Analysis

  • user interaction
    yes
  • max time kernel
    151s
  • max time network
    156s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-es
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-eslocale:es-esos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/09/2026, 19:08

General

  • Target
    launcher.exe
  • Size 29.2MB
  • Sample260905-xs8bcs1bnd
  • SHA256 9701e9018ea96493d4627d22ae623cd4375d0d62143937d39ed47624852ff91a
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\launcher.exe
    "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
    1⤵
    • Downloads MZ/PE file
    • Suspicious use of WriteProcessMemory
    PID:4160
    • C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2928
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:1420

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        DXIED6.tmp

        • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\DXIED6.tmp
        • Size 56KB
        • SHA256 04ca4d428a13e5d09040f736513c0108e96cd7acffcf6cc3e6305af2ab266c58
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dsetup.dll

        • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dsetup.dll
        • Size 93KB
        • SHA256 57bc22850bb8e0bcc511a9b54cd3da18eec61f3088940c07d63b9b74e7fe2308
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dsetup32.dll

        • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dsetup32.dll
        • Size 1.5MB
        • SHA256 8a011da043a4b81e2b3d41a332e0ff23a65d546bd7636e8bc74885e8746927d6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dxupdate.cif

        • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxupdate.cif
        • Size 65KB
        • SHA256 c6c5e877e92d387e977c135765075b7610df2500e21c16e106a225216e6442ae
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dxupdate.dll

        • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxupdate.dll
        • Size 173KB
        • SHA256 fb4f297e295c802b1377c6684734b7249d55743dfb7c14807bef59a1b5db63a2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dxwsetup.cif

        • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.cif
        • Size 56KB
        • SHA256 762ff640013db2bd4109d7df43a867303093815751129bd1e33f16bf02e52cce
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dxwsetup.exe

        • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
        • Size 515KB
        • SHA256 8f5e89298e3dc2e22d47515900c37cca4ee121c5ba06a6d962d40ad6e1a595da
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dxwsetup.inf

        • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.inf
        • Size 477B
        • SHA256 d63c35e9b43eb0f28ffc28f61c9c9a306da9c9de3386770a7eb19faa44dbfc00
        • MD5 SHA1 SHA512 TLSH

        dxwebsetup.exe

        • Path C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        • Size 288KB
        • SHA256 2cf71d098c608c56e07f4655855a886c3102553f648df88458df616b26fd612f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DirectX.log

        • Path C:\Windows\Logs\DirectX.log
        • Size 3KB
        • SHA256 dd39d189bc1b805a252f40ca681533e579c4083c9b27b34ed0207ba5418e049f
        • MD5 SHA1 SHA512 TLSH

        DirectX.log

        • Path C:\Windows\Logs\DirectX.log
        • Size 1KB
        • SHA256 f32e7a328663884337576ad1b0eff93f904bc9ff00b980752aae5a02e176f55d
        • MD5 SHA1 SHA512 TLSH

        DirectX.log

        • Path C:\Windows\Logs\DirectX.log
        • Size 5KB
        • SHA256 f347cb4a0bf2c9f2010a1337bb88663fc108244c884985ccc4fee44a6e72d301
        • MD5 SHA1 SHA512 SSDEEP TLSH

        filelist.dat

        • Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
        • Size 137B
        • SHA256 f960075a7b1c2590e18700f3230f7baea9aced3e6ba5dc93dac193027b5cec48
        • MD5 SHA1 SHA512 TLSH

        filelist.dat

        • Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
        • Size 243B
        • SHA256 c9ebd0c038382084726724ee5203e547bb79c34a99e95bb4e1e9b4bfd8def35d
        • MD5 SHA1 SHA512 TLSH

        filelist.dat

        • Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
        • Size 111B
        • SHA256 e60413bec64775bf1933ef4f9673c8bcfbe0ce71e950fd589bbd14c0f9a00359
        • MD5 SHA1 SHA512 TLSH

        filelist.dat

        • Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
        • Size 384B
        • SHA256 df533eb9e0dbc2d1822963a5de20a7fecf8539e7308eb542653e6dcae9c82bb9
        • MD5 SHA1 SHA512 TLSH

        filelist.dat

        • Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
        • Size 525B
        • SHA256 97d97b1c7f27857c71ad255d8127d6aee07ac9d9ff89cf26122d2b67725245dd
        • MD5 SHA1 SHA512 TLSH

        filelist.dat

        • Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
        • Size 666B
        • SHA256 f62e34af76dd829b4fa111ec5fd14ccf7223e8d8be149ba08c9fbdccd822af91
        • MD5 SHA1 SHA512 TLSH

        filelist.dat

        • Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
        • Size 952B
        • SHA256 a99703529f06346901e4e262d93f1b8c8e4da3e96ca4c071106c4382ca2558c9
        • MD5 SHA1 SHA512 TLSH

        filelist.dat

        • Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
        • Size 1KB
        • SHA256 f926561442ba3d43ee6ea8d4b42588b25d5b8a382577fcd89ee3bf2c263084ae
        • MD5 SHA1 SHA512 TLSH

        filelist.dat

        • Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
        • Size 1KB
        • SHA256 6b38ba9035194a880c460dfd5d48569d6bfedfa099a9931332e79626abf042ee
        • MD5 SHA1 SHA512 TLSH

