8162b2d665ca52884507ede19549e99939ce4ea4a638c537fa653539819138c8

Analysis

user interaction
yes
max time kernel
756s
max time network
789s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 07:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
Geometry.Dash.v2.2081/Geometry.Dash.v2.2081/_Redist/vcredist_x86.exe
Size 4.8MB
Sample260910-jasw3asxft
SHA256 8162b2d665ca52884507ede19549e99939ce4ea4a638c537fa653539819138c8
MD5 b88228d5fef4b6dc019d69d4471f23ec
SHA1 372d9c1670343d3fb252209ba210d4dc4d67d358
SHA512 cdd218d211a687dde519719553748f3fb36d4ac618670986a6dadb4c45b34a9c6262ba7bab243a242f91d867b041721f22330170a74d4d0b2c354aec999dbff8
SSDEEP 98304:RuLgywiN1ah6HcG0UJrN7SDgndrHZDMeaNNjt0CKKBgY2r71pZ/APaOR72HgQo0z:I7wq1W6HqULS8djZDTaNNeCKVP5ORsg0
TLSH
T1D3363341B7A660F9D20778B256377FDB1C28C2CC7B28130AA365E5E87ADB7C08355798
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation ransomware

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 64 IoCs

pid	Process
1328	Setup.exe
3208	Setup.exe
3720	dxwsetup.exe
5056	vcredist_2015-2019_x64.exe
3168	vcredist_2015-2019_x86.exe
9140	infinst.exe
9192	infinst.exe
6304	infinst.exe
6032	infinst.exe
1152	infinst.exe
5788	infinst.exe
2576	infinst.exe
7028	infinst.exe
6312	infinst.exe
8500	infinst.exe
5468	infinst.exe
7000	infinst.exe
8608	infinst.exe
7920	infinst.exe
5964	infinst.exe
4908	infinst.exe
5476	infinst.exe
3036	infinst.exe
2576	infinst.exe
7424	infinst.exe
7468	infinst.exe
8604	infinst.exe
6516	infinst.exe
8104	infinst.exe
7432	infinst.exe
7872	infinst.exe
2852	infinst.exe
7704	infinst.exe
6216	infinst.exe
2196	infinst.exe
740	infinst.exe
4692	infinst.exe
928	infinst.exe
880	infinst.exe
8856	infinst.exe
2800	infinst.exe
8660	infinst.exe
1620	infinst.exe
8300	infinst.exe
8768	infinst.exe
6356	infinst.exe
8976	infinst.exe
8152	infinst.exe
9168	infinst.exe
6324	infinst.exe
3168	infinst.exe
5988	infinst.exe
6584	infinst.exe
6776	infinst.exe
7468	infinst.exe
8160	infinst.exe
8708	infinst.exe
6260	infinst.exe
2964	infinst.exe
2028	infinst.exe
6688	infinst.exe
3152	infinst.exe
4368	infinst.exe
5228	infinst.exe

Loads dropped DLL 64 IoCs

pid	Process
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
3208	Setup.exe
3208	Setup.exe
3208	Setup.exe
3208	Setup.exe
3208	Setup.exe
3720	dxwsetup.exe
3720	dxwsetup.exe
3720	dxwsetup.exe
3720	dxwsetup.exe
5056	vcredist_2015-2019_x64.exe
3720	dxwsetup.exe
3720	dxwsetup.exe
3168	vcredist_2015-2019_x86.exe
3720	dxwsetup.exe
3720	dxwsetup.exe
3720	dxwsetup.exe
3720	dxwsetup.exe
3720	dxwsetup.exe
3720	dxwsetup.exe
3720	dxwsetup.exe
3720	dxwsetup.exe
3720	dxwsetup.exe
3720	dxwsetup.exe
3720	dxwsetup.exe
3720	dxwsetup.exe
3720	dxwsetup.exe
3720	dxwsetup.exe
3720	dxwsetup.exe
3720	dxwsetup.exe
3720	dxwsetup.exe
3720	dxwsetup.exe
3720	dxwsetup.exe
3720	dxwsetup.exe
3720	dxwsetup.exe
6984	regsvr32.exe
3720	dxwsetup.exe
3720	dxwsetup.exe
3720	dxwsetup.exe
3720	dxwsetup.exe
3720	dxwsetup.exe
3720	dxwsetup.exe
3720	dxwsetup.exe
3720	dxwsetup.exe
3720	dxwsetup.exe
3720	dxwsetup.exe
3720	dxwsetup.exe
3720	dxwsetup.exe
3720	dxwsetup.exe
3720	dxwsetup.exe
3720	dxwsetup.exe
3720	dxwsetup.exe
3720	dxwsetup.exe
3720	dxwsetup.exe
3720	dxwsetup.exe
8096	regsvr32.exe
3720	dxwsetup.exe
1916	regsvr32.exe
1916	regsvr32.exe
3720	dxwsetup.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	dxwebsetup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	dxwsetup.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	dxwsetup.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	dxwsetup.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	dxwsetup.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\M:	dxwsetup.exe
File opened (read-only)	\??\Q:	dxwsetup.exe
File opened (read-only)	\??\T:	dxwsetup.exe
File opened (read-only)	\??\U:	dxwsetup.exe
File opened (read-only)	\??\Y:	dxwsetup.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	dxwsetup.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	dxwsetup.exe
File opened (read-only)	\??\J:	dxwsetup.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	dxwsetup.exe
File opened (read-only)	\??\K:	dxwsetup.exe
File opened (read-only)	\??\S:	dxwsetup.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	dxwsetup.exe
File opened (read-only)	\??\V:	dxwsetup.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	dxwsetup.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	dxwsetup.exe
File opened (read-only)	\??\P:	dxwsetup.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\R:	dxwsetup.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\H:	dxwsetup.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\X:	dxwsetup.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SET48EA.tmp	infinst.exe
File opened for modification	C:\Windows\system32\SET4F63.tmp	infinst.exe
File created	C:\Windows\SysWOW64\SET56E2.tmp	dxwsetup.exe
File opened for modification	C:\Windows\system32\d3dx10_43.dll	infinst.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Dec2005_d3dx9_28_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Aug2006_xact_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Aug2009_d3dx11_42_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\SET1EFC.tmp	dxwsetup.exe
File opened for modification	C:\Windows\system32\SET1FD7.tmp	infinst.exe
File created	C:\Windows\SysWOW64\SET2F7F.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\D3DX9_41.dll	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Oct2006_d3dx9_31_x64.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Mar2008_x3daudio_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\system32\d3dx9_32.dll	infinst.exe
File opened for modification	C:\Windows\SysWOW64\SET2669.tmp	dxwsetup.exe
File opened for modification	C:\Windows\system32\D3DCompiler_33.dll	infinst.exe
File opened for modification	C:\Windows\SysWOW64\d3dx10_35.dll	dxwsetup.exe
File created	C:\Windows\system32\SET3285.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\SET48C6.tmp	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Oct2006_d3dx9_31_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Jun2005_d3dx9_26_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\xactengine2_8.dll	dxwsetup.exe
File opened for modification	C:\Windows\system32\SET36AA.tmp	infinst.exe
File created	C:\Windows\SysWOW64\SET43ED.tmp	dxwsetup.exe
File opened for modification	C:\Windows\system32\SET4D31.tmp	infinst.exe
File created	C:\Windows\system32\SET4D31.tmp	infinst.exe
File opened for modification	C:\Windows\system32\SET587B.tmp	infinst.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Feb2005_d3dx9_24_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\tmp8E08.tmp	oalinst.exe
File created	C:\Windows\SysWOW64\SET3D8B.tmp	dxwsetup.exe
File opened for modification	C:\Windows\system32\SET41C6.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\SET4264.tmp	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Nov2007_x3daudio_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Aug2009_d3dx10_42_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\xinput1_1.dll	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\SET3212.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\SET337C.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\SET3779.tmp	dxwsetup.exe
File opened for modification	C:\Windows\system32\xactengine3_0.dll	infinst.exe
File opened for modification	C:\Windows\system32\X3DAudio1_5.dll	infinst.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Apr2006_d3dx9_30_x64.cab	dxwsetup.exe
File created	C:\Windows\system32\SET1121.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\d3dx9_27.dll	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\xinput1_2.dll	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\SET473C.tmp	dxwsetup.exe
File created	C:\Windows\SysWOW64\SET4858.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\xactengine3_5.dll	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Aug2005_d3dx9_27_x64.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Feb2010_xact_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\SET1744.tmp	dxwsetup.exe
File opened for modification	C:\Windows\system32\SET1C7B.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\xactengine2_7.dll	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\SET3D9B.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\SET474D.tmp	dxwsetup.exe
File created	C:\Windows\system32\wrap_oal.new	oalinst.exe
File created	C:\Windows\SysWOW64\SET1163.tmp	dxwsetup.exe
File created	C:\Windows\SysWOW64\SET14FF.tmp	dxwsetup.exe
File opened for modification	C:\Windows\system32\d3dx9_36.dll	infinst.exe
File opened for modification	C:\Windows\SysWOW64\SET4973.tmp	dxwsetup.exe
File created	C:\Windows\SysWOW64\SET53C0.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\tmpAB5D.tmp	oalinst.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Jun2008_d3dx9_38_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\system32\d3dx10_34.dll	infinst.exe
File opened for modification	C:\Windows\system32\SET2B61.tmp	infinst.exe

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\XNA\Framework\v4.0\EULA.en-US.txt	msiexec.exe
File created	C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\DXSETUP.exe	msiexec.exe
File created	C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\DSETUP.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\Feb2010_X3DAudio_x86.cab	msiexec.exe
File created	C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\Feb2010_xact_x86.cab	msiexec.exe
File created	C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\APR2007_xinput_x86.cab	msiexec.exe
File opened for modification	C:\Program Files (x86)\OpenAL\oalinst.exe	oalinst.exe
File created	C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\dxupdate.cab	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\XNA\Framework\Shared\xnavisualizer.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\APR2007_d3dx9_33_x86.cab	msiexec.exe
File created	C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\dsetup32.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\Feb2010_XAudio_x86.cab	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\XNA\Framework\Shared\XnaVisualizerPS.dll	msiexec.exe
File created	C:\Program Files (x86)\OpenAL\oalinst.exe	oalinst.exe
File created	C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\Mar2009_d3dx9_41_x86.cab	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\XNA\Framework\v4.0\XnaNative.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\msdownld.tmp\AS611D03.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS613425.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS615D39.tmp\Aug2007_d3dx9_35_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS61790E.tmp\Aug2008_d3dx9_39_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS617D63.tmp\Aug2008_xact_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS619E0A.tmp	dxwsetup.exe
File created	C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Direct3DX.dll	dxwsetup.exe
File created	C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2907.0\Microsoft.DirectX.Direct3DX.dll	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS612495.tmp\Mar2009_d3dx9_41_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS617787.tmp	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS617D63.tmp\Aug2008_xact_x86.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS61A1A4.tmp\Feb2010_x3daudio_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File opened for modification	C:\Windows\msdownld.tmp\AS60FA0A.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS610A46.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS612A61.tmp\Aug2009_d3dx11_42_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS615171.tmp\Feb2007_xact_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS61B4A0.tmp\MDX_1.0.2903.0_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS61B6D2.tmp\MDX_1.0.2904.0_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\assembly\tmp\83O2AQBT\__AssemblyInfo__.ini	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS60EDF4.tmp	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS613F12.tmp\Dec2005_d3dx9_28_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS6142EA.tmp\Feb2006_xact_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File created	C:\Windows\msdownld.tmp\AS61483A.tmp\Jun2006_xact_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS615C8D.tmp	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS61A2BE.tmp\Feb2010_xact_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS6176CC.tmp\Jun2008_xact_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS61790E.tmp	dxwsetup.exe
File opened for modification	C:\Windows\assembly\tmp\5ZY4HSUI\__AssemblyInfo__.ini	dxwsetup.exe
File created	C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.AudioVideoPlayback.xml	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS610E7C.tmp\Aug2007_d3dx9_35_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS616806.tmp\Nov2007_xact_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS61699D.tmp\Mar2008_d3dx9_37_x64.cab	dxwsetup.exe
File created	C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2909.0\Microsoft.DirectX.Direct3DX.dll	dxwsetup.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File opened for modification	C:\Windows\msdownld.tmp\AS6129C5.tmp	dxwsetup.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File opened for modification	C:\Windows\msdownld.tmp\AS60EFB9.tmp\Dec2006_d3dx10_00_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS60FBCF.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS6122A1.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS6126B8.tmp\Mar2009_d3dx10_41_x86.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS6186D9.tmp\Nov2008_d3dx10_40_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS619418.tmp\Aug2009_d3dx9_42_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\assembly\tmp\30ROE94Y\__AssemblyInfo__.ini	dxwsetup.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File created	C:\Windows\msdownld.tmp\AS6166FD.tmp\Nov2007_x3daudio_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS6196E6.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS61A85B.tmp\Jun2010_d3dx11_43_x64.cab	dxwsetup.exe
File created	C:\Windows\assembly\tmp\R1XFV3AZ\Microsoft.DirectX.Direct3D.dll	dxwsetup.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File created	C:\Windows\Installer\e6345c9.msi	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\0AA7CFB2C445A3E47869763FEB56B59E\4.0.20823\F_CENTRAL_msvcr100_x86.DF495DFD_79F6_34DF_BB1E_E58DB5BDCF2C	msiexec.exe
File opened for modification	C:\Windows\msdownld.tmp\AS613B49.tmp\Jun2005_d3dx9_26_x64.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS617DE0.tmp\Aug2008_xact_x64.cab	dxwsetup.exe
File created	C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Diagnostics.dll	dxwsetup.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File opened for modification	C:\Windows\msdownld.tmp\AS6161FB.tmp	dxwsetup.exe
File created	C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2903.0\Microsoft.DirectX.Direct3DX.xml	dxwsetup.exe
File created	C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2908.0\Microsoft.DirectX.Direct3DX.dll	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS60C8A9.tmp	dxwsetup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

System Location Discovery: System Language Discovery 1 TTPs 29 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_2015-2019_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxwebsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxwsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DXSETUP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_2015-2019_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dotNetFx40_Full_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_2015-2019_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_2015-2019_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_2015-2019_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oalinst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_2015-2019_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_2015-2019_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_2015-2019_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_2015-2019_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oalinst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_2015-2019_x86.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
8652	chrome.exe

Checks SCSI registry key(s) 3 TTPs 11 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000000f2192634d2a4d980000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838010f2192630000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841010f219263000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e30f21926300000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e60f21926300000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe

Checks processor information in registry 2 TTPs 33 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DXSETUP.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DXSETUP.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DXSETUP.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335001051953344"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DXSETUP.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\urlmon.dll,-4200 = "Open File - Security Warning"	DXSETUP.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DXSETUP.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	DXSETUP.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DXSETUP.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DXSETUP.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DXSETUP.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	DXSETUP.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "1"	DXSETUP.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DXSETUP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f5ca7b34-8055-42c0-b836-216129eb7e30}\ = "AudioVolumeMeter"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8122FF4-9E52-4374-B3D9-B4063E77109D}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{fac23f48-31f5-45a8-b49b-5225d61401aa}\InProcServer32\ThreadingModel = "Both"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9cab402c-1d37-44b4-886d-fa4f36170a4c}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_3.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4c9b6dde-6809-46e6-a278-9b6a97588670}	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cd0d66ec-8057-43f5-acbd-66dfb36fd78c}\InProcServer32\ = "C:\\Windows\\SysWow64\\xactengine2_7.dll"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{343e68e6-8f82-4a8d-a2da-6e9a944b378c}\InProcServer32	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e21a7345-eb21-468e-be50-804db97cf708}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f5ca7b34-8055-42c0-b836-216129eb7e30}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_2.dll"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d06df0d0-8518-441e-822f-5451d5c595b8}\ = "AudioReverb"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cac1105f-619b-4d04-831a-44e1cbf12d57}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3b80ee2a-b0f5-4780-9e30-90cb39685b03}\InProcServer32\ = "C:\\Windows\\SysWow64\\xactengine3_0.dll"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c0c56f46-29b1-44e9-9939-a32ce86867e2}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_0.dll"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c1e3f122-a2ea-442c-854f-20d98f8357a1}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0977d092-2d95-4e43-8d42-9ddcc2545ed5}\InProcServer32	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{bcc782bc-6492-4c22-8c35-f5d72fe73c6e}\InProcServer32	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{65d822a4-4799-42c6-9b18-d26cf66dd320}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4c9b6dde-6809-46e6-a278-9b6a97588670}\InProcServer32\ThreadingModel = "Both"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{248d8a3b-6256-44d3-a018-2ac96c459f47}	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\DirectShow\MediaObjects\a8122ff4-9e52-4374-b3d9-b4063e77109d\InputTypes = 6175647300001000800000aa00389b710100000000001000800000aa00389b71	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1138472b-d187-44e9-81f2-ae1b0e7785f1}\ = "XACT Engine"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8bb7778b-645b-4475-9a73-1de3170bd3af}\InProcServer32	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{074b110f-7f58-4743-aea5-12f15b5074ed}\InProcServer32\ = "C:\\Windows\\system32\\xactengine3_5.dll"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.Xna.Framework.Storage,fileVersion="4.0.20823.0",version="4.0.0.00000",culture="neutral",publicKeyToken="842CF8BE1DE50553",processorArchitecture="MSIL" = 6c00660060002e003200510046002b00300041004c0048005600370077003800680027002100740058004e0041004600720061006d00650077006f0072006b005200650064006900730074003e007b0072006100690027004a006300710041003d00550070005d002e0026004d0043007a007100590000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{343e68e6-8f82-4a8d-a2da-6e9a944b378c}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f5ca7b34-8055-42c0-b836-216129eb7e30}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{b802058a-464a-42db-bc10-b650d6f2586a}\InProcServer32	dxwsetup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.Xna.Framework.Avatar,fileVersion="4.0.20823.0",version="4.0.0.00000",culture="neutral",publicKeyToken="842CF8BE1DE50553",processorArchitecture="MSIL" = 6c00660060002e003200510046002b00300041004c0048005600370077003800680027002100740058004e0041004600720061006d00650077006f0072006b005200650064006900730074003e006000490066005200610038006c007d006e00400064003100700042005b00330060002c003900350000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c0c56f46-29b1-44e9-9939-a32ce86867e2}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3332f02-3dd0-4de9-9aec-20d85c4111b6}\InProcServer32\ = "C:\\Windows\\SysWow64\\xactengine3_2.dll"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{629cf0de-3ecc-41e7-9926-f7e43eebec51}\InProcServer32	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3a2495ce-31d0-435b-8ccf-e9f0843fd960}\InProcServer32\ = "C:\\Windows\\SysWow64\\xactengine2_6.dll"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{65d822a4-4799-42c6-9b18-d26cf66dd320}\InProcServer32\ThreadingModel = "Both"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{fac23f48-31f5-45a8-b49b-5225d61401aa}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c0c56f46-29b1-44e9-9939-a32ce86867e2}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f4769300-b949-4df9-b333-00d33932e9a6}\ = "AudioReverb"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{b802058a-464a-42db-bc10-b650d6f2586a}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_2.dll"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c7338b95-52b8-4542-aa79-42eb016c8c1c}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e48c5a3f-93ef-43bb-a092-2c7ceb946f27}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_6.dll"	DXSETUP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3b80ee2a-b0f5-4780-9e30-90cb39685b03}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e180344b-ac83-4483-959e-18a5c56a5e19}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cac1105f-619b-4d04-831a-44e1cbf12d57}\InProcServer32\ThreadingModel = "Both"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d06df0d0-8518-441e-822f-5451d5c595b8}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_5.dll"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4c9b6dde-6809-46e6-a278-9b6a97588670}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248d8a3b-6256-44d3-a018-2ac96c459f47}\InProcServer32\ = "C:\\Windows\\SysWow64\\xactengine3_6.dll"	DXSETUP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1138472b-d187-44e9-81f2-ae1b0e7785f1}\InProcServer32	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77c56bf4-18a1-42b0-88af-5072ce814949}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f4769300-b949-4df9-b333-00d33932e9a6}\InProcServer32	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{629cf0de-3ecc-41e7-9926-f7e43eebec51}	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94c1affa-66e7-4961-9521-cfdef3128d4f}\InProcServer32\ = "C:\\Windows\\SysWow64\\xactengine3_3.dll"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d06df0d0-8518-441e-822f-5451d5c595b8}\InProcServer32\ThreadingModel = "Both"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}\ = "XAudio2"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.Xna.Framework.Game,fileVersion="4.0.20823.0",version="4.0.0.00000",culture="neutral",publicKeyToken="842CF8BE1DE50553",processorArchitecture="x86" = 6c00660060002e003200510046002b00300041004c0048005600370077003800680027002100740058004e0041004600720061006d00650077006f0072006b005200650064006900730074003e0048006100380066004c0049004f0071007b003f00380032003100310034002e002400740052006c0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c60fae90-4183-4a3f-b2f7-ac1dc49b0e5c}\ = "XACT Engine"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3a2495ce-31d0-435b-8ccf-e9f0843fd960}\InProcServer32\ThreadingModel = "Both"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77c56bf4-18a1-42b0-88af-5072ce814949}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_8.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{65d822a4-4799-42c6-9b18-d26cf66dd320}\ = "XACT Engine"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{962f5027-99be-4692-a468-85802cf8de61}\InProcServer32\ThreadingModel = "Both"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4c5e637a-16c7-4de3-9c46-5ed22181962d}\InProcServer32	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03219e78-5bc3-44d1-b92e-f63d89cc6526}	dxwsetup.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Geometry.Dash.2.2081.zip:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5048	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2148	osk.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4276	firefox.exe
Token: SeDebugPrivilege	4276	firefox.exe
Token: 33	2660	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2660	AUDIODG.EXE
Token: SeDebugPrivilege	4276	firefox.exe
Token: SeDebugPrivilege	4276	firefox.exe
Token: SeDebugPrivilege	4276	firefox.exe
Token: SeDebugPrivilege	4276	firefox.exe
Token: SeDebugPrivilege	3480	taskmgr.exe
Token: SeSystemProfilePrivilege	3480	taskmgr.exe
Token: SeCreateGlobalPrivilege	3480	taskmgr.exe
Token: 33	3480	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3480	taskmgr.exe
Token: SeBackupPrivilege	6248	vssvc.exe
Token: SeRestorePrivilege	6248	vssvc.exe
Token: SeAuditPrivilege	6248	vssvc.exe
Token: SeBackupPrivilege	5972	srtasks.exe
Token: SeRestorePrivilege	5972	srtasks.exe
Token: SeSecurityPrivilege	5972	srtasks.exe
Token: SeTakeOwnershipPrivilege	5972	srtasks.exe
Token: SeBackupPrivilege	5972	srtasks.exe
Token: SeRestorePrivilege	5972	srtasks.exe
Token: SeSecurityPrivilege	5972	srtasks.exe
Token: SeTakeOwnershipPrivilege	5972	srtasks.exe
Token: SeShutdownPrivilege	7500	msiexec.exe
Token: SeIncreaseQuotaPrivilege	7500	msiexec.exe
Token: SeSecurityPrivilege	9112	msiexec.exe
Token: SeCreateTokenPrivilege	7500	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	7500	msiexec.exe
Token: SeLockMemoryPrivilege	7500	msiexec.exe
Token: SeIncreaseQuotaPrivilege	7500	msiexec.exe
Token: SeMachineAccountPrivilege	7500	msiexec.exe
Token: SeTcbPrivilege	7500	msiexec.exe
Token: SeSecurityPrivilege	7500	msiexec.exe
Token: SeTakeOwnershipPrivilege	7500	msiexec.exe
Token: SeLoadDriverPrivilege	7500	msiexec.exe
Token: SeSystemProfilePrivilege	7500	msiexec.exe
Token: SeSystemtimePrivilege	7500	msiexec.exe
Token: SeProfSingleProcessPrivilege	7500	msiexec.exe
Token: SeIncBasePriorityPrivilege	7500	msiexec.exe
Token: SeCreatePagefilePrivilege	7500	msiexec.exe
Token: SeCreatePermanentPrivilege	7500	msiexec.exe
Token: SeBackupPrivilege	7500	msiexec.exe
Token: SeRestorePrivilege	7500	msiexec.exe
Token: SeShutdownPrivilege	7500	msiexec.exe
Token: SeDebugPrivilege	7500	msiexec.exe
Token: SeAuditPrivilege	7500	msiexec.exe
Token: SeSystemEnvironmentPrivilege	7500	msiexec.exe
Token: SeChangeNotifyPrivilege	7500	msiexec.exe
Token: SeRemoteShutdownPrivilege	7500	msiexec.exe
Token: SeUndockPrivilege	7500	msiexec.exe
Token: SeSyncAgentPrivilege	7500	msiexec.exe
Token: SeEnableDelegationPrivilege	7500	msiexec.exe
Token: SeManageVolumePrivilege	7500	msiexec.exe
Token: SeImpersonatePrivilege	7500	msiexec.exe
Token: SeCreateGlobalPrivilege	7500	msiexec.exe
Token: SeRestorePrivilege	9112	msiexec.exe
Token: SeTakeOwnershipPrivilege	9112	msiexec.exe
Token: SeRestorePrivilege	9112	msiexec.exe
Token: SeTakeOwnershipPrivilege	9112	msiexec.exe
Token: SeRestorePrivilege	9112	msiexec.exe
Token: SeTakeOwnershipPrivilege	9112	msiexec.exe
Token: SeRestorePrivilege	9112	msiexec.exe
Token: SeTakeOwnershipPrivilege	9112	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
7500	msiexec.exe
7500	msiexec.exe
1428	taskmgr.exe
1428	taskmgr.exe
1428	taskmgr.exe
1428	taskmgr.exe
1428	taskmgr.exe
1428	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
3480	taskmgr.exe
1428	taskmgr.exe
1428	taskmgr.exe
1428	taskmgr.exe
1428	taskmgr.exe
1428	taskmgr.exe
1428	taskmgr.exe
1428	taskmgr.exe
1428	taskmgr.exe
1428	taskmgr.exe
1428	taskmgr.exe
1428	taskmgr.exe
1428	taskmgr.exe
1428	taskmgr.exe
1428	taskmgr.exe
1428	taskmgr.exe
1428	taskmgr.exe
1428	taskmgr.exe
1428	taskmgr.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
2148	osk.exe
2148	osk.exe
2148	osk.exe
2148	osk.exe
2148	osk.exe
2148	osk.exe
2148	osk.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4632 wrote to memory of 1328	4632	vcredist_x86.exe	89
PID 4896 wrote to memory of 4276	4896	firefox.exe	94
PID 4896 wrote to memory of 4276	4896	firefox.exe	94
PID 4276 wrote to memory of 260	4276	firefox.exe	95
PID 4276 wrote to memory of 260	4276	firefox.exe	95
PID 4276 wrote to memory of 260	4276	firefox.exe	95
PID 4276 wrote to memory of 4304	4276	firefox.exe	96
PID 4276 wrote to memory of 4304	4276	firefox.exe	96
PID 4276 wrote to memory of 4304	4276	firefox.exe	96
PID 4276 wrote to memory of 4304	4276	firefox.exe	96
PID 4276 wrote to memory of 3304	4276	firefox.exe	97
PID 4276 wrote to memory of 3304	4276	firefox.exe	97
PID 4276 wrote to memory of 3304	4276	firefox.exe	97
PID 4276 wrote to memory of 3304	4276	firefox.exe	97
PID 4276 wrote to memory of 2768	4276	firefox.exe	98
PID 4276 wrote to memory of 2768	4276	firefox.exe	98
PID 4276 wrote to memory of 2768	4276	firefox.exe	98
PID 4276 wrote to memory of 3908	4276	firefox.exe	99
PID 4276 wrote to memory of 3908	4276	firefox.exe	99
PID 4276 wrote to memory of 3908	4276	firefox.exe	99
PID 4276 wrote to memory of 3908	4276	firefox.exe	99
PID 4276 wrote to memory of 5640	4276	firefox.exe	100
PID 4276 wrote to memory of 5640	4276	firefox.exe	100
PID 4276 wrote to memory of 5640	4276	firefox.exe	100
PID 4276 wrote to memory of 5640	4276	firefox.exe	100
PID 4276 wrote to memory of 2892	4276	firefox.exe	101
PID 4276 wrote to memory of 2892	4276	firefox.exe	101
PID 4276 wrote to memory of 2892	4276	firefox.exe	101
PID 4276 wrote to memory of 2892	4276	firefox.exe	101
PID 4276 wrote to memory of 5692	4276	firefox.exe	102
PID 4276 wrote to memory of 5692	4276	firefox.exe	102
PID 4276 wrote to memory of 5692	4276	firefox.exe	102
PID 4276 wrote to memory of 5692	4276	firefox.exe	102
PID 4276 wrote to memory of 2576	4276	firefox.exe	103
PID 4276 wrote to memory of 2576	4276	firefox.exe	103
PID 4276 wrote to memory of 2576	4276	firefox.exe	103
PID 4276 wrote to memory of 2576	4276	firefox.exe	103
PID 4276 wrote to memory of 2824	4276	firefox.exe	111
PID 4276 wrote to memory of 2824	4276	firefox.exe	111
PID 4276 wrote to memory of 2824	4276	firefox.exe	111
PID 4276 wrote to memory of 2824	4276	firefox.exe	111
PID 2928 wrote to memory of 3208	2928	dotNetFx40_Full_setup.exe	135
PID 4412 wrote to memory of 3720	4412	dxwebsetup.exe	138
PID 7804 wrote to memory of 5056	7804	vcredist_2015-2019_x64.exe	144
PID 7552 wrote to memory of 3168	7552	vcredist_2015-2019_x86.exe	149
PID 3720 wrote to memory of 9140	3720	dxwsetup.exe	155
PID 3720 wrote to memory of 9192	3720	dxwsetup.exe	156
PID 3720 wrote to memory of 6304	3720	dxwsetup.exe	157
PID 3720 wrote to memory of 6032	3720	dxwsetup.exe	158
PID 3720 wrote to memory of 1152	3720	dxwsetup.exe	159
PID 3720 wrote to memory of 5788	3720	dxwsetup.exe	160
PID 3720 wrote to memory of 2576	3720	dxwsetup.exe	179
PID 3720 wrote to memory of 6984	3720	dxwsetup.exe	162
PID 3720 wrote to memory of 7028	3720	dxwsetup.exe	163
PID 3720 wrote to memory of 6312	3720	dxwsetup.exe	164
PID 3720 wrote to memory of 8096	3720	dxwsetup.exe	165
PID 3720 wrote to memory of 8500	3720	dxwsetup.exe	166
PID 3720 wrote to memory of 5468	3720	dxwsetup.exe	248
PID 3720 wrote to memory of 1916	3720	dxwsetup.exe	168
PID 3720 wrote to memory of 7000	3720	dxwsetup.exe	169
PID 3720 wrote to memory of 8608	3720	dxwsetup.exe	170
PID 3720 wrote to memory of 9024	3720	dxwsetup.exe	171
PID 3720 wrote to memory of 7920	3720	dxwsetup.exe	172
PID 3720 wrote to memory of 5964	3720	dxwsetup.exe	173

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\_Redist\vcredist_x86.exe
"C:\Users\Admin\AppData\Local\Temp\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\_Redist\vcredist_x86.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4632
- \??\c:\ee5f82e73105e34bbbe3c6e9a9c1a5\Setup.exe
  c:\ee5f82e73105e34bbbe3c6e9a9c1a5\Setup.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:1328

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4592

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4276
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1956 -prefsLen 27097 -prefMapHandle 1960 -prefMapSize 270279 -ipcHandle 2044 -initialChannelId {cf7f24e1-5c02-432f-b4b6-c290727cf8c6} -parentPid 4276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4276" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:260
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2424 -prefsLen 27133 -prefMapHandle 2428 -prefMapSize 270279 -ipcHandle 2436 -initialChannelId {e8b1df26-501e-4c94-b658-4ecc248d46c1} -parentPid 4276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4276" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:4304
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3872 -prefsLen 27274 -prefMapHandle 3876 -prefMapSize 270279 -jsInitHandle 3880 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3888 -initialChannelId {aa2c137b-2765-432a-bcb3-6ad3cbdd19e7} -parentPid 4276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4276" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3304
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4040 -prefsLen 27274 -prefMapHandle 4044 -prefMapSize 270279 -ipcHandle 4148 -initialChannelId {bd55aa31-81c3-4ecd-afc4-25a451d1354f} -parentPid 4276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4276" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2768
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4512 -prefsLen 34773 -prefMapHandle 4516 -prefMapSize 270279 -jsInitHandle 4520 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2612 -initialChannelId {2e09ab9d-6e7e-4cd7-b145-a4885dc496ea} -parentPid 4276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4276" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3908
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4992 -prefsLen 35010 -prefMapHandle 4996 -prefMapSize 270279 -ipcHandle 5004 -initialChannelId {716a887e-9701-4512-92fe-fab3a0898ac4} -parentPid 4276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4276" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5640
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1608 -prefsLen 32952 -prefMapHandle 5440 -prefMapSize 270279 -jsInitHandle 4912 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1620 -initialChannelId {d3142dff-1b88-4199-8a72-19f4315bfaca} -parentPid 4276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4276" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:2892
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5452 -prefsLen 32952 -prefMapHandle 5456 -prefMapSize 270279 -jsInitHandle 5460 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5468 -initialChannelId {2fd8db44-29c5-414d-8e94-eb2f2a477153} -parentPid 4276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4276" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5692
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5784 -prefsLen 32952 -prefMapHandle 5788 -prefMapSize 270279 -jsInitHandle 5792 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2744 -initialChannelId {9f6b1ecb-bc26-4b36-bfcb-eb6330329ac6} -parentPid 4276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4276" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:2576
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6668 -prefsLen 36845 -prefMapHandle 6656 -prefMapSize 270279 -jsInitHandle 6660 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6260 -initialChannelId {0ad81cff-d4f7-4ea8-b193-3a2a300eada4} -parentPid 4276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4276" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:2824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:236

C:\Windows\system32\osk.exe
"C:\Windows\system32\osk.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2148

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004CC 0x00000000000004DC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1188

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3480

C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\GeometryDash.exe
"C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\GeometryDash.exe"
1⤵
PID:5640

C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\GeometryDash.exe
"C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\GeometryDash.exe"
1⤵
PID:2368

C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\GeometryDash.exe
"C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\GeometryDash.exe"
1⤵
PID:3372

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\HOW TO RUN GAME!!.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:5048

C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\GeometryDash.exe
"C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\GeometryDash.exe"
1⤵
PID:620

C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\GeometryDash.exe
"C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\GeometryDash.exe"
1⤵
PID:4700

C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\_Redist\dotNetFx40_Full_setup.exe
"C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\_Redist\dotNetFx40_Full_setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2928
- F:\d4d56c059e60e9b48120648685\Setup.exe
  F:\d4d56c059e60e9b48120648685\\Setup.exe /x86 /x64 /ia64 /web
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  PID:3208

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{60A90A2F-858D-42AF-8929-82BE9D99E8A1}
1⤵
- System Location Discovery: System Language Discovery
PID:4000

