnu503MMKZezdaTYyPr+3wqJJvP:jVz9JHPDu503qezd0PPr+3w
TLSH
T11945CF00B6678465D1A639714B15BF3DCB3FBE6247C44A46430BBA4A2DBFDC04B297E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DirectX.log

Path C:\Windows\Logs\DirectX.log
Size 474B
SHA256 566c399bdee59290929bcd2eb50b372b6addb0ffdb54f4f4174c673d4fbdeee3
MD5 52ab1859360b33862368860acc9a9497
SHA1 51f80cd89b3186d82c5a8c81fbfca5a60c602134
SHA512 6120acb2b5445218bf8bf81a477f4229a2173be6d585e7730033e117a240e93f46613813e438da8bc1a35689d4ea9169f65b8db4e07744ab2cbf69dbf3efe0d9
TLSH
T1BBF01CB43AFF04D0650566A79DFBBB52DCDEF2239BDC506F30981A92826021D6D05B07
MD5 SHA1 SHA512 TLSH

Submit Download

DirectX.log

Path C:\Windows\Logs\DirectX.log
Size 12KB
SHA256 02e64d9bdbc57f9f0ecdcbc9f5b868b47ef8ee3d1af72e554c183eb28f7e3433
MD5 eca52ea7b153567bec359133e7bfc0b4
SHA1 690f137cf29cf1c6e3ea0648fec94b972710b73e
SHA512 8fce945016d6c55140c77bf2010c77350afe31f30919dafc4f7b9225791f71cc220f422cf6c38d30ff455f084346181cebfe6eb98ba99a853ff5e58f17a6123e
SSDEEP 96:reyWy0nIDDvoYfSVYz2JMilZpITHb33MEVVJyfzfYfIADpVAD5lzf0PNx+q+6h9e:Pf000
TLSH
T16C42F3BCB917CCB1BA1274498EC95FC3D48FE36B09581226918E9BD0D71875E084EFAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1128-58-0x00000000051B0000-0x00000000051C2000-memory.dmp

Download

memory/1128-54-0x0000000005150000-0x0000000005184000-memory.dmp

Download

memory/4256-6274-0x00000000030C0000-0x00000000030EE000-memory.dmp

Download

memory/4256-6273-0x0000000000DA0000-0x0000000000DA8000-memory.dmp

Download

memory/5656-18-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/5656-27-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/5656-26-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/5656-25-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/5656-34-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/5656-24-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/5656-8-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/5656-0-0x00007FFC1D85F000-0x00007FFC1D860000-memory.dmp

Download

memory/5656-4-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/5656-2-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/5656-1-0x00000255409D0000-0x00000255409DE000-memory.dmp

Download

memory/5656-6307-0x000002555B310000-0x000002555B386000-memory.dmp

Download

memory/5656-6308-0x000002555B290000-0x000002555B2AE000-memory.dmp

Download

memory/5656-6325-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download