        filelist.dat

        • Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
        • Size 1KB
        • SHA256 39b61c1336e7bb95487dccaad47d33cff953589c17f51496a95342fcb17f148e
        • MD5 SHA1 SHA512 TLSH

        filelist.dat

        • Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
        • Size 1KB
        • SHA256 f064b65618e11a6fef9253c955c36c8af441113aa7609822f2a02bf48c0ee3ff
        • MD5 SHA1 SHA512 TLSH

        filelist.dat

        • Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
        • Size 1KB
        • SHA256 7c079edb82fb33dbb50e014099db55afb1f338a31b5ee39ac5bc77297195daae
        • MD5 SHA1 SHA512 TLSH

        filelist.dat

        • Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
        • Size 1KB
        • SHA256 101654a7dcc364b91670353a4cd396204207866229ab9be7a648b5f66f9d9fff
        • MD5 SHA1 SHA512 TLSH

        filelist.dat

        • Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
        • Size 1KB
        • SHA256 ebf31697329a1e22e6ab4cc3c97d140fa76366072c518477425779a9288df983
        • MD5 SHA1 SHA512 TLSH

        filelist.dat

        • Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
        • Size 2KB
        • SHA256 13f74a30aba7102226de97797839832b44d9987ce7d23c2c711903a5709b25d4
        • MD5 SHA1 SHA512 TLSH

        filelist.dat

        • Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
        • Size 2KB
        • SHA256 830f7d089d575cbfc227a0db375196a7d8d5078af42884e4582660bb2a4bb767
        • MD5 SHA1 SHA512 TLSH

        filelist.dat

        • Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
        • Size 2KB
        • SHA256 36a9f0b234a4b274ad23d470224dcdab49a81a7f54bea7df9f0247a33a3ebf87
        • MD5 SHA1 SHA512 TLSH

        filelist.dat

        • Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
        • Size 2KB
        • SHA256 6086fba7481b45b503e2d892ff5dad13f5fb347374919a2764371b1efef49099
        • MD5 SHA1 SHA512 TLSH

        filelist.dat

        • Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
        • Size 2KB
        • SHA256 58fad17da80f0ab474f029b87f3b02d33876d4f098a9aa4f0923af347493c457
        • MD5 SHA1 SHA512 TLSH

        filelist.dat

        • Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
        • Size 2KB
        • SHA256 95c5c1cd8a611b120d9679dee736734d5577f16b55b41de8bff677b5f9bc671a
        • MD5 SHA1 SHA512 TLSH

        filelist.dat

        • Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
        • Size 2KB
        • SHA256 f19333bf7528ed3ba989e5275f57d2b606689aeb748efdcdca218753044415fe
        • MD5 SHA1 SHA512 TLSH

        filelist.dat

        • Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
        • Size 3KB
        • SHA256 35b2248915becaea7f1fea2fdde13aa5d71d6e762a7eed1d275f88f8b34449b5
        • MD5 SHA1 SHA512 TLSH

        filelist.dat

        • Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
        • Size 3KB
        • SHA256 8e781f69d16f7836dfadd36f83c68c601580bec6de797d4ee64a48737d31e5ae
        • MD5 SHA1 SHA512 TLSH

        filelist.dat

        • Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
        • Size 3KB
        • SHA256 d3a15b921d27ceb8d84477506f951082fbbd796e0fde794aedf2211628cfa955
        • MD5 SHA1 SHA512 TLSH

        filelist.dat

        • Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
        • Size 3KB
        • SHA256 5d455aec145c442f759e0b4464ba5eb8b10b2df1cc4801d0ec134c77a2a9295c
        • MD5 SHA1 SHA512 TLSH

        filelist.dat

        • Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
        • Size 3KB
        • SHA256 5f31262fbc7876338e63845e7dbbac366dbd1e2d9efdd062f07dba4c1f225239
        • MD5 SHA1 SHA512 TLSH

        filelist.dat

        • Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
        • Size 3KB
        • SHA256 696b358cad689b95026aedf733f462fdf565e21bb41b23652fba21216ed78d43
        • MD5 SHA1 SHA512 TLSH

        filelist.dat

        • Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
        • Size 3KB
        • SHA256 cb58110c6d731f63ec93d03536358ad0b4ad2d65a8cab2e9f7a62266cb5a1ddc
        • MD5 SHA1 SHA512 TLSH

        filelist.dat

        • Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
        • Size 4KB
        • SHA256 57bc21b86044daf245e01b6e546994ae1ae05a5d7f9c4bf4f82f6f3435935514
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dxupdate.cab

        • Path C:\Windows\msdownld.tmp\AS5A0AA6.tmp\dxupdate.cab
        • Size 98KB
        • SHA256 6e39b3fdb6722ea8aa0dc8f46ae0d8bd6496dd0f5f56bac618a0a7dd22d6cfb2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Apr2006_xinput_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5A9B9B.tmp\Apr2006_xinput_x86.cab
        • Size 48KB
        • SHA256 3fdf63211b0dd38069a9c1df74d7bc42742de003cef72ad1486aaa92d74546fa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Apr2006_xinput_x64.cab

        • Path C:\Windows\msdownld.tmp\AS5A9C76.tmp\Apr2006_xinput_x64.cab
        • Size 88KB
        • SHA256 e63a67783ef7624559f95ab697bf8afbdab7ace31200283ef840e6b94aa16e5a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Aug2006_xinput_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5A9D70.tmp\Aug2006_xinput_x86.cab
        • Size 48KB
        • SHA256 6dd7c0abe37d3df7aa6db7bb352260f4a15dc965ff9d30aa32fe9595c1a18300
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Aug2006_xinput_x64.cab