C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\_Redist\dxwebsetup.exe
"C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\_Redist\dxwebsetup.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops desktop.ini file(s)
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3720
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe d3dx9_24_x64.inf
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:9140
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe d3dx9_25_x64.inf
    3⤵
    - Executes dropped EXE
    PID:9192
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe d3dx9_26_x64.inf
    3⤵
    - Executes dropped EXE
    PID:6304
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe d3dx9_27_x64.inf
    3⤵
    - Executes dropped EXE
    PID:6032
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe d3dx9_28_x64.inf
    3⤵
    - Executes dropped EXE
    PID:1152
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe d3dx9_29_x64.inf
    3⤵
    - Executes dropped EXE
    PID:5788
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe XACT_x64.inf
    3⤵
    - Executes dropped EXE
    PID:2576
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_0.dll
    3⤵
    - Loads dropped DLL
    PID:6984
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe d3dx9_30_x64.inf
    3⤵
    - Executes dropped EXE
    PID:7028
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe XACT2_1_x64.inf
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:6312
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_1.dll
    3⤵
    - Loads dropped DLL
    PID:8096
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe xinput1_1_x64.inf, Install_Driver
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    PID:8500
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe XACT2_2_x64.inf
    3⤵
    - Executes dropped EXE
    PID:5468
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_2.dll
    3⤵
    - Loads dropped DLL
    PID:1916
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe xinput1_2_x64.inf, Install_Driver
    3⤵
    - Executes dropped EXE
    PID:7000
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe XACT2_3_x64.inf
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:8608
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_3.dll
    3⤵
    PID:9024
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe d3dx9_31_x64.inf
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:7920
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe XACT2_4_x64.inf
    3⤵
    - Executes dropped EXE
    PID:5964
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_4.dll
    3⤵
    PID:6948
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe d3dx9_32_x64.inf
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:4908
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe d3dx10_00_x64.inf
    3⤵
    - Executes dropped EXE
    PID:5476
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe XACT2_5_x64.inf
    3⤵
    - Executes dropped EXE
    PID:3036
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_5.dll
    3⤵
    PID:6400
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe XACT2_6_x64.inf
    3⤵
    - Executes dropped EXE
    PID:2576
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_6.dll
    3⤵
    PID:200
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe d3dx9_33_x64.inf
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:7424
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe d3dx10_33_x64.inf
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:7468
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe XACT2_7_x64.inf
    3⤵
    - Executes dropped EXE
    PID:8604
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_7.dll
    3⤵
    PID:8504
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe xinput1_3_x64.inf, Install_Driver
    3⤵
    - Executes dropped EXE
    PID:6516
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe d3dx9_34_x64.inf
    3⤵
    - Executes dropped EXE
    PID:8104
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe d3dx10_34_x64.inf
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:7432
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe XACT2_8_x64.inf
    3⤵
    - Executes dropped EXE
    PID:7872
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_8.dll
    3⤵
    - Modifies registry class
    PID:3448
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe d3dx9_35_x64.inf
    3⤵
    - Executes dropped EXE
    PID:2852
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe d3dx10_35_x64.inf
    3⤵
    - Executes dropped EXE
    PID:7704
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe XACT2_9_x64.inf
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:6216
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_9.dll
    3⤵
    - Modifies registry class
    PID:2720
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe d3dx9_36_x64.inf
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:2196
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe d3dx10_36_x64.inf
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:740
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe X3DAudio1_2_x64.inf
    3⤵
    - Executes dropped EXE
    PID:4692
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe XACT2_10_x64.inf
    3⤵
    - Executes dropped EXE
    PID:928
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_10.dll
    3⤵
    - Modifies registry class
    PID:2512
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe D3DX9_37_x64.inf
    3⤵
    - Executes dropped EXE
    PID:880
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe d3dx10_37_x64.inf
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:8856
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe X3DAudio1_3_x64.inf
    3⤵
    - Executes dropped EXE
    PID:2800
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe XACT3_0_x64.inf
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:8660
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_0.dll
    3⤵
    - Modifies registry class
    PID:3200
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe XAudio2_0_x64.inf
    3⤵
    - Executes dropped EXE
    PID:1620
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_0.dll
    3⤵
    - Modifies registry class
    PID:2916
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe D3DX9_38_x64.inf
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:8300
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe d3dx10_38_x64.inf
    3⤵
    - Executes dropped EXE
    PID:8768
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe X3DAudio1_4_x64.inf
    3⤵
    - Executes dropped EXE
    PID:6356
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe XACT3_1_x64.inf
    3⤵
    - Executes dropped EXE
    PID:8976
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_1.dll
    3⤵
    PID:7300
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe XAudio2_1_x64.inf
    3⤵
    - Executes dropped EXE
    PID:8152
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_1.dll
    3⤵
    - Modifies registry class
    PID:276
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe D3DX9_39_x64.inf
    3⤵
    - Executes dropped EXE
    PID:9168
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe d3dx10_39_x64.inf
    3⤵
    - Executes dropped EXE
    PID:6324
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe XACT3_2_x64.inf
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:3168
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_2.dll
    3⤵
    PID:7008
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe XAudio2_2_x64.inf
    3⤵
    - Executes dropped EXE
    PID:5988
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_2.dll
    3⤵
    - Modifies registry class
    PID:6568
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe X3DAudio1_5_x64.inf
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:6584
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe XACT3_3_x64.inf
    3⤵
    - Executes dropped EXE
    PID:6776
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_3.dll
    3⤵
    PID:3184
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe XAudio2_3_x64.inf
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:7468
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_3.dll
    3⤵
    - Modifies registry class
    PID:8792
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe D3DX9_40_x64.inf
    3⤵
    - Executes dropped EXE
    PID:8160
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe d3dx10_40_x64.inf
    3⤵
    - Executes dropped EXE
    PID:8708
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe X3DAudio1_6_x64.inf
    3⤵
    - Executes dropped EXE
    PID:6260
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe XACT3_4_x64.inf
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    PID:2964
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_4.dll
    3⤵
    PID:8296
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe XAudio2_4_x64.inf
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:2028
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_4.dll
    3⤵
    - Modifies registry class
    PID:5648
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe D3DX9_41_x64.inf
    3⤵
    - Executes dropped EXE
    PID:6688
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe d3dx10_41_x64.inf
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:3152
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe D3DX9_42_x64.inf
    3⤵
    - Executes dropped EXE
    PID:4368
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe d3dx10_42_x64.inf
    3⤵
    - Executes dropped EXE
    PID:5228
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe d3dx11_42_x64.inf
    3⤵
    - Drops file in System32 directory
    PID:7224
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe d3dcsx_42_x64.inf
    3⤵
    PID:5628
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe D3DCompiler_42_x64.inf
    3⤵
    PID:424
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe XACT3_5_x64.inf
    3⤵
    PID:6816
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_5.dll
    3⤵
    - Modifies registry class
    PID:7992
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe XAudio2_5_x64.inf
    3⤵
    PID:8280
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_5.dll
    3⤵
    - Modifies registry class
    PID:4868
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe X3DAudio1_7_x64.inf
    3⤵
    PID:8848
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe XACT3_6_x64.inf
    3⤵
    PID:5992
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_6.dll
    3⤵
    - Modifies registry class
    PID:8616
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe XAudio2_6_x64.inf
    3⤵
    PID:6516
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_6.dll
    3⤵
    PID:2684
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe D3DX9_43_x64.inf
    3⤵
    - Drops file in Windows directory
    PID:6912
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe d3dx10_43_x64.inf
    3⤵
    - Drops file in System32 directory
    PID:5468
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe d3dx11_43_x64.inf
    3⤵
    - Drops file in System32 directory
    PID:3144
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe d3dcsx_43_x64.inf
    3⤵
    PID:9028
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe D3DCompiler_43_x64.inf
    3⤵
    PID:9160
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe XACT3_7_x64.inf
    3⤵
    PID:7728
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_7.dll
    3⤵
    PID:4144
- - C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe XAudio2_7_x64.inf
    3⤵
    PID:944
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_7.dll
    3⤵
    - Modifies registry class
    PID:6760

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{60A90A2F-858D-42AF-8929-82BE9D99E8A1}
1⤵
- System Location Discovery: System Language Discovery
PID:2428

C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\_Redist\oalinst.exe
"C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\_Redist\oalinst.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:7684

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{60A90A2F-858D-42AF-8929-82BE9D99E8A1}
1⤵
- System Location Discovery: System Language Discovery
PID:7340

C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\_Redist\vcredist_2015-2019_x64.exe
"C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\_Redist\vcredist_2015-2019_x64.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:7804
- C:\Windows\Temp\{F7E14893-C8C1-42B9-B2A8-2972F10FE8CC}\.cr\vcredist_2015-2019_x64.exe
  "C:\Windows\Temp\{F7E14893-C8C1-42B9-B2A8-2972F10FE8CC}\.cr\vcredist_2015-2019_x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\_Redist\vcredist_2015-2019_x64.exe" -burn.filehandle.attached=736 -burn.filehandle.self=592
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5056

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:6248

C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\_Redist\vcredist_2015-2019_x86.exe
"C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\_Redist\vcredist_2015-2019_x86.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:7552
- C:\Windows\Temp\{AC32AD8E-7A1B-4A9A-929B-AA39DC10CA19}\.cr\vcredist_2015-2019_x86.exe
  "C:\Windows\Temp\{AC32AD8E-7A1B-4A9A-929B-AA39DC10CA19}\.cr\vcredist_2015-2019_x86.exe" -burn.clean.room="C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\_Redist\vcredist_2015-2019_x86.exe" -burn.filehandle.attached=596 -burn.filehandle.self=696
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3168

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5972

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{60A90A2F-858D-42AF-8929-82BE9D99E8A1}
1⤵
- System Location Discovery: System Language Discovery
PID:5912

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{60A90A2F-858D-42AF-8929-82BE9D99E8A1}
1⤵
- System Location Discovery: System Language Discovery
PID:1704

C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\GeometryDash.exe
"C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\GeometryDash.exe"
1⤵
PID:8708

C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\GeometryDash.exe
"C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\GeometryDash.exe"
1⤵
PID:8064
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 8064 -s 900
  2⤵
  PID:2684

C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\_Redist\oalinst.exe
"C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\_Redist\oalinst.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3292

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{60A90A2F-858D-42AF-8929-82BE9D99E8A1}
1⤵
- System Location Discovery: System Language Discovery
PID:8056

C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\_Redist\vcredist_2015-2019_x64.exe
"C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\_Redist\vcredist_2015-2019_x64.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:8260
- C:\Windows\Temp\{A4680C08-9DB7-491D-8AA4-256C3D308236}\.cr\vcredist_2015-2019_x64.exe
  "C:\Windows\Temp\{A4680C08-9DB7-491D-8AA4-256C3D308236}\.cr\vcredist_2015-2019_x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\_Redist\vcredist_2015-2019_x64.exe" -burn.filehandle.attached=736 -burn.filehandle.self=592
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5036

C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\_Redist\vcredist_2015-2019_x86.exe
"C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\_Redist\vcredist_2015-2019_x86.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3464
- C:\Windows\Temp\{2141E6DC-AB79-46DC-BFE6-DC4E3C9E2D7E}\.cr\vcredist_2015-2019_x86.exe
  "C:\Windows\Temp\{2141E6DC-AB79-46DC-BFE6-DC4E3C9E2D7E}\.cr\vcredist_2015-2019_x86.exe" -burn.clean.room="C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\_Redist\vcredist_2015-2019_x86.exe" -burn.filehandle.attached=592 -burn.filehandle.self=588
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7516

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{60A90A2F-858D-42AF-8929-82BE9D99E8A1}
1⤵
- System Location Discovery: System Language Discovery
PID:6356

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:8292

C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\_Redist\vcredist_x64.exe
"C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\_Redist\vcredist_x64.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4140
- \??\f:\dcbbc47808795b7f1ed661d4ad\Setup.exe
  f:\dcbbc47808795b7f1ed661d4ad\Setup.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  PID:9024

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\_Redist\xnafx40_redist.msi"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:7500

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:9112
- C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\DXSETUP.exe
  "C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\DXSETUP.exe" /silent
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Modifies registry class
  PID:6216
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Microsoft Shared\XNA\Framework\Shared\xnavisualizer.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:1572

C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\GeometryDash.exe
"C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\GeometryDash.exe"
1⤵
PID:7384

C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\_Redist\vcredist_2015-2019_x64.exe
"C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\_Redist\vcredist_2015-2019_x64.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:6340
- C:\Windows\Temp\{CA1A4299-18AE-4A94-84D7-B443DBAB5867}\.cr\vcredist_2015-2019_x64.exe
  "C:\Windows\Temp\{CA1A4299-18AE-4A94-84D7-B443DBAB5867}\.cr\vcredist_2015-2019_x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\_Redist\vcredist_2015-2019_x64.exe" -burn.filehandle.attached=736 -burn.filehandle.self=592
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6880

C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\GeometryDash.exe
"C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\GeometryDash.exe"
1⤵
PID:7404

C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\GeometryDash.exe
"C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\GeometryDash.exe"
1⤵
PID:5996

C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\GeometryDash.exe
"C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\GeometryDash.exe"
1⤵
PID:4720

C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\GeometryDash.exe
"C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\GeometryDash.exe"
1⤵
PID:1152

C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\GeometryDash.exe
"C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\GeometryDash.exe"
1⤵
PID:3796

C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\GeometryDash.exe
"C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\GeometryDash.exe"
1⤵
PID:7612

C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\GeometryDash.exe
"C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\GeometryDash.exe"
1⤵
PID:9092

C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\GeometryDash.exe
"C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\GeometryDash.exe"
1⤵
PID:5144

C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\GeometryDash.exe
"C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\GeometryDash.exe"
1⤵
PID:6964

C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\GeometryDash.exe
"C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\GeometryDash.exe"
1⤵
PID:4540

C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\GeometryDash.exe
"C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\GeometryDash.exe"
1⤵
PID:7112

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1428

C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\GeometryDash.exe
"C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\GeometryDash.exe"
1⤵
PID:1992

C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\GeometryDash.exe
"C:\Users\Admin\Downloads\Geometry.Dash.2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\GeometryDash.exe"
1⤵
PID:7216

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:5000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fffbcbbc728,0x7fffbcbbc734,0x7fffbcbbc740
  2⤵
  PID:3524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1912,i,13671562483637877341,18353846765569008911,524288 --field-trial-handle=2064,i,11497307266247021694,771920260048411001,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:11
  2⤵
  - System Time Discovery
  PID:8652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1680,i,5138087352804614477,11680430885976150061,262144 --field-trial-handle=2064,i,11497307266247021694,771920260048411001,262144 --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:3808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2348,i,9431281589078543814,17952014664033296413,524288 --field-trial-handle=2064,i,11497307266247021694,771920260048411001,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:13
  2⤵
  PID:2696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3288,i,4299197209853541775,10759622290866403299,2097152 --field-trial-handle=2064,i,11497307266247021694,771920260048411001,262144 --variations-seed-version --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:6784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3292,i,12547057105582491213,11114128334063320427,2097152 --field-trial-handle=2064,i,11497307266247021694,771920260048411001,262144 --variations-seed-version --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:8024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4796,i,14219912374228078168,11287414059102587295,2097152 --field-trial-handle=2064,i,11497307266247021694,771920260048411001,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4924,i,6081318201029211500,7626352938766694509,524288 --field-trial-handle=2064,i,11497307266247021694,771920260048411001,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:14
  2⤵
  PID:2684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5524,i,11381526154633571039,10800709989610147947,524288 --field-trial-handle=2064,i,11497307266247021694,771920260048411001,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
  2⤵
  PID:7036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5624,i,828257185892750577,15905763529934442247,2097152 --field-trial-handle=2064,i,11497307266247021694,771920260048411001,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:7732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5664,i,18368344535606230787,3115135499287680628,2097152 --field-trial-handle=2064,i,11497307266247021694,771920260048411001,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:7228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5912,i,4201945696613505552,1093753057647100483,2097152 --field-trial-handle=2064,i,11497307266247021694,771920260048411001,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:5784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6108,i,12683787175621277289,17231220284338411656,2097152 --field-trial-handle=2064,i,11497307266247021694,771920260048411001,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:7596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6120,i,15813101079408220486,8057450614569452617,524288 --field-trial-handle=2064,i,11497307266247021694,771920260048411001,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:14
  2⤵
  PID:6912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6364,i,11515707973416418681,10869124219392806697,2097152 --field-trial-handle=2064,i,11497307266247021694,771920260048411001,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:8372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6100,i,1645162547578908072,14907631265849523927,2097152 --field-trial-handle=2064,i,11497307266247021694,771920260048411001,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:1
  2⤵
  PID:7020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6740,i,15783203169467332645,17308031404538593056,2097152 --field-trial-handle=2064,i,11497307266247021694,771920260048411001,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:1
  2⤵
  PID:7928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6116,i,15699438369408728348,13531542802936489239,2097152 --field-trial-handle=2064,i,11497307266247021694,771920260048411001,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:7760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5556,i,5200277860575264351,14882688361612397821,524288 --field-trial-handle=2064,i,11497307266247021694,771920260048411001,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
  2⤵
  PID:3500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5552,i,11549548712981692039,15422843041382014885,524288 --field-trial-handle=2064,i,11497307266247021694,771920260048411001,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
  2⤵
  PID:4584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6600,i,2184845942640582557,17030144566645710552,2097152 --field-trial-handle=2064,i,11497307266247021694,771920260048411001,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:1
  2⤵
  PID:5208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5708,i,15300519950582997224,16064494590309401809,2097152 --field-trial-handle=2064,i,11497307266247021694,771920260048411001,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:9
  2⤵
  PID:6800

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:9108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:8596

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa38d8055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
PID:264

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:2424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e6345ca.rbs

Path C:\Config.Msi\e6345ca.rbs
Size 17KB
SHA256 1dac748881b9e42360f8b10138e0523893f0c8dafb88dd78bc3bd6a121dae7b5
MD5 39f732289a1d0cd1f4e0e7d89d4f98e1
SHA1 a6f30dbb9aec12d4e8b86a0315cbbac66efaa8b6
SHA512 b8b981108b2c37c9b10b5b8ecb890480294746db24f9b9653d0471d7437106eebb37778e9bccdd5953d1d7ba72f8fdc99b88ce340a5956498d57788e7ea68a1a
SSDEEP 192:sjfsF4rDVZ3akIqCtemANJ7wwsI2NJ7wws3B7/an2ayzRURpJ:sjfsSm3qCYNJ7wweNJ7wwm98UzSt
TLSH
T1478285206A05D1E2E9A22F70CF133F2937A2E7C5AB90139B04CE95658F5B7C40ED47D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e6345cc.rbs

Path C:\Config.Msi\e6345cc.rbs
Size 596B
SHA256 a95318698fbc90998503adc77976ccf7ec55f2643b50e5f3869d897e2c1b0f69
MD5 18a0b93d3095d8d088d7aef9f1a80a42
SHA1 b13f7e2252d3464b600ef0b84b9423cf98edfeac
SHA512 49d638bfa0688411d3273576354d5e4ec81799a9083c9c6a26f632eb4943a49042c4cc6e54050190fcc1a2ba30f19be24eae2ce8dcd5cdf31ef3ec414a395aec
TLSH
T1DCF0E142F789A0D7C196B6F5B701AF012A9B9138620085A5480C81DE3C9B5558FF4590
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 448439435d3998e36391e0aeaea65fc02d31e9d9941410710eb5c94c8950287c
MD5 2040ae124676938e37fb192c0f0f1464
SHA1 b9e7ab29baeba875d6f1dc123135940986c867d1
SHA512 2d66eb00f699f0c019a868ce63055437023351404de4da382fcad60b7b16a8f371c4a3feb094541ef0957e02c95690aff2f7177d38478da28b35d822cbe081ba
TLSH
T1C6519AB7C7D4866D881556F49B216E1FCE3D0A24131C3C6289E8EE5B53E29B2E21038E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 454c19f94b21955e55fbdebf4ae457d3e3d546bece5449a0f7f6f12bbb202d90
MD5 8af3b751d4fe4b3060c1cac5880609e9
SHA1 14826246f1bd8626456594e64a2908da2ab6c63d
SHA512 6a6b40a56bf4f4ed3d0ac149de936ea89c5115d70808eb02dcb5daa55ab009c78a1c9caea77e78512bd98546d26777d0d4fd7bf3d90131d3cc18de6442cfcf93
TLSH
T117F059EBE639B567107904BA0E047C852AB3A8720B812CE4DF6E43ACE0858F70B16407
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 31d902cdad2cd9ec03ba6953e3742ad39eb13416de0c6aaf4c1fa697009883c8
MD5 7d657c52c2fe7e52bf677a84dc74d431
SHA1 1f9b5b9a524e4f3195d418a462fe46824c4af686
SHA512 8f4bc6b24f6614b9b78269498db8330fb147f20875259d05e979b166cea67b02a4d3b9389b5aa6bf9e1eec48da544b7b777f6af3c3fa39399c1b1d38b635b591
SSDEEP 192:JR0dA7Sv7JQAPRp2799Hsb+WNnNK0M+jLeR87U3VyIsnAUge:JR0dk+PXcvwM0Ds87Oe
TLSH
T18042A56EAA10653B9CDBD719FD217BA3E3F6102671D42E80EAFC892C15E79CD2117007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 edfde8b57213691a7b7fda8afc27e8aacf7d899dddd9a2c68c718dd82a46a41c
MD5 d8a1b8069291f3f94eb4ecd5366452e5
SHA1 76130f5373b6b90ff0cac65a57214722e1694400
SHA512 0618c857a778f47d0fac63ac9000f23386af6911213569bf57b4baf7f197ddae2b5bd15f9e9906ab5b8f2f28983b0e7b4ca3dba225b77e6569c4c5a8e859ef33
SSDEEP 384:GQjH+7KxkXqKf/pUZNCgVLH2HfgslZRXODCB+ErU37FHGKuSbc2r7w:GUH+7KxkXqKf/pUZNCgVLH2Hfgsn1Oe9
TLSH
T10752F82BA48D9A3B0F98D68CDC16AF4FACF1025766784C2457FA5D0803E5BCB115A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 881a2cf7b96eff92436787f06a91d03fecb1317afd8b496af543453584cfd59b
MD5 33feafbba4ef36b60457aa6f39762596
SHA1 772c1547b078597802a309129852e72d47c5d5e4
SHA512 5168e7dea1c885086db3df38ade1f0ef46f9bbe74953c118e22cc09413fa155e59bc535f50ecba157e32f47f8b27fbb2bffa96ec3bc87ef46a5a7af3dd0d6ad1
TLSH
T16EA00260A6C01E29DF3C46B17025454193434C351854470366E2D998885B9D84115741
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe654487.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe654487.TMP
Size 48B
SHA256 1d58b203a2e8f944be1bde195d16a2cb4b4d8e1489956912978fca32f3fba7a2
MD5 4622f681eaea3fc3b415d3569595b352
SHA1 95bc04d624c75f7a7683aeca45b96275a4f690c4
SHA512 8d98d5c0e1c2c47b602b123b984b9eafee83d2518ad97e22ed9bca292c74b75241b3dae830aacac8813d890e482af2e52de7aa1edb7f89fa05a65603f58f9a45
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe654513.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State~RFe654513.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 68ee04e9963a0a354a011d724d90a119461537622b9d292ebb7a530abb08a7ba
MD5 00ce25b43d152f982ff655f606a2532f
SHA1 17ca6dbd7d66d1008ececab88887943f49ec31f0
SHA512 9dc913f090d992408faa3a8caa2d547201d159119efc7d4a0547c9514b0d15de3fb08535bf127fb0b9ebb4c1cd7361b510272c6dc418ddd3fb703f4570a9a134
SSDEEP 3072:+mPz2f4qGIUhtmVs/KCZN5z4HZ5+gxJCoIr712:+mqf4pvhtmkKAXz43+eC1r712
TLSH
T180D3128EEA7E109395EA6B2C30477A16C2B02D6C4DB0D6E4FB17D4557AE3DD91282323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 39e1dfcbab0e8eca0a76077a8f2a84ee168fc84616de3b6a3c59cd472e0a47e0
MD5 4ae39b8a0167db3d9e61f18d5efdaeef
SHA1 ec261834705a0fd56a5adac9d50e74dd334f67c1
SHA512 a01f10217f4a0e726c0f62f5f565a6a5e5bb1398a687e2e4b136fa2a65b59fb81ab529e80e14b7147a01ea41ae2fbba7967537ec7e533db39e8194150121dae1
SSDEEP 3072:9mPz2f4qGIUhtmVs/KCZN5z4HZ5+gxJCoIr712:9mqf4pvhtmkKAXz43+eC1r712
TLSH
T1FFD3128EEA7E109395EA6B2C30477A16C6B02D6C4DB0D6E4FB17D0557AE3DD91282323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 4187beb007ca9054393491935412e82151307980070983611ea807ac8494938c
MD5 d4404ed3b49249d0154d9e694e35c977
SHA1 16ca6e5b6931be9b0969ed2500372af90c3fa120
SHA512 a221059faead1703e80b2f11e42a2dd4f87b0db248f7d0430f5747c13f6696f40c84d417ad0b14a6db0aca245c22aad49108ee304f30b3dd269b302a4efaa23b
SSDEEP 96:5C0d+CgjAe56y7nKZwpOfsobajcRDotok5H4DpB6vGyvk54EzTboRYv4a:5C0Ngjf5ZKSNqDUDuv7qEzTbog
TLSH
T14EA11AB1A46D4DB394B7C989B5437B43DEA561A7A561EF80E8DC1F0C00FB5E81382223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5E43012191E7B1F510ACD5BF039D8BF1B9A277B2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\cache2\entries\5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
Size 16KB
SHA256 562d795b68d8b34b130951497d5f52512ad218ef9f00160647264b6a0c2f2079
MD5 3e540e7e07635755563a3310bc0f5404
SHA1 c7b79847c8232482fd1866aa964cc8afeb79b63a
SHA512 6e4e52d65685a0f36f85615ec503370dda45b1d677199e529186c163b265b24819cfa28c63039234865746b388da89d58e35233a7226cdb2402015d4a064b943
SSDEEP 384:HkCjiO024YPDL84KKDL849B7SOEAd9KVRaAcP+AWRMAhk2:EzZYPDL8lKDL8CB7S/AmVAf+hRMU
TLSH
T1BA729E395F003CBC1597C0E8C5F9929A8D18B7A7DFE680AD21583D0DCAD8A69B4F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

472ee7190d52e7687ae85458aaa391c0.png

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\thumbnails\472ee7190d52e7687ae85458aaa391c0.png
Size 27KB
SHA256 c32e29925bce2b2c609c491c9c92c07d4efb38e9ed294e929bc8bbfe2d5eddca
MD5 c34db263c5a241d88ec1c728ba5ae6a4
SHA1 974b3acef97ee73e395a49e8090e048c0e5dc081
SHA512 33083e94059be25762e82f66a191155fe48c4996ae8bde2b27422caec546a7e394095178cbea3870a0745146ba2eddb899ea9305a0b973cc1302189a0c09cd87
SSDEEP 768:CCJkpowa1UDSuUA25rr7KxzrOQcqBWwVK3rWWQi:nJv1gfU/mrOoBWwov1
TLSH
T10CC2F162C104EA534C3976A35AB0E05D7E96436E7E8702DF840BEF6766B81B4C0F947B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

X3DAudio1_7_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DX4B76.tmp\X3DAudio1_7_x86.inf
Size 803B
SHA256 87759c44c5487e479d7bd072d3b541ebcf718c35d8e9edbc1b15e793dc3beb21
MD5 3d0b9186400510833f9b90e3d38f0a4d
SHA1 a210c6c765911bdc3929db2d14c0de01542976d3
SHA512 54f100ad064781bca7c8d813b0ae554473c8ff0eadd4c30d85459c9a273416bdb6080bce3072c3eba555863455ceffaf25357e0180d287557251e9bbde6591a5
TLSH
T15001F12EF95165D4F04236C03352C6C37E681118A765385BB5EEC389BB71404CBEA0FB
MD5 SHA1 SHA512 TLSH

Submit Download

XACT3_6_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DX4B76.tmp\XACT3_6_x86.inf
Size 849B
SHA256 da4b77f9e2cee68c8ff767e851b9abdb1d73a30704e6a2e0d3874f8cc559665f
MD5 f4accbe16484e94f2bdfca0bc70a11cf
SHA1 ae220ebc7b6c32772ff5c796f7d4837be50532a1
SHA512 33a1e7ada5a29ee8d77e35f9fa96f1af14d8d39e2785e55b1903bc636c1e8ff254f464e24c17c7bdd4c63b8a62b78bc1a1d28d88faf7552fff4f9dfedc9f45c1
TLSH
T10F01AB28F6719684F043B601621286C3AA79124AA345701B75FD8791BF62608E7AE0FB
MD5 SHA1 SHA512 TLSH

Submit Download

XAudio2_6_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DX4B76.tmp\XAudio2_6_x86.inf
Size 882B
SHA256 c60c4a6018e5f860a12322a0d77a1f2ad85c2d6d6dd04cc651560790dd66c9ad
MD5 e547742e48e3170b9ea1fcffcd22b607
SHA1 c361a5516bbad8a3faddbb8ab9e42682be22fc7b
SHA512 16079fdc88f1a010958ea44c88bca3287b44c308e97dadede13aab761eabb91d67ba3e7a72cb9c89c844994dcb71eb33559a27c7668b4bab40b67ab58d780bbc
TLSH
T18F119C5DED616758A4823A8072328DC77EA823186E64209775FC868977A300B977A0FB
MD5 SHA1 SHA512 TLSH

Submit Download

d3dx9_33_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DX4B76.tmp\d3dx9_33_x86.inf
Size 779B
SHA256 a693c2da4a1e4d3bde21e3249b7cb800481125dbcbe2b490e33faf64cab0d8cc
MD5 e696b56e377e60c847b703f96f742d7c
SHA1 1fc5efabf99176aff95154e09dae9e8be5ac95da
SHA512 f010b02ec744826f58d86e48c7ab5e823abcf09e6800c27756938ccb7ce4db2b7844493877022f38e69cd94058e83e1c61d816d83243e888f660e4d6cdf44b17
TLSH
T18A01BDACE2A12A48F08275012016968769681240635D309F39EE8B81FB73A6483E90BF
MD5 SHA1 SHA512 TLSH

Submit Download

d3dx9_41_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DX4B76.tmp\d3dx9_41_x86.inf
Size 779B
SHA256 c8ae58f1bcf6c9f4160c2e11974d38e5f1dadd615f8de972d743c47c4f68b00e
MD5 cbf8cb0064bfef5fe67c2180d7a45f67
SHA1 2fe57bea40601657be26384ac11a03c6cec4baf1
SHA512 d171e5a127b0b98b039ed15df8dd161ef0518be628b341c8fa360b7659f437514f0ae92ccee2a375c792670564c29b31cd7b31a4ec87dfa07c09e45a60090ede
TLSH
T17C01BD6CFA613A54B4827900252596C37A582300A76A309B39ED86C1B772A0583AE4FF
MD5 SHA1 SHA512 TLSH

Submit Download

dxupdate.dll

Path C:\Users\Admin\AppData\Local\Temp\DX4B76.tmp\dxupdate.dll
Size 169KB
SHA256 b1f954cd75dc3c9d5bc57f1a4c28720ee3639aa8a4306f3da7b27d3c361ff8f5
MD5 c4842e139fca422e265c91c44a1341d6
SHA1 299a5ab4644fe7302b515aa10ef0f1715046275c
SHA512 e85a35164e0feafa73a676dacf67d275b8e8aa5be40d861743662a7d1ac8135625c2d59a73e5c77fe1e3e8bd8523d9c823c89137aa4cb1b32d392cd9a1b59989
SSDEEP 3072:SF6LKSiwVi/9SXBLGqkNWMPCydN0BMz/xYHWl7LdOIlkhuGzyZT25FnSINKz:YwVaMMjUMPCydN0Bu/OHW5LdrCQGOZmw
TLSH
T191046C2DBB80D471C4E200F9650C26B16BFEA9B6072A80D7E3501BD9E8A57C5E17D39F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xinput1_3_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DX4B76.tmp\xinput1_3_x86.inf
Size 783B
SHA256 ba212aa1514df6509474a46c7b2fa07c210d249b524bf7d47d058461009a75c1
MD5 e16c94edc4b577b7abe7b06e31376884
SHA1 e86cf530fe00c0fa2a107684a198b37e97b9ce76
SHA512 5405f6936e05e1260a3778d86d76145d2853a345afa156ba6e0a7cf4bc9267cd4cbb5cd32878adda3c6130721218fb899fc896bf823cd63c32c7086b18cfe9db
TLSH
T1B601B86CE3A12A48F497B610345996C3A9AC10406759346F35EE8790EB72680C3F94FF
MD5 SHA1 SHA512 TLSH

Submit Download

AUG2009_D3DCompiler_42_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\AUG2009_D3DCompiler_42_x64.inf
Size 830B
SHA256 8977772e5392b8e79364b3b8d97300e97ad891f38d5a2dd306549401e46b05ff
MD5 bf489f4a6f1c8772091caf9d3f96628e
SHA1 c0da8b93f1e17acd81e5664ff7f014cf470d12f8
SHA512 2e21de522c0be4b797262528399d7ec8604fbf466e8de49cc12b9c2e2daa3a8f0977e952bd36135ed4887516d31ff8c782273325d2afad48f8b3202f35b4ffbd
TLSH
T176016B9DCC02D43276EAA9F27B87674B1767084AED1565187D9900D4EF63304117D6FC
MD5 SHA1 SHA512 TLSH

Submit Download

AUG2009_D3DCompiler_42_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\AUG2009_D3DCompiler_42_x86.inf
Size 1KB
SHA256 bb8834d2366f6899c507bae176a13dadbd44488451a263eac830be95f4bad43f
MD5 e7f9ca8ca804cc404f855be173f6ac61
SHA1 5cbe6a3e7cd65a66bb6ed17930ccfacb8c756fcd
SHA512 cca663b914f6f6d1b86db83e4f2976b103af041ca171257b9815a689788018434228182bac943fcdc7770d43180d53f887ec987e9639edc26ecabc7d20dbc4e1
TLSH
T1983114ED8916A43076E5B6B2BF8F274F57674406ED252108BBC908A4EB73701126D1FC
MD5 SHA1 SHA512 TLSH

Submit Download

AUG2009_XACT_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\AUG2009_XACT_x64.inf
Size 920B
SHA256 5d57466af1801ff3a92b1540907f0e4b91d90189177d68c6b4c8833e5d57dec3
MD5 e8623d8be34f89b38932adebb2ab2df8
SHA1 f7d844b8c77bbf1bdbaf4c615be7591299185bb1
SHA512 a398b5057707743dc3077f04e3796fc231da56b54d58c826b13ec610bbdadb0513c56183156be2e45b47ae96971a9287097ffdcd709f496e96f8f7233375f1a0
TLSH
T1DC117D99C843C233F689B1F17F47368AA7670407EA1123087AC515CA6BA3101A19C6F9
MD5 SHA1 SHA512 TLSH

Submit Download

AUG2009_XACT_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\AUG2009_XACT_x86.inf
Size 1KB
SHA256 1eb88b5460824fd32eec9b90e7ef5cb529f51215046e539d39fa27a409709766
MD5 5b6e899df58c5dd0201934027490278c
SHA1 8379d615b05654bdbdb6512b98abdb93a9179796
SHA512 2326b2b5f046ea663bc8723155098ab58341ace400fed48933575dc55b1cd14ee8f8d67194303783a1d1f412e395eddd8952127eb35d8ec745208a6889dc63cf
TLSH
T11B319ED9C842D131F685B273BF4B3A8E96774407E960260873CA4E9E6BA3201529D5FA
MD5 SHA1 SHA512 TLSH

Submit Download

AUG2009_XAudio_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\AUG2009_XAudio_x64.inf
Size 923B
SHA256 4348663aa7cfe22916fb13d93307e7384376fad9d6fa34c6196f80df42c61a33
MD5 af52205973fa73d4227dd5e105f6a37a
SHA1 2e16e2914fcb65e55a117b24b992d6e8cbec8c55
SHA512 92b8ce27f01fec9c17c2677eb4e9e3f1dd592a94a3ea12e9580c8e206a8895c99b0498b2fac30323814c8da16a48555bf5a76eb72afcf5b99ee2e05c67cb4ef0
TLSH
T120117DC5CC838333B789B0F2BF472A8A57570416FE211248BA9615CD5BA311662AC5E9
MD5 SHA1 SHA512 TLSH

Submit Download

AUG2009_XAudio_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\AUG2009_XAudio_x86.inf
Size 1KB
SHA256 842cc52100b5774bcda19e40837bd552b308e74829d5b35a505822c7436892e1
MD5 6d9bf03bfc9465df08d17b18c431926b
SHA1 184ff4a21ae4756179fd179d1c3d007842a7ec2c
SHA512 35efd74761fce6b8c7371cbfc5c8c50a0142a3fa3492dda3e566b031bb1dfd58633960230985d899348073de38295e25f76d716b153640a9e0e8ce6d59954f5d
TLSH
T1C13159C98C429271B784B1B37F5F3E8F57670416ED61110873D64ED96BA3212216C1FD
MD5 SHA1 SHA512 TLSH

Submit Download

AUG2009_d3dcsx_42_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\AUG2009_d3dcsx_42_x64.inf
Size 815B
SHA256 f7a5a84bb654837193e0f40b579777f5c6cc2c7341cf90503d6a6709d319797f
MD5 32b0f585bed3e042371e125ebc7e0f80
SHA1 dc0f6d3a501cceb50a92848f045725f93182f150
SHA512 ff7ebc445ead8c5109585ecdc58c7bb20f9cf9debebe587ace38c64f70277ee6a9c9359af0ff55a1d4bdd2d01b958efdce743f30cf5b20bc8656fe4124ec5670
TLSH
T17401CE99CC03D03276DAF5B23B87674B2723081AED12254939D900D4EF63344516D6FC
MD5 SHA1 SHA512 TLSH

Submit Download

AUG2009_d3dcsx_42_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\AUG2009_d3dcsx_42_x86.inf
Size 1KB
SHA256 ff9da1b0328fd918cf9558ee57387a4865afe98db1410cc16b1e921c5a744c48
MD5 a156f288883f2c1e867896c114509aaa
SHA1 02d7a136da0bc6c8cec933a880c62b90ea8d329c
SHA512 632fd6b2940a851bc82c2d57a962dfced3b2cc61010e037ef9065b4a8da5a0f112bc2c66984cf76334556bcde35d49dece1841ffca9c149526a56d3824178b02
TLSH
T1EF3107D9C812E030B6D5B2F2BB8F374F6737041BE955214977C908A0AB73751125D1F8
MD5 SHA1 SHA512 TLSH

Submit Download

AUG2009_d3dx10_42_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\AUG2009_d3dx10_42_x64.inf
Size 815B
SHA256 2bfdd3d3bf485439013045b3a08942f457385bb89ab76d9479fbdd85f09e9d96
MD5 8d272f58bf5ce42962d7d9835e9b489e
SHA1 7e0969289f839b5dfe606f6ce6ed106460f97682
SHA512 0554257a41df07860233f26330020a45e2dab2613a6028f79914aec7552d5c54525b137e450202db1283b602c3d95908acbf9f1eed20dd79c21fda5963fc2b5e
TLSH
T15101A699CC03903276DAE5B2378B678A2B230806EA2265683D9D04C4EF63204616C2ED
MD5 SHA1 SHA512 TLSH

Submit Download

AUG2009_d3dx10_42_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\AUG2009_d3dx10_42_x86.inf
Size 1KB
SHA256 a80a00464775da82c02f628c5bc13cab0d0643ec2a44b28d2acf7c77d467becf
MD5 b3a2e761e5da007cc6036c5703e12eed
SHA1 447e852f9bdc357b00864d4dccc7486f1313918b
SHA512 28a106886578fb38f144602d2b29c72a906bb24a50b16ea7d3f71f8bd7f194fc0d7c8451dd1c3e9ecc59be3a866c07a23dd394a17d39eb7b55cde7b347bed3a1
TLSH
T1753106DD8912A030B6D5B2B2BB8F374F5B370407EA5561687BCD0CA0AB73751125D1F9
MD5 SHA1 SHA512 TLSH

Submit Download

AUG2009_d3dx11_42_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\AUG2009_d3dx11_42_x64.inf
Size 815B
SHA256 f9c13939779d4526107cf7d3554c122efb564cff02228d02b0b6ff211904f5dd
MD5 520790b3b1eb8bb9ff00e4730d17e256
SHA1 51872475e3c31bb749f0bffaa42ab4ae362b2dea
SHA512 da76b41ba262ac7adcb2b48b8e3845b7c57b1c45a664a1f0bc90d420cfeae1ee454c2089ca37ca5df264759f016c781ab1bf17c026d9733df7271e8ee3320dec
TLSH
T164016699CC03943676DAE5B2778B678A2B270C06EA21655C79AA00C8EF63204616C2ED
MD5 SHA1 SHA512 TLSH

Submit Download

AUG2009_d3dx11_42_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\AUG2009_d3dx11_42_x86.inf
Size 1KB
SHA256 edf6764083b47c04fda52b149f565587c6a07d4455357fe3c27c9e56cc57a94d
MD5 9deabc0af1186bc22a6feacaddc5839a
SHA1 2a1fbc0737777513390210fe7fa48fa8805b15b0
SHA512 8a3dc2b4d25a2a4ed94cb70e88b051d9df9985f3c6a8af0725bb521e029015755b415c23a44ae8318aea4a04ec9b9c1ffc895df41d28c384d78a465dbb29ed3f
TLSH
T1443137DDC912A031B6D5B2B2BB8F374F5B370807EA21215C77DA08A4AB73711125D1F9
MD5 SHA1 SHA512 TLSH

Submit Download

AUG2009_d3dx9_42_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\AUG2009_d3dx9_42_x64.inf
Size 812B
SHA256 4887cbec8545b02152eb16f6296987a43a256b69b408330eaee362184f298d98
MD5 ecbefd1db4cb52d5089b1d4b20a08656
SHA1 85134f773bccff3e874d27d7e79dcd1e9485c903
SHA512 a50afd834f0d892af5eb33b9c6ffbb330ddebcebd123fc7f706f05efac9491b49dfdcfe6196f3b6a3c9f7ffedf4fa723e0499f03417552404c0fb4f4fa3c046c
TLSH
T11F016B99CC02E43676EAE9B27B8B274A2767050AFA127158799A01C4AF63250116C6EC
MD5 SHA1 SHA512 TLSH

Submit Download

AUG2009_d3dx9_42_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\AUG2009_d3dx9_42_x86.inf
Size 1KB
SHA256 5989dc367a8f84815bcfa1c46ff756527c6250c62973220d1af354b70027eaf2
MD5 dff48361a5cb0dea034dc6f16de99477
SHA1 afa417acf7e9da37923255a623ef34c7f6446c80
SHA512 750b69eee07e7d6e7fbdba722e2e1ce377729dca5fe52b4d57d23dd2b80b28b3af8403aa43c469a5042ad35eb09ba4dbefc40a014a137e1b5d87e0f2de203856
TLSH
T1253146DD8C02F4307AA4B6B27B9F374F2727450BEA61310977C90990ABB3351115D2F8
MD5 SHA1 SHA512 TLSH

Submit Download

Aug2008_XACT_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\Aug2008_XACT_x64.inf
Size 920B
SHA256 cf09d632a4b2cc670d435f356f309dc58359735834baed10343fdfbf37eddaa1
MD5 f616331f6e6916d1d27fbcf357cf1478
SHA1 e5530aa845bca9b1c89abbbc189f65584008cedb
SHA512 c39fd664f43c4cfad8e65d5d6b3ca845abc0b341cb663acc7e274a00c3218394d3d04cca850312074a294bcee4e5a0796a3c90d6263de63f8f83078d9c44c8ec
TLSH
T10B117AD9C813C23376C9B2F1BF47368AA7670407EA2113087AC605CAAFA3101A19C2FD
MD5 SHA1 SHA512 TLSH

Submit Download

Aug2008_XACT_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\Aug2008_XACT_x86.inf
Size 1KB
SHA256 f1daaa8d96108a4a338f62a4a1339143ddc566e194ca00dde5427136bfccb0af
MD5 d2aedfbc8bd56092d658bd60b464dfa5
SHA1 54f8e1cd59f43cbe02767face39fa42f50ddd229
SHA512 41d74bf9899e8d904bb0bfeed5e053ac3c453e0d591526aaf5305ba33128abfe29cea09bdc23e2131f91626a66f0ff58f6cc02fda9692e58fb2c476795e2b6d4
TLSH
T1CC31BCD9C812E13176C9B371BF4B368E96774407E860560873CA0EDE6FA3201528C4FE
MD5 SHA1 SHA512 TLSH

Submit Download

Aug2008_XAudio_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\Aug2008_XAudio_x64.inf
Size 923B
SHA256 311bd58ed7437a1cc79692ae360a02efbc8ec51194abcb80bad78b2208a94d58
MD5 fe4812a5425f1b6d9562b9609db16ba8
SHA1 01a206feff15ead479848ddf056a560701960fc2
SHA512 2a98b997af381504ec8e2c5b182c73717ab81a455ae77c57036aa904f87dc8fdfd16a7835cc1e631e9435257da8bc631946b32d8f3bb72d260d1114c4c3c4390
TLSH
T115117D85CC43823377C9B0F3BF4B2A8A57570816ED251248BA9605CD5FA310652AC1E9
MD5 SHA1 SHA512 TLSH

Submit Download

Aug2008_XAudio_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\Aug2008_XAudio_x86.inf
Size 1KB
SHA256 f211a7d99b3ffa0180bd91f68b2c285564227e075d499e950e76fde04e7707e3
MD5 e0947065f559b93eb93a7ceeaa8bfd44
SHA1 39bb647363b00924c7c0b3792f8017d7c7d9e3b4
SHA512 620810dcd56857b2d3d5f1271c5d4979cc90977acebfea81edb472d02da8e6104e89984816a91ab57a2469253a391bcc378093f1adaeea7c0d35f7f1b794969d
TLSH
T16E3159C98C02A27177C4B2B37F5F3A8F57670816ED65510873D64ED96BA3202216C1FD
MD5 SHA1 SHA512 TLSH

Submit Download

Aug2008_d3dx10_39_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\Aug2008_d3dx10_39_x64.inf
Size 815B
SHA256 a5eab981c313538afcd7abc7742854d251c736835ffc1f549a4768fdf49c3e71
MD5 b01ca47b1cffd13ec5d8a6a592ae8449
SHA1 e1b615488ba42c44922522dd47b2e99f1b5394e7
SHA512 2609474f1ce19473ff8f5f4550f9eca077bcf063bff8ea7fe890493e1119e80e6b233141a8e9dbe7d9f1e167c4941fead6cafe506f98053e623728b7edcf4ea2
TLSH
T1ED016B9D8C039436768AF1F27787674E1B270806E95125187D9E00C4EF63304516C2E9
MD5 SHA1 SHA512 TLSH

Submit Download

Aug2008_d3dx10_39_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\Aug2008_d3dx10_39_x86.inf
Size 1KB
SHA256 e83f8d48323887af89648c5bd7af713b42d20ccb757be34675f1fa527e6cc33f
MD5 baa493c7a361f1ac0c5efc94f1568f97
SHA1 16dd101673b96b54bc5a38c20ec3ed785c6bf7bb
SHA512 2e8db3d1ce2830caa9a0f698bc31e2b907e39a233fb056fae44062b3ff732b3b62f12fcb2eb948c1728df9b64c4d8ee873c0f95e56c2ad1727140236ecc71095
TLSH
T1B63105D9C9129030B6C9B6B2BB8F3B8F5A370407F96221587AD90890EF73751128D1FD
MD5 SHA1 SHA512 TLSH

Submit Download

Aug2008_d3dx9_39_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\Aug2008_d3dx9_39_x64.inf
Size 812B
SHA256 4cbb1c6804b9c76bba4e41f0d2a45f1daba7350af9da4ae6966651f7f4da041a
MD5 9411bf36f2075b7e42468277e8020e40
SHA1 c38bb84e7381baf0d2720e5f1822781a639c04bc
SHA512 c860da71a89c41e81c1c89b3e1f4e93e747d7dca1152a4ba063f53f899fc701fe24f14abecfe883571af518df4c2d766432ddbae2ccb2c52bd87d85f6ad015b3
TLSH
T1C4016B9DC802D47676DAF9B27B8B279E2767050AFA123158799A01C4AF63240116C6EC
MD5 SHA1 SHA512 TLSH

Submit Download

Aug2008_d3dx9_39_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\Aug2008_d3dx9_39_x86.inf
Size 1KB
SHA256 8a23d386626328f9519076f33d5c3b71c639f2347741442c3374974e6f61bd53
MD5 b28ef6e3eebceb622d1431fedd9f545a
SHA1 c6ae73cbbdff4632911dc1759a9ccdd73056ac8b
SHA512 4f2bfced9eedabd6ca807a1b88cc063d15a31ab0bd8e2b60c65d6daddac9a111c434a0fa7d7641813d9880612464351ea30368bf6f0ed9ffc69bfb4d51882d12
TLSH
T1873146DD8802E4347A94B6B2BB9F379F1627450BFA61310973CA0990AFB3341115D2FC
MD5 SHA1 SHA512 TLSH

Submit Download

D3DCompiler_37.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\D3DCompiler_37.dll
Size 1.4MB
SHA256 715876d15b590936e4d32602a764d810650eec134922b32eea742e2fa71791c1
MD5 ea752dbce35045d3c830dc16578cc8ab
SHA1 0a9bdf391ccdd113fde4d10f0afc80d54df01259
SHA512 3cf5e79062203d39fdb74e789e22405b93de126deda3d698963682d51f264cafe9a91d433312bb7976fa9b50a4798060fcb97b6de7f0dd422eecac2a922e31dd
SSDEEP 24576:/dWG0BzXPbAiuJYVcXJK0Boop2kA4ux6yQJM4D:6z/bnJVcZK0iMz/uy
TLSH
T19D657D21D64F8079C8D612B65E5EB7E5642CCE31032062C772947ED8EE353E26B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D3DCompiler_38.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\D3DCompiler_38.dll
Size 1.4MB
SHA256 ddcaadbdd47bcba02c8d1880d456acc20732d21554977338ae507987ed04046e
MD5 103cbfc5591008ad33046e20e8e1eebe
SHA1 4a8bd29d7cbe5652ba58cd6754318a03497d841a
SHA512 ddab1a2ab33b224ac3f9ed396415bbbdf96bd59bc6794fe26796ee87691154d5e1ca2abf8bb85e7a9fb6793446bf17f6f6f53b74e69443270f50ce0b85e06b6f
SSDEEP 24576:ob830RBe9+g6SSDgkQ/Hrw5XGZSZx/Zatoy/B/A:pKBe9KDgkQjKWSZ1gtoH
TLSH
T116657D21E64E8039C8C612B25F5FB7E5252CDF31032166C772947AD89E357E26B3A70B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D3DCompiler_39.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\D3DCompiler_39.dll
Size 1.4MB
SHA256 b99b655abc4ec45851cc2acdb7a348e739687200a4fe3be9c35d6738dd61112f
MD5 c4f1972497fe2ceb7d900938c97fcf91
SHA1 27c1886e7823813ac61c35ea0cd5b72ea0ea7dbc
SHA512 8d35dd4000e1d632d0924b594d6ef13454159f8c3b85636f180486ff794b76f8a84d7977e340ef08217f0f68747b593eae0b44824a20c12494007f4a40cc3d00
SSDEEP 24576:SiSiwPsW/CcMsGI+1LUtpbvaxvDgrPWvBG5WNixPQ/:F4/CcMs+LUtpb+bSPQRNF
TLSH
T109657D21E64E8039C8C612B25F5EB7E5252CDF31032166C772947AD89E357E26F3A70B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D3DCompiler_40.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\D3DCompiler_40.dll
Size 1.9MB
SHA256 f0a6f156d13150de6ebb094233e5ff78581fbdb77bd0ff8d083698c42bc8e13b
MD5 3384134eeb8f223178c2eb8323003ec0
SHA1 c8eaef8cbc91f4386e42904dee70abb6ab7304f2
SHA512 dafcf4c116d994c17d47d36b1dbc2ba8ca61cadeefa5d770adc391713d2c13ed2b6eb8d2464f4811cb472c8e1eef384ba21d7ad8203ba4e9ef07f33781feaaf9
SSDEEP 24576:mxjG1RD04UayXFlXKYEmVWbF9lhZdOblHl7ha6JOcIMcNG:mKCVlXKYEGWp9lhZEbJdharU
TLSH
T18F957D11D28BC07AD89E11765E5F736D69388F52036052C772807EE96E373E26B3A70B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D3DCompiler_41.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\D3DCompiler_41.dll
Size 1.8MB
SHA256 69ddadf8f5be24f10382706480b55e2492008d102001779f976608e880c65aab
MD5 781e8b5b6fdb3c9b4e4a4a9fb019960d
SHA1 292b9f02bc2377c6f89b505554394ace161c68c0
SHA512 718955c983708f3ce5b6796de28658603bb61270ca6f1b3ee01d73ca9a789db326a7998df38cbd6330e69bfe3d9504b0fd351fb7bb18566be6af03fa36b7573a
SSDEEP 49152:Rfda7j+n341NZyBtnDc7fKrIDrHecmIx/QUF:VijZ1NMngP4IL
TLSH
T13D857D11C60A807ECCCE12795E6F7729692C9F51036097C762847EE99D727E36F3A20B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D3DCompiler_42.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\D3DCompiler_42.dll
Size 1.9MB
SHA256 6c976311406c23aa71018d274da0ecdef43b6e3a3b0b01e941a5e8e4e974386c
MD5 b33b21db610116262d906305ce65c354
SHA1 38eef8d8917351ee9bdff2cc4fbfaefaa16b8231
SHA512 7049726ccbba90d06b3a56e1dbde8196935d4681b5548248cd3e6a8e38183c268152ba2b07eb90823bbe327c02ec946c59abe3562b59e29d9bcff8fe90e0adcc
SSDEEP 24576:JvjFvnqUUI6tHi2E0HvSiMKR4lKNZtPUJplNNbvnnVb4T9zSAUtcLt/oW1XfY6RO:nvFD2E0H6iMFyFUJNNDnVbk9zRUtA/Nq
TLSH
T125958C11D70A807ACCCE11B96F5E772539689F61036097C77290BEE49D727E32E3A60B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D3DCompiler_43.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\D3DCompiler_43.dll
Size 2.0MB
SHA256 2f23182ec6f4889397ac4bf03d62536136c5bdba825c7d2c4ef08c827f3a8a1c
MD5 1c9b45e87528b8bb8cfa884ea0099a85
SHA1 98be17e1d324790a5b206e1ea1cc4e64fbe21240
SHA512 b76d780810e8617b80331b4ad56e9c753652af2e55b66795f7a7d67d6afcec5ef00d120d9b2c64126309076d8169239a721ae8b34784b639b3a3e2bf50d6ee34
SSDEEP 49152:DpX9JVeE9HP6Zpy9KyhMI50Du8LljslNsHSHFUq9OiapbbO5Akb:H3P9HP6Zpy9KyhMI50Du8LljslNsyHiS
TLSH
T1FBA59E11E705D0B2CCCB00B16A5DB7A6647C9F30432096C7B2947EA95D72AF35F3AB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FEB2010_X3DAudio_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\FEB2010_X3DAudio_x64.inf
Size 815B
SHA256 68351f03f4ef83e4b8c359e3e130441081690a1866b838a1b35d64674ef3abbf
MD5 49460e9297b0faab5a5d73e7aa2caa67
SHA1 a7e211f3d4ae808f67a798924c4d3314183df873
SHA512 92c4c0751e9123e1eb09da312bc44041d13262e26cefb807dcd1b354c5bd12c0d7197f1d3d457ddef89714b77ffe45db9c717332963c6daa507ae02a6d5fc941
TLSH
T13401829ACC03D5327689F1F17BCB2BCB5B27041AEA316518B68A04C8BB7310051AC1FD
MD5 SHA1 SHA512 TLSH

Submit Download

FEB2010_X3DAudio_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\FEB2010_X3DAudio_x86.inf
Size 1KB
SHA256 d4da3e530982812d1e2a31570b80af541fac1b13c72997d2aad7ea3bfeaf4a4a
MD5 e84adf38d499ae39090ad60fd76d76e3
SHA1 6af4d58bc04aac2723e8b97649f1b35fb1aca84c
SHA512 6714992e7aee7bd0798fbec68f92c97ee502127580e21e1b6693ed6737312b44dbc9fd9ef579fe552590e9e5a4904df94e4116334265a34699a04aa76ab87c24
TLSH
T1FD21269ACC0294707685B2B27F8F768F5B670417E9612508B3CB0E94BB73701219D1FE
MD5 SHA1 SHA512 TLSH

Submit Download

FEB2010_XACT_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\FEB2010_XACT_x64.inf
Size 920B
SHA256 c7efd1ec4e4d31644a5054d32cc1e6795464472c05439573ae93e1727a5eea4a
MD5 45f4f5d8439b3a33df8f1d9f39a162c6
SHA1 e09440edc243b072aa589ed139ab9fdeff3193d2
SHA512 f8b7ab66b7fd182efddc2a851c6468a311705267afd5fb81554713b338f24642c5e7b5d5000b85e417154c4285457f9fdcdcf9f42c155c801f7a295e6ae3ea34
TLSH
T1091190D9CC03C1337689B1F17F47368AA7670407E91123187AC505CEEBA3101919C2FD
MD5 SHA1 SHA512 TLSH

Submit Download

FEB2010_XACT_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\FEB2010_XACT_x86.inf
Size 1KB
SHA256 e850fdb84bcac0f667927e53fee943efd3f43be6c6a0ae1e17f3fff83ddb2635
MD5 82c10b720e33be099f69e4010d44ecd2
SHA1 e95a2eb23db3fd610d71089500aad523f93c9469
SHA512 853261c439b26cdc8991ac289b9f9925976452ed613481b0cf09e75444882805ffa15633eba441d8e1a04641f5f6378b68e2270a6a48d3911d7f9c2c0b1235bd
TLSH
T11331BCD9D802D131768DB271BF4B368E97774407E860261873CA0E9EEBA3201568C8FA
MD5 SHA1 SHA512 TLSH

Submit Download

FEB2010_XAudio_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\FEB2010_XAudio_x64.inf
Size 923B
SHA256 da63330fd2a1538b714ee6cf2e09256446a04a55f866b3f70237d8a7165cb3e3
MD5 1c4dc3c97e96135a784867d68d193bef
SHA1 5019f79ea9b624999fe58420daac619c5695994c
SHA512 d529d68ccdacd41a7bb688bf226a23f4d08639213d96e3e428c16176681c5f7d45ca8527291322b2a6d4dd14fea1cab3cf183006bca3b5a45fbf2e05c2ee1437
TLSH
T1B7117DC5CC4382337B89B0F2BF572A8A57571416ED212248FA9605CD5BE310652AC1EE
MD5 SHA1 SHA512 TLSH

Submit Download

FEB2010_XAudio_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\FEB2010_XAudio_x86.inf
Size 1KB
SHA256 74c827ef94881099761e04397ef8f162fd0ccaf4876a5503c4b53a5216d2acca
MD5 e6e942a2cfbb587bfcc4203b5bb34fd4
SHA1 2e0172ea1936911a98e11a6e98990703e24172c0
SHA512 3d70d76e6f459819a1703c5019a2e10fe518ee6e8eb5d3313fe57d3d1b6313b52c4904398a26841c78a9ecf9d715e1201e834ab3df47265e070ec94417a78e4d
TLSH
T1A0317CC9CC0293717B88B1B27F5F3A8F57670416ED612108B3D64E996BE3202256C9FE
MD5 SHA1 SHA512 TLSH

Submit Download

JUN2010_D3DCompiler_43_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\JUN2010_D3DCompiler_43_x64.inf
Size 830B
SHA256 3e779533a273e3395109c7efac13ba1c804c01b3ddb16938406fbdf90d851216
MD5 6494a3b568760c8248b42d2b6e4df657
SHA1 700f27ee4c74e9b9914f80b067079e09ec7c6a7f
SHA512 2bf68b123d7823ad7182e132d9e55f8de7580229e8e1b3b40030da50bb9bdeaf67bb9727ce2171fa83b7f804c24d9728ffabb44cb5017b16b771bb19e62b1b42
TLSH
T1B901AB9DCC02D43277ABA5F23B87674B1763084AED1125487D9900D4EF63304117D6FC
MD5 SHA1 SHA512 TLSH

Submit Download

JUN2010_D3DCompiler_43_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\JUN2010_D3DCompiler_43_x86.inf
Size 1KB
SHA256 5dd568919e1b3cbcb23ab21d0f2d6c1a065070848aba5d2a896da39e55c6cbbf
MD5 1a86443fc4e07e0945904da7efe2149d
SHA1 37a6627dbf3b43aca104eb55f9f37e14947838ce
SHA512 c9faa6bb9485b1a0f8356df42c1efe1711a77efa566eee3eb0c8031ece10ffa045d35adb63e5e8b2f79f26bf3596c54c0bd23fea1642faae11baf2e97b73cf5e
TLSH
T1883114ED8916943077D5B2B2BF8F264F67674406ED65214CBBC908A4EBB3701126D1FC
MD5 SHA1 SHA512 TLSH

Submit Download

JUN2010_XACT_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\JUN2010_XACT_x64.inf
Size 920B
SHA256 f3c288d84db29f7bc4d2c771341f765b5e1940a4827fcb55a65b48eec83c71d3
MD5 dc506eaa8bdc02b0918e8ce956b505ce
SHA1 9bfa75f2b2d7ba26a778623c8505e10428a1f6cc
SHA512 9938b821370919a25e801cc19841e951ef4523fa62eeccade6825e74c43319e9bad2f76e5971ce5d26ec2fe55258f7c9390626bc3b934c84b70f7a2870976b89
TLSH
T1611190D9CC03C1337689B1F17F8B3A8AE7670407E91123087AD915CE6BA3141919D2F9
MD5 SHA1 SHA512 TLSH

Submit Download

JUN2010_XACT_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\JUN2010_XACT_x86.inf
Size 1KB
SHA256 ca604ce9d2ee43a09b39b23a6a2a048b1a79d85c7d78679cc73aacc75cf7a62e
MD5 dbef26a0b937dc1859e9582aa88bf928
SHA1 25f85650c6f62e59c11f7234be22d34e890793b3
SHA512 4259193cd51168020b3b02ffaae89d7b4a972273b227cc3116c8cac3874b7c329e66c989ad200f93b05d1e4f90657b5391f37d6d128108db66ad7d6a758aa34c
TLSH
T15D31BCD9D802D1317689B271BF4F368E96774407E860260873CA1E9E6BA3241528E4FA
MD5 SHA1 SHA512 TLSH

Submit Download

JUN2010_XAudio_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\JUN2010_XAudio_x64.inf
Size 923B
SHA256 1a0f1b929724f8b71d5ce922f19b9d539d2d804c89af947d5927b049ef0fd3d8
MD5 dd987135dcbe7f21c973077787b1f4f8
SHA1 ed8c2426c46c4516e37b5f9aac30549916360f7e
SHA512 f0469c94219b4df99d7b9b693161a736fa8eec88a3f6c7f2cf92fab2ade048dfe61fcde3a4cf4f7a2aaf841d079a46b17259dea22cfb02831983f55bd7f61899
TLSH
T1B5117D85CC4382337789B0F2BF872E8A97570416ED212248BA9A15CD9BA310652AC1E9
MD5 SHA1 SHA512 TLSH

Submit Download

JUN2010_XAudio_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\JUN2010_XAudio_x86.inf
Size 1KB
SHA256 d786d06a709d5dc26067132b9735fc317763fcf8064442d6f77f65012ba179da
MD5 31d8732ac2f0a5c053b279adc025619f
SHA1 c8d6d2e88b13581b6638002e6f7f0c3a165fff3c
SHA512 abc37922307f081a1ffdc956ce59598c19ad1939ecfb6ea3280aa6aa7a99c3eba5462731586ca262f7d7257d7d2a74ff57a45abf6b93521eb6f1c9f22f8eb244
TLSH
T1D7317CC9DC0293717784B1B27F5F3A8F57670416ED61210873D65E9DABA3202216C1FD
MD5 SHA1 SHA512 TLSH

Submit Download

JUN2010_d3dcsx_43_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\JUN2010_d3dcsx_43_x64.inf
Size 815B
SHA256 5289b5ad22146d7cc0c35cdb2c9662742693550de8f013d1ec40e944288d155a
MD5 e1f150f570b3fc5208f3020c815474c8
SHA1 7c75fc0cf3e3c4fd5045a94b624171d4e0d3b25c
SHA512 a53618ed6ebcd50ef074b320eb3ebd38af4770a82caa808e47cba6a81982ced46cf954a1c5a383f171006e727d8211b4fce54c9faf27b4c14a770a45a09037b8
TLSH
T16001CE99CC03D03276CAF5B23B97674B2723081AED12258939D900D4EB63344516D6FC
MD5 SHA1 SHA512 TLSH

Submit Download

JUN2010_d3dcsx_43_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\JUN2010_d3dcsx_43_x86.inf
Size 1KB
SHA256 d5200b332caf4fff25eb3d224527a3944878c5c3849512779a2afcfeae4c3ca1
MD5 cf70b3dd13a8c636db00bd4332996d1a
SHA1 48dd8fc6fa3dae23cb6ca8113bc7ad837b4570d7
SHA512 ae31a9e20743a2052deec5d696a555460a03d400720679ed103759241b25d55e2fbc247170da3c0c0891f32b131ab6a6845de56c2d3387ad233aa11db970b313
TLSH
T17E3106D9C812E430B6C5B2F2BB9F674F6737041BE955214D77C908A0ABB3751125D1F8
MD5 SHA1 SHA512 TLSH

Submit Download

JUN2010_d3dx10_43_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\JUN2010_d3dx10_43_x64.inf
Size 815B
SHA256 a65f370a741d62c2be0ca588758d089dd976092cb910bb6b1b7d008741e18377
MD5 13c1907a2cd55e31b7d8fb03f48027ec
SHA1 ca37872b9372543f1dbe09b8aa4e0e211a8e2303
SHA512 545aaf268d141e2aae6800e095a1ae4eafe6bfe492d95dfe03789ccb245cc3ef3f50f43b10a41a3b0efdc7f8c63621b437323e133ba881f90a3b940095b80208
TLSH
T1F5018E9DCC03D436768AF5B27787674B1B271806EE5265A87DD904C4EB63204516C2FD
MD5 SHA1 SHA512 TLSH

Submit Download

JUN2010_d3dx10_43_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\JUN2010_d3dx10_43_x86.inf
Size 1KB
SHA256 4d4263cbb11858c727824c4a071f992909675719be3076b4a47852bf6affd862
MD5 53a24faee760e18821ef0960c767ab04
SHA1 4548db4234dbacbfb726784b907d08d953496ff9
SHA512 8371471624f54db0aca3ea051235937fc28575c0f533b89f7d2204c776814d4cd09ee1a37b41163239885e878fb193133ad397fe3c18232ad3469626af2d2ed1
TLSH
T1D83106DD89129430B6C5B2B2BB8F374F6B371407EA51216C7BC90CA0ABB3751125D1F9
MD5 SHA1 SHA512 TLSH

Submit Download

JUN2010_d3dx11_43_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\JUN2010_d3dx11_43_x64.inf
Size 815B
SHA256 2c4cf75b76203cba6378693668c8c00b564871c8bfd7fbda01e1e841477b2a3b
MD5 590fe1ea1837b4bfb80dc8cb09e7815f
SHA1 792b5b0521c34c6b723a379dd6b3acf82f8afb1f
SHA512 80bee8f1ad5bfaba6b3ac5a39302a1427dbaa5919d76c89b279dc753170ec443924eadf454746ce331a6682ee729ab79bd390a5d3b55db8d08fd6f4869101f53
TLSH
T188018E9DCC43D436768AF5B27787674B1B270806EF21659C79DA00C4EB63204516C2FD
MD5 SHA1 SHA512 TLSH

Submit Download

JUN2010_d3dx11_43_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\JUN2010_d3dx11_43_x86.inf
Size 1KB
SHA256 3925c924eb4ec4f5a643b2d14d2eda603341fbbd22118cdd8ae04aaa96f443c0
MD5 fb5d27c88b52dcbdbc226f66f0537573
SHA1 2cbf1012fbdcbbd17643f7466f986ecd3ce2688a
SHA512 8aa2200f91eca91d7ee3221bc7c8f2a9c8d913a5d633aa00835d5fb243d9cb8afa60fe34a4c3daa0731a21914bc52266d05d6b80bfc30b2a255d7acdf0d18eb5
TLSH
T1E93137DDC952A431B6C5B2B2BB8F374F6B370407EA21215C77DA08A4ABB3711125D1F9
MD5 SHA1 SHA512 TLSH

Submit Download

JUN2010_d3dx9_43_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\JUN2010_d3dx9_43_x64.inf
Size 812B
SHA256 272650a2d9b1cfea17021f4bf941b21f2206791e279070d4e906ce0ce56ac16f
MD5 ce097963fc345e9baa1c3b42f4bfa449
SHA1 e7624afc3a7718b02533b44edfe4f90d1afda62a
SHA512 f3c4f00eebd9d465bc2415d59c417bca0f5a07c8e13880b28704f770763609a653d4b06f53d98325b66c2c7094895190900c47980f81463215e919f00966ee7b
TLSH
T19A016B99CC02D43677DAE9B27B8B274A2767050AFA127198799A01C4AF63240116C6EC
MD5 SHA1 SHA512 TLSH

Submit Download

JUN2010_d3dx9_43_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\JUN2010_d3dx9_43_x86.inf
Size 1KB
SHA256 6b33d32da02f664092d44b05237990f825b4062c105a063badcf978648b5e95b
MD5 a11deb327119b65bacce49735edc4605
SHA1 0be2d7fa6254b138aa53d9146cda8fedbba93764
SHA512 b0134a3d6f2d576e5fafb601014ab66fef91d661013acc8a7a9129940369a1d9ed5c0f228bb1666a4e891f09b4b18e83f0cb2080047aa84fa45ab663e5739a31
TLSH
T1A73146DD8C02E4307B94B6B27B9F364F2727450BEA61314D77C90990ABB3341115D2F8
MD5 SHA1 SHA512 TLSH

Submit Download

Jun2008_X3DAudio_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\Jun2008_X3DAudio_x64.inf
Size 815B
SHA256 f4526ad18f081b84a139e6d98923569fc8ffc7644e20499e2f68abfb3e87753e
MD5 0225e16dbd17754f202f34cc1fdaa60e
SHA1 d8d7e02849d9594b346023e9e69a5b2a4fffc45a
SHA512 2b308f4c4592a80d4215781ba7ace57f93a7449b2ce36a7c78203e1f16f1b7321dff6c32272180c9cbaee5d31afbdcd11f3d474004fe13c63752d3c0201d2033
TLSH
T1A8018E99CC03D5327689F1F27B8B27CB1B27041AEA316618BA9A04C4BB7320051AC2FD
MD5 SHA1 SHA512 TLSH

Submit Download

Jun2008_X3DAudio_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\Jun2008_X3DAudio_x86.inf
Size 1KB
SHA256 0064b7db5bfe52b6f40f61d962901c7baa116abbc72328f50586b6fa65f894bd
MD5 7949a4d37b517c39295f0d656cbde501
SHA1 27313949fe172d687e9faaaf91044ef56b7c973e
SHA512 93d947c95b7ae357bd47a5a050437cb05192eb6c84e9222a46d70ecc7c54bc2a5cb1d3f65cb2a4db5fe18106ed9be5a7aefef08f9634b28cd5cf128bd00352fe
TLSH
T136212499CC0294707689B2F27F8F768F5B670417E9611508B3CB0A90BBB3701229D1FE
MD5 SHA1 SHA512 TLSH

Submit Download

Jun2008_XACT_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\Jun2008_XACT_x64.inf
Size 920B
SHA256 90577c4c3d5d0de80c805caf0cc713582698ef7224fecf4ff911ba6309c5c920
MD5 9b2753cd7967a014a6391b44900ce258
SHA1 d6d227999ad32de75e05ae7d7fc43640e8893ec4
SHA512 31136e55f01d382cb20f7109d0369a3ab7c8997dde1b65e9214e410ab686add4ef6950241c0aa9fc93ea0cfe3134d98ae1f3f48b44e92a620715bf159d6f5914
TLSH
T1E7117D99C803C1337A8AB1F17F47368AA7770417E9111308BBC505CE6BE3101919C2F9
MD5 SHA1 SHA512 TLSH

Submit Download

Jun2008_XACT_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\Jun2008_XACT_x86.inf
Size 1KB
SHA256 79cb10222e466d54908d30ee433830e9673d5a538fabc5f4568521c2aff66eb1
MD5 59c4f83a7fa2a8dee4970d37a96c2b55
SHA1 75b42f58c61d8c8ae185cd8560dbfedb7c4d6d9c
SHA512 9a9b7ea3b354cbb29d88797533332abd4d1ad195b28ee6af05a0c6f83343b1e2ae0ce172e9941eb5f0d7ed3fb0382c1319fe4808ea2bf8988a1dc63b78c8c095
TLSH
T1A1319CD9C802D131768AB271BF4B368ED7774407E962160873CA4EDE6BE3201529D5FA
MD5 SHA1 SHA512 TLSH

Submit Download

Jun2008_XAudio_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\Jun2008_XAudio_x64.inf
Size 923B
SHA256 9ce21064f2feed9bc9426a6e92e9c850aae31abeb80c7906ff917fbf4cc03913
MD5 c564c4dd81be3fe65783bca776be371e
SHA1 b60e1e1e34b8c56fac53dd7af79e1e05e04866bb
SHA512 5b790aa1a6215ce8687cf3503267e31d1d7b41b5e4675bc634be957fbe14c53556989278017f2c97336df13d16eeaf975e0602a4cf9c8356598c392977df4dcc
TLSH
T130117D85CC4386737B89B0F2BF472A8A57670426ED211249FA9605CD5BA310652AC1E9
MD5 SHA1 SHA512 TLSH

Submit Download

Jun2008_XAudio_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\Jun2008_XAudio_x86.inf
Size 1KB
SHA256 e5e435c4536f987e1087218b025e6dc66c24c3e300e839391891f1b3bfd360dd
MD5 e82ee7f4d71ae8bf90378bb6dc107d57
SHA1 6fc8e3437dc9d87213064e69bf0769d20fa7a739
SHA512 baea9f4d6c744f26b55426c9666f135c07f3e8af15fee04cdf34c0af83567815dadd5a4ac8a6547a49d58e0c837a28fb18c4fe1f50fbed8da9991bd2aed8ab7e
TLSH
T128316BC9CC0296B17784B1F27F5F3A8F97670416ED62110973D64ED96BA3202216C1FD
MD5 SHA1 SHA512 TLSH

Submit Download

Jun2008_d3dx10_38_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\Jun2008_d3dx10_38_x64.inf
Size 815B
SHA256 0de0ada970774620c0905227666fc30910e64f3cfa4b99e4c5481685d12e3ded
MD5 e2b760696e2300b1c9b6c2531b39d029
SHA1 1c576840cf04b73de362b28b943bd69b09b3883e
SHA512 94e4bd9834c21acc7709fd28dc557455929f940be0a4a794105188dceed7e023f87a489a1de44a9f93f3780f6f9088ab3d4e829a0089bec74a25ba4297a0dd73
TLSH
T1C2016B998C039436768EE1F27787674A1B270807EA5125197D9E00C4EB63304526C2E9
MD5 SHA1 SHA512 TLSH