        • Path C:\Windows\msdownld.tmp\AS5A9E3B.tmp\Aug2006_xinput_x64.cab
        • Size 88KB
        • SHA256 c26633d38e0a91b9be70382e916a83d50e219609f7e05cfb2d27dfafbe480b43
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Dec2006_d3dx10_00_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5A9F35.tmp\Dec2006_d3dx10_00_x86.cab
        • Size 190KB
        • SHA256 02daa8b5ac3752f76c3bfd9a505ebf22b1b4b41e44eb92ce2799033b2330d186
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Dec2006_d3dx10_00_x64.cab

        • Path C:\Windows\msdownld.tmp\AS5AA05E.tmp\Dec2006_d3dx10_00_x64.cab
        • Size 210KB
        • SHA256 f9bd5bb083bd55d1d2a690bc66d6d9da0b1a8b49f09e811e788c030669121118
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Apr2007_xinput_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5AA187.tmp\Apr2007_xinput_x86.cab
        • Size 55KB
        • SHA256 b6c1166c57d91afeeeaa745238d0d6465ff2084f0606fd29faf1bfa9e008a6c5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Apr2007_xinput_x64.cab

        • Path C:\Windows\msdownld.tmp\AS5AA281.tmp\Apr2007_xinput_x64.cab
        • Size 97KB
        • SHA256 86ee073c199b5080fe4f5be6ac24bb1117fea42e4bbcd828b4f0ec26c669b22c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Feb2005_d3dx9_24_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5AA36B.tmp\Feb2005_d3dx9_24_x86.cab
        • Size 992KB
        • SHA256 3d4e48874bddcd739cf79bf2b3fd195d7c3e861f738dc2eab19f347545f83068
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Apr2005_d3dx9_25_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5AA58E.tmp\Apr2005_d3dx9_25_x86.cab
        • Size 1.0MB
        • SHA256 5487ed4e969a822e5c481cefb1d4da3066b1d5ec8c55798b246915ecb58a8665
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Jun2005_d3dx9_26_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5AA938.tmp\Jun2005_d3dx9_26_x86.cab
        • Size 1.0MB
        • SHA256 c44eabf5be3b87cd845950670c27f6a1e5d92b7758ba7c39c7849b1ee1c649c0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Aug2005_d3dx9_27_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5AAB5B.tmp\Aug2005_d3dx9_27_x86.cab
        • Size 1.0MB
        • SHA256 8c062b22dc2814d4f426827b4bf8cfd95989fd986fb3aaa23438a485ee748d6d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Dec2005_d3dx9_28_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5AAD8D.tmp\Dec2005_d3dx9_28_x86.cab
        • Size 1.0MB
        • SHA256 645f8d90b07c69330a8c7c8912d70538411c9a6b2813048da8ad3c3119487f93
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Feb2006_d3dx9_29_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5AAF81.tmp\Feb2006_d3dx9_29_x86.cab
        • Size 1.0MB
        • SHA256 4114e76799af3da9db3dae51305dad70a05b757e506e4a327092d536cca7ee75
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Apr2006_d3dx9_30_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5AB1C3.tmp\Apr2006_d3dx9_30_x86.cab
        • Size 1.1MB
        • SHA256 ca7b9c6a49e986c350147f00a6c95c5b577847b5667b75681a1ee15e3a189106
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Oct2006_d3dx9_31_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5AB434.tmp\Oct2006_d3dx9_31_x86.cab
        • Size 1.1MB
        • SHA256 4891e2dea9d1798f6a89308e58c61a38e612f8433301ea2376ae14c3dfcb3021
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Dec2006_d3dx9_32_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5AB638.tmp\Dec2006_d3dx9_32_x86.cab
        • Size 1.5MB
        • SHA256 a1cc7603302ee53d54f4353c223d95e223706924d99b864220b13814ef93eefb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Apr2007_d3dx9_33_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5AB88A.tmp\Apr2007_d3dx9_33_x86.cab
        • Size 1.5MB
        • SHA256 efa2e6de548401376a575e83a79de019aa38f191d63fdef3bd2b07d8cb33e3d7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Apr2007_d3dx10_33_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5ABB58.tmp\Apr2007_d3dx10_33_x86.cab
        • Size 682KB
        • SHA256 949068035ce57bbb3658217ec04f8de7a122c6e7857b6f8b0ca002eb573df553
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Jun2007_d3dx9_34_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5ABCC0.tmp\Jun2007_d3dx9_34_x86.cab
        • Size 1.5MB
        • SHA256 1c1e1c6f68ba556a0af09a38c32eb421c543a4848c4b42d25867c98dab3b3a50
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Jun2007_d3dx10_34_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5ABF60.tmp\Jun2007_d3dx10_34_x86.cab
        • Size 685KB
        • SHA256 8ec971c91040618338ac2369188f3e5d7c85a5b1e3b9fc8e752dd845d295cdba
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Aug2007_d3dx9_35_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5AC115.tmp\Aug2007_d3dx9_35_x86.cab
        • Size 1.6MB
        • SHA256 4914d2b5c3251b00c0cc236f51afe469728d92b50c953c66d213f079ac928eac
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Aug2007_d3dx10_35_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5AC3D4.tmp\Aug2007_d3dx10_35_x86.cab
        • Size 781KB
        • SHA256 9536166ee7cc1100cfe24e01532e8e4deed6baa838b4c025581f2ca046a25915
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Nov2007_d3dx9_36_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5AC55B.tmp\Nov2007_d3dx9_36_x86.cab
        • Size 1.6MB
        • SHA256 f52cc1304b533083b3fc5553c49433c0e4e46d66d567b9de0b558ca518db1544
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Nov2007_d3dx10_36_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5AC81A.tmp\Nov2007_d3dx10_36_x86.cab