Submit Download

Jun2008_d3dx10_38_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\Jun2008_d3dx10_38_x86.inf
Size 1KB
SHA256 f5f54664ec67f6333a9f0607d891bd0dc2acfee8cce09ac4ee0372b5d0aa12fd
MD5 d12a6b9889eeb330b4a4e86e9bd175ae
SHA1 62a4a7cb8fcc0edc240caea13b2b487cd012fb00
SHA512 86274606e76b98b71dc4eec5180b3a52cb6627ac5ecc8b008512b7bad404e03b834b7129ce326a3c9c1cfa8b19bd5e97467a9390bc8a0e749771ca06d9f73491
TLSH
T16E31F499C9139030B6C9F6B2BB8F374F5A370407FA6222587ACA0890EB73651128D1BD
MD5 SHA1 SHA512 TLSH

Submit Download

Jun2008_d3dx9_38_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\Jun2008_d3dx9_38_x64.inf
Size 812B
SHA256 ddad68974990a21a8d4a91c47ef1034ddf0475551586f04e86b8cd2f0c990d6f
MD5 df5538bc9e0494845a8e2d607e06e561
SHA1 a056a64230f03835dcf9bbc5d84edc2eb0c09484
SHA512 4f19379034eb47e01de81a611facc2c8300c7b10306ebbabd232a249debb4acdcd3de42b71d851011be5b3abcae1ca232ae6891be79adfd754369dc0f16b249f
TLSH
T111016B9DC802D43676DEE9B27B8B275A2767050BFB123158799A01C4AF73240116C6EC
MD5 SHA1 SHA512 TLSH

Submit Download

Jun2008_d3dx9_38_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\Jun2008_d3dx9_38_x86.inf
Size 1KB
SHA256 06faf7f7ea5503dcece13d6537e57cd2581d5188a5d839fe7f118298a721b51a
MD5 c7fc0a82355bafed08a5597930b80263
SHA1 037419fc93581e053b4cd31c57222c8b8761e242
SHA512 51829843dd7e2e501d6054f500fa523bf63f19382890880cac0e3f207a00dbc544195489de67c7dcf876d9061f2af12bd346513e1c98047b0c185669be5d8cc9
TLSH
T1853146DD8802E430BA98F6B2BB9F375F1627450BFA61320973CA0990ABB3341115D2F8
MD5 SHA1 SHA512 TLSH

Submit Download

Mar2008_X3DAudio_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\Mar2008_X3DAudio_x64.inf
Size 815B
SHA256 b7dba312a71ed109c9c54cc5cc096096eb8cf0962396e8dc996f8fa28307547c
MD5 2f7b3369825c6b74f4b645ebf52c8e98
SHA1 105972c77223b943df6533d517c698241ddee9b1
SHA512 88a47bc3520f9fbc082f1ddca7e083cff9bdbe5c4a0a851925ea14d8e0f327f2a9982e5b4ac457e4950acdcf6788299c4e13a15ff38bb76c8d212f1466cfcec2
TLSH
T11901829DCC03D532B789F1F17B8B27CB5B27041AEA316518B68A04C4BB7310051AC1FD
MD5 SHA1 SHA512 TLSH

Submit Download

Mar2008_X3DAudio_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\Mar2008_X3DAudio_x86.inf
Size 1KB
SHA256 0b6e28f00364a9ff436c3d99f0d4e80bf615f1450f420122324853cc0b88b16c
MD5 9ab8a749708995453ee8a995a877af2b
SHA1 eb8a0ad7f7b38aa190e2fb8a4a2d11cc9fa9b493
SHA512 9b0ed586fed0ffe25d4076b202afcc7ad580dbb05593e392a12d64b639098f8b7687463f213e53dfbb85616c5a3781adaef8f1ffd293c082a84291472266480b
TLSH
T18A21049DCC0294707685B2B27B8B768F6B670416E961150CB3CB0A90BB73601219D1FE
MD5 SHA1 SHA512 TLSH

Submit Download

Mar2008_XACT_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\Mar2008_XACT_x64.inf
Size 920B
SHA256 1038a41e63ee8abbc8be85a86fafb2ac1d03defa6b88deb270f96a6ed1a97122
MD5 d5debb90aee2d6a73bb448aaa99f985d
SHA1 950ff1a768bdabf14ca2cc6809431c3be8b19d9a
SHA512 dca65e91d4eb619fb34615a3c8683e04af84e843346b88bf4d52cae0c27e52b5a7a417c531eaf50cf45932e3fd6f5fff1bcfeeea4fe65efffbe791c8ac1a8101
TLSH
T13F1190D9CC03C1737699B1F17F47368AA7670407E91113187AC505CE6BA3145919C2F9
MD5 SHA1 SHA512 TLSH

Submit Download

Mar2008_XACT_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\Mar2008_XACT_x86.inf
Size 1KB
SHA256 6b0cc0dc993e172855864fa078c4e5c8f2f46bfc3200bf2ccdf3292931ee3cb2
MD5 e3ad8befca2528572d6c51a15e072c94
SHA1 9718337261b8b93b546a5c20bee8b44d26707053
SHA512 de4915424d8a53ede76394fac14c4de46838f21afc8bf30f560d2d00df4f366dc9ab48bb343be3580087a7d5862a14c08f83b5d9cc8e78aa4cce4e6b71b70c59
TLSH
T14331BCD9C802D1327689B2B1BF4B368E96774407E860161873CA0E9E6BA3245538C4FA
MD5 SHA1 SHA512 TLSH

Submit Download

Mar2008_XAudio_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\Mar2008_XAudio_x64.inf
Size 923B
SHA256 10a2db49dd3bea59133bbd82b3fc0f8a959b65b0c250c11a9a6f3123b961e6e9
MD5 8eab978252843c5c47a913e4eee460b5
SHA1 b5ac7e6a36157c41d56e1113d7768e67530640c0
SHA512 d1b7be4eaba7126f3f64d625cb9c9d16dd40dd1dec96b4d647f9a5e24d6b945faebb65f25348d9ffbe092b03b1a54414cea9a2e4d1eb1deb102ab5abdb34d810
TLSH
T1B31190C5CC43C3737799B0F2BF572E8A57570416ED211648BAD605CD5BA310A52EC1FA
MD5 SHA1 SHA512 TLSH

Submit Download

Mar2008_XAudio_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\Mar2008_XAudio_x86.inf
Size 1KB
SHA256 472bcfb54b5d63377da128596dfb30c8f200f79edaaf6d29de1afcdb71a3413d
MD5 35c6f6f109257f242cfb2ad2062d50c4
SHA1 222406bf52449ff0d5a7ca8ace6cbd3dd5f41708
SHA512 71180d47d8c177d84e68bcd6b9f948dc8c946f7a6c4091e20e04f1c8098b9ba92bde976194b06595834ba4b159a702c091d04ec823ac377b7ba7713f057f99ee
TLSH
T1B6316BC9CC0292717784B1F27F6F3A8F57670416ED61150873D64E9D6BA3206226C1FE
MD5 SHA1 SHA512 TLSH

Submit Download

Mar2008_d3dx10_37_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\Mar2008_d3dx10_37_x64.inf
Size 815B
SHA256 f37681f4d49f71d48b1960c3efac74f28af9fa764b29ed3a40b5f424fc8f60c9
MD5 b21f653f707315be4c85ff4630af305b
SHA1 32b0d69a786a2cd37d2fdf541931d90ae8656944
SHA512 e68348c9413f77749218fa34e55e416c7bac95f234522bb6eccbed1185a3f3af2a393511d3b83dbfc64580e1725f9f53e7e586570d696a3fee76761e8b0902f4
TLSH
T1670166998C039436769AE1F2778BB78A6B270806EA5125187D9E01C8EB6330461AC2E9
MD5 SHA1 SHA512 TLSH

Submit Download

Mar2008_d3dx10_37_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\Mar2008_d3dx10_37_x86.inf
Size 1KB
SHA256 bae3bc2b7071d2d1c657a87a8c8af6c0fb5373f11c9aa5f61b406924717d0792
MD5 1242da12c637d5976af936f60f387c26
SHA1 a6890fa9d41f6785d54a7d3e1b229b64010089ab
SHA512 7fcaf6ac1a8166e8c68d650dfea40bf329565d4ef92316ed0188a252736c9e288cc8f7d017b0de4af05245d1bf94a85b2dc72a93c618a1f2caeda45fd84a6a09
TLSH
T1593105D9D9129030B6D9B6B2BB8F3B8F5A370407F96221587AC90990EB73751128E1FD
MD5 SHA1 SHA512 TLSH

Submit Download

Mar2008_d3dx9_37_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\Mar2008_d3dx9_37_x64.inf
Size 812B
SHA256 a4fda3373241c2748a969ddeeb6ef41b3cc1bca6608362ba87db75f69023fe9c
MD5 ec75fe979fd2c2372ea75c72a905c832
SHA1 954642c9087489285c8f0786b63aee108ec08d04
SHA512 dcaa772d21d1be7fe59f1ad32d10e7cb454ed2a4d98b3add201f8bef03718c29f9915fb4cb779111a954a9d93d898393ac2ba593c2d4d378b88bd492b7b5381b
TLSH
T1B0016B99C802D43677DAE9B27B8B375A6B67050AFA163158799A01C4AF63240116C6EC
MD5 SHA1 SHA512 TLSH

Submit Download

Mar2008_d3dx9_37_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\Mar2008_d3dx9_37_x86.inf
Size 1KB
SHA256 d55858e166a2fe00d4acc30da756f0ab2c4dd5a79a9874eab3100722c74a1b75
MD5 020d1260794d5780937f0f7a919cd62d
SHA1 511ecd1186deaf129a5532b79fc776a9ab8fa9be
SHA512 201e24e51dd859c35fa9d0a403993cb0b2eba67effbc598ca4491f05bff4f0805731b1e7cf6026b7dff9fbc3167c16b43887f080fa40ac11c6ffe09297401f9f
TLSH
T11A3157DDC802E4307B94B6B2BB9F375F1A27450BEA61310973CA0990AFB3341115E2F8
MD5 SHA1 SHA512 TLSH

Submit Download

Mar2009_X3DAudio_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\Mar2009_X3DAudio_x64.inf
Size 815B
SHA256 4da1a6bbcb7e84073dcd1898f854702ec32f5324478b2fa39c4a9868abeecd3b
MD5 5e65d9cfe5f15381afe2016508800dca
SHA1 93a44fa2bd9559929c4ed459a336e1cc27738f90
SHA512 9ab50d72212f79f949679b7e7c19f698f2b1c6f1d695555d925b7cdcff800a14fc98535476150a15c563eab74d8a98316f44027b0e3ad2834735a6f94aa07646
TLSH
T1FE016F99CC03D5327A89F1F17B8B278B1B27041AEA217518F68A04C8ABA310051AC1ED
MD5 SHA1 SHA512 TLSH

Submit Download

Mar2009_X3DAudio_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\Mar2009_X3DAudio_x86.inf
Size 1KB
SHA256 aabd029d75f25244bae4ca17dbf9c4feebec0d5f121fcd388c175c3360be1bac
MD5 c1501e224e63e7c7fbdbfb7734a8e4f0
SHA1 c6aff4de1b44499d304649b782346b0a6decdbd8
SHA512 e29f985810029a43a987ba45c905aae84d0615330e6fcedf81806a403f59c8861fdbb31935b0c610378d8131d38ac6798c778f5c6fada9f51838cd8a8cfcaa99
TLSH
T153212699CC0294707689B2B27F8F768F5B670417E9612508B3CB0A94BBB3701259D5FE
MD5 SHA1 SHA512 TLSH

Submit Download

Mar2009_XACT_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\Mar2009_XACT_x64.inf
Size 920B
SHA256 9369fb0a9d3353627c097fc19780e5e7126af47766ef6a4a95ff3ddcca56691e
MD5 eb9c537b01096960889de48d1a13725a
SHA1 205f797be95c576f2b15760a25440f532011332c
SHA512 c82ecd2c952b1df01e6c7f7858341c62b36330945dfd0c6bdc404d14bee5682ca06a19448961e03a2093ea00040fd38ce60c126b9f155607b7435b28f74055f6
TLSH
T1E71190D9CC03C1337789B1F17F47368AA7670407E91117087BC505CE6BA3101919C2F9
MD5 SHA1 SHA512 TLSH

Submit Download

Mar2009_XACT_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\Mar2009_XACT_x86.inf
Size 1KB
SHA256 764c3caeb1725a11701ca7119fdc49b3219553b79f9a5c1a02b20991391e5a21
MD5 25b4458970583bd63b3e21ca5eda19b4
SHA1 a41a7c318342365d64f94da5c2b9d0490895d684
SHA512 4239e25d6701e28a58424361d2bbcd27abcd91308ee2b5abde611304b0c2caf3cd807c8aaf3665569a565664b12c53e17aca73703ece809b9f26487d9f9a3778
TLSH
T17131BCD9D803D1317789B271BF4B368E96774407E860160873CA0F9E6BA3301528C4FA
MD5 SHA1 SHA512 TLSH

Submit Download

Mar2009_XAudio_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\Mar2009_XAudio_x64.inf
Size 923B
SHA256 4a554d09934581a87a4cc98749b525b6794947b64b8414d380edfd502713f9b6
MD5 8d2a8bbe89cd936282ff828c10ae57ad
SHA1 acdedc9919abeead28ef07da56ea33f88c45c3a7
SHA512 69ee567df6d9edf90a6a2a882b745597fe0720af3eaa0f23ae7241e7519aee5af435566bb1e0cd8b2f6bf6956b21f73d7af9d8e9511afe48a54f68f440aea2c1
TLSH
T1E41190C5CC43C3337789B0F2BF472E8A57570416ED211648BAE605CD5BA350652EC1F9
MD5 SHA1 SHA512 TLSH

Submit Download

Mar2009_XAudio_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\Mar2009_XAudio_x86.inf
Size 1KB
SHA256 1b66e4d80f9843fc73b0a6097fb8ed5f3d2cfd5cfb5c328904d2c370bd87bb3e
MD5 ce1394e17492dac92e0257482272617c
SHA1 f1babf395b608a9966cb5d89d85d131ce8263576
SHA512 c5b800c6d519d147e37b459b3c667d2e05b6e344ac38be69aee40dc1e20b232c9a123f0f6ec8fb5909ba8d76fbb24a626ffb2f76b08bb3d3984d6ad6541d6a9c
TLSH
T1E03148C98C0392717784B1F27F5B3A8F57670416ED61114873E64F996BA3702216C1FD
MD5 SHA1 SHA512 TLSH

Submit Download

Mar2009_d3dx10_41_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\Mar2009_d3dx10_41_x64.inf
Size 815B
SHA256 53dc284b87f5787804823977d2fbb528e393829367db5d2ac5dd79c581a27616
MD5 d9bc0224ff859db21a9f684ff138cbae
SHA1 dd4f2ecdc2a7801588166d92d6e6aaf769bb3627
SHA512 29d5c1e3b54e79e322a966d954935a31aa7108aa31f04e711e36efbdabdbbd3282ff56df9d640fe48f8707d55a7af435c83b7f281177d4d5bf01364786596ff2
TLSH
T167018E9DCC03D436768AF1F27787674B6B270816EE5125287DDA04C4EB63304516C2F9
MD5 SHA1 SHA512 TLSH

Submit Download

Mar2009_d3dx10_41_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\Mar2009_d3dx10_41_x86.inf
Size 1KB
SHA256 0170a4b551b58d92a753e86793bf3af762fe3f8d781512f710a4d661aec8d626
MD5 6f64b88a71edf6070f48277cc7e22125
SHA1 1c77aace8a83ecb9a388bdee2aaf38e78af08ac5
SHA512 4349bed85d5c42f921005ad6915571b680cbf178dc1c9fc8f218dbda7cc34b76647edfa324d3c529dfba18da800bc010623a6ee8b34a5ede0a447d1e7dc93827
TLSH
T1BA31F299DD139030B6C9B6B2BB8F3A8F5B370407EA6221687AC90890AB73651124D1BD
MD5 SHA1 SHA512 TLSH

Submit Download

Mar2009_d3dx9_41_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\Mar2009_d3dx9_41_x64.inf
Size 812B
SHA256 12fe918aeb224a9bd4d2a8142f97c95d58a9a69e591e7e4f95014c155bb03519
MD5 d4a1295d35748a262f28c2d3ed7a116f
SHA1 f6794d7a852b3f56e93fcded600077220ebfef74
SHA512 79a2c575482ebeb4157971c07df42c76b42fca1b00e213f3f311935977bc27c86ecee6b387d93e9dadee06bdbcd6d4edbd72ca0a66925eaee547f1bd195e7f02
TLSH
T183018E9DCC02D43676DAF9B27B8B274B6767061AFB12315879DA01C4AF73240116C6FC
MD5 SHA1 SHA512 TLSH

Submit Download

Mar2009_d3dx9_41_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\Mar2009_d3dx9_41_x86.inf
Size 1KB
SHA256 bd29711cc2ecd924990167ffa95f48842e24aeed3acef1023717040240b4bbb6
MD5 b37a5ff044eb65521a290c79ba1a3e00
SHA1 ed505464894bd3e52654834487f3821ae117edfe
SHA512 eae4408cfa7f9c39b101489688cc570a184b8a57f3d20d3b0452a581fb80c4f485dc2f512a39669a92a5bde81fbf474e1585f566ff482e87610780c23126c21e
TLSH
T12D3157DDCC02E4307A94B6B27BAF364F5727460BEA61310977C90990AFB3341115D2F8
MD5 SHA1 SHA512 TLSH

Submit Download

Nov2008_X3DAudio_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\Nov2008_X3DAudio_x64.inf
Size 815B
SHA256 d04d052fa3065cdf00e96bcdd7dabf3583ef10b6d80fd67cb03c32f09f2e602d
MD5 fe8f918218c40fcc007bf16e9cf0b76f
SHA1 2b66a5a714bc7a0ebdccb0029e179bb3f32009e5
SHA512 9845d8d2c0c0c618594e692abb382e4244d95f5a06c48d7ae694dd09ada670ff23bab07fbfd09310f60f6684267ed0709a1d146da6fbbecef4790b9373840b2b
TLSH
T1AE018299CC43D532B689F1F17B8B27CB1B27041AEB316518B68A04C4BB7310061AC5FD
MD5 SHA1 SHA512 TLSH

Submit Download

Nov2008_X3DAudio_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\Nov2008_X3DAudio_x86.inf
Size 1KB
SHA256 d0361ffe046b7a7a374a4938d419e4121365892e4f2138899f670619ab34ac6a
MD5 e8adbd1e68258d5657a34ea722f3bd32
SHA1 ae4e88d17663889e841992436b524a35506ee534
SHA512 62b132cbde7afebaf20a437b810ea42b7c782eff4fa1f83e2e586b2fd9303829ac90c54704e28f53010a8487e04bf92b791c85fff4c949a12cdff2132c2b09de
TLSH
T120212699CC42E470B685B2B2BF8F7A8F5B670417E9611508B3CB0A90BB73701219D5FE
MD5 SHA1 SHA512 TLSH

Submit Download

Nov2008_XACT_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\Nov2008_XACT_x64.inf
Size 920B
SHA256 2d8a68e726728e4f4be05e35fca812b855046ce4bf697f0dea14094dbd7e1d79
MD5 d28248a55a7747733c0e4356c1a15d70
SHA1 befab66a5faf1889c6eb2208698874b00024b78c
SHA512 f7b89d96e287ddf8200462c4eb0415f2fec81b7a69e5fd4bd5bd33cfc805287d287dc403060b01639cdb67b14ebe65e42f75c3a1fabbcaf8692d315cd5bf45a7
TLSH
T17F117D9DC803C133B78AB1F27F47368AA7670407EA1113087AC505CB6FA3101919C2F9
MD5 SHA1 SHA512 TLSH

Submit Download

Nov2008_XACT_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\Nov2008_XACT_x86.inf
Size 1KB
SHA256 31680e7a90d24eda04c910e1f3e6c02774cfc5c36ae08e7ac043665264702f83
MD5 87c8d16c6db20854f9610bd5be6e5ae5
SHA1 c17d78456637cc2a67b35d48f9cb3c730526425a
SHA512 061d80816e2e5a7a2df68cd91a95e5f17aae8610a18b254abb7d5929826b14da5755eb01912eb369d1fb5725f2a4c144ce92e0d08b61799903d83fc91f35413e
TLSH
T16731ADDDC802D5317785B272BF5B368EA6774407EA60160C73CA0ADF6FA3201528C4FA
MD5 SHA1 SHA512 TLSH

Submit Download

Nov2008_XAudio_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\Nov2008_XAudio_x64.inf
Size 923B
SHA256 ed20b160dd26a5ed3c220a1fd9b5fc880b3280ebf56c2f73e76b6d4da5ef82bd
MD5 318d70544da7620126540b0712200e7b
SHA1 707c4a04f02e10b08a16528b0da8b284cfa315c9
SHA512 4acbf6b35043ffe9c740e3e48fd9320e10f5dbe317dd89dcb97b68495b60cc2cb2cd98e57fad030ed053636b710d344b96667b69bec4b7727ba2508f35f23aeb
TLSH
T1C4117D89CC438633B78AB0F2BF472A8A57570416ED211248BA9605CD5BA310652AC1E9
MD5 SHA1 SHA512 TLSH

Submit Download

Nov2008_XAudio_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\Nov2008_XAudio_x86.inf
Size 1KB
SHA256 950b5aef596fc5048732f6cf263dfca5bcc25df7dc17df91efcbc3551751a3b3
MD5 052b3294a9345385406ac2056e724804
SHA1 79372406f5cf40deefd8ada18ba238e80360ac70
SHA512 9b0cff2968acd2552609169a138d40fcc25ff2c35b70ba61cabf769f4e5b54774f32392508867b6ed9198b3da5a858b3a7079d7c4a4ddb31f63e4d4985efd2bd
TLSH
T1023159CD8C029A717784B1B27F5F3A8F67670416ED61110C73D64ED96BA3202216C1FD
MD5 SHA1 SHA512 TLSH

Submit Download

Nov2008_d3dx10_40_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\Nov2008_d3dx10_40_x64.inf
Size 815B
SHA256 7f902d9ce6f6d71be1d16997ffc9661be2540522c73cc185516415a52dced2a5
MD5 f0769f57bd08036d669104f9bc942228
SHA1 18fd51cbdb46f1ffd47103dc026f1cabf4e4868c
SHA512 427acfacf52759a1ebd749022c375767fc283a625b6773e06f8965926e0b96a969a27a440bd661015b56eeffa6decce7322e43974172966520c9ea5f6164914e
TLSH
T122018E9DCC13D436769AF1F27787674B1B270806EE5125287EDA04C4FB63304516C2F9
MD5 SHA1 SHA512 TLSH

Submit Download

Nov2008_d3dx10_40_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\Nov2008_d3dx10_40_x86.inf
Size 1KB
SHA256 a4eed39cf36adccac4317e5822b30aa37ac5b001bcf4a24f7b5ccac6b8b71e9d
MD5 7a3a4c3b7c9c979261ab1fe477809731
SHA1 545004e59315dea0bcee6bde61bde3c45f79d107
SHA512 556cf8ff26de695e39aa42fbbfe0bb986fca9ecdc08209c28404aa1b285cba8bc4ba62659fd0d929d138c781446fdcf2a30c0e1aa1487f6f1d75c9f15145c7bd
TLSH
T1C431F499C922903176C5B6B2BB8F364F5B370407EA6221687BC90890AB73751124D1BD
MD5 SHA1 SHA512 TLSH

Submit Download

Nov2008_d3dx9_40_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\Nov2008_d3dx9_40_x64.inf
Size 812B
SHA256 d071b30f56763506da0c939b8d35b0540bef3ef0d51a5cfbc45816ca91f891a3
MD5 4f4a9d3074a4ce8fa141a17b0c2e97c5
SHA1 e77b4e76ef70fb08befd69a03b9f5dcf02c81428
SHA512 7b961d3b9ed247e75047a5bac6d65ed741fb3c210fadfb23d4b77653af7001fd557fecbc2bfacac00188894374ec7ef3b0a5c1b1f6ddb0c9ad3ee3dcd1f32027
TLSH
T1A3016B99CC02D47677EAE9F27B8B274A2767050AFA123158799A01C4AF63240116C6EC
MD5 SHA1 SHA512 TLSH

Submit Download

Nov2008_d3dx9_40_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\Nov2008_d3dx9_40_x86.inf
Size 1KB
SHA256 955637638635025f01f82febab4a4977252a765439d90ce940fba752723b9db6
MD5 d9f6cb1edf9f92a045f4b2b8ec17cdb9
SHA1 fb362c8de21847523211fa512cdbf73e5b49aa60
SHA512 e22fa0520dd3f905b5170e3ede4d9b9e40b0522c9b39308d150c01e5bc381949d70ce04818efa9eb2a08bcc3b26f2179db9a5aa1a5d14d757ee2dd2c5c3cfae5
TLSH
T1853146DD8C02E4317B94B6F27B9F364F1727450BEA61310977C90990ABB3341125D2F8
MD5 SHA1 SHA512 TLSH

Submit Download

X3DAudio1_3.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\X3DAudio1_3.dll
Size 25KB
SHA256 74ec3e6b253af1b68252e62a5c08479453b3341d49c606adcf36913fe9ed9717
MD5 c593fd0a96ee4b6390b653c4c641313f
SHA1 60d71ca2eed9ff8afa5561cf1dccca03607134b0
SHA512 1bb328d1a68dd7b7657d033bc2bcb8e2c096bc591e435b5691a4ad4f0f49cfad70d4e48af48d10eaf4ad13d479a3f4fef66b09a0852f8c61ff33937c7ea22190
SSDEEP 384:h/7QkuMZrV3GpOJ/jUKduAdjFW5qW/znELKt8Cy/j6k:lrV3GpO7XjwMU8Cy/j6k
TLSH
T14BB24D82AA3CC102F9991DB1227DFC833C3DEBC54B26C2E32196B4D84D663D46BF5569
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

X3DAudio1_4.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\X3DAudio1_4.dll
Size 25KB
SHA256 799b38139523a3b30d26e21798ee705375c61eed8ae2434fddb52fde51f4bb78
MD5 e3832514bd21236067b7227f6165ef95
SHA1 bdde126bfa7e3133f33e3d3e7b4618422c61acac
SHA512 e60bb2b8cea5864f3311dbc0ad8f7813764bd55153bc0554e2842b6973fe24a1ce9e4381fc6fb05792d97799fb247d591e15b7dc41eec2bf563bd4f7ca797d85
SSDEEP 384:znqkuMZYV3G5OJ/jUKKu7d7lWZtWyv+DEnELKt8Cu1jC:zn1YV3G5OcM7w9ChU8Cu1jC
TLSH
T120B25B81AA3CC102F9952DB1227DF8833C3DEBC54B2286E32197B4DC49663D0AFF5569
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

X3DAudio1_5.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\X3DAudio1_5.dll
Size 22KB
SHA256 315944bb2a1959c8a4bd2677ed415363e1611c7351ce55319dc98fd2aac83f87
MD5 350fefe18b86bd4d9ab2a96d00215a49
SHA1 be4ddfa0edc3a463471fc170e9706abac0a672fc
SHA512 490bdd66920e36aaba2a4d12bfe4aacbead7403b1a623bead0d9ab5f68d80f46fa530c5f7de9e747eb8acbfbec8c635aea32655dddcb6a9d8e006339e1e8857f
SSDEEP 384:4nqkuMZYV3G5OJ/jUKKu7dg1W8sWvv+DxELKt8G/jP4V:4n1YV3G5OcMgF5CWU8G/jQV
TLSH
T102A25B41A63DC112F9991DF0127DF887383EEBD54B2282E3219770D889663D0AFF656A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

X3DAudio1_6.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\X3DAudio1_6.dll
Size 21KB
SHA256 574d14ab9a641c6cbadd78f2cd6c088b64b59c3646057952e63cad7d2778e1c3
MD5 e763798cad2a90b6ab61854f50cd47dd
SHA1 419f2c98d2a3f419db1b1e9b5f4f7c3b9b636c1d
SHA512 b455b0078786b7ff8362f7404095037a5332603383707a6dd493f381eae3e28135696fb4863e1915ea01c0f12ce10d021a18ab91cbab06b4d20142e0b38833fd
SSDEEP 384:MnqkuMZbV3G5OJ/jUKKu7dzRWGvWpv+DjPLz4qjpv7:Mn1bV3G5OcMzPoCfz4qjpv7
TLSH
T1E1A26C45AA3D8111FAA51DF0227DF897383EEB944B2282E3115374D886653D0AFFA17A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

X3DAudio1_7.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\X3DAudio1_7.dll
Size 21KB
SHA256 288c701bdedf1d45c63dd0b7d424a752f8819f90feb5088c582f76bc98970ba3
MD5 c811e70c8804cfff719038250a43b464
SHA1 ec48da45888ccea388da1425d5322f5ee9285282
SHA512 09f2f4d412485ef69aceacc90637c90fad25874f534433811c5ed88225285559db1d981a3ab7bc3a20336e96fb43b4801b4b48a3668c64c21436ee3ea3c32f45
SSDEEP 384:hd8NTutwAV7uTOJ/jUKdiAdzJWZuW8lLXci2jXHUcwVP:hmAV7uTO7jzU8Mi2jXHUcwVP
TLSH
T14CA27C55BA7DC112E9A819F0217EFC873C3DEB944B1282E3119270DCCA653D0AFF9666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XAPOFX1_0.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\XAPOFX1_0.dll
Size 63KB
SHA256 8b396d275de2550af8ada6a1ff71f0f4870b51c8407e44044c2dde7ad6b754cc
MD5 dd165760f1b95200a3da2d9dfdb84234
SHA1 0724300a1cbaa32e03a234cf6080a67967c335d3
SHA512 eb130afda1481dd0e27a19330a8be8045b3172e46edcc5a0cb089e191fe415c41cfbdf3af8f084a6ff58f89cf8d7d4d0879a3bae8f93a52ffc84da2d4fec5ccc
SSDEEP 768:A067GrY1hLDfBUKqdF/VwcrCZ0LYQBjtOApay/L/iIl46o2W7VERSw0CzImXU8C7:0GrYjSLuiLZ3phDouN0CDE8Cy/Q
TLSH
T1C0535C02ACE9C3B3E8A924F1957E74A3383DC7C55B1489C3235446D8DDA27D06FF92A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XAPOFX1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\XAPOFX1_1.dll
Size 67KB
SHA256 5ab63c0f040fdf65e681eba4daa55ed83e89ea10c426dc2fc763da0fc94f3ace
MD5 d95eaabf5d277ef91d9ca70151209e56
SHA1 3d47ebbd6236045309d2222a696b7141c0957379
SHA512 6d2e73468485fee2b4007f1fdf16381cdd6c77edbe5530f63cbf8696646b14d06100fdf54a48547f29ea5775f29226b16808a5a1bd4c0778413855f80e5b8259
SSDEEP 768:A67GrYuRIzYVLBBnRuURo0fXqawZhOHCcV5LwX0lH5QHmO7VEameJImpHwuaU8Cw:bGrYgLzXCaLCcoXuKImuuT8Cy/X
TLSH
T11E634A42A9E9C3B2F8A929F1887E75A3783CC7C45B1489C3234446D4DDA17D06FF929E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XAPOFX1_2.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\XAPOFX1_2.dll
Size 69KB
SHA256 d1a55061bcb42f69b7cf35e2985d48e30c7a90f0bc668e90390f465b36bd0161
MD5 295e47a75f278580f9441041eaaea3d2
SHA1 0716ca729ca3d84e9dfb4bd97c1e12466cc68625
SHA512 a3cee1d45759fe3323fe8c3c49600856a86b61b3174c4d9c71e58a95db4848683c71605f5bd8c04bec591da02d96b79c68c1135410930ca63d17f7a929f2dc4c
SSDEEP 768:767GrYZf/xgB0mGc540RYvu0mSyak70clVVtLVXrTHl4TFdKw8bBS7VEBBqYdRji:MGrY7ZYMuOyV0cJ7TlPsu9dRJO08G/M
TLSH
T1AF633A026CE9C3B2F46918B1D8BE3967383CCB845B258AC3235446D1DDF17D06EF92A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XAPOFX1_3.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\XAPOFX1_3.dll
Size 67KB
SHA256 c6956ac2ee59f71e86784138b5443de6970a1274ac161945b8a44dc1d535db84
MD5 c4479a4547390e3c5ef28d453abde4f5
SHA1 9b3af3d2ffcf52cc6628cb486372be2870771637
SHA512 94a55bbff8a285d6b91ae72b70664b2c1a067890db175e20265be2d57a4b29deec52f08f0aba8ae07ed30dfcf96889ab835b971d2bf567758d3f7b881a7e5324
SSDEEP 768:067GrY37QTI6BuVHMp4k74J+DHVKiBkReLhnrTHlaD+Ww8bYF7VEoU9N50746dNn:fGrY/ds4+7IiB3rTKPsuXN5Z6ReZ/E
TLSH
T14C633A426CE9C7B6F4A819F1D4BE35A7383CCB845B248AC3225445E0D9F17D06EFD2A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XAPOFX1_3.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\XAPOFX1_3.dll
Size 67KB
SHA256 b05ad9417028b9777f69422caa01ae9fd22c7bfe542bc6e7de2649e28a4ea643
MD5 30686ece80545e06d78d156eb9f7d463
SHA1 b257ba4ffad8003fb7d12e9babd3cf4e88bd52f9
SHA512 ca03bb01d8e2608517462597076bfa96f4b2595c33b2635d80e4348ac3926e17c93e5db30d7e43c30277cf8ac07f982a0c729f83a00df8965993d4f0758eca13
SSDEEP 1536:sGrY/ds4+7IiB3rTKPsuXN5Z6RkqrHUAv:VYK1IiB3knZgkqoO
TLSH
T1E3634B026CE9C7B6F4A819F1D4BE35A7383CCB845B248AC3225445E4D9F17D06EFD2A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XAPOFX1_4.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\XAPOFX1_4.dll
Size 72KB
SHA256 0aee44b12913a95840ee6431d90518b0d72c54a27392e21ee6995e2151554a06
MD5 e4ce2af32f501a7f7dddd908704a0ee6
SHA1 9dc2976efb15b6fba08bebdeb98929b6961063a5
SHA512 ec14a58414d595a36c6b575cdae690f11481cd3f0b35fd2f4c6a6d162a6272882cfe03da865e09a34972775790529f51c80b69056a2fcb909f25b549ed2f7f01
SSDEEP 1536:1/GrYvIGDi/t+YoCBlrT8EGscPCEBu0OI+k95M:qYw/VoCBl0EGsjEh1+k95M
TLSH
T11D734C026CF9C6F2F46468F5D4BD39A73838CA84A7248AC3625445D1D9F07E0AEF93B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XAPOFX1_5.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\XAPOFX1_5.dll
Size 72KB
SHA256 becfdcd6b16523573cb52df87aa7d993f1b345ba903d0618c3b36535c3800197
MD5 8a4cebf34370d689e198e6673c1f2c40
SHA1 b7e3d60f62d8655a68e2faf26c0c04394c214f20
SHA512 d612e2d8a164408ab2d6b962f1b6d3531aed8a0b1aba73291fa5155a6022d078b353512fb3f6fff97ee369918b1802a6103b31316b03db4fa3010b1bf31f35fb
SSDEEP 1536:YGrYa/nsaXTeizHgMK7DaCsVtqqXtF9rHU8:pY8saCizgMKXaCezXL9o8
TLSH
T1D3734C01A8E9C2F6E45828F5E4AE39973C38CE984B2085C3635845D5DDB47E07AF93F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XAudio2_0.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\XAudio2_0.dll
Size 468KB
SHA256 e435b73193bdf651f7ae564eba05266595ac672db45e0e22dce92d0bcb3c6513
MD5 418cdc57e55ee79c3f86c13a19b3d5e3
SHA1 cac2b8396b1c82a6f7ee2a3e3ec3d2e4c2f869fe
SHA512 1ba5a49d9102911d13d86ac4f0e4ecb44069c93a58e2e3225d9464755c14f8d57f230eb32049c2747385f7cbaa9c0da0f6001f27b685eebfcd94f3f5b8fa3250
SSDEEP 12288:KvZK6d3YVzHqrMRiq6awUw8fhktee5Zqfgx:Kl3kKQR6aKoktz5Z1x
TLSH
T12FA42A22B4425235C9F722F189AF3339673CC78557451AD712E4AAF8BE922D03F705EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XAudio2_1.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\XAudio2_1.dll
Size 495KB
SHA256 32a7c6a4edef46f025a4a5c64b892e29baaae948e86d9ed49e82014eec1441de
MD5 e34ff0115b1ee3b4e03d22ae9840ee03
SHA1 746e6e84ff7f630643ff9381b9dff1f40a49ca16
SHA512 7448bb3ebb8815e13e14514c8580dfb7f6de1a96c90f6611f6766dfb48ae7bc4a06efdc493060c054f222e7d9b308e062e1cabb19a60f50ff9e20f06905df58d
SSDEEP 12288:U+kF4Wm720dvyXYID3ZoIAl0mlCwaLU5jy2sg0:7i4LWZoIALCwJ5jj0
TLSH
T14FB42912B0528279C9F722F185AE333B6738C78557451AD713E499F8AED22E03FB05DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XAudio2_2.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\XAudio2_2.dll
Size 497KB
SHA256 9c7897b4ee1bcd190b1c0b7b77e64ee731d234764683a1e2286af70d86b62753
MD5 50f4a0d5e6a0bafefa78f353533b8e06
SHA1 d370434eea3a557ed77b2363dfac720a5ed98666
SHA512 7686b893996b76a25ca7da971ca3a10400dcc682a05e8317a9d159a9317537de0bc20dfdef643e85e6ee548d7893138497fc156f77534124a8eb3e3ce47f0cb0
SSDEEP 12288:Pt6JzrSlO3i8zRHaoJQ4obpFNbntcgR0jNg5:P6rtnJQ4oxbnqgRl5
TLSH
T1FAB43A12B1528275C9F722F184AE333B2738C78557451AD713E899F9AED22E03FB05DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XAudio2_3.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\XAudio2_3.dll
Size 502KB
SHA256 04dec9d7c68962e01efec0aac0ef7a3499bc4c16e8a41bd61fe6641da48d7dcc
MD5 47ed15dc87ae334c13c4dacd1be2cced
SHA1 54f94839c4e4d798a1f4f1fb6ee240957a738cb0
SHA512 da0707a153172c48036d885404035829ea251b7df5a9246fc05dd164ceae9604cb0cc931b85d77151bc613cd5e7e4d0430a4fd92697c8bbc8faf5fcfd1c140c4
SSDEEP 12288:eXbVf0r2Z3aTCHB7yKF50IwGgp2vfDmpcwXfHQ:Ac850IwMvf6pce/Q
TLSH
T107B43A12A0528275C9F722F185AE333B2738CB8457451AD713E899F9EED21E07FB05DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XAudio2_4.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\XAudio2_4.dll
Size 505KB
SHA256 bcde4317debd0052b1436a6fda60e1dcb1e308979498117fa0cb50061f38101c
MD5 e684c5fa18adf9ea14737757413bf727
SHA1 1dd454144e8c0f3aaf24db0b77f03737914d9a72
SHA512 9686f92745a30fd9e442ff6a24dd89410aa483ccd46edbefce0fe378645292255a323e1aae146180e8a4ecd15765a996df959a302d5cdbc6dfa4c5fcb8252e4d
SSDEEP 12288:NhjmdIM0IBVwL/DvIL5jXxq5DUz1syLqVWQr:NssbijXxqm1sGqVjr
TLSH
T1BCB42A12A4528275C9F622F184AE333B2738CB8457451AD713E499F9FED21E03FB15EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XAudio2_5.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\XAudio2_5.dll
Size 503KB
SHA256 c596de2ab8394fb62538fef0b4657317f4ead50a6d798c5d066e25e334576c27
MD5 8b01fb723f3b30ab3debddbf97cfe577
SHA1 e379c3b7d0a66da06b6a381deea19bc541ee0689
SHA512 ba8c5bf7eb657bce6e2c937e082b97bd6169d1cf3daa5800e5112d62596bdea47e5c1f23146f3f696cd68e8def4df92e3fb24a9aa8b9a08320738b66fa6dfe2e
SSDEEP 12288:Mp6zTNTlhHZIrT0MwCyJQgk8N/q1aifw9CSvo:MVMXJQgkj1amw9xvo
TLSH
T166B42912A4528275C9F722F185AE333B2738C78457451AD713E899F9EED22E07FB01DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XAudio2_6.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\XAudio2_6.dll
Size 515KB
SHA256 61b57170f7c6365714396072d22cb98746718c0f44c9f0d5c62fdb1b218639c7
MD5 4976243bd70fae3d1d24e49739ab2710
SHA1 6ef27b10bcf4e697fe77c3e964b326be11e4444f
SHA512 af2d6aaad44bed880a1a2ee947618b142c76a5eca42d4608196b74df9108a9649059d8207e84a58b76ad43aefe9b66ffcc519f8126667177011cf4199f163e83
SSDEEP 12288:QWi8lqH+P+wCS+OlElME9IdMANXtaDWzF6xuwEiS:QBtZEPMAN0WzoxuwhS
TLSH
T17CB43A12A4528275C9F722F184AE333B2738CB8457451AD753E499F9EED21E07FB01EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XAudio2_7.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\XAudio2_7.dll
Size 514KB
SHA256 d1690b602cb317f7f1e1e13e3fc5819ad8b5b38a92d812078afb1b408ccc4b69
MD5 81dfddfb401d663ba7e6ad1c80364216
SHA1 c32d682767df128cd8e819cb5571ed89ab734961
SHA512 7267db764f23ad67e9f171cf07ff919c70681f3bf365331ae29d979164392c6bc6723441b04b98ab99c7724274b270557e75b814fb12c421188fb164b8ca837c
SSDEEP 12288:Tcn8HWZeKA6SKE8bZiCENnOgQs/WIOPtm:T98+hIBENODs/WNtm
TLSH
T145B42A12B0418275C5F726F185AE333B27388B8557411AD753E899F9EEE22E07EB01DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