        • Size 788KB
        • SHA256 bdf7fb01c02783a4f8c9f5e7911f5cae3e2a7cbc425b90b36f9ea6eef2c27de3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Mar2008_d3dx9_37_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5AC9FE.tmp\Mar2008_d3dx9_37_x86.cab
        • Size 1.4MB
        • SHA256 91a50d9efcdfbcdf22a91d6fbb0f50d3c2aa75f926d05cc166020bf7aaf30e28
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Mar2008_d3dx10_37_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5ACC31.tmp\Mar2008_d3dx10_37_x86.cab
        • Size 802KB
        • SHA256 6a2727269e6cac7c4d2e316333d29bac0dc1cd7f51c36c0c08b0388203dedad2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Jun2008_d3dx9_38_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5ACDD7.tmp\Jun2008_d3dx9_38_x86.cab
        • Size 1.4MB
        • SHA256 57e57a6348e55aaaca6bed5e27bbdd0a4bd0dde69c77f4d26c805be6384be927
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Jun2008_d3dx10_38_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5AD019.tmp\Jun2008_d3dx10_38_x86.cab
        • Size 833KB
        • SHA256 e8dc1063c9434eed8d633741b19cdfa1889581041e2214b87b5159e3ea087f3c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Aug2008_d3dx9_39_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5AD21D.tmp\Aug2008_d3dx9_39_x86.cab
        • Size 1.4MB
        • SHA256 61e703e8d231412f135b4aba629122d9cb69ac9ee39fa3cbbe6b95de05097a8b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Aug2008_d3dx10_39_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5AD430.tmp\Aug2008_d3dx10_39_x86.cab
        • Size 832KB
        • SHA256 84800c55f773d5d6913e344e41baba58cf07cec2e6c7114ca3bf48e8f355419f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Nov2008_d3dx9_40_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5AD5D6.tmp\Nov2008_d3dx9_40_x86.cab
        • Size 1.5MB
        • SHA256 863ac3438f57158d4f53900c6924bfdc132ab43a5af57d4658e65842836b4fa1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Nov2008_d3dx10_40_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5AD847.tmp\Nov2008_d3dx10_40_x86.cab
        • Size 945KB
        • SHA256 ec52b075a3e9c7fe468b317e0ff977964b1003d560065128741f4392bf47c49a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Mar2009_d3dx9_41_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5ADA1B.tmp\Mar2009_d3dx9_41_x86.cab
        • Size 1.5MB
        • SHA256 32356344aeddf709c9d5302d8f3fcc1ff1be2e82d8d17833a2086400af248794
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Mar2009_d3dx10_41_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5ADCCB.tmp\Mar2009_d3dx10_41_x86.cab
        • Size 1019KB
        • SHA256 b7da29103cdf374de0c09713cb985035eac45fb8b394d3b8157d8a7562a89899
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Aug2009_d3dx9_42_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5ADEFD.tmp\Aug2009_d3dx9_42_x86.cab
        • Size 714KB
        • SHA256 9c96b6fc4df5c0efca9f0d653976772b2b964243214f99066e4ca4aa6df791dd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Aug2009_d3dx10_42_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5AE0C3.tmp\Aug2009_d3dx10_42_x86.cab
        • Size 190KB
        • SHA256 bb46189eb8cb7769eb7be00cfbc35902072fa9408313ef53f423e5ae5c728f61
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Aug2009_d3dx11_42_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5AE1CC.tmp\Aug2009_d3dx11_42_x86.cab
        • Size 105KB
        • SHA256 39ff69ba9161d376c035d31023d2fdeecb9148a2439abe3afd8f608f7e05e09b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Aug2009_d3dcsx_42_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5AE2D6.tmp\Aug2009_d3dcsx_42_x86.cab
        • Size 3.2MB
        • SHA256 a9a704b73531d6bf59a421ab5c046c19a16d2b0b07f09816dbe9da4550a24b17
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Aug2009_D3DCompiler_42_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5AE8A2.tmp\Aug2009_D3DCompiler_42_x86.cab
        • Size 882KB
        • SHA256 6bd32337826f5a5141fc06391919a249e984150905c2546dc8bfc33d41a24e82
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Jun2010_d3dx9_43_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5AEAB5.tmp\Jun2010_d3dx9_43_x86.cab
        • Size 753KB
        • SHA256 457c5ce48eaa0fe551b46dffc1e4dca985d261686d8d4e6bced533ee1f682fce
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Jun2010_d3dx10_43_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5AECD8.tmp\Jun2010_d3dx10_43_x86.cab
        • Size 195KB
        • SHA256 f0bc06ceb484d97cf01526f9223df7b4357d166c4391869f2e7d514dc1fe769b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Jun2010_d3dx11_43_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5AEE01.tmp\Jun2010_d3dx11_43_x86.cab
        • Size 110KB
        • SHA256 b80db68cd82caf8bedaee62808171b20c546a76499c3ad53014e3bd2fbd2918d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Jun2010_d3dcsx_43_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5AEEEC.tmp\Jun2010_d3dcsx_43_x86.cab
        • Size 747KB
        • SHA256 799b517227812252481c9c9b22cf16ff185ffc20b9273612c8a37153b53aad93
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Jun2010_D3DCompiler_43_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5AF072.tmp\Jun2010_D3DCompiler_43_x86.cab
        • Size 912KB
        • SHA256 293ced557ad732abd2737333df39b08216f31601d7ab65b743fe51b4efb8b6f0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Feb2005_d3dx9_24_x64.cab

        • Path C:\Windows\msdownld.tmp\AS5AF2F3.tmp\Feb2005_d3dx9_24_x64.cab
        • Size 1.2MB
        • SHA256 be3de63f136a2b41d3229e477ce2cd7f67ded031b4b370e640c39b80368238cf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Apr2005_d3dx9_25_x64.cab

        • Path C:\Windows\msdownld.tmp\AS5AF564.tmp\Apr2005_d3dx9_25_x64.cab
        • Size 1.3MB
        • SHA256 a239e99d02fbfc9d30d5b705aa743fc070386faea1a66b3d67099ab446568a12
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Jun2005_d3dx9_26_x64.cab

        • Path C:\Windows\msdownld.tmp\AS5AF787.tmp\Jun2005_d3dx9_26_x64.cab
        • Size 1.3MB
        • SHA256 794e23d8b08f88bb0d339825b3628c24cd0297195657f9871ee6324786fada36
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Aug2005_d3dx9_27_x64.cab

        • Path C:\Windows\msdownld.tmp\AS5AF9D8.tmp\Aug2005_d3dx9_27_x64.cab
        • Size 1.3MB
        • SHA256 3500c1a7cfb5594521338d1c29946d1e4ffa44d5b6bc6cf347c5bbbde18e94dc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Dec2005_d3dx9_28_x64.cab

        • Path C:\Windows\msdownld.tmp\AS5AFCD6.tmp\Dec2005_d3dx9_28_x64.cab
        • Size 1.3MB
        • SHA256 daf10a54089755f9a8aceff0c7695f1aa42d35e3179da5b9bb91e409036ae547
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Feb2006_d3dx9_29_x64.cab

        • Path C:\Windows\msdownld.tmp\AS5AFF95.tmp\Feb2006_d3dx9_29_x64.cab
        • Size 1.3MB
        • SHA256 a5ffaf9d58da5d79402c4dc93e79960f971d2701d4651bb33d18925af641f11d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Feb2006_xact_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5B02D1.tmp\Feb2006_xact_x86.cab
        • Size 132KB
        • SHA256 6456fc26622f3a72b9449ed0e61874cf1adba23cccbfcda1324f033fe0788fda
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Feb2006_xact_x64.cab

        • Path C:\Windows\msdownld.tmp\AS5B03DB.tmp\Feb2006_xact_x64.cab
        • Size 177KB
        • SHA256 c91a6380c65853e41e2f9593b954f3b5af49bcc894476d8eb78cd9f8b6dd7da4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Apr2006_d3dx9_30_x64.cab

        • Path C:\Windows\msdownld.tmp\AS5B04F4.tmp\Apr2006_d3dx9_30_x64.cab
        • Size 1.3MB
        • SHA256 27d99894e2a68601f46487c9999723dc83bcc9c6f903f2e2622d05668035b015
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Apr2006_xact_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5B0756.tmp\Apr2006_xact_x86.cab
        • Size 133KB
        • SHA256 52c71c89ccc22fed3d7c985a22c464451af34b63b3a26a3799bc25d881221ebc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Apr2006_xact_x64.cab

        • Path C:\Windows\msdownld.tmp\AS5B085F.tmp\Apr2006_xact_x64.cab
        • Size 178KB
        • SHA256 f82b2043b470bf0e711c3d05d758a379920340212437917b5d98af0c14e7bfe0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Jun2006_xact_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5B0959.tmp\Jun2006_xact_x86.cab
        • Size 133KB
        • SHA256 23495764aba10ff35cf9d23aeeffdf38716219d8a155ae29162f01f7fe6a30cf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Jun2006_xact_x64.cab

        • Path C:\Windows\msdownld.tmp\AS5B0A34.tmp\Jun2006_xact_x64.cab
        • Size 179KB
        • SHA256 5163afa067fe2f076ab428dd368ba0a2cf6470457ba528a35e97be40737a03c0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Aug2006_xact_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5B0B4D.tmp\Aug2006_xact_x86.cab
        • Size 137KB
        • SHA256 31b16f93be7f5f9bb78e9ece6da96565d50a0bc1f66b206b7a21c601a308dc53
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Aug2006_xact_x64.cab

        • Path C:\Windows\msdownld.tmp\AS5B0C57.tmp\Aug2006_xact_x64.cab
        • Size 181KB
        • SHA256 13e7eb934a7596e7c3b7d8a0962e68da841d9c73d154825dc982ff6d05cff221
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Oct2006_d3dx9_31_x64.cab