apr2005_d3dx9_25_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\apr2005_d3dx9_25_x64.inf
Size 806B
SHA256 3d97810d00ceb3e7674a2ef81427d4180f77f93f9454837c5933fbc6a1ad5c1d
MD5 f052926f0715b88b23ad52855b34df46
SHA1 c411b1ddee73a4b317d652bc3ec159ed58efffa8
SHA512 8fad81eeb503d81b96c098190b5c4155f4bfe1cf2f36fdb5834a176c7c78d11b52efb6b3ba6f3168d7a21a1fc5e53fec770d125feaecd7d1cfad9cb1106d0b94
TLSH
T1E2018E9ACC03D43976CAF1B27B8B374B27B70907EB11255879CA0184EB33244716C6E8
MD5 SHA1 SHA512 TLSH

Submit Download

apr2005_d3dx9_25_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\apr2005_d3dx9_25_x86.inf
Size 1KB
SHA256 f484ef48e0c6e2be8207d8c8c7308dd966d52bea1fde221b927d3e49f1cab0b7
MD5 bae5034d79a545ce120f2c336de0f68a
SHA1 7276af2015696d5041214fa92eff4375b3d8b183
SHA512 be58875949d23732ff63a6f505b242a44811cb9603a9863d6a78a4c9193b6336b89ec9a82666865888590a7b81ad99d466a3847e7c22d0de399d476364280a22
TLSH
T1244125DA8802D5347798B2B2B79F3B8F5B77451BED62214973C50980AFB3361264D2B8
MD5 SHA1 SHA512 TLSH

Submit Download

apr2006_d3dx9_30_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\apr2006_d3dx9_30_x64.inf
Size 806B
SHA256 b70b8f62a2459580d22999301f1823bcb8a9bef54bd33b38e0af274a3a12e010
MD5 5d684b07779ae5b421e23167e2b9b44a
SHA1 1e3570908b810cc799f047221351cac7a3583787
SHA512 6688f5a9952b36a0a83e806c9be99d9ffe9ba4982b76a9c7e8cef5f824c17ffe9e5ad9ef4e4974c6e2a9cb37e8c05584d8d83033182d1c5d00a786bd2b693e23
TLSH
T18E0189D9CC03D47A76DAF1F27B8B378B27770907AA21255879CB0184EB33240616C6F8
MD5 SHA1 SHA512 TLSH

Submit Download

apr2006_d3dx9_30_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\apr2006_d3dx9_30_x86.inf
Size 1KB
SHA256 373cca07c0ceffa72901441219a4457de9ff110aededae5e4818588da39cd344
MD5 a49046c25439fa900b1d1bf826506ce3
SHA1 deb71dad1d55dc5af2f80a1c3010c0d899bec187
SHA512 d3e04f2e7b358faaefdd683e7ede8a41c2f65b7c8072754b03b2a5de416651f92712fa7d9bc6027d7326dc5bd8a497161685c04cbb7bb36a384aeee8dd77b086
TLSH
T1604123D98802D5357699F2F2B79F378F5B37491BED61214972C60980AFB3361224D2F8
MD5 SHA1 SHA512 TLSH

Submit Download

apr2006_mdx1_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\apr2006_mdx1_x86.inf
Size 2KB
SHA256 2546a1875bf868edc621a1cd0ee262151faa08762bcced0117e1304eace0c04d
MD5 2ca62bfeb43facdd1fc06f20fb20397b
SHA1 ffbb8f6a8a11f949ca180a7e73279c4b775bbbb4
SHA512 3d16b07bbfd172dfa979dfcf4384baff35538de371dfd0b266e5110772f0751f9e5274fa92b06d1f289f8aaa585ca1fe382f8469561e74e343f37e8a05f85dbb
TLSH
T159417BE4E8015036F29AF1E27BDB274B172F14479C39218CB1D98344E7BBAC2125C4BD
MD5 SHA1 SHA512 TLSH

Submit Download

apr2006_xact_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\apr2006_xact_x64.inf
Size 908B
SHA256 d9c3216ada5dd7791ca852a8ea97765f94a7b56fed27b20916b5067eb82b14d0
MD5 09c9b7346b65f5ba209934f16e711c8a
SHA1 9d6cf0fe295475c438fce214d9d24d5579f2f29e
SHA512 26b84a457b5bd17a5deba56926af156a2144213a2b75fb015641a7817fd2307cfb439ca22ec0bb584dd21f8f9e4c7b3cc749a350b26cfcd0257f5fbda23fd9c6
TLSH
T1BE119CD9CC4380367F89F7B1BF47274B97770827AC211249BAC6058D9BE3141A1DC1E9
MD5 SHA1 SHA512 TLSH

Submit Download

apr2006_xact_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\apr2006_xact_x86.inf
Size 1KB
SHA256 037db252501fd0e30303c11706d804d9eabbf319d0b4e88181ef8f297b4fef8e
MD5 f67df97463d42bedc122fbedc37096c4
SHA1 42cde962b355cb3c6a7a7a88c8dc315f811a7494
SHA512 93815abbd6b6666438adb146bff476aa2728aa7475178259fea623dbfdae819bcf1accddddb7695ef23bb2913d234264ad2ec826bda6eae5d99459798b032144
TLSH
T19C3178D9880391317A94F372BF4F364FD7770816ED22010967CA4AC9ABE324266DC5FA
MD5 SHA1 SHA512 TLSH

Submit Download

apr2006_xinput_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\apr2006_xinput_x64.inf
Size 854B
SHA256 f9d01e93e547045e1d232242c900530dfdfa54698586c7049281965e3bd01ca2
MD5 019f21ca754cc2e21d97c3a2a97d5ef6
SHA1 54d97b4018e0cd04c63f1221cd8da7a0990a2cb0
SHA512 0c0ef6a8bbc05eb81cdba8aa2c3f4a0d39f4859b6de495c79f813894253ad1ddca4851841064cadfb1901ea1f056c68560aae1e68bd12c590a143a6b7f0b16f6
TLSH
T1E2018CCC8D469031B689F2B17B8B3B8A1B7F0817D9502218B5DF4688DB37104A27C6F9
MD5 SHA1 SHA512 TLSH

Submit Download

apr2006_xinput_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\apr2006_xinput_x86.inf
Size 1KB
SHA256 b604779115d32d439f77b33257c96f928ec4ce564189f7d0d357099c1da140c4
MD5 53294b978995caafcb6a9ac8f67b8580
SHA1 c165d2c615261f135f60442ad0a6e589d681a850
SHA512 a3da7e02ecfadb181ed13855b093908fca0aae2ee75e6bc4f873fe69a34cdc08f3bf504aac2ea98f9573437d2ff000e43ae8450c87036ead48e6c2b80ec523ed
TLSH
T10A21F4D9C9039635768AF2B27B9F7B8F573B4806AD12121C72CA45C4AB63301126C6F8
MD5 SHA1 SHA512 TLSH

Submit Download

apr2007_d3dx10_33_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\apr2007_d3dx10_33_x64.inf
Size 844B
SHA256 3e61c4d723d282c36c5493d82644ea96715b7b548e50494d22b4a83d4e2b8237
MD5 00ad98b94609033c2819745587b0eed5
SHA1 2a07dda60a97dc2b4a7cf3cfc6245e72cea0efb0
SHA512 e7fea5f9186c324423c0b129dc3e8594df49dc84c61400f4635ccf688075b256d7923ca8f4483bf7b2fe43862e71aa134cf2c9545a23c622d0cc04dc7d6dac1b
TLSH
T11301AF998C039436768AF1F27787A74B1B271806DD5125187D9E00C9EBA3704516C2E9
MD5 SHA1 SHA512 TLSH

Submit Download

apr2007_d3dx10_33_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\apr2007_d3dx10_33_x86.inf
Size 1KB
SHA256 3286ba521fda888b1808f12955a58d7da4df7d2fdb472c7837a1e0e1a6317a06
MD5 fda5776cc944ebf6d84fb45c8a1a35f5
SHA1 f3b603dcdcfd6a310c2b0945f1a3b97276041ecf
SHA512 b051b04ce06ad21d08ace3a28d490214556f4b5be060ee05f8a4ff872d1cc72df05624021a9a0cc1efa4e63772f55cc61f11edf03537831a44ddd6ab409e83b1
TLSH
T1F6314499D912943076C4B6B2BB8F374F1A332407EA62215C7AC908D5EBB3700129D1FD
MD5 SHA1 SHA512 TLSH

Submit Download

apr2007_d3dx9_33_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\apr2007_d3dx9_33_x64.inf
Size 812B
SHA256 2d87efca75d8b9aeab3262841d52a7c56bad34ac6b9691f4df2d89b14c950f8d
MD5 e40a6f3215c3f1397eb18b3388f95032
SHA1 4845590abf12bb5725d94d7aeb953a5686918537
SHA512 942f54a3984a29e1973ec096709de890fe870a9dfc84a8c5597244251cbd69f84543cc5cffe620a076d0a16dea6e393c6790553d6d9e2fea1af1c0f00a12140d
TLSH
T1C1018ED9CC03D43A76CAF5B27B8B374B27670906FA15219879CA01C4EB73250526C2FC
MD5 SHA1 SHA512 TLSH

Submit Download

apr2007_d3dx9_33_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\apr2007_d3dx9_33_x86.inf
Size 1KB
SHA256 349a09a2791d697bffffc61410a536cdcf258f0d7c86dda44a297e8aec4bdf00
MD5 044cae9c30c88bda73727243f5e5206d
SHA1 de744e349cf4ea458b10657d510966d21ad08d67
SHA512 18e501142004afbcd28b41bdd3a9b19e2eebc047d7858ee11a9135f19759cfd8c643ff074a51e937bbcab7162888fd95effc146be21fe63dfc300ef03ed44056
TLSH
T1F13157D9C802D4347694B2B2BB9F374F263B450BEA51214C73CA0990AFB3761125D2F8
MD5 SHA1 SHA512 TLSH

Submit Download

apr2007_xact_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\apr2007_xact_x64.inf
Size 920B
SHA256 bf6ca1165632efccb0292ae8b739ce68d78ebb95dd39b8e4c1717d78a026db10
MD5 dcfa000ba60f73c2c02ab590faa1ae10
SHA1 154b9ff40cd92bfaa572b289662d0305fa2fa017
SHA512 34f6cf1f3fbbdd79d04dd55315b0074abc21b9c26df6e2fc9d66c6d15f36ad35edea741000a84a25ea9a68a94d46f500398a27c8865a30746574741dffaadabf
TLSH
T12C117D99C802C0377789B6F17F876B4AD7670816EC1022487A9E15CDABD3241A1DC1F9
MD5 SHA1 SHA512 TLSH

Submit Download

apr2007_xact_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\apr2007_xact_x86.inf
Size 1KB
SHA256 008db10780aa8fb6f20b7aa5f5d513ca77efb36c8dddfb9ad89173ecaf700af5
MD5 99f23af200574f24c4c5d9ee12fd2cb8
SHA1 f0e50816ed808748f9379733921c9302551cd937
SHA512 5e97d157ed8ad10f9cbb9490a16141fa52b2f32e09edc7e7f5e4b2d9c9bf38bbb85706d76543ca4ffe9b54d5fbc4b763b7df0893f1e7e56ae4c8ac1a720dbaf2
TLSH
T128319AD9D802D1313A84B372BF4B364F86774416FD71214822D95A89EBE324162CD5FA
MD5 SHA1 SHA512 TLSH

Submit Download

apr2007_xinput_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\apr2007_xinput_x64.inf
Size 860B
SHA256 0d6e1c0e961d878b319ac30d3439056883448dcf26774003b73920f3377ecac8
MD5 94563a3b9affb41d2bfd41a94b81e08d
SHA1 17cad981ef428e132aa1d571e0c77091e750e0dd
SHA512 53cac179d7e11c74772e7b9bd7dd94ffbc810cfc25e28326e4d0844f3f59fd10d9089b44a88358ac6dbd09fb8b456a0937778f78ecc442645764f693ccd620b8
TLSH
T1CC118CCCCC0290327789E2B17B8B3BCA5B6B0417E961225C35DF4588EB67145A27C6FD
MD5 SHA1 SHA512 TLSH

Submit Download

apr2007_xinput_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\apr2007_xinput_x86.inf
Size 1KB
SHA256 1c798cb80e9e46ce03356ea7316e1eff5d3a88ccdd7cbfbfcdce73cded23b4e5
MD5 e188f534500688cec2e894d3533997b4
SHA1 f073f8515b94cb23b703ab5cdb3a5cfcc10b3333
SHA512 332ccb25c5ed92ae48c5805a330534d985d6b41f9220af0844d407b2019396fcefea7076b409439f5ab8a9ca6819b65c07ada7bd3aa1222429966dc5a440d4f7
TLSH
T1D42126DDC8039435778AF2B27F9F7A8F663B8406E951221C73CA4994AB73341126C2F8
MD5 SHA1 SHA512 TLSH

Submit Download

aug2005_d3dx9_27_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\aug2005_d3dx9_27_x64.inf
Size 806B
SHA256 0a8ffec8d7ef3a0aa005f604a045dcf80cf5b6473b4f26e30c58eee23e253fae
MD5 7cfa60cdb7e697b40a268eb8814446e5
SHA1 e8e77082361d5a5ebf6163cf880f9700cff5741b
SHA512 77aaea559ef94d405194351b52643512a71990833dac22a331d5b78d569263db11bf969e26224ba8a362bf538782010ca074286ea605490d40c10f7d2d53d255
TLSH
T190018ED9CC03D43976CAF1B27B8B375B6B770907AA11255879CA0184EB33284616C6E8
MD5 SHA1 SHA512 TLSH

Submit Download

aug2005_d3dx9_27_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\aug2005_d3dx9_27_x86.inf
Size 1KB
SHA256 d02232a6587c460c026601517178318bab2ac29c59d269c6e3d1a3a993a9a1c4
MD5 e45a175750a672cbb2553087a8c5cf8a
SHA1 70d487f99e101bf39650594c27674313181a8ff6
SHA512 199882ada178e41be14af82001829d009379445028d3803d2a86eef899c01600cf2aa86123311b728e888498674379a35d40ed0964c2f88da24758fe3c7093d2
TLSH
T1A54143D99802D5347698B2B2B79F379F5B37081BED21214873C50980AFB33A1264D2F8
MD5 SHA1 SHA512 TLSH

Submit Download

aug2006_xact_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\aug2006_xact_x64.inf
Size 908B
SHA256 6fe310a67227203bbca3389dfe3403fa268cb424f4b525cca2d5407ed26670a5
MD5 d40e6c659cb7a757d8e751b050495927
SHA1 a9c515d786bc8f5c739fcf5ac1b6e15365f9e14e
SHA512 fb58acb95f1914da3c650168ed50fb6f75df68773daa8e8389db9c7c7c4d0e8bf93e46458fb76de676acc65132d781a7624f67289860a19e03520ecdbdb66896
TLSH
T1B2119CDDCC438436BB8AB7B2BF47274B97670817AC21124879C6058D9FA3141A1DC1F9
MD5 SHA1 SHA512 TLSH

Submit Download

aug2006_xact_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\aug2006_xact_x86.inf
Size 1KB
SHA256 34e7227e03812fce5415b0a4c3d15a9e9b259350ac9873db2a98b2ea76ae2284
MD5 ddb0d03b1d4a6ce09da5cbc61f5525c0
SHA1 ba5e1361e394301d5b9d9a4aec68ae21f19c70a5
SHA512 2160652a7f8adfc346e0af6f822875c34d2d13f168b9895b063925979d4fcf33a7da777ce7d43c9ef2b23186ac00378e8c2d4ee115bb2ff794e863e8b6feec5e
TLSH
T1903168DD880399317B94B372BF4F364BA6770416AD21010C67C94A89AFE32416ADC5FA
MD5 SHA1 SHA512 TLSH

Submit Download

aug2006_xinput_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\aug2006_xinput_x64.inf
Size 854B
SHA256 35f25b9538e55172cf36729519581444e26b38a9dae5cccc4ad75dfa34ea08e7
MD5 90d7a7386af9b951f939d869567894d1
SHA1 ef70a6efb5f7b32193bdec6c5ff13a4abeb4f00c
SHA512 10920d0116aab01eb1130eb91b26bd91d4b3ff8e09a77db5b79f88c94c463389548c2b3ce494162d4b2c3fda903eae6c2d87492475c56fc901c37fc8306555ce
TLSH
T1A1018CCC8C4694327689F2B17B8B3B8A1B6F0417DA50221875DF46C8DF77104A27C6F9
MD5 SHA1 SHA512 TLSH

Submit Download

aug2006_xinput_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\aug2006_xinput_x86.inf
Size 1KB
SHA256 cc66d67daa1f4c31ff5e59c2606c3930f72204a5057c29b9d58dde37a47b1cb7
MD5 f87111f61ac57d80199cead8e63ec45a
SHA1 4a525a78a90fa87290f60f0598fe285f9f46c90a
SHA512 ddb1b7259aeec662fa271f6a6d271e9d48c4b8ce4d47d452dc2ab15611421baa13cec0024e668309b7444b31fa5b24f41b032796c81a36e94d7e577d9c516712
TLSH
T15E21F4D9C803AA3576CAF3B27B9F7A8F57374406AE11121C72CA45C4ABA3301126C2F8
MD5 SHA1 SHA512 TLSH

Submit Download

aug2007_d3dx10_35_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\aug2007_d3dx10_35_x64.inf
Size 815B
SHA256 af4bdfeb4283f04e24475279931e042f17052224cf708f0c444fba2f2e221289
MD5 703b4ea6a182ee3b48026d01319579c0
SHA1 3184959599dcee4e74b251ff14dd2aac81e2ad68
SHA512 a6e67befdb1d757bc08f6a726e6d79c4f51324edbd1f48730616e27079bfa60262b88b4c49cca046e3da3832e375dfc29b2ff48b7007443606da94793ef7ed84
TLSH
T18501899DCC03D436768AF1F2778BA78B2B670806EE5125187DDE00C8EB6730461AC6F9
MD5 SHA1 SHA512 TLSH

Submit Download

aug2007_d3dx10_35_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\aug2007_d3dx10_35_x86.inf
Size 1KB
SHA256 7987e2c475705bf8f049a15af946ec0cb5ccddf27c0b5c8126694421df601770
MD5 741a5ce76295b86694cd7540870eeec2
SHA1 2c165af0047c98d2864379ea5fec33bb1507bbf9
SHA512 b7d0a0bdcd060ee263860024abe5b054aeb2c8c8c7ccdff9cfa9886188d7177b1bb8799909b3c95aba181292b5bb9f9426ecab0a6a2689970afca5a1739fc4d3
TLSH
T15A31F299CD129030B6C9B6B3BB8F3B8F5A770407E96221587AC90890EB77651128D1BD
MD5 SHA1 SHA512 TLSH

Submit Download

aug2007_d3dx9_35_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\aug2007_d3dx9_35_x64.inf
Size 812B
SHA256 e34ad9e49f31cb9211e0f350405c344d93fc65075e470c8fe09dd78af68f2c80
MD5 0b3f4e715a43024fd00f769e62cd8b9d
SHA1 ef6de20d95a920e3b69307737976bb243783160a
SHA512 336df101ab341c5f22d516089fd31fd9f0541a01d3ac4ab4e171b73452ba3bab3cad84af50f1e9da17c46bcfbe7a1b52284e2ef2af49c67c6d6cce2969e14ec9
TLSH
T11F016B9AC802D43A76CAE5B27B8B374A27A70906FA11219C798A41C4AB63250616C6FC
MD5 SHA1 SHA512 TLSH

Submit Download

aug2007_d3dx9_35_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\aug2007_d3dx9_35_x86.inf
Size 1KB
SHA256 c0d87c1b079b54b75b86939199ca5ee1f796ae3de9c4ed0ae074a4fa01823c73
MD5 815d75e4264b1f9c0bbcc529ee7a290a
SHA1 cc956156066c87ce1bd2b7628453f1824a426412
SHA512 bdaaca529cd52df20cf1e35b45e1824fe48d09442666b18faa3e948937026b09d880a27f1d915816bc6e1d98b0b486d590f867aeaa046317b7f48d6a0f949391
TLSH
T1A33157DAC802D4347694B2B2BB9F3B4F167B450BE951214C73CA4990AFB3361115D2F8
MD5 SHA1 SHA512 TLSH

Submit Download

aug2007_xact_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\aug2007_xact_x64.inf
Size 920B
SHA256 2fcc4bdc6516418d3b4935c301e14f30e3bbd0adfd264bc34067b27b0b266b8e
MD5 a78f12b4514614db269bf55faf383875
SHA1 0425c3e3ccb15f691d6f5d30b71856138063002b
SHA512 9d1cc2704541b71b246c2cc8e6e1d667cd7e691e42865aa5b0a800cf26386cf00781ae7727b7f90711e987148e98f4253e05b6d3872d3f69b0584bcf97b3fbea
TLSH
T1A5117A9DC802C0377B89B6F1BF47674E97670816EC1012487A8606CDABE7249B1DD1F9
MD5 SHA1 SHA512 TLSH

Submit Download

aug2007_xact_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\aug2007_xact_x86.inf
Size 1KB
SHA256 c246c38e41ed71bde4b3cce4fe337826173896a04c26f8b2a00b06bb0cec024d
MD5 8898bbb8acc1b54b3b9b6a2f6b0e2cfb
SHA1 e5ace499d26e573544be76c8e45cc5278d15022e
SHA512 b0633c44541cdaa2d2c3174027d849ecdf5ccf2149da4a2932f59db600cafd8b959aa0382973e23fec7a76ed7555e96065a4d8aa077f50c2a14e5080673aef30
TLSH
T11D3158D9C802D1313A94B372BF4B365F86774816FD71114826C64B89AFE324672CE5FA
MD5 SHA1 SHA512 TLSH