        • Path C:\Windows\msdownld.tmp\AS5B0D70.tmp\Oct2006_d3dx9_31_x64.cab
        • Size 1.4MB
        • SHA256 4f5cffa56fd44f7775f12fc511a1e3f030c05ac78484f6866b12b82979067c22
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Oct2006_xact_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5B103F.tmp\Oct2006_xact_x86.cab
        • Size 137KB
        • SHA256 f6b6ebc9c239c5263aafaa63fd691da5aa715e9c794d5fd663e86559d5c6ae56
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Oct2006_xact_x64.cab

        • Path C:\Windows\msdownld.tmp\AS5B1139.tmp\Oct2006_xact_x64.cab
        • Size 181KB
        • SHA256 662d4e5d005cdba02fabb0d7a68a7b48ecafdebe21718d892833d5c482e5add7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Dec2006_d3dx9_32_x64.cab

        • Path C:\Windows\msdownld.tmp\AS5B1242.tmp\Dec2006_d3dx9_32_x64.cab
        • Size 1.5MB
        • SHA256 da1ce01be39f41f967282849715e8310dc1887bfeb92c4e0166d2c31f00647f7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Dec2006_xact_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5B14C3.tmp\Dec2006_xact_x86.cab
        • Size 145KB
        • SHA256 b98e55c654b9ee6f6d040665d932bea7a1299c56cc9996eea900ac4f5649c7d3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Dec2006_xact_x64.cab

        • Path C:\Windows\msdownld.tmp\AS5B15CD.tmp\Dec2006_xact_x64.cab
        • Size 191KB
        • SHA256 bdaf9c41f83e65de2b73aaca2002541d48c65f551cfa0578b3259d3bfca54ead
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Feb2007_xact_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5B16E6.tmp\Feb2007_xact_x86.cab
        • Size 147KB
        • SHA256 0e3655490667ddf17150aec089889268bdd7f1e8367d2bed6f3eb68a5ff28288
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Feb2007_xact_x64.cab

        • Path C:\Windows\msdownld.tmp\AS5B17F0.tmp\Feb2007_xact_x64.cab
        • Size 193KB
        • SHA256 3454d5101716a5c17bcdee8632668d981f99e8558d8d05e20a33ed718ed8c2ac
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Apr2007_d3dx9_33_x64.cab

        • Path C:\Windows\msdownld.tmp\AS5B1909.tmp\Apr2007_d3dx9_33_x64.cab
        • Size 1.5MB
        • SHA256 3ca2acf6b952d6438b91e540f39abcb93ee12e340ba1302f7406f01568e5cf91
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Apr2007_d3dx10_33_x64.cab

        • Path C:\Windows\msdownld.tmp\AS5B1B7A.tmp\Apr2007_d3dx10_33_x64.cab
        • Size 685KB
        • SHA256 1a37565c5b868b6a5c67f3e24b8af547506799444cb77c7086e7b0cec852f239
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Apr2007_xact_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5B1CF1.tmp\Apr2007_xact_x86.cab
        • Size 150KB
        • SHA256 39f970bf4cc42e9325ada84a603c6c691bf94921385a52325f402f7432ace697
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Apr2007_xact_x64.cab

        • Path C:\Windows\msdownld.tmp\AS5B1DFA.tmp\Apr2007_xact_x64.cab
        • Size 194KB
        • SHA256 7781f0494648989583d4ac7695b9c5310eea76b6a102e15ea0fc7376250e4584
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Jun2007_d3dx9_34_x64.cab

        • Path C:\Windows\msdownld.tmp\AS5B1F14.tmp\Jun2007_d3dx9_34_x64.cab
        • Size 1.5MB
        • SHA256 fe4b15931e048c97cbbc26f753093e7d41eccf174402542631284f8bdb9ee692
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Jun2007_d3dx10_34_x64.cab

        • Path C:\Windows\msdownld.tmp\AS5B21D3.tmp\Jun2007_d3dx10_34_x64.cab
        • Size 685KB
        • SHA256 02ed1b5a850edb52ec174de177e91842edc7c5f4c06ceda5b16f3427dbcd4c99
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Jun2007_xact_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5B2359.tmp\Jun2007_xact_x86.cab
        • Size 152KB
        • SHA256 245b0c554cbe2677939a70e5c4c6666b1b43d10d47980223f8cdeadb2d0eb76b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Jun2007_xact_x64.cab

        • Path C:\Windows\msdownld.tmp\AS5B2453.tmp\Jun2007_xact_x64.cab
        • Size 195KB
        • SHA256 3f2ca0accef2594fb014296f4111b7fbb59729c5d928b22f7283c392494fee7c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Aug2007_d3dx9_35_x64.cab

        • Path C:\Windows\msdownld.tmp\AS5B256D.tmp\Aug2007_d3dx9_35_x64.cab
        • Size 1.7MB
        • SHA256 28b6ff092de67717c47649c87e7114c34325edda199ce2943403c4f3f4c3e0b2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Aug2007_d3dx10_35_x64.cab

        • Path C:\Windows\msdownld.tmp\AS5B282C.tmp\Aug2007_d3dx10_35_x64.cab
        • Size 835KB
        • SHA256 c97275f60e2f25732b3b264b8bdf9cfdaa39d6e5b189c08fab5cd7a04fae9bf7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Aug2007_xact_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5B29D2.tmp\Aug2007_xact_x86.cab
        • Size 152KB
        • SHA256 c35652b18c6a2d108812f415ddd435ce0eef5489e37142300ba67d66986ef43c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Aug2007_xact_x64.cab