Submit Download

d3dcompiler_33.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\d3dcompiler_33.dll
Size 1.1MB
SHA256 12e238af4b4edc1f774213709a87a91b77b2c9d2d18fe475b027872923b6fa17
MD5 fae7e1d578c42a7c3d9d61a99d178bd5
SHA1 8ac88ff2bc5f616ed284a04ddcbaeb72fb1f304a
SHA512 75107c64acfb6d84e1b05ba78377dc4699ba83b694b7ace474665c85f3e5843db6d06348fefed539c6c2b233775c7ef81d7bfd81937207e04e637043633cd0b9
SSDEEP 24576:xZ7WQ9poSeEOgXgGZWFO59DF4G5aJQ6N7Q7Trlxux:H7W694FOHxhy
TLSH
T1BF358E63A5539132C45212F21A9FA3B576BADF7013215AC796903EE8ED392D34F3A307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_34.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\d3dcompiler_34.dll
Size 1.1MB
SHA256 5044a5810fd931339933a8d0c56115a5a5c27d8c0d8e348977e2724a032accf0
MD5 75f206c195bbaca6ef28565b1c0cd75c
SHA1 4687454c58f64f2154f0e99bf5a323f73ca1790c
SHA512 84c0a8fd3e4293d85e919940f6f24d88fc6fd68f39cffefc34014656fee54256ce581ba408eebf5bf9dac3da9de19f2bf8403521c55881d3877dd64a8e50120f
SSDEEP 24576:NUVqoO7+dg64RGoDxNIjE9BERO6b6CVwOo:WVwEWxNIjw
TLSH
T11A358E63A543A132C45212F21A9FA3B5767ADF7013215AC796903EE8ED392D34F3A317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_35.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\d3dcompiler_35.dll
Size 1.3MB
SHA256 5a866cdf74f981e783624dafb0e72f133ad9f9b293856d7a18c7558fa357beb1
MD5 5b441670a4f5f8bcce76741902b8af56
SHA1 b98df0c54483664ecdc92eccdcdee09d082972d8
SHA512 0243deac1124425b65cfbc7d6465bfb09a4849e6c5be3645b808cd3fa487c3044c5b45e9943ee31542a7a47803c02f0b92c05c1e4bee18cf6076641e1c0794f6
SSDEEP 24576:FgNhd5Doo+qzT3BPKUt7PuC+2QXcBXFdOqn/DRCrLC8gi13sCnphsBH:GNNoo1zNDPuC+2QXy1n7crLC7i1a
TLSH
T174558D22B24E9077C8D611B25EAEB3D9616CDF72131025C722947EE8AD317F25F3A217
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_36.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\d3dcompiler_36.dll
Size 1.3MB
SHA256 f15efcab1780fe7d784a3cd3798f147fa249e81b7ef9a494b85dc7fdab084734
MD5 fb4299688a0d3a37687c015ac2b9922d
SHA1 a4898d246afbb0ed399e77fa5ff29c99caf912a0
SHA512 664b139754d587dc32820354c1333fe6a5528b07b8bbfaf27374a5da7e86a4c3e7904250976ef3cf8620fd0568c34fa75704a8b1585c382b99d4ee46518617ae
SSDEEP 24576:VgmXlA7HWfcBGval2Q5RuJyFBHiAamdib1AEq8fujMdR+mpr4:2mmDWBv25RuJyFBCA9y1AEq8feMdm
TLSH
T184558E21A64E9077C8C611B25EAEB3D9752CDF31131125C722987EE8AD346F25F3A21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcsx_42.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\d3dcsx_42.dll
Size 5.2MB
SHA256 e462eb3d41db54988ce3be46ced60b0073f8d939a9946cda67fb1df3c8afe0a1
MD5 b337306dfb508a1bcef1974bfbb8d924
SHA1 203c32d73f99e1097bc306c9225307a18c617f4d
SHA512 5c7a101e403aa2eab57e2972427a67ae6cd1598a35f983af784ca3a7446f7c60ad3cff7e52510f14647645a49c387020a06242663433db89e6454188b93813e0
SSDEEP 98304:NOznLAOLu6LfqM53ry8Gcst/2TDme4hSqv1YYvlDo/eDBOPSfbVPoCzms2iNf1/K:NOfAAu6Tq63G8GcsBY14V1nvlDo7PSf2
TLSH
T1BB461221D79581FBD8BC1B3145BB2A0D35B2986B87F262F3EF15A75C9C3E6804630E91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcsx_43.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\d3dcsx_43.dll
Size 1.8MB
SHA256 b46a44b6fce8f141c9e02798645db2ee0da5c69ea71195e29f83a91a355fa2ca
MD5 83eba442f07aab8d6375d2eec945c46c
SHA1 c29c20da6bb30be7d9dda40241ca48f069123bd9
SHA512 288906c8aa8eb4d62440fe84deaa25e7f362dc3644dafc1227e45a71f6d915acf885314531db4757a9bf2e6cb12eaf43b54e9ff0f6a7e3239cabb697b07c25ea
SSDEEP 24576:/j0ZXvi+of1/z+uQ5Da3Qx1fF4dEQMtqVC43ux:/A9i/f1/z+Zce4dpMATe
TLSH
T13885F515CB115AFBD5FD02B249E31B24777290A37EF312B3CF0946255CAE388A6319B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dx10.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\d3dx10.dll
Size 429KB
SHA256 fd2caa28493ea76021b93641958238b7a933f4f6db1a2070be03cc81d87d8307
MD5 6f34f7405807dcbf0b9bf6811c94c6d9
SHA1 2de04a49825acf76a6a7aa02108337142d30b6ff
SHA512 df623daace6702d25365697b62a4ab7d03d944306521022c6e65e94cf1970b5057da811f10e675c952d93a37abd1b862b8ce8648429780aeb99a4d55fda6aaad
SSDEEP 6144:yum8Nn37GEhLK4aVeb83E98yGvrDB690YmX3QeeaQeelKQeesQeefsQeehQee1GI:y98NnrVhLWVeo3EoDB690Y70lz
TLSH
T148948D10A9A01534ECD7D2B4A12E71F8A0EE9377476068CB5D5C06E67CFABC54BB06CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dx10_33.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\d3dx10_33.dll
Size 433KB
SHA256 b04e2b089656eae01a0071359f9d7fb040dea804c1b9d2379431864174259c2d
MD5 37a8171accf46a9c196054066c28827f
SHA1 886264510372602c2ee0193c5a185d719a61316a
SHA512 713b843a35dcfc32caa67c52ce0a32af6f54dfc4c11615d32613017aeeb257fb3f9168443a4288c71209e5d40f2e1b281febcbae6da076d2b57cf01aa3cd78b2
SSDEEP 6144:1Ve3sZJUM2iyD5M+g0ecSorz+yOgvQeeaQeeSQeesQeeWEQeehQeesjfOL5CpZIf:1k32ex/K+gzQrz+HHL5CI4z7y
TLSH
T1A7948D60A9A41134ECD7C2B0A12E72F8A0EE9377476068CB4D5C06E67CF67C54BB46CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dx10_34.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\d3dx10_34.dll
Size 433KB
SHA256 330e120d745e1132252df81800362a7ae0b61a9060afc800165ba8a1d55d3fb3
MD5 5aa9987f2e62b56d7661b6901901f927
SHA1 2cd4e3e70c3b37da134ecfeeedd377d1726d9759
SHA512 af9e39f368b47b1500e5d68a6f234361fdfc29ea31c32f614c5887f124d6097be0b2d8f37287d0cd0b094d3a12e3f5881ea822542a1c85f10566604fd6228988
SSDEEP 6144:jVSYvJlLgCiCfJsRy0BQHISJolniuGvQeeaQeeSQeesQeeWEQeehQeesmf5+iCa9:jwYhl0IfJsRyICFolnZn+ie6RH
TLSH
T1B6948D21A9A01134ECD7D2B4A12E72F8A0EE9377476068CB4D5C06E67CF67C54BB46CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dx10_35.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\d3dx10_35.dll
Size 434KB
SHA256 db775655fd923e29509402556f86002dd9aea062cdcdba7073e1057a67b5ce50
MD5 f3764552e45880dc49b82f38699aa87c
SHA1 25e347799bb3f36bdee30aa78cd9e59c7faa5add
SHA512 7e52bbfb4f309b9f5a9632efd3dc28a0509b7d5edf471267f7e794ce8479dd8cefcb29535327a7384bcc25b5331ff87c223fb70fbb5da22fea3c919ba4c5444a
SSDEEP 6144:UFRPWgGD1ePJD5FrU6DBRw/B3tN9qG2QeeaQeepQeesQeeu3QeehQee1xfPPRBOS:UDPWxhehbrU6DByB9NoYJ3QZWx
TLSH
T1D8948D10A9A45534ECDBD2B0A12E72F8B0ED9377476028C75D5C06EA7CB67D48BB06CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dx10_36.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\d3dx10_36.dll
Size 434KB
SHA256 aee0248f18dfef8194451a22c69adda1cca38c03ae9aa776114da9d8851d4c38
MD5 d9158e78a368b08d9133043eb3058c12
SHA1 d71d6f103bf7433f442f55c355dc74fd4b8a736c
SHA512 8bcf2da86f708ae84141089f80131244d957e64c6fed0fc39dc688201659cffa7005bfd4cbbb315ee0a60c61e38ead3b4e4fcb3d2f0ecd0386a6fbe486d82bd9
SSDEEP 6144:oF1PWgGK1ePJD5FrU6DBRw/B3tN9qG2QeeaQeepQeesQeeu3QeehQee1xfPPRBOb:oLPWxAehbrU6DByB9NoYJzMZAC
TLSH
T1B1947D10A9A45534ECDBD2B0A12E72F8B0ED9377476028C75D5C06EA7CB67D48BB06CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dx10_37.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\d3dx10_37.dll
Size 452KB
SHA256 61aaf973712f848b24c3e769e3252248ece96db63f206de0ca7ff43d9ed87a51
MD5 4a43e9a2b17e4cafa9cb5fec0b5b686b
SHA1 9e28d3d197958e65ab8dcaac91fa55cd1991c3f5
SHA512 8411bbd130427b690332d222233465bf79426670f565ac3b01a71929dadcfdd18002c54d60981dc1f202e6625f99ab73451805d64518fad9b5a9793407df2d71
SSDEEP 6144:bs80W1Xr1e8BVZiAmZfw6yrKhbXTC0okQeeaQeexQeesQeeP9QeehQeeHSPBDBnG:w1WBZeQKAmZfw6ysbXT9SD0Bvgg
TLSH
T1E3A47D11A5A45134DCDBD2B0A12E72F8A1EE927747B028CB4D5C06E67CF67C58BB02CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dx10_38.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\d3dx10_38.dll
Size 457KB
SHA256 bf463b7ee2235f351309b5fd790f514acf2b55a4a1f90222f7479024cc28fc34
MD5 a2650b27472c21cdd817eeede65648e1
SHA1 c0e5f70386bb229e289a476f2a95965699ba53fd
SHA512 85320f262c10d80e889258a8584648dc20283d1af0467924e8745555c94a8fc056ac609b31d36a898829ad418c9df06047ecfcc644693bd136ccb50ecbd6fe91
SSDEEP 6144:NIB9GO7BeuLc2EBqQp1gY01mZZw6OpXQYcYKdfcQ9HCIQeeaQeemQeesQeev5Qe7:NU9r1euLL5Q4mZZw6NfcQ9Hib9lSg
TLSH
T1AEA47D11A5A41034DCDBD2B0A12EB2F9A1EE967747A029CB491C06E57CF6BC54BB07CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dx10_39.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\d3dx10_39.dll
Size 457KB
SHA256 613afdb8b44bb3bed945279229d9604a3cd553f8c2b9b091235cbab8cd00de61
MD5 e6c2f1d8b667ddc04cb55b9f0159ef97
SHA1 9dc5c2d54397aeb56deafb63ee34b641f7030ee7
SHA512 5cc39f19b6de99bad0be00fcbde9d498e23f29303c6ed4ba79c2b2bc63f259f9b617ecf6ac67beee8a71c03a0e80c29412e0159a5014a43a6168c37835bb0e00
SSDEEP 6144:3I29GOYBeuLc2EBqQp1gY01mZZw6OpXQYcYKdfcQ9HCIQeeaQeemQeesQeev5Qe:3/9rCeuLL5Q4mZZw6NfcQ9Hibj1Na
TLSH
T16AA47D11A5A41034DCDBD2B0A12EB2F9A1EE967747B029CB491C06E57CF6BC54BB07CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dx10_40.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\d3dx10_40.dll
Size 441KB
SHA256 c05787cbf3aa4527baae96a425ceac910090ef48809990a450c33f3cda0e4767
MD5 91b4aad4412bb223b466f3dfb43e86da
SHA1 850aeb2b3ca15158be00faa5c161312cf4a876f0
SHA512 413f68d1ad36aa51389da62eb2fe89969e4460ab166ce44943e382fd2d1cad0953979eebb20af58dd51def3fefa1100ea9fe95c05714c36d5322e281cea1a1a2
SSDEEP 6144:BkYQ9rGgBeN0sOWfREfBBeju3rxQ2GZZwEPQeeaQeejQeesQeenkQeehQeeR7fXn:B9Q5G6eesp6f0ZwvYoyNQ
TLSH
T1AEA47CA1E9940075ECCBE3B0610D76F9B2EEDA27436029CB595C0AE67C35BD107B478B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dx10_41.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\d3dx10_41.dll
Size 442KB
SHA256 9f4c15e1f68795727eded4737acc5a1aa85f896cd9e6924fddc9128b48f1bbd6
MD5 1aa571774936717ee776dbed51e9edf4
SHA1 98eac7257ab3350504c0a70342b6b24658411f55
SHA512 bb47d95d594b249608e323c8ff383c0655a56e9192e1a2f3157e9c18dc7b9baabcf8e6b09d30fef570e0718edf673c56a23df5b5d5c6ec3242ad3d887669127d
SSDEEP 6144:QBNBKKa2ijv09TH3FHkW8kQPwM7kRAcQUDQKDQlJ/YQeeaQee3QeesQeePJQeehO:Q3BLvijv053FHjiIEKiJ2wk48
TLSH
T1B8A46CA0E9A44074ECCBE2B0A10D76F5B2EEDA27436169CB591C0AE67C357D107B47CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dx10_42.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\d3dx10_42.dll
Size 442KB
SHA256 46429c4affe041b08a7acfda0e9162ba42de966acb2cbcaf09ef976232073b51
MD5 501ac862517c5445742bee8a2b88414e
SHA1 49f3f2df66d357aa84a5e7a0eb368ea595b7d95a
SHA512 08dc13d5ad0a0d2aaca9d3dbfb53304216111da73bf48810df2982650d580757c10c8b9bf80ae5191e06ebaa44b2bf9c244ae141308748c3e7fb9ef6088900ad
SSDEEP 12288:LVUU2K/lYzobQ7yHJjgpqUMiuJRGODIPjxoula:Zt2K/lYzlNmRGODIPOula
TLSH
T19BA46B90E9A40074ECCBE3B0A10E76F5B2EEDA26436169CB591C0AE67D357D107B47CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dx10_43.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\d3dx10_43.dll
Size 459KB
SHA256 56fcd13650fd1f075743154e8c48465dd68a236ab8960667d75373139d2631bf
MD5 20c835843fcec4dedfcd7bffa3b91641
SHA1 5dd1d5b42a0b58d708d112694394a9a23691c283
SHA512 561eb2bb3a7e562bab0de6372e824f65b310d96d840cdaa3c391969018af6afba225665d07139fc938dcff03f4f8dae7f19de61c9a0eae7c658a32800dc9d123
SSDEEP 12288:cFUDOgwNvArf8r3bK9s3kW3CG3vQ3sad/QNbubxu:5DOgw6fYbK9s3kW3CG3vQ3snputu
TLSH
T1C5A46A91D5505135ECDBD2B4500D31B626AEDA7353A1B2C72F5C6AEABE38BC01A343C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dx11_42.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\d3dx11_42.dll
Size 229KB
SHA256 8c8fa8dce19e2f43e82cecd73a268e831a5ce0a16023845f7fa7fcb597772e85
MD5 d09ac80a4b5312239852836c84df3392
SHA1 ba838d90a1e74d6b9a57abfc9729dd3b2e7fb192
SHA512 69232a47c80f01433716f3a9202af25e1b9a298a2b7b7d23b959e59d9c4ebf329cbe9a9a5bde41c06e978fda062225447114f9ae736920e7bbce8587a9390613
SSDEEP 6144:0tV/QdI2irCNqCd6ulr8QiH+QwthdDCp8f9MBTL:0vWtthdDXVqTL
TLSH
T129347B717E508630D8F6D3B4111D332662EEDD4207B1F6CB196CABD6ECB52D19B30A8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dx11_43.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\d3dx11_43.dll
Size 242KB
SHA256 492e960cb3ccfc8c25fc83f7c464ba77c86a20411347a1a9b3e5d3e8c9180a8d
MD5 8e0bb968ff41d80e5f2c747c04db79ae
SHA1 69b332d78020177a9b3f60cb672ec47578003c0d
SHA512 7d71cb5411f239696e77fe57a272c675fe15d32456ce7befb0c2cf3fc567dce5d38a45f4b004577e3dec283904f42ae17a290105d8ab8ef6b70bad4e15c9d506
SSDEEP 6144:8K0GaAtQlDJCSB4MvfIeDRI9Z7IJItblSwJ7FnH4fa1wlMjb5:eGjQlDkSB4MvfIeDRI9Z7IJIRlfJ7N4w
TLSH
T1C7345BA1EA00513AE8F6D2B4211D732151F9DE3007F2E3CB165CABDAACB56D18A347D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dx9_24.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\d3dx9_24.dll
Size 2.1MB
SHA256 94ec67763f67932dd4273ef5cc12889a5cef090ffea3ee78a80c7b530272b1b5
MD5 bc831661963763ac4d504c5cabb1fdd9
SHA1 51b323ea377f9dcd52946f5fe77ceb5673d1592c
SHA512 fe97241d5d9ce298f62ae3295eb9f4091430c8c2c53e967b76e0aed76c3579f8bb07338a0de48e4547c63ab381b3b3d0989a183447b8e47496f35493541295e3
SSDEEP 49152:M3ETCP8E3UcrsDhSQd4zgdFpctofcQeYANHJ/jooInNhS:M3ETCP8EvsDhSQd4zgdFpcSkQ5ANHpjD
TLSH
T108A59E11EA978674DCA71174015E33F5116C8BB027605BCF96842FE9AEF12E58FB828F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dx9_25.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\d3dx9_25.dll
Size 2.2MB
SHA256 4c54df27ce84d21b2924e64ff79b13e7876ce85d8e0c9c1d0abd8da73888187a
MD5 5b48fe9d6686f0d54b26a005ace24d1d
SHA1 1c395f6d2aa729a607e69dca73f8205cefd26aa4
SHA512 6a4fa549578097ba36495ec210365c27d165065820f0fdad20864a3139949e72da00f9b7c614d07d8950307e596b693ed7a291a5c69cc0f9ba30c5f74d6332f1
SSDEEP 49152:IxfcP6/1/QQ0ANFrbfxdqPeQ6eg+XMD3hP7zfOHXD:IxfcP6/1X0ANFrbfxdqPeQfg+XMD3hPQ
TLSH
T108B59D51EA968274CCA721B0229E33F4216C9B70176017CF96442FD9AFF12E69F7439B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dx9_26.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\d3dx9_26.dll
Size 2.2MB
SHA256 8ea96fe01c3c86a36fcb3795ae03eb12034003e335ef475571efaeda17c5bc78
MD5 523ab607eef81cc4d909e7febd8a788e
SHA1 2fbf1444daab3312da6b34509763656a28252134
SHA512 791f520533f58cbccded4e7c1f64fc14d20942efe57f32a5ee75eca4107543718eb35ecaf52e6eb3d9112867141271b8c097766fcc3562f016bb612bf840528a
SSDEEP 49152:bffHqb0wZC17akb5wz1F531O9+yqH2jn3TC0OsS7w6L:b3HqbW17akb5wz1F531O9+yDjn3TC0/L
TLSH
T1D5B58D62EA964234C89331B411DD33F5616DCF70277016CF96942ED6AEF12E19FB828B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dx9_27.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\d3dx9_27.dll
Size 2.2MB
SHA256 a70d571cd675c97c9eeb4a234dba1d667ffb54ec3bb14defb36b3e2f605ae257
MD5 852edc778a7a50077694f84d8e601234
SHA1 14705b638e1af81ddda5dc52f68c61ebfce5e9e3
SHA512 51c4031d98bfe3251a81ea9f4434ce38f077645a40d0ca413e31b6951c384a1635cb040c24ccf1baeef3d5a47d0d18d8b47fef3bcb28570d6e936fcea6f912c2
SSDEEP 49152:hCJX3Wmq3K+KeRx7Y2VaVAbBkmN6XHse+Qjj1BbnRdzW:hKX3WRZKeRx7Y2VaVAbBkmN6ce+Qjj10
TLSH
T12FB58E51EA974134CCD321B411AD33FA216D8F7027B016CF96542ED5AEF82E29F7928B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dx9_28.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\d3dx9_28.dll
Size 2.2MB
SHA256 f3e391b5f1c1f9637cabf2b812b6f5d65e4776c89d779f506f6b643cc563176d
MD5 be19b603dfbaa829ee5b7749b3ba97db
SHA1 3d42825b3e7fe5744f67ef145ed47bb524496305
SHA512 095e8357911c1a06000f5df291bc3cbd80aa3a9672f485fd1f2b9bdb1172d1c7235449485948bee26fcec630d6b80fc927454f9b32cb31c823494c780e0e3df6
SSDEEP 49152:PlyLkmqkhJIg/bj74ifPRFL2pckDHK/ZK8wVkR47l/F:NYkmqng/bj74ifPRFL2pckO/E8wVkC7z
TLSH
T150B58D51EA974234CCD321B411AD33FA216D8F7127B016CF96542ED5AEF82E29F78287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dx9_29.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\d3dx9_29.dll
Size 2.2MB
SHA256 c5e21c18f8c79bc517da59e3192c39ea73bdcaf85867628187f6b3cca07dd21f
MD5 99f4fc172a5ace36cf00aa7038d23f2c
SHA1 893e05e369c2388daec359ec550fee5b9122ed40
SHA512 a4b86d84f99c3d0c0825e3581878aaa25207765bcfbf31cb07cd6bf69a9cbbe1c3068719b212e38f741e06a89b9bc6d217077a0dec7f9efb1be75fc3c214dd52
SSDEEP 49152:KGyjXaPb5h0n0hFp7KLO2PNhLkWqZjUHD2OIhQIZVhcDcRY:J2XaPYn0hFp7KLO2PNhLkWqZjq2NhQIQ
TLSH
T1A2B58D51EA974234C8D321B011AD33F6216D8F7127B016CF96542FD5AEF82E29F7928B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dx9_30.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\d3dx9_30.dll
Size 2.3MB
SHA256 5edeed79f2359527a55b8189cfa8b9b121cd608d44eead905a0f3436938ad532
MD5 e415862612e65f10d7d888443ecd7594
SHA1 aa8440ec3b5bac6594fd58d97c10c2ab7d419b2d
SHA512 f5de2f9e045c3d579d98b25fbbb7b90aa9ddcada0c6bc4e103e5257394f3cbb7c968d89db61e15b10605561cefdd63456912aa428af5a62cb769ac8c4e5eecba
SSDEEP 49152:LIl/nVa7R4ZSVeEepGvsH04y2Fs3nLgHKhAHrHBI41pSTbPq:sVnVadVeEepGvsH04y2Fs3LjhAHrHBIY
TLSH
T17AB59D51E6968230CCE312B5015E33F9217D8B7117B026CF96542ED9EEF26E19F7828B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dx9_31.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\d3dx9_31.dll
Size 2.3MB
SHA256 e2065619fe6eb0034833b1dc0369deb4a6edc3110e38a1132eeafcf430c578a5
MD5 797e24743937d67d69f28f2cf5052ee8
SHA1 7d39afbf94675487a9ff7e41d2dbb8daedf7ad00
SHA512 8804d0d95688a932c7bf7e1a023179de8df3a5436e356b36d803cb9781f3a378adb9fe69d03b28362755b808cbeb2cc718ab920672270de0b954996996328f5e
SSDEEP 49152:9UIXU56pbC6gU8DJpHJLfdrKF322i0aGHhBoMWMNPbSVjeZgxl:OsU56hMU8DJpHJLfdrKF32R0aOBoMWcU
TLSH
T130B59D51E6968230CCE312B4015E33F9217C8B7117B026CF96542ED9EEF26E59F7829B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dx9_32.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\d3dx9_32.dll
Size 3.3MB
SHA256 e96693794daa05a75a83c11df2e7b42f2de61567c6ad0b69e353b50f6c88119f
MD5 26af232140c88b42d92a88f2198edf6a
SHA1 b62aed3f71d8963227e5021c2222192873ce753b
SHA512 54a6a235af4dc3f3c693fba5ac2d487d96c9d7a2bb7deeab35d5a252e723e597226ec84e953625c8808546f91fbcfc42add85076846a63925fd9eabc09dbf935
SSDEEP 98304:BSUkPrLAaSH7gj3XMrEwtqIyI+SQK4GqvXI0EYTbwBZ85xoAA:RkgaSH7gj3XMrEwtqIyIPQaqvCOO87or
TLSH
T1DFF5AD61E6424135CCE241B0519E73F821AD8F3167221ACF96A43FD8BEF56D28F38697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dx9_33.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\d3dx9_33.dll
Size 3.3MB
SHA256 c6b7b2ad7742dde5dd8d1a35fdc1c185e586e551ad9c74d3fb21759cd8ca4da8
MD5 cdb1cd22baff21f48606b3c1a18b000b
SHA1 9315b5db975a34dbebdb4dcae652ba1db01c482c
SHA512 c5fb24de8f1ee6fc1ed6e74580b5d22599ea4eb6c3589645fff0b15dc8dca051c4917e60fbc00ca86542dd63a8f5e40da92ea77e24826c0c6bdba9b58c36d4db
SSDEEP 98304:9Yho7VaMeKQqGfyxXIicOExzUx8PjtvssPFAQAl7fxI8f6B2+:ih8V2KQqGfyxXIicOExzUx8Bssun3f69
TLSH
T128F5ADA1F6424135CCE242B0418E73F861ADCF7157601ACF96A42FD8AEF66D28F34697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dx9_34.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\d3dx9_34.dll
Size 3.3MB
SHA256 b6f77f06518d35345fb61172b6a13159125ed60c469d28b1a2e07970e9ddf81d
MD5 1ca939918ed1b930059b3a882de6f648
SHA1 0c388397620ce0edbb362bb3ab2d4a9f31a56b6d
SHA512 d1e09da8551e588b8d5d5837a79da9ae4ddd6a372457d3c341e68e3da07c0c1e84decadea9534cc87ef9ef38c094171004f836e6f74831fd6531ce72aaefeb5e
SSDEEP 98304:PWm3Mr7ScWXx1XbhVBhe+C0cJQN2Cr4j0HltQsxJzKZSg:OmwScWXx1XbhVBhe+C02JCEjI7JzKZS
TLSH
T1E2F5ADA2F6424135CCE242B0418E73F861ADDF715B6016CF56A42FD8AEF66D28F34297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dx9_35.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\d3dx9_35.dll
Size 3.6MB
SHA256 2198022938156b790e9cfb0f7997494b66a11a1ad49b395be58251d635b66b26
MD5 3ef18b78d17c962f2b71ac1cb7757684
SHA1 2380329c17c7a530075c7572d17592bb3a00c4c2
SHA512 93e9bff79630ee5897bfb3bc496f778aba160312edcff9f0b8cdb8e8af3d5c7b73a8d95d54ab26cc638a2ff7cfa27153629f9fa8a4a687ae3c83e1178471e720
SSDEEP 98304:6eZs4VIINCMxlLTiqGhWlzVulCvRMRs7RXTxKeR7J/k32x:rVIuCMx0qGhWlzVulCvRMRs7lTxj7JB
TLSH
T1EB06BE61E65B8075C8D641B0594DB3F4606C8B32572127CF66A43FE8EEB47E28F38297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dx9_36.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\d3dx9_36.dll
Size 3.6MB
SHA256 c12f0ab0338eb5031d3d04beaf7208ac848f7e037d21ff963d2af90221cbe935
MD5 44bfec5c9c82a2ee9871d88fd3b9a0e2
SHA1 e2aeb78330d0815cffedfe88438a71024577d4b6
SHA512 35c42ce3afeeb3710d3d96d2cf9ffa2828fe17f8d749fd149e3797e87e154508c77f637de0e424d38bb3fa56bca959cf9da7787323950ec8261b144c09ae306d
SSDEEP 98304:7DNlnYF7Rej1ppSPBCfDOFjb613xfScl1lraX1gPYZaAHc6:7nCRexpaCfDOFjb613xfScl1dQgPY26
TLSH
T19106BF61E74B8175CCD641B0594EB3F8606C9B32572027CFA2982ED8AE747E28F34797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dx9_37.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\d3dx9_37.dll
Size 3.6MB
SHA256 c2ccb84c672a9d8966e82a28005a4269886ee304972ac3590c0b8a9c1622a3d8
MD5 ac3c517fb0fbbe45fe44007bcd3625a7
SHA1 eabe1601d0132882c7226a4ed04fbbdd5e8f0db0
SHA512 89b44142355c494f2a21276d0629f3536adc0dd7cec101a1f2816031afcc8a96f94663ad46744c772d6b63d172ea62e9b957d6292e4a6184f958576f62b05836
SSDEEP 98304:LKBKxKSKfKtEGFjJRogJcR0PwKtEupCLp9ql4PQAp/1q2R57/fBzoimlrRlxfFI:LKBKxKSKfKtEMr9cUwfupCLp9ql4PQAt
TLSH
T11206AE61DA0B4035C8D691B05A5E73F5206C8F31572017CFA6582FE9AEB43E29F7878B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dx9_38.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\d3dx9_38.dll
Size 3.7MB
SHA256 743e77a228e7d75442263ad70051e44534f7972c6326fd34b505a9c2c245894b
MD5 8f3eb548ac4ed90252394f60c77e3196
SHA1 e40bb2e3c99c55f2df9def2765bb014e01389622
SHA512 bad441c93d37269a9d49edc39ded933e43baf2a563c425ea2db222a9859ecd1f076c2255c077a5afd07922b50adfda2bbb731ff6f292623b353a3dfbde4ce4e5
SSDEEP 98304:+cIeIJYRpe2hIOXRPdXiVP+ehon+e8kry2WXqT126nJrN7sVE:+HWe6IsPdXiVP+Con+e8kryrqT5r3
TLSH
T17006BF61E64B4035D8D691B01A4EB3F4206C8F3257612BCF66542EE8AF753E29F38397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dx9_39.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\d3dx9_39.dll
Size 3.7MB
SHA256 5d29988cad858f754ecc62c3d30de555f82cc21b5b26c448b890295e9b7bee82
MD5 8cb3defb8887c4f0846db1fc1304d6d2
SHA1 5fbe058848db16117ce7cfdabea1f178ba229a6b
SHA512 4cb675b179d05ead18d2e42329e0d10cd1d520cf9c8c0681b89aca79ac9c814e82941b0086135bd57721b66b55b6feae00bd29af804f59a486e935fda413fc43
SSDEEP 98304:+DrWxsD/di4jmmtDTjPZT0kZKkk4Q1arBz8jNTPcCTtop+c7dQQ3:+XoyiomujBT0kZKkk4Q1arBzGTPXc2s
TLSH
T18306AE61D64B4034C8D252B05A4D73F4606C9B3267311BCF66A42BE8AEB57E2DF38397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dx9_40.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\d3dx9_40.dll
Size 4.2MB
SHA256 16fd909aeb68d0d1aca8529dc7f78880b97d6649d70ce8d03a2c858bc28e216b
MD5 eea5e428ce63804f9b12d21c97b5968f
SHA1 77a7f48f4bdb7e66ed5e524bb8879e3da0d6cd1d
SHA512 545518dabd82441ddfc17fe1c1cbd7d14603bb58130de1307a31f73b93ca42afdf25dfcf481f0383c4e039edfe4a88ae7b84b06a2850c29bbc3550114e499c73
SSDEEP 98304:E6EoQ715V9VRhAuR9ClDt2iHbEsX0sycGoKO0nceqyaWd2U:/Qp5VUuR9ClDt2iHbEsX0s6LO5Wd
TLSH
T14E16AE60DA8BC039D8CE5170450E73B9616C9B71036057CFB2986EE8AE777D29F3429B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dx9_41.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\d3dx9_41.dll
Size 4.0MB
SHA256 6ac4df203af419d3f3b7d9a99e14a3490ea3ad307c474bfe36baea642b1421f6
MD5 3fa06cf5079b84155d18b05c08f7131b
SHA1 fafe52876151a08f39dbb6b4aa137dd85558ba5f
SHA512 24d29c3ffb6532da860fef4dd93e61f7532cea3af94928495a3af0231e7dff6db5cad25713451a2e722c076462b94818cd6969a1c7d8905585b0f64e12174d1e
SSDEEP 98304:DdpF8pg4HYUQpisB7+86QJxpj+p9jdIcFXZvkyIOPsmQJAax0z:ppF8pVAisL6QJxpj+p9jdIcFXZMyILAf
TLSH
T19416BF60D60A8039CCDA51B5664E33B5356C8F71432057CF62683FEAAE747E29F3825B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dx9_42.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\d3dx9_42.dll
Size 1.8MB
SHA256 f8b9cfab7fffbc8f98e41aa439d72921dc180634a1febca2a9d41a0df35d3472
MD5 c6a44fc3cf2f5801561804272217b14d
SHA1 a173e7007e0f522d47eb97068df0ca43563b22bc
SHA512 2371844bc86cdce2d1933625b921b982c4d1b84a39698b51180b09a2d45732407d721fa01d294ca92a88777607a1bb00283f6bcdd4231137a388216d0b09dd5a
SSDEEP 49152:E8kmV+RIMtAO1r5EHT7SPy/OsXEKWtElmrAtmguohFR:E8k8+RIMtAO1r5EHT7SPy/XXtlmrAAgd
TLSH
T198958D91D66B0174E8E29070510D72F0609C8632976127CFAA681FD9AFB87E1DFF42E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dx9_43.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\d3dx9_43.dll
Size 1.9MB
SHA256 0b28546be22c71834501f7d7185ede5d79742457331c7ee09efc14490dd64f5f
MD5 86e39e9161c3d930d93822f1563c280d
SHA1 f5944df4142983714a6d9955e6e393d9876c1e11
SHA512 0a3e311c4fd5c2194a8807469e47156af35502e10aeb8a3f64a01ff802cd8669c7e668cc87b593b182fd830a126d002b5d5d7b6c77991158bffdb0b5b997f6b3
SSDEEP 24576:8UtU6OIyl2Wy9M3bJ45fPS0zFZghQ6aOiFaKOE31GrvFXl74YZ29X1MDd6olmrBs:8566l2u45BiNYFrz31Cv3D29kd6kWa
TLSH
T14895AF51C5191075FDE69030110D32B2219C9B316391ABCF665E2ED9FFB8BE1EAB8387
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dec2005_d3dx9_28_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\dec2005_d3dx9_28_x64.inf
Size 806B
SHA256 510b6d528be3f2997b8bd811486dc3c13eb27a9de22d1bf030e6db0e632cca4d
MD5 9a3ccc90b71d554e968eca0a812bf0b3
SHA1 0ed1ca28d7f6c8b4e017cd48b8504340cb4d736e
SHA512 0f10d2ec9f72651927599b69dc3f4e037febfb9c2a18e02eaa49962903c1cf77b63ae6335c06effdfac26b87418ef2c7a2d53dd799a28d275632d8255ffa8be4
TLSH
T15D01899DCC03D43A7ACEF1B27B8B378B27770907AB21255879CA0184EB33244616C6E8
MD5 SHA1 SHA512 TLSH

Submit Download

dec2005_d3dx9_28_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\dec2005_d3dx9_28_x86.inf
Size 1KB
SHA256 d4d03c4ab3c8486d6331548e967ee17e011fdac90f63c0a9a44a744815a7da7a
MD5 e0b6120a048295ebbc629a9f8fbe53ad
SHA1 3d9cbcbdafc1f9058af74896a5859591e164555c
SHA512 66c0b9501bb08d41bb708d0a724fe6ac27abaf735ca224074e594cde932ad1f9eb9db5defba8a8a71a0a12904f20324ee4d129a1ac9fcf816fe74d648379908c
TLSH
T1864127D98802D5347A98F2B2B79F374F573B451BEE61224973C50980AFB3361254D2B8
MD5 SHA1 SHA512 TLSH

Submit Download

dec2006_d3dx10_00_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\dec2006_d3dx10_00_x64.inf
Size 426B
SHA256 2a43ac72ab9a6f4771c02b6e10884921b733b86dbd7ebdfc5502d011cd5c8d05
MD5 eec826f7141bedeeef38c5a3528b5034
SHA1 529081aedecb7b9fbc7d9707eeb6415f98bc128e
SHA512 62cbe09326cd04c891faa124c65554fd631382a2e078c70ef72a1a07d57239b3ce599b57be3fccc755075174df1d63ac3597dfb3aef9b4ea34ba4597d804d2c4
TLSH
T1FFE02B1CCC03543830CAF4B23B4363863AEB2203EF1011183A4F04C8DB3324091BC2EA
MD5 SHA1 SHA512 TLSH

Submit Download

dec2006_d3dx10_00_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\dec2006_d3dx10_00_x86.inf
Size 673B
SHA256 33291a47388edecc059f1825c1979142d7a9cd4a850716f9dce687deba1fa750
MD5 1b702c5bdf738a8abf4a3108097a6b7c
SHA1 c1d9c9d5e07117f273064bec36ac92b5ed624d38
SHA512 498483dc823e76316e977dcaf7fbc557c3e60c67129a678701d5168105edc97f97479107330d5eb3989dc179273cc9b74d055827f036f2f3551a0a3d398f04f4
TLSH
T1EC01D39DEC0255343194F5B27B5F768B27BB2107EE91151C378A05C8AFB338052AD2F9
MD5 SHA1 SHA512 TLSH

Submit Download

dec2006_d3dx9_32_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\dec2006_d3dx9_32_x64.inf
Size 806B
SHA256 ff00313af4a90f426492d72969f5efc6c56a17f2dd91f20cb5c0a38d9f1f2b6b
MD5 39929631df326b944470256c4f9cbbf3
SHA1 932de27abf59c889c02ed747f0ac04f5e494492a
SHA512 8dd2755a2b2fb90c6880cbbde65d127f55d12df2bab4560ddf86d6793b2cd4733929d97efef5fd8eeb417731a571888c893188df0361ee57eb4437fab331cb13
TLSH
T1BC0189DDCC03943AB6CAF1B27B8B378B27670907AE11615879CB0584EF33250616C2F8
MD5 SHA1 SHA512 TLSH

Submit Download

dec2006_d3dx9_32_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\dec2006_d3dx9_32_x86.inf
Size 1KB
SHA256 ef09d783bf5cff2cfba99946e5e71fda577b196a49c88bed1c51b5fd29cecf94
MD5 c28f4fd1644e2a20b1c897438e197e1a
SHA1 5178534444ed7dec8c63f02defe7bdb864c47123
SHA512 7cf93260efb1d794a17ba25b1fa02ba03b0ceeed8131d274b805155072a9a2b92a899471a8b23add8bf46c6a5a3cda63499043eaa754001bb43cafd882c8e708
TLSH
T1043167D98802E5347699B2B2B79F3B8F5777451BED51215872CA0980BFB3361124D2FC
MD5 SHA1 SHA512 TLSH

Submit Download

dec2006_xact_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\dec2006_xact_x64.inf
Size 908B
SHA256 f2f2040b8d13705f00d8e20a53f22093aa0f8c8d6aa6224992ba727ace7b75f6
MD5 ca414f7196d9b2a7a9d4057ca0714fac
SHA1 7eae4a5bfcd42915adeff5377036ecb4bd656999
SHA512 1efb725a49a8ea7125074436bfe988af360b1ac22629d34a754cabaf3c151855d08e826a0e244cdf9b624b531de14d23f32c1c16c82f6832c8604cbf52882e11
TLSH
T1A011DCD9CC838236BB88B7B1BF47274B87270817BE21224879C6118D9BA3140B1DC9E8
MD5 SHA1 SHA512 TLSH

Submit Download

dec2006_xact_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\dec2006_xact_x86.inf
Size 1KB
SHA256 4c0a40094228a51f567bec65c2cdf289d268812c1af579e3c6b76cd3adb77e12
MD5 211700aaa53bda6894be85df3dbdc792
SHA1 4874325e984b4f0d884cc732da474b3bb59d3848
SHA512 8f51d965cd1ee20cac11256afc5e422d94d43435729d653b25c5347e108fa50e59c3bba18fbd7fe4e2a1a6bd54da1622b80e029a5914e973f3faf5884a262baa
TLSH
T134317AD988839131BA94B373BF4F3A4F96770416FD21210867C94A89ABE324166DC5FA
MD5 SHA1 SHA512 TLSH

Submit Download

dxupdate.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\dxupdate.inf
Size 12KB
SHA256 93f5589499ee4ee2812d73c0d8feacbbcfe8c47b6d98572486bc0eff3c5906ca
MD5 e6a74342f328afa559d5b0544e113571
SHA1 a08b053dfd061391942d359c70f9dd406a968b7d
SHA512 1e35e5bdff1d551da6c1220a1a228c657a56a70dedf5be2d9273fc540f9c9f0bb73469595309ea1ff561be7480ee92d16f7acbbd597136f4fc5f9b8b65ecdfad
SSDEEP 384:eXTiDxtV0xxmBxbD6Ys7s6xHOJYwYdDxAp8xXZyUxIJM:eXiM
TLSH
T121429976B5168259F40EB3A016AF3EC95E3B008FB53164CD79EF11B0572E1ACA2FE464
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

feb2006_d3dx9_29_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\feb2006_d3dx9_29_x64.inf
Size 806B
SHA256 ef36ece1a6bd8af3b0b9247b081d28ed511b7e18c43eb3aff364c9ce8d3a06c3
MD5 0d951a2eda3638d4c976a5ffc1a9f8db
SHA1 fca89fa6bc6d4c25758b7baaff9136c3d73140ff
SHA512 89e960fbf9421a208476f7f65acf8047d231f3d6fd87fb31b01185ce88f5ebb1fa7513224124889082f41f1dcd579cc8bbb638f1af73081b4630fb07934dbb80
TLSH
T1DE01899DCC03D43A76CAF1B27B8B378F27770907BA21255879CA0184EF33244616C6E8
MD5 SHA1 SHA512 TLSH

Submit Download

feb2006_d3dx9_29_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\feb2006_d3dx9_29_x86.inf
Size 1KB
SHA256 f12f4bd86d5cd748b0fcf7106e9dff333c27c0886541339ba1f40c443bdc61cd
MD5 f4c258b663ebf54c55d7d09b05b26ff6
SHA1 85af1252cf3d9ae7afcf8d576cdc17910203ad03
SHA512 cbd491fd8e847a4659758bfe0f5a4b56c97e539e3b3aa7ca601c329d858c882cceefb9ee8341d794235b7c2403a090f45a0ba8f2f44de3e3b1685d027d8bd19f
TLSH
T1964123D98802D5347698B2B2B79F378F5B37491BEDA1214973C90980AFB3361264D2B8
MD5 SHA1 SHA512 TLSH

Submit Download

feb2006_xact_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\feb2006_xact_x64.inf
Size 890B
SHA256 b7ca1a4942057592c5b83b4425350da41c61779dcae608112141d727091842d4
MD5 7d46669082d530935e79c74c4fd83bf2
SHA1 194a05e3b019beb07da96c3bef780e6154a78b9d
SHA512 590a9628fb90d4140d6f96238caac46f8ab23a59e3a9d94a28d1638006085efdbfad259b9633e4a56585f6cc10119d67abf3fa873a426a1946af589c17f84fa1
TLSH
T1F911CCD9CC4380327BC9B6B1BB87278E5767480BE82151087ACA06CD9BE3101B2AC1ED
MD5 SHA1 SHA512 TLSH

Submit Download

feb2006_xact_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\feb2006_xact_x86.inf
Size 1KB
SHA256 45146fd446fc8533dc5f97d88bee9ae220161f24797114d0bf3afc7c479ed69b
MD5 9dda266ba05cd917cca889659e3b98c8
SHA1 2a2ba2ccb3c9d87c03198b9ef3b9c6e21d693055
SHA512 26fa18c8058397b8b5d89baf1fb9cd689827b48781dbe40ddf884c0a3ff9cf8d8451c6c084a693e4fdf107ad181fcce35a2fcfb371548df948416b5713d8ce38
TLSH
T1E0319BD9CC0391317A96B372BB4F364F57774806E921410877CA488AABE3202769C5FA
MD5 SHA1 SHA512 TLSH

Submit Download

feb2007_xact_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\feb2007_xact_x64.inf
Size 908B
SHA256 184c1684c57de07983edaaa1ae2751b263497673ee8418af023a63fa03553f53
MD5 42161a1071084cb4f32b0d7d748d9b62
SHA1 e7e29605c21b7a2c370dcf979a40c50b93ceb298
SHA512 2aa8e864dc28ee5d0583d044e3d8a9399d8d49b9fb1c522c1c640eb7b079515ffb0bac5280a220c23e15ea4c7ad45c7f1722e05e9f9baa069f4a2670e4976358
TLSH
T1DB119CD9CC4380367B89B7B1BF47A74B97670817AC21225879C6058DDBA3141A1DC1ED
MD5 SHA1 SHA512 TLSH

Submit Download

feb2007_xact_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\feb2007_xact_x86.inf
Size 1KB
SHA256 64b6020f43bbab7f7c2368fcfe7224165fef555b2bef813aa13b2d9f6295d46c
MD5 5f1df74b0110f56ae0b6556dd2dbc14c
SHA1 c8c7d383f5e37c06015e1304b599568999bd4e09
SHA512 06572fbaa625c85b05f5f4eaf880083607b6d010a8d4bfdb28cfbb1021b08e533f3491080faecb24055acb897b337d83caf9306fadebc1f1353763e8908850a5
TLSH
T1A631ACD98803D1317A88B372BF4F764F97770416ED21211873C94A89EBE32416ADC9FA
MD5 SHA1 SHA512 TLSH

Submit Download

infinst.exe

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
Size 65KB
SHA256 5ec466d86f7205e7a99985f0be8cacd0494454780c28ac90ff5d4b906b9dc5e5
MD5 c292f0eacff8f95b789c78907bb52a46
SHA1 497087279afae9c13c5aae642fcbd3f269f31345
SHA512 854e9d5554d98fcecd3ad777565988ab363863057818392b56c325df6f613fb8efb501026ba8d081eebbca53d72f081cd13a2e90e42f93d6010ed3865bc33b2c
SSDEEP 1536:k4qL6Ta7Wx3wTn1xZ2Sn0nfLXJzRvR/oh:k4qL6+G34nYq0fLXJzRRo
TLSH
T1A0636DC3A6445075E0BF923486E26B23F7F1F458037993DF1A5489291E67BEC2A7C34A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

infinst.exe

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
Size 65KB
SHA256 300ed1a4ef37c8d5f13d67a5daabd46bcdd9ad9da4fe6283f20d7d38f72caaf5
MD5 fd1b55b856bcad2230f4338f72f9cf9f
SHA1 3d1bcaae1f2f2a759486bbf4dd543eadc7efbe91
SHA512 dc73dab5f5384a01bf66197ebc9b74a24c146e8f17571c98edf1d7d1dbc33b0f4075d46150b782891397d8a4875a8cf375a111855eb689f2a8e6ed0aa3ee0091
SSDEEP 1536:MjqL6va7Wx3wTn1xZ2Sn0nfLXJzR4R/oj:MjqL6SG34nYq0fLXJzRIoj
TLSH
T170636DC3A6445075E0BF923486E26B23F7F1F458037993DF1A5489291E67BEC2A7C34A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

infinst.exe

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
Size 65KB
SHA256 cd5f212a25c5f4ccb9a0c4688f1308941c2c238083b9a4766260b79261c4e243
MD5 cfcd6a19a9a3fd405658817ae0a13aa7
SHA1 b937e22b5b9b13defbd0010e9c3b0bd9b91d2e03
SHA512 17664a38f5ed68f8aa40d157d9016e66cd16b0bf7ec0c2e05c147fc94fe3355f7b5363713697b40f701441ee7ce73181327665a9ece76cb6337bec2ee6224e4b
SSDEEP 1536:G3qL6Qa7Wx3wTn1xZ2Sn0nfLXJzRCHae8:G3qL6fG34nYq0fLXJzRrf
TLSH
T145636DC3A6445075E0AF9234C6E26B23F7F2F458037953DF1A5489291E67BEC2A7C34A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

infinst.exe

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
Size 65KB
SHA256 1a008a90db1768c12226ca16b48df724a821c47aa729fb553eb401c7527e770d
MD5 870d6791e146f78a32b7f45370b596ed
SHA1 7f4da1c44a2b82fdf9af9fb62652d49c305cf4a6
SHA512 a7d41c02ac58509c4973e7642b266469c8cf753fdf782c1c49be0a7fdcee955bacdd530b4d204b47e7d62073260c9e10f343fa05f333a51b5dc63f0ca002991b
SSDEEP 1536:+oqL68a7Wx3wTn1xZ2Sn0nfLXJzRgHaej:+oqL6zG34nYq0fLXJzRd0
TLSH
T1F7636CC3A6445075E0BF9234C6E26B23F7F2F458037953DF1A5489291E67BE82A7C34A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

infinst.exe

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
Size 65KB
SHA256 76eed293cdcdf17942acc313366b22b55ad78ee0389989438e63ab7ae145167d
MD5 bce73adcf5fcfac42ce15c6691275ea8
SHA1 484355fcbc55357c2f576fbdd64d33c8ec8ffa5b
SHA512 5e53f89142918eca969e005d006f0a106862877ee6e5d317ffa1b7c017730fd1d3d98e5e75f603183d0371da39c11022cf62232a2b614a9bc5e055f52d6da65e
SSDEEP 1536:A1qL61a7Wx3wTn1xZ2Sn0nfLXJzRFHaeC6:A1qL6cG34nYq0fLXJzRML6
TLSH
T101636DC3AA444075E0BF9634C6E16B23F7F2F458037953DF1A5489291A67BEC2A7C34A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

infinst.exe

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
Size 68KB
SHA256 34ab99536ea59ad60ba6efda3ea6d18291ef096a0bab3664248d6045805da0ec
MD5 45d4dac07aa361bcd77aa815d1724a16
SHA1 3bbdf7da5d51211ae269572961b5ebf508ada28d
SHA512 d940002a8e0112a3b56a909008403b447e9cbb80e38b9bbd508f40aa68224f7e5d9681e1039e747ae939e0829a25be2319b9f9d0862cebb042e4c525ccbc20be
SSDEEP 1536:dSKL6bzRYK/ixmu3XyhJRxjWhKfLXJ/y/Fae:dSKL62K/u3XmxCAfLXJ/y/E
TLSH
T1E8637DC3A648407AE0BFA53486F15B23F7F5F854033953DF1A1489290A67BDC2A3D74A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

infinst.exe

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
Size 68KB
SHA256 d4e57566914f1d36f4ebfb6e164ce2170f1d5e6392189d0ad6de3ef3b0a9aad3
MD5 98b1369d38333fe9143259687edfb25d
SHA1 3536573ce844dc1441b91e1124b6689b93add430
SHA512 3544088b8436ae6e48d22a7638d59f3c14fb914caeba17a87d1af469b82f818a1a71c5faacd52f69b5bff190b44fd91f893d07b7e05c2e9a9dd363bd75722057
SSDEEP 1536:diKL6ezRYK/ixmu3XyhJRxjWhKfLXJqu1FaeQ:diKL6hK/u3XmxCAfLXJqu1E
TLSH
T1C0637DC3A644407AE4AFA53486F15B23F7F5F858033993DF1B1489291B67BD86A3C34A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

infinst.exe

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
Size 68KB
SHA256 fbe2e9cf7e400537a4871218113df178f70501ffeea59a8f0f721927124d6d46
MD5 ffc75edfaca60d28b6e6c1da8488f0bd
SHA1 358ae6e2680666b994e721db5fac0105a86a9c6f
SHA512 dadf216d9e92b349179b27cf436483dd5a52bfdc1db659f3d99b6d1bcc5f1fdf3b0fa4bc8bd08f89439ca1f07f5dc66625043f8065c0cc75e8b3627e59eb8d0d
SSDEEP 1536:TcKL6dQK/ixmu3XyhJRxjWPgfLXJpCu1FaeV:TcKL6mK/u3XmxCofLXJ4u1EU
TLSH
T125637DC3A6488076E0BFA53587E19B23F7F5F858033953DF1A1489291B63BD8263D74A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

infinst.exe

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
Size 68KB
SHA256 e0838d8d562ed4683bc06ecdbc46fe19dcddf711a0c7909dabf62da572035dcf
MD5 c92c92060d535cc9800b6ce231276852
SHA1 79281861482c717e61fe9bae300e0fba310485fb
SHA512 7c8893c92c005c7c21f829912da4b9e5a843e842826d5e362a9828710486240aa109f26e38a84cfc03617f4abaeda25f0ce215b8f6a1f9a65c58ef5606814d13
SSDEEP 1536:igKL6YzRYK/ixmu3XyhJRxjWhKfLXJ68Cy/8:igKL6rK/u3XmxCAfLXJ68Cy/8
TLSH
T135637DC3A648807AE0BFA13486F15B23F7F5F854033993DF1A5485291A67BDC2A3D74A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

infinst.exe

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
Size 73KB
SHA256 de817d92db706f329d50567221c42110ae781d679ef853cc684aec779ab51ccf
MD5 edbb7730845fe5ed4717b06f84c1cb2b
SHA1 d9bc196e34d69ca0ec91a5a835b444ac3e8aea42
SHA512 cb7c5db143087a470d7ca7f5d4200ae62513ffc27b864528d851c310d0f6f68d55b6fa45b7d3e0b81043ada5f7f6468447e9a877b6c6e06099c38690a6c07d10
SSDEEP 1536:+7XfyLmZsxNAYhVkLGrB17RwyIK94+4Xn8G+eKSFlA/:+7XfyLmexLVN17RwyIK94+438G+PSFG
TLSH
T10B737D98B79050B9C476C27D89C29715E7B2F81503BA03CF072486AAAF337E5593E363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

infinst.exe

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
Size 74KB
SHA256 ea31341129f7558d34fc2fcae9e715343aaadfc57f06a33a6da18448bd71b77d
MD5 6f05a242d0253e19d67978780bc06528
SHA1 ed8c623b0e462e92185d498552a11be01723861f
SHA512 2bafde8afa6918956f745b34397a4f6ac479d3696a363184ea75cb9e05c5d83796527ea6cf343004544173e5370bca0258d5636e3cc5cec16701d68d82cd97f3
SSDEEP 1536:XcXfyLmIfmXJu7jiwgQ87Nl5LJw3xzFtmQVbSt5RuY:XcXfyLmRXJuUT7z5L8xzFIQVbSt5Z
TLSH
T18F735B98B39450B9C46AC17DC9C29714E7B2F81A037643CF072886AA5F737E5693F322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

infinst.exe

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
Size 74KB
SHA256 a4b1a15b9744ef83cefd88fa86fb4f9053d8e32cb08845cd37b0672a54fcab98
MD5 093bb40e0a01b36c7797eac30877b189
SHA1 da9b78c7ae98d13974ae55a15df03393b49453fa
SHA512 10b912a3ed84b3e5947a1d56a5ef9d5aac87bd878271f8dc9e32bfe327f2e0afa6ecbb558f6927f361b7f6084be676bb5902c5755de49c182b7fd9973eab079e
SSDEEP 1536:oQXfyLmPfmXJu7jiwgQ87Nl5LJw3xzFtmQVbSt5RuY:oQXfyLmWXJuUT7z5L8xzFIQVbSt5Z
TLSH
T158736B98B39450B9C46AC17DC9C25715E7B2F81A037643CF072886AA5F737E5693F322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

infinst.exe

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
Size 74KB
SHA256 46906f2dde3a45d9537fa5a8e4c409cb81b7aa4f9ea9c8870a581dde00104f2e
MD5 5204860188d0719fc5c53a7f7fd4824d
SHA1 b6f0e1e9860612ae03956ea0c6a6b3b392ee71b7
SHA512 f3c7e1c9fe7ad7bd8485b2632ac5f3dbb07db9ed3a2ec934902abf1ec9f43aeef32e4b56e69875a15de3c40637cb65524db8f63f4ef4e914811b1bdedfcb6003
SSDEEP 1536:cLXfyLmKfmXJu7jiwgQ87Nl5LJw3xzFtmQVbSt5RuY:cLXfyLm7XJuUT7z5L8xzFIQVbSt5Z
TLSH
T1AE736B98B39450B9C46AC17DC9C25719E7B2F81A037643CF072886AA5F737E5693F322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

infinst.exe

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
Size 74KB
SHA256 4c8befaece0c58eb75c38e2347db04557c1bd2a4a269282c3769d6bcccf50395
MD5 44442b56a318475a3e7acb055ca79d29
SHA1 9ffe16ecdacd79269344643ca160d940e88e7292
SHA512 d64ab17f7e1baaeb5aafa4e7eb100257d7a29b1f5caed394b2d3b656c4c9ae56a0f9b952f60573e3ebffa090740f95b0f173eaf2642d6245eb8c2bc6c619b096
SSDEEP 1536:3zXfyLm+fmXJu7jiwgQ87Nl5LJw3xzFtmQVbSt5RuY:3zXfyLmHXJuUT7z5L8xzFIQVbSt5Z
TLSH
T104735B98B39450B9C46AC17DC9C29714E7B2F81A037643CF062886AA5F737E5693F322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

infinst.exe

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
Size 74KB
SHA256 691109b9127863b82291ec4c0f9bbf51f0119b775347ba37bda33be36f5c00e5
MD5 fb0ae16b37175ddbacaad1e68ba4ad33
SHA1 9daa03dcd49b22cf8ae819ca3f76af92e92d1342
SHA512 f87ad95efca1c49eba427fe58974e4d35d2b8e862c54c5e8f1af8de007a966077dcd5edce5a69e3571ace4196861885f4df8b4b304b4b13388c903053c4e6382
SSDEEP 1536:h+XfyLmDfmXJu7jiwgQ87Nl5LJw3xzFtmQVbSt5RuY:h+XfyLmCXJuUT7z5L8xzFIQVbSt5Z
TLSH
T19A735B98B39450B9C46AC17DC9C25714E7B2F81A037A43CF072886AA5F737E5593F362
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

infinst.exe

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
Size 74KB
SHA256 1707a6644d66406a9ac149b8fc959d964dce5c028ca3e1d0d5052e70f80515e2
MD5 d001b26aaa9bec255c0b697732e571da
SHA1 adce71afb93cf04a86c1b9d2f80144ca35742d2a
SHA512 af39d48e90cd2cd575a8d039642985e25ead1fa51528a082d91c9bcaf9d1ec97afd0f66c0bebb53043221ef13dda69000ebbdaea87605efbe873f471e16a6f90
SSDEEP 1536:0sXfyLmIfmXJu7jiwgQ87Nl5LJw3xzFtmQVbSt5RuY:0sXfyLmRXJuUT7z5L8xzFIQVbSt5Z
TLSH
T12E735B98B39450B9C46BC17DC9C29715E7B2F81A037643CF062886AA5F737E5693F322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

infinst.exe

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
Size 74KB
SHA256 3a07c2436d3fd2473e15518a53262d4f0fb7f2a05589437cc5668f929063e782
MD5 7d8f5afb77c3ada97a83f3fc253d6392
SHA1 e5424d020c6de84ccf72253834c545024161f682
SHA512 52f4bd961febfe6f691d7dd1e826f689319656393756e0c5c9e3d9729ad47e072071b204f63a3b37b67204fcdffd4539db08cbf190605dd9652ace51627e8845
SSDEEP 1536:qkXfyLmGfmXJu7jiwgQ87Nl5LJw3xzFtmQVbSt5RuY:qkXfyLm/XJuUT7z5L8xzFIQVbSt5Z
TLSH
T145735B98B39450B9C46AC17DC9C29715E7B2F81A037643CF072886AA5F737E5693F322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

infinst.exe

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
Size 74KB
SHA256 d808bb408a4bd695a9793e70b1c61637e008ac11174dbe1373481e2bdb0c9299
MD5 730e5493910e5693499485e352381c6a
SHA1 2871488c24d069e677868e0a590e7e74f1f19b12
SHA512 62fb2a2ddfd62d48ca8a709426c07e1cda0e66df5b977c3bfdc3b191d15c3a139a5c6180ed7a66b2418a5436273d713f2af1cb21f7dc77df78e0743d6a18e176
SSDEEP 1536:dlXfyLmGfmXJu7jiwgQ87Nl5LJw3xzFtmQVbSt5RuY:dlXfyLm/XJuUT7z5L8xzFIQVbSt5Z
TLSH
T1D6736B98B39450B9C46AC17DC9C29715E7B2F81A037643CF072886AA5F737E5693F322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

infinst.exe

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\infinst.exe
Size 81KB
SHA256 8c62fe8466d9a24a0f1924de37b05d672a826454804086cddc7ed87c020e67ff
MD5 a7ba8b723b327985ded1152113970819
SHA1 50be557a29f3d2d7300b71ab0ed4831669edd848
SHA512 60702f08fb621bf256b1032e572a842a141cf4219b22f98b27cb1da058b19b44cc37fb8386019463a7469961ca71f48a3347aaf1c74c3636e38d2aea3bca9967
SSDEEP 1536:uOPXfyLm7r2P25504T+kGvNcD9QeZu/FOfNlpaJrxO1wh:usXfyLm7rGo504TzucD9HoIfND8xO1wh
TLSH
T182836B9933A410B9D1AB927CC8E24B05E7B2B496473693CF0368469A5F23BC55D3E733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jun2005_d3dx9_26_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\jun2005_d3dx9_26_x64.inf
Size 806B
SHA256 addafcf0cfd36587c12eb2692922f0fb134874d11005a0544cc054546a493933
MD5 134624a22aefee1fad4eb11445b8d342
SHA1 3f0f65ab8be678250660ba47f33f229643c118b1
SHA512 24bfc2d96b3078f82ba031045271460295f3a1e6dd3c8c30d8d50c98daa9051aeca93ed8ecae8722b70083d3b0ba41735f81068e7514e81767e1e119e45ad6f3
TLSH
T183016699C803D43A76CAF1F27B9B378A27770906AA21355879CA0184AB23244616CAEC
MD5 SHA1 SHA512 TLSH

Submit Download

jun2005_d3dx9_26_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\jun2005_d3dx9_26_x86.inf
Size 1KB
SHA256 262ed4a65dd45e19f196cb2d9946326693ee31a86b51bf77116dec2727971cb6
MD5 62f8ec9c0d3bd54ace90cb15f5caa208
SHA1 e84f4a60c79f862aca0f917d1d30898af4036fad
SHA512 3de4ad76b207c2a0ecc10835cb787d61faa02e3531f6242a606ac0686cbfa156f59c30695effe5560d9a8481800b356873b7590beb8a739b33c0b1fcccea3fab
TLSH
T10C4125D98802D5347698B2F2BB9F378F5B37451BED61314973C90980AFB3361264D2B8
MD5 SHA1 SHA512 TLSH

Submit Download

jun2006_xact_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\jun2006_xact_x64.inf
Size 908B
SHA256 fe9caa55be17684622fd7339b1b96e1f0d107dc33c065706d24a435d523c6e12
MD5 a983924d66305104b4e21a551dc66448
SHA1 23deca69eea790ae7afc30cffa55e87ac8520cdf
SHA512 83c2117df0fc37979ccca7d861598a8a127d135456f72597366ac65276906435ab99fa353f246f9f61634fe96f8376d38253300f177d5cedac194cc92407f3d9
TLSH
T1F6119CD9CC4380367BC9B7B1BF47274B97670817AC25124879C605CD9FA7141A1DC1E9
MD5 SHA1 SHA512 TLSH

Submit Download

jun2006_xact_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\jun2006_xact_x86.inf
Size 1KB
SHA256 6bdce6f6779712e38c6d9e6e5961217e417254089f096c719f25566e952cb257
MD5 fa59f92f7d32613a12189e75eaa700dd
SHA1 f2c3947427e7eca9fd1ad53427d1dec28a5f0f55
SHA512 e8dcbd918cdd7d98a94d53413088e2f75e4d1a15d4f69b6927f3cf19760d9f2fc577659fd533b2e4e2997aa29f285b0fbb35830331997549e429dbdcc7ae9853
TLSH
T11F317AD98C03A1317AD4B372BF4F364F96770416ED25410867C94AC9AFE324166DC5FA
MD5 SHA1 SHA512 TLSH

Submit Download

jun2007_d3dx10_34_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\jun2007_d3dx10_34_x64.inf
Size 815B
SHA256 0f75b7ef71e183476ec938705024eb8a10a77d7602a336be876c7f5d17429725
MD5 bf312732fe77f600a36f2a7b98a346dd
SHA1 5e9c70959111dbe60ad86258cb5bb20d0e9caa0b
SHA512 10f3d128da5180ecccda522164269e4940b69a7f55af9501de648e572ab5275f02c113be5342969c73e118fb7ec49209883c4a8d6c4648fb898289f77ce7a3d0
TLSH
T108016B9D8C039436768AE1F27787679A1B270806E95126287D9E00C4EB67304516C2E9
MD5 SHA1 SHA512 TLSH

Submit Download

jun2007_d3dx10_34_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\jun2007_d3dx10_34_x86.inf
Size 1KB
SHA256 808983dfd3db7c3452589ea4e14ab4af8ef47dbad3b639f9a3c55685c9b73867
MD5 55e30750af2bf57321ad1097a512d725
SHA1 0af3c73afaae0e8a1fdabe25beeb96b32eafb9ad
SHA512 0ad8b51a550243d3f24ec5934f2b5e53f1d8e0b87997a7cda38840b3160121f1e221e6cb09d3f5b384df74be2ed10d4dd92fb02aff98bd0ededab751ddaa7149
TLSH
T1B531F49DC913903076C5B6B2BB8F379F5A370407E96222A87AC90990EB77751128D1BD
MD5 SHA1 SHA512 TLSH

Submit Download

jun2007_d3dx9_34_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\jun2007_d3dx9_34_x64.inf
Size 812B
SHA256 77f3fa1756181a90d2ee63c26cddfdaba0d720c9a49121db28746cd02b3e071d
MD5 d203c1993f21a870871ebb0c99de313d
SHA1 e69a5bc70fe66f89fddd81330dc148a1e788a56c
SHA512 e03c341f2d8df6e8174447d32bccb56b096073a35a3d8193860bd4628d812d1fa381bd35a55e17b4f27c5c5fffddb25223d932e995736fc608030501954d45ba
TLSH
T164016B99C803D43A76CAE5B27B8B375A27670906FA112698798A01C4AB63250516C2FC
MD5 SHA1 SHA512 TLSH

Submit Download

jun2007_d3dx9_34_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\jun2007_d3dx9_34_x86.inf
Size 1KB
SHA256 a568b7b8a0360ad94b1ed6388eca6ca9d8770937360a426a0fdadef9a4019bba
MD5 b1d65a13b527d75ecdc30cabf407d103
SHA1 db6df8ce6c28cb4a0275aa134c2d42a0ed957fa2
SHA512 7d80f772b36c408c258f7db1180bc09996620634e6304761f5c10659d0885bb8d0b19bcad50a13a5d99ee92dc8e15587534d966bd32c5a8910308eab623a7f86
TLSH
T1463157D9C802D4347694B2B2BB9F375F163B450BE951224873CA0A90AFB3361115D2F8
MD5 SHA1 SHA512 TLSH

Submit Download

jun2007_xact_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\jun2007_xact_x64.inf
Size 920B
SHA256 405d8cbe3c87b16afac2a9254497412a42de4ae2d8fb470a1234dc3260e0b90f
MD5 c8ca749e73883789faf6561a375d9b51
SHA1 fabee2ac65f1d4267da8df07cd3e4cf4eb19148f
SHA512 56a0fd5b8f065b82f5f9b73dbcbf912045847180a6614dc48ed7b27fea3909839615aab0c8d0a122d9fca952e9591da5152b4c618e84a2d7aa409dea4fa4237f
TLSH
T138117AA9C802C0377B8DF6F1BF47674A976B0817EC1012497A8605CEABE3241B1DC1F9
MD5 SHA1 SHA512 TLSH

Submit Download

jun2007_xact_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\jun2007_xact_x86.inf
Size 1KB
SHA256 33b980fb973394d9d8cb4645914d4cf6793bf92bd311e0431ce9cacc59fdcbc5
MD5 757a5f0cceaf39b5c7c9bd61650fd12e
SHA1 a7b3dda77f0f2334466d324eefeb3e5f6809d880
SHA512 f4f969b017c9233bc4a2267118fe921689b3237d28fc2b251ea3b6227e0b17dee84dfb8df6491928791891dfcd265688069b92d8a88cb9dfdbfff07b24a4dfcf
TLSH
T124315CE9C802D1317A98F371BF4B365F877B4416FE71224826C6468A6BE324172CD5FA
MD5 SHA1 SHA512 TLSH

Submit Download

mdx_1.0.2902.0_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\mdx_1.0.2902.0_x86.inf
Size 1KB
SHA256 3bd14cf2a96544ece692e1911500f7196370a111017fb6b0e23db0f0d0f40dfa
MD5 81700fd8d24ccd5ed83ce202dadcc625
SHA1 380473dc3560cc64fd0beca96674554d87085c28
SHA512 8ee1bd03fcd6125d22d1d35437537f594a84e67573ac72d440d45d419b88f5d3d1f5fcd8804e1a0b873714c1a71c63a488b8068f0c465e94940ea6e2db1c7860
TLSH
T18D414AD8CC06E1787799F1F1F7CB365B1B7B141BA92A115C71C84944ABA3641225C6BC
MD5 SHA1 SHA512 TLSH

Submit Download

microsoft.directx.direct3dx.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\microsoft.directx.direct3dx.dll
Size 2.6MB
SHA256 7986e3fbe05418fe5d8425f2f1b76b7a7b09952f3ec560b286dd744bf7178059
MD5 a73e7421449cca62b0561bad4c8ef23d
SHA1 cf51ca7d28fcdc79c215450fb759ffe9101b6cfe
SHA512 63d24647ac5d0beb8f1284973927263cb6e05b4c399cda3912178114b42d541dd516c6d67a453ea997d9d0cd9126a1802678062f0951c2547e1b445ba50dfbe4
SSDEEP 49152:CVtWTlcCjM1snlKtnzkXxB1xvN4gh3P9888BFtHAVYL8VTWIZaBrpdutHlx+w:lM1snlKtnzkXxB1xvN4gh3P9888BFtHs
TLSH
T170C57D05F6969136C8AB12B0119D37F821684676676123DF81849FA1BDF23D6CF383EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

microsoft.directx.direct3dx.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\microsoft.directx.direct3dx.dll
Size 562KB
SHA256 5e90089e69e4f7e2e42ea4a81fb62005c3710d0a4acdf207b97ed03f5641d013
MD5 afcf5f50c632f3a5598abc28f196d77c
SHA1 294385693592f9d6320f8b0b18f45bc194d01a4d
SHA512 29746ffc665051e13386e452c3e41a593b6339e09a228927929be100cddb3e0e0fd3b54abe02eb7d46a3d97466ecb02bac362398b72fd8e804cbb21c8bc856d9
SSDEEP 6144:M+1mhBubP0MqFnCo4T/vKc5MivKu/NOnn+n3PFtKIx5Q7:nM7cP0MSCXd7ZQ7
TLSH
T1EAC4A50AB740EA3BD52E1B3214D21B60127951CA635236DB05589B307CFB7E6CE396FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

microsoft.directx.direct3dx.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\microsoft.directx.direct3dx.dll
Size 565KB
SHA256 78d85f0e2cb7d7bde534222f4ebfea1c9e06d37ecd3bb7ebd59e35f00b94b11d
MD5 933085360527de1b4947289ca468184e
SHA1 d5ee5e1e3c992c7518b5ce510c627c1564131b12
SHA512 2e22398d7cdcd6a46daf3dd3478d861bc4012ba1b54862311ae031ebcd3f908352157cbeea528f22ef1824f8924c3f217311feaf1804cf675eafc07a8d3962eb
SSDEEP 6144:CCxSOwe+wyc5si56H0NOnn+ndgFYKICza9G5:CZ/1a9
TLSH
T1C7C4C65AB750FA3FC52E1B7254D20A601679618A635233CB0158AB30ACBF3D5CE356FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

microsoft.directx.direct3dx.xml

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\microsoft.directx.direct3dx.xml
Size 1.3MB
SHA256 7b38e6dd8c567d17d94f595c33fb234284abe884a1148025f59c8e426ec30c03
MD5 d2ecbcc04f7e087d738df9329d47c30f
SHA1 0f2d7c485020928227b668a148b0a60d99bd6695
SHA512 5662bbb30d7a601efac49f0e090cf05112565ac40dd998787e40d4ee6988f985ad8513b0d5f80e17f8ec9e7784af1c50a70137c0ec22b0c72107b601503bcbeb
SSDEEP 6144:C6HDM/iYC7RchI1Fy5tEERyoOrzl6ZhNt2tnIeN8+D5qkQGjO2NMT2FbNXYBI:3DCiYC7RchI1Fy7eN8+D5qkvbNXYBI
TLSH
T15A65FF20B6DCCA2684A342131C84B980FB5C467B645EDD1D388D6F2E6B76ED1D63F893
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

microsoft.directx.direct3dx.xml

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\microsoft.directx.direct3dx.xml
Size 1.4MB
SHA256 c3cc575c93690ddf44fd71fdeaff3d61552e9d4eafbef77840e4208522d81fb7
MD5 1c124cc5c3be4a5e8d6619125b1b33eb
SHA1 455365d2ff521d135b75522a4ce6382aa73b7c30
SHA512 1e9fde35b9c4d4a123a92545f5b15b12657d4652328e8d249ca31338f80b10a9b70811a16c40e82f286ce1b192bc545d29605c2ded4b937cf69088d9aa9943dd
SSDEEP 6144:W6HD4/iYC7RchI1FyJtEERyjirzl6ZhNt2VnL5CN8+D5qkgGjO2NMT/9LNXYtE:7D+iYC7RchI1FyfCN8+D5qkYLNXYtE
TLSH
T1CE65FF20B6DCCA2684A342131C84B980FB5C4677645EDD1D388D6F2E6B76ED1E63F893
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nov2007_d3dx10_36_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\nov2007_d3dx10_36_x64.inf
Size 815B
SHA256 7a49ae818e199cf9f9bd831f94cb6d03a1e72a141d76546261979b30642757b7
MD5 60e353607750ae5e63cb8e56f443321a
SHA1 8f1b07f8cfbd66e9a7e3c15118bddd99b04d6871
SHA512 038aecc1264f608c6028ec2288f0d8de6c9202bb3d1e96fd247e889afa06f1ce592bc9e224f37e83f29c0984cca6c4e85ab11eb28570aafa20b076f2b2e5b6e8
TLSH
T10E016B99CC039436768AE1F27B97678A1B271846E95125187D9E00C4EB63304526C6ED
MD5 SHA1 SHA512 TLSH

Submit Download

nov2007_d3dx10_36_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\nov2007_d3dx10_36_x86.inf
Size 1KB
SHA256 96f48bb810055699d37e9e27a65947483a0b4df304870e3b5448d3051b3e4926
MD5 582814cd47564fe8e3424cb2eb090501
SHA1 87a2114434564bb0a5cb4ea337577dd405f5e42d
SHA512 203d522271aacc0200bdd684934a8478b54a258f55ecca49a178ccabf418a328cd02ebd2a9656bd9dcd40c33de21d33664c5b16c1e7877de424d37b4f9b3e7a8
TLSH
T18E3105D9C9129070B6C9B6B2BB8F3B8F5A371407F96221587AC90890EB73751128D1FD
MD5 SHA1 SHA512 TLSH

Submit Download

nov2007_d3dx9_36_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\nov2007_d3dx9_36_x64.inf
Size 812B
SHA256 d1b544b3912e73e5984cd759096120febe6f17e41a3cf920ef82431b9b569c1d
MD5 345ecd585eec22fb33a62e59c2758b6d
SHA1 2d6ed63996903c32b3e7ae24d86c924b11d53e7c
SHA512 6d88cd48bc32a008989ec4bb71afba0afeeaa12f17833fb4072c38b237bd006f192f4e4e7a65d8aebe5d6dac1d13098eea370b03ced343a5541e0ef23e813364
TLSH
T119016BD9C802D43A76CAE5F27B9B374A27671906FA113198798A01C4AB63250526C6FC
MD5 SHA1 SHA512 TLSH

Submit Download

nov2007_d3dx9_36_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\nov2007_d3dx9_36_x86.inf
Size 1KB
SHA256 843764f70f56d430c0695e263c895a135a631f793213d1005fafcf9c210d1ac9
MD5 08ffe480ee5e54fc19a2feea46adced6
SHA1 c939391c489bb321f70707183b0d3f4b5f13911b
SHA512 c05aa34b860b5620c982731af15889da5571395fb35faa24d43ccbb1b42dcc756769a0b9153c28112d7347f28d4ba933d8b15fb36a3e511ac99eb148f848ed99
TLSH
T1493137D9C802D4347699B2F2BB9F374F567B451BE951314873CA0990AFB3361115D2F8
MD5 SHA1 SHA512 TLSH

Submit Download

nov2007_x3daudio_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\nov2007_x3daudio_x64.inf
Size 815B
SHA256 1cc72ca78433fbb72ee6b654c908748ea846c87c80424816745f285ed3bc910b
MD5 55402001ac41f0bcd1f457a36d298848
SHA1 a18fbdc9631610f2550f05cc3aed5a665afee7a4
SHA512 96cb7ff1d43a7c1642d8ce9cb3c23ba460f6c083a7927fe0ad7a3ebb85649c384ef0542ee3e7dff6b99413b95a2a333327cd28349665901f466782fe96ee491a
TLSH
T1F3018299CC03D53276C9F1F27B8B27CB1B27081AEA316518B68A04C4BFB310051AC1FD
MD5 SHA1 SHA512 TLSH

Submit Download

nov2007_x3daudio_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\nov2007_x3daudio_x86.inf
Size 1KB
SHA256 f882bdbc8230d24b24e20f9d0db447586e9493801900a8ba381eb493bd41f5d5
MD5 4287ed3f6647fcd80ec6b0f7f2606964
SHA1 27b2e4212295478645a017a4df820af6bdb4dd0b
SHA512 c816d7127fb7fadb971b757ba76d4b918fe18bb16e5d2249b4bd80b0b6c47208e7ba5e11b521d9cd0a23d464c392f98a3c617b91c0ae799f3aa10401b4e2bcd7
TLSH
T198212699CC02A4707685B2B27F8F768F5B670817E9611508B3CB0A90BBB3701219D1FE
MD5 SHA1 SHA512 TLSH

Submit Download

nov2007_xact_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\nov2007_xact_x64.inf
Size 926B
SHA256 841d579573afd51499c7cd8ee986a41db63cedb722e8fac351d3632ff470c161
MD5 bebd51d24aa338f6192e291d03684b6d
SHA1 cf2c0efb60f44748b0ef3f95276b0512719f130d
SHA512 28fdc41091d761faad79c1af33da0372086689113df2f1cb40513d50727e5aefd652a977ad5c92bd62f1c5ef9cfc24c23bc6758ddd6a4d1ac5db0b5e401432ca
TLSH
T1F4117A9DC803C07B7699F2F1BB47264BA7670456EE2111087AC605CDABE3541A1DC2F9
MD5 SHA1 SHA512 TLSH

Submit Download

nov2007_xact_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\nov2007_xact_x86.inf
Size 1KB
SHA256 24714f229e479338ed89bdd6143140505fd63f517b7e71170ea6c072a1748b06
MD5 7e2a5eadf9f1eaf90d5eac15b7a9f558
SHA1 907cf74056bf7ad91e47c98aaad9a092ab42fd02
SHA512 63c2f438e6feaec2b9fce15617940c97862a54527d549fb6ea149e4d18199c1752e255c6cb167ff20b9cc1f74b87ffc97110b65652bc5c3883cd14894d21f8fc
TLSH
T16C3195DDC80290397689F3B2BB4F264F96774416EC601508A3CB089DABE3A4257CC4FA
MD5 SHA1 SHA512 TLSH

Submit Download

oct2006_d3dx9_31_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\oct2006_d3dx9_31_x64.inf
Size 806B
SHA256 c031987e68e476365cd885e41a072f85fdfc9e480c93871d024a5ccf26d17118
MD5 e2a0e651573cffbf81578b864b50cfe7
SHA1 1c739f17f63ce7c5ba00638259628f7fc919cf74
SHA512 abfc6452d055bf6a3fadafb9562352bda90ee0edae5a0fec798951ef9d39701835212533a60eaab67c5c0fcf01ccb9115fcea3779b024ee1e11f217cb676e7f0
TLSH
T15A0189D9CC03D43A7ACAF1B27B8B378B67770917AA11255879CB0184EB33240616C6F8
MD5 SHA1 SHA512 TLSH

Submit Download

oct2006_d3dx9_31_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\oct2006_d3dx9_31_x86.inf
Size 1KB
SHA256 a1c61096019a6ae1a9f31e3fe67aa2bb7e9e451967959d7088344f3f20ab572e
MD5 8f7aa1f0f2389f3cac574652f5d6672d
SHA1 921f2161cf46c6314a330ff52c83f8a3f1058f0d
SHA512 a85c03ccaa27adf3c75287529f18e84f526cf91785e0f4281db0eb86feba78522603e21def19bd2a33e03ceaedd9109b8af1dbda4a3fe93fe6eb95366b6df747
TLSH
T17C416AD98802D5347698B2B2B79F378F5B3B451BED52214972C60980BFB3361224D2FC
MD5 SHA1 SHA512 TLSH

Submit Download

oct2006_xact_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\oct2006_xact_x64.inf
Size 908B
SHA256 4c388e9eaf3c39e75d003a58020e491b675b3a6054c702062a9c90e86f691d96
MD5 535ca39d61f752c3f1ba4956871fa27e
SHA1 4941efb676adedb9a46d7cc7415d8af03957b3fc
SHA512 f203958ca9c7d37daccd342a4deb125b60ef839b5b674a2a0220d7f0d770d5cfcd5c1f691470200bb4d8711f2f6a77d8b968e17020dbcec8c40b127a09f5f9de
TLSH
T143119CD9CC4380367B89B7B1BF47274B97670817AC211A487AD6058D9BA3141A1DC1E9
MD5 SHA1 SHA512 TLSH

Submit Download

oct2006_xact_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\oct2006_xact_x86.inf
Size 1KB
SHA256 66998b21cbe6f05b12cdb4bb45549dcb1b4a92f8a1b910334150a8d767fa39e9
MD5 6181c4b93bad5332b34180ac0bae5077
SHA1 259c8de2dff2a5dd8d4971fa1ab3fb0d193ae90b
SHA512 8508ebc77b667907c5c2f587131f24cb25c5a67ab2f7d8b94216931457f486b37b9701397ed6ef527c9c6786f82a938a52d2b6cb0afddeff4101cb100e3ceca8
TLSH
T1AB3198D9880391317A84B372BF4F364F96770856ED21018863DA4B89ABE334262DC5FA
MD5 SHA1 SHA512 TLSH