        • Path C:\Windows\msdownld.tmp\AS5B2ABC.tmp\Aug2007_xact_x64.cab
        • Size 196KB
        • SHA256 e8ef9c88a6b958916c1959d1c6c7f1666d22e0f70ce8a8c83183f49ed71f6287
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Nov2007_d3dx9_36_x64.cab

        • Path C:\Windows\msdownld.tmp\AS5B2BB6.tmp\Nov2007_d3dx9_36_x64.cab
        • Size 1.7MB
        • SHA256 23ad953d03c9da720002834eddabe71bd649dc9cd31abc7a09a8e77a948414c5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Nov2007_d3dx10_36_x64.cab

        • Path C:\Windows\msdownld.tmp\AS5B2E94.tmp\Nov2007_d3dx10_36_x64.cab
        • Size 847KB
        • SHA256 bee9bec21771bc5365847be692e785ea619d625df629981a167429df6f0cc9cc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Nov2007_x3daudio_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5B303A.tmp\Nov2007_x3daudio_x86.cab
        • Size 21KB
        • SHA256 90f472ed8b0beeea5db1b462da44577160337c767b27ce70ed58d68d0a03e7a8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Nov2007_x3daudio_x64.cab

        • Path C:\Windows\msdownld.tmp\AS5B3105.tmp\Nov2007_x3daudio_x64.cab
        • Size 48KB
        • SHA256 122e09bbf46b3c3edae6c28ad060482dac24d4331c682fe0231cc5b6fb53c5e8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Nov2007_xact_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5B31E0.tmp\Nov2007_xact_x86.cab
        • Size 147KB
        • SHA256 6dcb9461eab4aceb999784ecd74d985b3543899542ffd66203929f409c70c8d8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Nov2007_xact_x64.cab

        • Path C:\Windows\msdownld.tmp\AS5B32BB.tmp\Nov2007_xact_x64.cab
        • Size 195KB
        • SHA256 9fa6f4116a4eb1e72f75cbdcb2e34198a243d169276d4f493ecb8a9dff3722d4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Mar2008_d3dx9_37_x64.cab

        • Path C:\Windows\msdownld.tmp\AS5B33D4.tmp\Mar2008_d3dx9_37_x64.cab
        • Size 1.7MB
        • SHA256 7ef2e2a5d4843f58b3eaca34f5a9c63e9abfa726a3244b762a6de70bb9a95123
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Mar2008_d3dx10_37_x64.cab

        • Path C:\Windows\msdownld.tmp\AS5B3636.tmp\Mar2008_d3dx10_37_x64.cab
        • Size 828KB
        • SHA256 6aff708a5bc25b4ecee972f930293324f86bc45dc97d687dab782108606c5902
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Mar2008_x3daudio_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5B3839.tmp\Mar2008_x3daudio_x86.cab
        • Size 24KB
        • SHA256 1ababdfd6ca26f1c56f618f8c9f90dbc063d964bfa31caa787b0a8a1bee519be
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Mar2008_x3daudio_x64.cab

        • Path C:\Windows\msdownld.tmp\AS5B3904.tmp\Mar2008_x3daudio_x64.cab
        • Size 56KB
        • SHA256 312c2dfd80126d25a1cfab0fadf5c99bf1f81b404e121afec908f5b5d04529a2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Mar2008_xact_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5B39DF.tmp\Mar2008_xact_x86.cab
        • Size 94KB
        • SHA256 d2140d9b4420b022d6e6135a67029033b5b0ec083893eceadd1007eee41ef4cd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Mar2008_xact_x64.cab

        • Path C:\Windows\msdownld.tmp\AS5B3AC9.tmp\Mar2008_xact_x64.cab
        • Size 122KB
        • SHA256 b6f81e365b7fc224f66bd6560e5040dabc9370b3f21f9bd85728349200dd7632
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Mar2008_xaudio_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5B3BA4.tmp\Mar2008_xaudio_x86.cab
        • Size 224KB
        • SHA256 bce9c695d24972eacef357da0f83ab9d9cce2ee9a46176ffffad3a0abd64f48f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Mar2008_xaudio_x64.cab

        • Path C:\Windows\msdownld.tmp\AS5B3CCD.tmp\Mar2008_xaudio_x64.cab
        • Size 248KB
        • SHA256 e9a2e00f9c96bd5c91c4ae069c1c2ef6451e0207e8c18074f14d0d0ac08301fa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Jun2008_d3dx9_38_x64.cab

        • Path C:\Windows\msdownld.tmp\AS5B3E06.tmp\Jun2008_d3dx9_38_x64.cab
        • Size 1.7MB
        • SHA256 f33a6b6ef55bd4e75a2e67d269b917fa6113f2b1c9b745b19d3ce6a6365d1cfc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Jun2008_d3dx10_38_x64.cab

        • Path C:\Windows\msdownld.tmp\AS5B4151.tmp\Jun2008_d3dx10_38_x64.cab
        • Size 850KB
        • SHA256 a75a8109e3b4ce2a805555577d45853bc2e67451ba287b45aa3ce4ca14ce87b7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Jun2008_x3daudio_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5B4316.tmp\Jun2008_x3daudio_x86.cab
        • Size 24KB
        • SHA256 75f048bc8261c1877126a82d3e7983f22f830596eefeaffb799947d9a13afd51
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Jun2008_x3daudio_x64.cab

        • Path C:\Windows\msdownld.tmp\AS5B43E2.tmp\Jun2008_x3daudio_x64.cab
        • Size 56KB
        • SHA256 7363590b33717a0c2e07f3b2dceb3689a526b255f29c84092022a37bf6e9b9c1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Jun2008_xact_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5B44AD.tmp\Jun2008_xact_x86.cab
        • Size 94KB
        • SHA256 fa86c9d133cc5ca499b1f57d52a6024cae3f5605ff0e5bc466f07e3f7bac121c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Jun2008_xact_x64.cab

        • Path C:\Windows\msdownld.tmp\AS5B4597.tmp\Jun2008_xact_x64.cab
        • Size 121KB
        • SHA256 09e15921b2a8204235c7128b804f26e72599f05f55005bd29fdb05da8c812460
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Jun2008_xaudio_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5B4662.tmp\Jun2008_xaudio_x86.cab
        • Size 265KB
        • SHA256 6d128830655e6cc400c1677ad91341e7b69f3d3f5acf32bc44ed2a32b5e776eb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Jun2008_xaudio_x64.cab

        • Path C:\Windows\msdownld.tmp\AS5B478B.tmp\Jun2008_xaudio_x64.cab
        • Size 266KB
        • SHA256 7679e7b1e03399a5d0d7b802308ee1503a9c5c59935d16c330db760876bfb37c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Aug2008_d3dx9_39_x64.cab

        • Path C:\Windows\msdownld.tmp\AS5B48C4.tmp\Aug2008_d3dx9_39_x64.cab
        • Size 1.7MB
        • SHA256 03f30dd485a82b6505a881f525e432bb84447e108bf086ef341a39951a1863ed
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Aug2008_d3dx10_39_x64.cab

        • Path C:\Windows\msdownld.tmp\AS5B4B73.tmp\Aug2008_d3dx10_39_x64.cab
        • Size 850KB
        • SHA256 c6602fb00efe93ea7875e29974c073b4f83991bfc064470de94a95dbacd51712
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Aug2008_xact_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5B4D38.tmp\Aug2008_xact_x86.cab
        • Size 93KB
        • SHA256 736b3c20aa536c1569465badec5bffda858978b2d9ec1e48ad639ccde301d6f6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Aug2008_xact_x64.cab

        • Path C:\Windows\msdownld.tmp\AS5B4E32.tmp\Aug2008_xact_x64.cab
        • Size 122KB
        • SHA256 1b640b0022c876f74a41db17672bb0685b74d3759a7818f84c8ffc51a9aa0d51
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Aug2008_xaudio_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5B4F2C.tmp\Aug2008_xaudio_x86.cab
        • Size 267KB
        • SHA256 a1550abc06e39ca576d24efd2801d139c64c7dce643246a7ddf2de2d03a7ba23
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Aug2008_xaudio_x64.cab

        • Path C:\Windows\msdownld.tmp\AS5B5045.tmp\Aug2008_xaudio_x64.cab
        • Size 268KB
        • SHA256 42807ba4736a40b7bb9b4b558c0daffd2ca75987dafe47a6571f3c45f178d29e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Nov2008_x3daudio_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5B514F.tmp\Nov2008_x3daudio_x86.cab
        • Size 24KB
        • SHA256 8fbe56582e93b3277caf8660f689cc9e9fa6a33056d40a88d48f669a005430cb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Nov2008_x3daudio_x64.cab

        • Path C:\Windows\msdownld.tmp\AS5B522A.tmp\Nov2008_x3daudio_x64.cab
        • Size 56KB
        • SHA256 4da03f7a174d276dbbbe469c12670fa85fe247428fd5033e93ccc3ae4d5f84da
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Nov2008_xact_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5B5305.tmp\Nov2008_xact_x86.cab
        • Size 93KB
        • SHA256 3e804174d83cf4908cce7aac97756541a58c16372368904a253d10d64fb4d2a2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Nov2008_xact_x64.cab

        • Path C:\Windows\msdownld.tmp\AS5B53DF.tmp\Nov2008_xact_x64.cab
        • Size 122KB
        • SHA256 636f4829ebbf2e9a1ebe572a0f0b7f8289089339cc38c7075f48fe4930134cc2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Nov2008_xaudio_x86.cab

        • Path C:\Windows\msdownld.tmp\AS5B54D9.tmp\Nov2008_xaudio_x86.cab
        • Size 269KB
        • SHA256 cad128dc2e64a47f65bb44f43a5a0650b045a5dae34ce13f34817642c56e4721
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Nov2008_xaudio_x64.cab

        • Path C:\Windows\msdownld.tmp\AS5B5602.tmp\Nov2008_xaudio_x64.cab
        • Size 270KB
        • SHA256 63229aa8bd8e675b292c263fcad6b7868394ad29987d3f4db55f618359cb0681
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/4160-5-0x0000000140000000-0x00000001439F6000-memory.dmp

        memory/4160-0-0x0000000140000000-0x00000001439F6000-memory.dmp

        memory/4160-1-0x0000000140879000-0x0000000141CC3000-memory.dmp