Submit Download

x3daudio1_0.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\x3daudio1_0.dll
Size 13KB
SHA256 228dfece2b4555a243a73e7bf461036f1e53951977625651ff5a59deaeaf4b88
MD5 4e961525cc7ff0e5d7da19e170b7c14c
SHA1 7e3654ef7f7c9524ff415582f1b066f29b4234c4
SHA512 8785d0b2188f36d53c1a2b99a669d6edff1c0c27905d5bda1615a503f115d5b0762f008481145cb0cb6a2589926543b9c8ed0ecc2e328593682e39b90fca2087
SSDEEP 192:F2PUx46S7ZA++Wxipcq+2WdakaWSF4L/CldolMGo3OuqoMOdLCqt:cPUx46S9xipN+2WMpWG4LCcMe/oTCm
TLSH
T1D1522A828B3C0205FD965FB122BAF9937D38F7C25F908D67107D91C62C52BE58E6891E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x3daudio1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\x3daudio1_1.dll
Size 14KB
SHA256 ff15f14174a5543f028fa49cca745582fe4cacf3bbe490749cf43444690ab359
MD5 121b131eaa369d8f58dacc5c39a77d80
SHA1 d8fe20cb6f28bc5334ae64a8df3563d1985beb9b
SHA512 ffe19ffea137603e5401f133d461b30af6fc25b3affb8a8ce20b98e3270de398b9ecc83a6cd904ff42c5885d3806c7e175957bf4a5827dc2f067756a51bc40db
SSDEEP 384:rRzhlxrni/jKXEg4iptXWfoWqDLCcM4aeW6l:rRfkLo34ipqoDL3bae/l
TLSH
T117624C828F380205FCA52EB4617DFAA3793CF7C21F919D2350A981C60D92BD59EA851F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x3daudio1_2.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\x3daudio1_2.dll
Size 17KB
SHA256 7c06bb70d12cf78de9c6a12a53c95f9dba41c140a48bccd500483e5b87795a8c
MD5 9e4efe7cc29ece294f3506fe0d8090bd
SHA1 b5d0e9cf45ac3b05fe21aed3ba41dd94b1ad1fa7
SHA512 998d3034cf21bb9aafe0821a96c64ab0c38f770cf9c6a6820a2292b569510dbcd0e71ce56dae813614d9a148c146e095245e963905e71679c3cfca1ad98f5e16
SSDEEP 384:FM1zdEM80Nuk4ipVjzWUrWLOnhu1jRaeW:61WjipV/ru1jRae
TLSH
T12D824BC28E3C4102FC562E716379F9937C3CEBC30A62CD1764A9F5D60967BD18A6891E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x3daudio1_2.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\x3daudio1_2.dll
Size 17KB
SHA256 1ae37d90d39c36c142a51ab9fef7230788ff95080f2bc47734737bf82d3c2c9b
MD5 ac49e8536bf510251611a77e2a6cb8dc
SHA1 8b1f64007fa777fa2aca1e456735ab872cbabeb9
SHA512 2c33ba362315ab102e4898ae92f7bc71e7c0c7fda8cd79f896cfe76e5a2a4129bf6a1e48d75b82ed7d915c0ced819e81c0f89640677b6bfa388962ce19bde2a7
SSDEEP 384:lhM1zdEM80Nuk4ipVjiWLrWm4nhu1jRaeWCG:81WjipVzAu1jRaeJ
TLSH
T18C824BC28E3C4102FC566E716379F9937C3CEBC30A62DD1754ADE5D509A7BD18A2890E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x3daudio1_2.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\x3daudio1_2.dll
Size 17KB
SHA256 4c448c7f77e3b4385d2cd35d0c470589cdf0524e532f9cf7ae084a8f88aa949a
MD5 f6a9fc2ad2f9111372b5ab3bba3707ec
SHA1 bc7afb780d42a332497139b5236b809433d86009
SHA512 6cb44bb174ef28cee3e3a6ac51897b5cceb3f2d06d08c556cf6476a285de3e3b03a624ca92fc11b95f29694629457fa39747e3041736f9b76e84f19a052ecba6
SSDEEP 384:nMVzdMb8duM4iZR4WJrWEOnELKt8Cy/jd:MV+jiZxPU8Cy/jd
TLSH
T1A88249C28A3C4212F8565EB423BCF9937C7CEBC34A72C95761EEE4C50966BD48A24D1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xactengine2_0.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\xactengine2_0.dll
Size 224KB
SHA256 cfd1c2d34feb7d94f282e97bf762a99bfa7309dc7353d96dfe4aadc187d26c67
MD5 2112fe0c46662d429347a7d7b49e3ece
SHA1 8cf607547e9c5a10f129a3a8f8f32bd295c0d5b4
SHA512 77f77add8411d418798d643d783752896d3fcac002f15696caeaf45b5396d2d42fe53bfb409d66ad505cdaac0ef0a20a62aa45b50aebe65237d2c44af36bbc34
SSDEEP 6144:+0FGvorNriTgfdedw50QSXLQcSAmHLaF0a:+0FGvMiMEW5rSCAmrA5
TLSH
T16B247B31A410827ACCE672F48A6C713452BDC7C65725ABD712682EF6ED603C16B792CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xactengine2_1.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\xactengine2_1.dll
Size 224KB
SHA256 666cef7d27a38f709063c9c581fd95e6b3fa27167bff4beff484dba2dc922a2b
MD5 7c9952111f4c743b9f0d8b68b6ed93c9
SHA1 75dc863ed10e4e4a18fa06dc32789cf16c738c38
SHA512 aaa3396fa9081f25b2eff6682ea26afbd297c8a61cee4540f9a947c1a96ad51f114a9985bbc69ea7d0251f6e4b1e835c92daf0f8c5fd66e477e3243ced3c9bef
SSDEEP 6144:WF0z6gPCTM9gCW/5mlHuxJjeLS/KJqmKDh:WF0+ncVS5kHuH/WMDh
TLSH
T1E9247B326450927ACCE632F48A6D7178627DC3C6172667D716A82EF6ED603D02B391CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xactengine2_10.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\xactengine2_10.dll
Size 261KB
SHA256 113640ae8cf78caa7cface2f906f9e6b60809906f5c26e08b2e90fc48430f3b7
MD5 73e055af78a64f9b2779d44407ca2ab6
SHA1 d771ef11d22a79dba7deccb9b3efedcbe74532d9
SHA512 a8d979297ecce24a29459e7ff814e53c649a6c969869279dbf0f29edea4d73883441519a27e5e46bb1e4b5b942cb26907cea9a488de0067e589632687b25b5be
SSDEEP 6144:dgKqiro4W9bR7QSu5r/baowkcZ3PWQwpWg5:dgKHWjQN7bqowg5
TLSH
T181447C21A8508235CCE232F486ADB17492ADC3C253359BD706A82BF6ED617D1AF751CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xactengine2_2.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\xactengine2_2.dll
Size 224KB
SHA256 4f996edb65022e33ae9c9f7acf7232c8d444f75c50c72894f6d3173b55404ebe
MD5 5c4d3843b491c047b7a619901fbd2ec1
SHA1 e02dd40f54e7dde0bcbd648e4fc6f723ac438bee
SHA512 474105b213bc067e0822ee22c769f0caa7a02f2d74a0422b676675fc45482db3a8a3dcb2744339a4c7fa029a2f58a2aef5db500c65cf646106d8ed096b17d062
SSDEEP 6144:vdy+T+VfKgpSBOhFaHnoVBDUrH+LY6q2Q:vdyAQva8aHoVM+LzG
TLSH
T1DA247C2168509275DCE632F48A6D7138927DC3C617266BD712682FFAEDA03C06F7918F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xactengine2_3.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\xactengine2_3.dll
Size 231KB
SHA256 ca20cf8e4034719a46bf67c6009486c2c1cfc2da10ffed3a67dcae677b4f6793
MD5 69d841744b2bae38fbb2d40a230a549c
SHA1 2a6429b1b1758bffe3366ab72212fb9b02152d77
SHA512 d5e26da74fc84da90b0f60451479524f1d03946076d009328aa7f9939456762633006d11970dc4c849101728ca32350c125005eb4e3f75114d4528cb17a35b44
SSDEEP 6144:calMdQ6T1e46HyPL+SOHdX/vR8pQTsv+SZDuCDcJ:calwrPryS+dX/XTo+SZDhu
TLSH
T173346B2168508375CCE232F48A6D7138526EC7C25765ABD716682EF6EDA13C07F3A18F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xactengine2_4.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\xactengine2_4.dll
Size 232KB
SHA256 1e0e09fc077bdeee3de065c663b83f6717d39d56778833f030955077d490d000
MD5 6550e1a0a7be611592c31222fcb981fb
SHA1 2197a951ecac85f7144fb925f6daff9ae7811e5e
SHA512 4013fba5e4211e66ebd9f733ff35635cca82875d6af71dcfeb481a436efeab608fe41310bae63d55c7fdd64a5c5f64068ec1eeb997160c8ae27f21f28e2bade9
SSDEEP 6144:IKt9Dk0kit7EFDZ2GdQS20Mt5k7d+aR8kxSQoz0mySuPxz:IKt5/xWIGdZ20MFaGkxSQY0pxz
TLSH
T15B348C2154508275CCE232F48A6D7238A27EC3C217756BD716683AFAED607D06F7A18F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xactengine2_5.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\xactengine2_5.dll
Size 245KB
SHA256 ec68b5163cbb5f15e2fbe37fdf5fcb0d01dffbe53a460cb2cf668f31f0127ad5
MD5 86c93789e9006f1ac47ed9dd47d4c8a1
SHA1 e9de46eb68271018aa31c71ef89d1ddef19edf7b
SHA512 5a86661171f039946fa0568c6a9c655026c0a74c04a7789fadcb4acfd6a4faa5179d14149321920ceca9a1214910abec3e67e356898d5bdd044ffeefaeb57df3
SSDEEP 6144:Y6RgJtW171QqJMgKex7JfvWqoOeDrlauitrS:Y6RIG71tJXhx7KO6rla7tm
TLSH
T17A346A21A4508339CCE332F48A6DB27492ADC3C61375A7D716582BE6ED603E16F7618F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xactengine2_6.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\xactengine2_6.dll
Size 249KB
SHA256 be45aef0889b03e2243282a912f41580e8566db666a782c26a1d4d7988799d03
MD5 39000e033d39d19ccce21aeafcce2476
SHA1 6e7823e689a9b720a049a260380805a235ddbf75
SHA512 65047afe28308ce69e3b410b3b52b5fa4f615c95802019cb9b78ac69694e9987076af4bddb2ed7e47b0fbe73729c91b94c525e5b7644a42658663ed044b384e6
SSDEEP 6144:Wv2rngtEm0/3rg40gyNHMGfxFCzWb2k/eZT/ayUHT:Y2rgtm3rg/gyNHMybJ/eZTayI
TLSH
T1EC447C2168508275CCE232F48AADB27492AEC3C21335A7D716582BF6ED613D17F7618F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xactengine2_7.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\xactengine2_7.dll
Size 255KB
SHA256 a43c92af3fbe91dfe2a1d415342631fe64e18c7dd3e16e93b6c78947b68e7bd6
MD5 7febb8ce2233cbae738b16d42ed29674
SHA1 fdc5682d6aa0ec57b8f3c742fe736d74b3c649cb
SHA512 73a3c07b13b31d2df1cece720a0268cfdb7ae2a066b9e613f7c4ff0fc37b94bd4f32207149d56e1bcaa5656fd4501b1d136d94e18e97c07a8e793906dbc7927e
SSDEEP 6144:WAllo3zbGzgRwXrexo1P8tZ5gv0SuR13mr1yF:WAljUwXreu1PgkuHmRyF
TLSH
T10C447C21A8509275DCE232F886ADB17592ADC3C21336ABD706582BF6ED603C19F751CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xactengine2_8.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\xactengine2_8.dll
Size 259KB
SHA256 15d82e89bea30bf82de6ba0cfbe97eeaf05d1e06bc0133f0d1ee8d0cc41f51f6
MD5 499210c45afeaadee8cf4dcf7d5e570b
SHA1 de5ca60de47c8f54d531b88ea80d9a24a8e87a98
SHA512 f76f69bc3b6cb4f92e675eeedbd10a80f0b970d75ea04392484d477a4d02dec670cdadcb90be9eb215c4ad48a90d28347c9104f0835e93b5a9803fd62670536e
SSDEEP 3072:B4wGZY0TWQZZ8rviE7A/0hhNHTz5FspVbuMGpcKl0XdwPLcFPExm43dBoiwWPM+J:B4wGQ23/032pVqlcWAFP/439wWP9y3
TLSH
T11C446A2168509235CCD232F486ADB17592AEC7C2273197E70A983AE6EC657C1AF351CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xactengine2_9.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\xactengine2_9.dll
Size 260KB
SHA256 93a0d8fc38e4e9a301d9e721afbeedc5af40becc0b11a6e7e8e38f08f366ff6e
MD5 46ee68f04a75a1ccf40235ea6f1cba05
SHA1 43a30e195b8d894c69bd857ee377ce7fa6170fa0
SHA512 16e4c624e4e74d8c1fd7652ae745a87de3698567faf0cf03651ad87f1f730405fc0d2eca68e4b0ff3c5c526c254aac232f9bd359ddb6563313a8f02db3603fa9
SSDEEP 6144:3U5AWJCxEr2ZC/yaUkbu4wADZHltTB04Dy9:3U54E7/7TbThJm
TLSH
T1C3447B21A8508235CCD232F48AADB27492ADC7C25735ABD706982BF6ED613D06F751CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xactengine3_0.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\xactengine3_0.dll
Size 232KB
SHA256 887329745c479ce8d3023c969adf66780dd7e51ab536f0a08550ba4c77066c20
MD5 8a83673f0ab001870583fde2b004fa59
SHA1 be8d312b359a9b8f9f184d78c93c762cbc46e321
SHA512 583c73590d4b90576955783e24149125615b135f5bf5a815674e2546b93a8f89f6c3a286df09257e547bcfa8c0bc399abba59fb64158b411a83f28a4a4feabca
SSDEEP 6144:SRgj9iWwOFZIkmG+xnf4tNAuGeK+uTTO4gt:SRgj9ihODIkmPxnQtKuGe9uTTxgt
TLSH
T1B534B5009540A27ADCF77AF90AEE3079B65CABC1130524D757D87AFBDB166E13A3018E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xactengine3_1.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\xactengine3_1.dll
Size 232KB
SHA256 088999560171c60129c95f9b541852392602561dce43e4c61a453d48065f52ca
MD5 2e0e25252e1d41752876e9fe12ade175
SHA1 d9de3a83235166a4bbc4bc356419c07aaf3e3f8c
SHA512 a4555cbbde372893c564e1fcd707525c92fbcfb6915354b0062474cc47fe36ef66a3af212c08da117f2f2121698e556633f8c399199344354ce0d4cea4d0a2ca
SSDEEP 6144:zv9+GkXUi1kbYSygmGLbrXuEsZo8EX5RD9JqgD:zv9rkXF1WYSygmGLbreEsZoJX5RD/qgD
TLSH
T17F34A4009540A27ADCF77AF94AEE3078B65CABC1130524D757D87AFBDB166E13A3018E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xactengine3_2.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\xactengine3_2.dll
Size 232KB
SHA256 e6a34c1f068f89d6515cb460eed3b4dbb53522c5579e6c75741482f0d40d9f99
MD5 f3c6be26949caadb11dbf0086082fac9
SHA1 6b7a2475aacaf63f30964e9958713bec331c82ba
SHA512 167afd32d847088d4973437f8b89badce194211f8fb1a14cf30df11848e4d4dd8d5243765edb1ed09df0f9b674cd7de764f1dae9fcac91f0ec98ecd259181d3b
SSDEEP 6144:hqV14uuqbIACZGH3qFmZpGUtKa3EVbpshTGzhg5:hqV14uvb7CZGH3qFSpxt53E1pshT2hg5
TLSH
T19034A4009541A27ACCF77AF90AEE707CB65CABC1130524D757D86AFBDB166E13A3018E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xactengine3_3.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\xactengine3_3.dll
Size 230KB
SHA256 ef052bc9b7fde596fff3ea2d9c8fc994f3282953dead1b7f5477e7154af67245
MD5 8ba296419af3417d1e9806b83166e472
SHA1 a2a8a64aedcbda68149a2726b094f1710cba71d1
SHA512 877e89553cbfb6afc6dfb22a590a468f035dccffecf842cb26010d5e62e33fe10e477d5cb157d321de3ecc59112ba616b80e767028eedeb4e70a591f1b81b902
SSDEEP 6144:3aw8aXkAY9JmwBkbheVVmhyw46TpKPfsjBh9HN:3aw8aXkAqJvkbheVVmhywXTgPfsj/9HN
TLSH
T10E34B4009541A27ACCF77AF94AEE3079B65CABC1130524D757D87AFBDB166E13A3008E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xactengine3_4.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\xactengine3_4.dll
Size 229KB
SHA256 d3bad7995b998f2c95dbb33020a198ef5a248825321032f051619f353d46182b
MD5 686f8d1b4926d48227a06acd4d41cd1e
SHA1 324fd1d21a42f0c30bb071beb2cd5db9abbf3138
SHA512 6ed69ab933492870b7fbf4e178999b835846075fe103e65f9a0f9b1ad8d47c9277f31a7a0fb53f3620b591b103b02bfa8efec530d7372680f585b82e128edcc4
SSDEEP 6144:eGhGAZ2UsK3PLW/Fo2H59tyMNtsDeH/l3Fve0:eGhVZ2UN3TW/Fo2H5TyMNtsDc/l35e0
TLSH
T12A34A4109541A27ACCF77AF94AEE3078B65CABC1130524D747D87AFBDB566E13A3008E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xactengine3_5.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\xactengine3_5.dll
Size 233KB
SHA256 1d37ab9b90372eaaafb5055401449dc3184428fed559baaf36fbcccd2479611a
MD5 db3c93e87452b8dab4f58ed1fd2b1998
SHA1 fbcc3c80c74e98e8554260b8a08e14dd1670075a
SHA512 af693d7d326dd7874e0eba5b4163c21aad86270f8e54058c637f1cd200e45eafb75f79a2d579c477c06082ace44f3318bcef71698089808690ff88443ddf348b
SSDEEP 6144:5dp60oWubGPAxJdOr7p4yrXTypCPZHRFgz:5dp6zWuaPAxJdOr7p//yIPZH8z
TLSH
T1183494109541A27ACCF77AF94AEE307CB65CABC1130524D747D86AFBDB166E13A3009E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xactengine3_6.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\xactengine3_6.dll
Size 233KB
SHA256 8a7e7c5ac2e6230f0249d46751522e7ecf85e7490cf7491ab73bf2e7e59e4c0f
MD5 f81c4678a55ffee585ac75825faf5582
SHA1 8fb2e6cf2a022eaed2ff5e3e225b3ca1e453d1cc
SHA512 8c8071bc2640d5c0fcf140ad68d4788cbb0706d17313c3cb74e25624a748b282acbf77eda678cf0d5fecf2ec3d583508c6f4eaf5c84073909b616f59b4f4e5fe
SSDEEP 6144:FHNB4NleX2RWWLykwq3/niRkI9yYJH0/eX:FHNBelM2RWWLykwq3WkIcYJHhX
TLSH
T1D834A4109541A27ACCF77AF94AEE3078B65CABC1130524D747D87AFBDB166E13A3408E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xactengine3_7.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\xactengine3_7.dll
Size 234KB
SHA256 d7b1cf58898046c430d49cf8f778e4898280f4709340c3938d3139894166fe8d
MD5 4fd7bcb9d8af6a165e9ba0c2eb702e7c
SHA1 a90863632c2d54dd06e01537744a7b65bb3d0db2
SHA512 7fcc435d07c434ec392bb9bfa98aee20b0b1cd2ad6a31f073af80f6f37639336349728c9b0fcd967c4c395fc40c0efad1e36142fe7632512b0f26aca1b1c4bea
SSDEEP 6144:Vk3x25EondaupoSRLZzv9WUpud8Mj3pHB2:Vk3xQEodaIoSRLZzv9W1dljph2
TLSH
T16034A4009541A27ACCF77AF90AEE307DB65C9BC1530460D757D8BAFBDA166E13A3018E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xinput1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\xinput1_1.dll
Size 61KB
SHA256 69cd725c53e0302e75db20e9a3e4b33f58dceaa2e6ea4938b2733df8bc289a71
MD5 f1726346e583442541fe73429f8e9c10
SHA1 a1b7a4edd7d1164197f734218fb485165c075d0a
SHA512 ba17740271ea92c917db85c64d4ef63a8f2036fb1398abdcbedf9d49c09a53e34ea04e8b3f5a2ee41c2b2ecea6196ed7f9866ee48a9f3528c3b4c1f19dc167d8
SSDEEP 768:F60yGHl0LBZE6jWh4UFyiax9cBXlu87/7E5xB/bE7VfJ0IBtsjvfqJPL3d/o+N:F69el0LpjW4w5zeTB/bE7fztsjaJR/o
TLSH
T1C3535A1568509237CCE255F802BD7B14B63FD6B0176058C32AD46AEEAEA77C26F3064F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xinput1_2.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\xinput1_2.dll
Size 61KB
SHA256 9714d146a785d458f0de8fef387d82c9f8e101c02407a0cbeb06f02a69518eec
MD5 33b62be226934e1b01f5043870c70427
SHA1 ad96f837accd277da2933d07aa86ffe3ef803b5c
SHA512 41f859fa59145ef6cdd6cfc4a14f90bb932d2c6aa339bda1763d8e315e6a78bde561010152460e6f996c9ac9ffe6650ccdf6ded34656081a0ed9ab1270773710
SSDEEP 1536:oW8s/sJjG4wKp5ewB/7EIFtsQu6O7gqHaem:98esg46U7Rts9A9
TLSH
T1D6535B1568509137CCD265F802BDBB18B53FD1B0176058C32AD46AEEAFA77C26F3065B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xinput1_3.dll

Path C:\Users\Admin\AppData\Local\Temp\DXF2CC.tmp\xinput1_3.dll
Size 79KB
SHA256 8d540d484ea41e374fd0107d55d253f87ded4ce780d515d8fd59bbe8c98970a7
MD5 77f595dee5ffacea72b135b1fce1312e
SHA1 d2a710b332de3ef7a576e0aed27b0ae66892b7e9
SHA512 a8683050d7758c248052c11ac6a46c9a0b3b3773902cca478c1961b6d9d2d57c75a8c925ba5af4499989c0f44b34eaf57abafafa26506c31e5e4769fb3439746
SSDEEP 1536:TVeqvNS6T6jxeEsU6b0xZtDDVb9X8u9JA7zitdrz/R8cy/FaeBD:TVeqvNOeFgxZ9DVVtRBy/EeD
TLSH
T199835B107480D236D8E361F806FDB714763CD66513A559C32BC4BBEE9EA63C26E3069B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DXIC5E4.tmp

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\DXIC5E4.tmp
Size 56KB
SHA256 3ef4c33102886eae3c812b948ff3fbf70bb03dd91e772b852da3f9aaf75bdb29
MD5 0dafb23d5bd4b80c79a0f82dc2de34d0
SHA1 8159fd03f133c9cd8cfb194971a5250b9ecda0a8
SHA512 78e7fb35cab3d0ace4e4fef2868cc5f31b2254c267402779893b3f3fce90b8d784328ac19ef0d6bd37d975d557917be19d7a8a32a94ff8606afd36883ec1c9bb
SSDEEP 768:eNITdgil00BU0twUZB7otN4PTH+y491I7/su6U3mI9rITogZD0+pYnrIvdgsl0KW:eEBDSYj4kiJOnitAmfdwe5q24jIxwzKI
TLSH
T1DF43FC00F0F269EE401A5D6A27895D6A0C9F24557C5D202EB9CF83A89FFC1ED938D5E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxupdate.cif

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxupdate.cif
Size 65KB
SHA256 c6c5e877e92d387e977c135765075b7610df2500e21c16e106a225216e6442ae
MD5 b36d3f105d18e55534ad605cbf061a92
SHA1 788ef2de1dea6c8fe1d23a2e1007542f7321ed79
SHA512 35ae00da025fd578205337a018b35176095a876cd3c3cf67a3e8a8e69cd750a4ccc34ce240f11fae3418e5e93caf5082c987f0c63f9d953ed7cb8d9271e03b62
SSDEEP 768:Wn+OeDyG6lG9CVGQM6UP8XUUkw8KlNxLkPkjdARflPp0VZRTBM9oZPFASJu71N1F:V
TLSH
T147633209734ED9FE900FF9A70EA66D4D686E81AB344D680E78FF52C50B3B4DD628D091
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxupdate.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxupdate.dll
Size 173KB
SHA256 fb4f297e295c802b1377c6684734b7249d55743dfb7c14807bef59a1b5db63a2
MD5 7ed554b08e5b69578f9de012822c39c9
SHA1 036d04513e134786b4758def5aff83d19bf50c6e
SHA512 7af5f9c4a3ad5c120bcdd681b958808ada4d885d21aeb4a009a36a674ad3ece9b51837212a982db6142a6b5580e5b68d46971b802456701391ce40785ae6ebd9
SSDEEP 3072:KU6LKKnw8i/9S7BLGKm/nuFV3uNgosUBxr+2y97CqGIpHtWMeJnQRLj+bTHyKaY:Iw8aIMrfuFVeNgosUBxra4rIZsqq
TLSH
T133047C19F640E871D4D20178311C6B3119FEA87017A980CBF3472BCEE9A97D5A67E36B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup_20260910_083616302.html

Path C:\Users\Admin\AppData\Local\Temp\Setup_20260910_083616302.html
Size 18KB
SHA256 c7bbafb2504428e9755a3434d70c56e270259e3b55efdc45bbea5a485f342f4e
MD5 6cff40a75bbc181a8c931f7e79c2b84d
SHA1 3e34bc83854df9e602374d573a5b3c64cb9dd0bb
SHA512 f6ca89755bbd02e13b4c228d656e22c7d8bb11f8f4197147b751b1a94c2114b141c8c3a8a122fcf4ba1d40363e596e3c7f3a8e11b683835da138ffc8eb3a312e
SSDEEP 192:7Ddx3KOTczFQ21Kp4n5DTx1iDecPeLHLHQFJFjZWblWUxFzJzcKHj9hm:fdsOT01KcBUFJFEWUxFzvHxM
TLSH
T10182795327E84244A1B6BF49AEB640750B79BD45AC3CCE7D12A0591E49E3E04F872FB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5000_336766788\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

configs.user.ini

Path C:\Users\Admin\AppData\Roaming\GSE Saves\settings\configs.user.ini
Size 291B
SHA256 c3dcb487fdf6c127403eab27418d038a4d75f0b4e72df846f1dccf21aa69dd51
MD5 502e3d7cd37a0a8f2511a42a9e4b5f07
SHA1 a9eb226acb675e79630061ef78ed0684ec053eda
SHA512 99283fce166c8ff35763097b14c53acd151081b18c9b8143ea616e7e0b95113571a8b864f2856db5654e13a9840ddfd94578eab3c4ff471260ce88d00a716b46
TLSH
T124D0C261580F687E2E6208A278C63EAE4B09D2CD15563E8D33C5672961A3D828D63A44
MD5 SHA1 SHA512 TLSH

Submit Download

configs.user.ini

Path C:\Users\Admin\AppData\Roaming\GSE Saves\settings\configs.user.ini
Size 422B
SHA256 0f5e33ebbb6c99f16c7112b0d71b960a619ae9222d2a4a1b5e059944443a90f5
MD5 800fcb2b59936724153d5edcef603994
SHA1 ec83d17604ce0e890c1da8de0aa12b37556f9e4f
SHA512 6f5ab04d71c4f89ba30c04ecf0003d8605043cc845085243b521c9b1587d022ae375f8104bdd4ae39ca1ebf9ef83e715ad108c9538526a8019e86c7fff27c72e
TLSH
T1FFE0F116580B1DBA2F720AA178D57FEE4F0ED3DC09402EDD73C1271A5193DC28822B44
MD5 SHA1 SHA512 TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\AlternateServices.bin
Size 10KB
SHA256 7967781d6f367635ae1f63810b106904f99f16218b832518ea2e0bd9ef1b4e21
MD5 b204abfa6291b752dee6ddb6df5f5614
SHA1 7936feaeec76465ee3d7db88a969551beb9265b8
SHA512 1b57515f5075220dc5f1f058c8b6f828e5ee7c23677ffe727dac371b32c15bac8f05beb79d157d79ec82a9f2a4c7b427cfed9a2164e1b4272aa43c9d4bc27c10
SSDEEP 48:2pO4bqKjdGPGbGWNf9DgXzkhzPNv3rh1h:2pO4bqKjdGPGbGWjgXzkh1bh1h
TLSH
T1AE2226F713712551F1928FF2509575CCCD73062E6878A4CA4E2CC0D65691BE0A8BFBAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\AlternateServices.bin
Size 10KB
SHA256 ad265a97f4c41b4571cebef20931203ea3bba06e0f13595279650d83b6096f38
MD5 e2c5d2c392c53dd86194b16b0d7b418b
SHA1 c233d8ff7d6c76dedf051df4cfa046ba32283f1a
SHA512 db9df532b3eb67146a528207a6be928de00218b081f4d20ec3a4eb9909984995e8474dd8121d895b6b9b016b21549083f4f3df2364a0d47b0a89ee17fe4e83c7
SSDEEP 24:HuhMZgpO+lzbqK3BlWDTsF2TvhTyoqhezsEEGsF/G63GyXF1:2pO4bqKfWDf9WoXzsEENv3xP
TLSH
T1E822F7F743726251F1A28FF2509539CC8C63051D543854CA8F28C0965AD5BD0A4BFB7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\db\data.safe.tmp
Size 46KB
SHA256 b2151f106c17c9b94c250e49304180684f5cd2df904908e982dcc7dda3daf482
MD5 0cd8ae569cc2c43943e706f5cf91680a
SHA1 11c264454e6c71a235df7fc9c5dffc8ca9616c47
SHA512 396b93a0c84e93ceb94ff6877d85f63a3c5f0f229d0d5b38f4d81393ffc52cd6ae95fe03382082e5d23f125f0fb8611887fefaa333edb421a7d46fe4639dfb7e
SSDEEP 768:Hf3OquIPAZGiGcm+uxdWBKsYjLy0J58iwwbzbvbMb6bub6b5babkGnwN+KV7Iy5k:Hf3OquIPhWBaGnwN+KV7Iy5U/v
TLSH
T16D23F044EB1A913FD42812BADCA61B003F79F889591A2F973A5C64786C872DC3D4E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 ed4f67f18e81ea77a5dd5d6610679c37cbebf7c6e19befafcb22ed01d559c227
MD5 dec46d12ebe0d49bb1e3fc2f08700355
SHA1 e1351fa864f7f9e4bea01b84ee5462379357c96a
SHA512 86aaee44f327dd1728ed7a79c7f0802e61a0184901175b4668af37b6bbed7f39591ed68415f32a12e74ec95dbc985a0562f7e7665e383e61cde058ee25f1a38c
SSDEEP 192:ROv5zbo7gZmAyjX8Io41d66JoztdzgCl6mc0dz:ObokZmAyjkSd66Joz/zgC1jd
TLSH
T13EE11168EA28963BC418427BDCA61F410F3A384BD84E7F15319D645C2D472DE7B8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\events\events
Size 1KB
SHA256 412d909c6ab065d5e3cadd52c53e2f30b9b6d6b72cbaa72136704e433f5f6156
MD5 e35d8240a2656c02a592543162fecb4a
SHA1 dd0a02aae6d90363201df6ec716e717c441e7eb4
SHA512 b660f76e70741243c16e53e0cf3cc2b262f7e22e6f8ab03dab30e86c76ddbaedfbd4f53faa5584234bd3456d319ea6c8e90aedbb8d2327050497274f45c6eef2
TLSH
T1F0217C4D39F84E2AABCBE2D87490068E57914E0704871D434D16EF8CCD81ED9727E43D
MD5 SHA1 SHA512 TLSH

Submit Download

41d643c4-da43-439c-bec2-cd4678de9598

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\41d643c4-da43-439c-bec2-cd4678de9598
Size 886B
SHA256 b715416efb3957bf60b3788787ca225c3ba49fa7bcb8d163e3f1b64dde5db401
MD5 4f35c6a5b1b6b502ac23584406883b2c
SHA1 b5afc8f0bf789a4ef269e1ba650773d922c496cf
SHA512 c59f1804412754d4b2a3cbe39e5ae9127c3e76a363dda172b2656a5ffabecdea7c3658cd896eff14b383ef937f1669eb5e37ae2273dbcd02db47a83ba0406c46
TLSH
T1E7110040997475B1DC38D28B98A1BB438AA57513C0C659143DA19F180EBB51FEB67707
MD5 SHA1 SHA512 TLSH

Submit Download

70a26353-3ad7-4725-b48e-e7075447adf3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\70a26353-3ad7-4725-b48e-e7075447adf3
Size 883B
SHA256 dc8358e7479f3e5482d91eb08572afc1da5055b6ee19bd107e43dcfa15204146
MD5 cba138140421edb4ac9042e8b1308f6a
SHA1 6aba3b5aa942da2df1ecc3cf9bcf16da4a06b558
SHA512 2d3b5b7ab74668a975c36b852dd2e0c29165aa588b304364739c7eeec78d13fe3607198eed1e7dcc30aca84f03adda40780e8541c40e2d5b9884aaacda907470
TLSH
T1A31100509535B5B2DC38D20BC8617F028BE9791380C754143DE25D140EBE91FEB67607
MD5 SHA1 SHA512 TLSH

Submit Download

afbb160e-9db4-4be2-897b-222f04db2641

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\afbb160e-9db4-4be2-897b-222f04db2641
Size 14KB
SHA256 9eab3aab8b1c25a0c57f83f66eaa0c1a53ca64a9d8ec88a21ed37dffd5023215
MD5 fde7500b6c1b5c8f8134aea74c861382
SHA1 da488f7c53216d04e8be414b3b9b3471339d19c5
SHA512 f95f92038d97144bb9dfdfa7f0894c44a3048ed5074328b95785985b9408d2c4a67d68bde6ddecd61c50d967abad7d84c8522e04398cdd351aeae4a7b4b14b86
SSDEEP 96:rvYJGUYUx0eV/QgBqgfnPyeR6hcb9hinmNf+BZzaAevnzoBbXrqerIj6PG/Jsp9c:rvFOmSNr2juu2OsuYOai52eQX
TLSH
T13062A8FEDD2241433A6AF92DF1A8BDAB0056293159C8879C6BEC4C3A33D2EB71517714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b97eea0a-0edc-4b51-aa81-adcb746b7838

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\b97eea0a-0edc-4b51-aa81-adcb746b7838
Size 16KB
SHA256 87a20f8b4b4d9ffcc3ab57f982feb18e04095f411e775dd3876c641b6b4484ae
MD5 67dac213271aa66a0cbe8c1dc515b9a5
SHA1 8e3ad17b83c2ee1f0ea3f8110fbc94dc2231e84c
SHA512 dfb15336a6a907e8b4b0216a8674b1d2c52bd40e0916bc230a5123a5571ebc9c5585b3a14f597a16003a107538b800af7551ba9aa9f446a9cd49c71dc4dd45ba
SSDEEP 192:pDKxUbc8NPT+zxD7j4wrQKsvBA21mUz2EagipLiJhadiBRMFHwA8LFgdFr3eCcXX:pDKxWcaPT+lD7EwrQK2yUzggCLQcpg
TLSH
T1F872C956686055BA8551E36894F87FC3E2F638CF4C019FCA8BE4BD086DDE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c2b898ca-2107-46c2-bf14-9ea190e4ede7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\c2b898ca-2107-46c2-bf14-9ea190e4ede7
Size 235B
SHA256 10d191121024437d2a26435d03650dffef7e95399ec9794f832f3eeceea73a7d
MD5 3abd1ac7efdece2d1400fc083b27a17e
SHA1 39b4bcf6625c7720c34d9959913acd06cc3a4d61
SHA512 c8eae634111383e99a79e4ac1b67245ee1d197bb66c2d383e8fa2aa63f88994a70c2a7e9c53cd97b605da53e5f82df5ced5461c0d82b4c9643305cd3a6d7d68c
TLSH
T135D0A790689CA75D48151F0BF0A46DC630894C3724B56C60B7A14979DAFDEC842A2857
MD5 SHA1 SHA512 TLSH

Submit Download

dd532236-6ebd-4b96-8db9-a4ba2c8ece48

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\dd532236-6ebd-4b96-8db9-a4ba2c8ece48
Size 2KB
SHA256 ba8c8d9924fd1e906e39647de18ab3b7adb46f8ff7f27a081381847347fd276d
MD5 b078aee69d70cc091f39b7298d63ccc2
SHA1 a2142f88957a947bfe359075179a8dcc7ac3fb47
SHA512 1aaabedc09ea3a2b97d41fa152e9009f7b23a7f84011bf2380a7c51f14cd769fc2148b464031f36ebb0916f2c1619ceb9ba2a0a4ae32527e6a5a01a775cf4479
TLSH
T19E41535C35785D769CAAF14D9482274E93A09A4344C628432EA2EF0C8E9669E337E52B
MD5 SHA1 SHA512 TLSH

Submit Download

deebf27f-bc6a-4ebf-be2c-1804fbb1ba1e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\deebf27f-bc6a-4ebf-be2c-1804fbb1ba1e
Size 235B
SHA256 6755d5940c2ac00005bcae25377689d161abce4417857f8d74ab139bcc2c76f5
MD5 d1f1a44a727df09760c422f9f6bec135
SHA1 be6e7f906f8e00fa7934460c69fbda0b12c0ff16
SHA512 4a0d35266a4c070e63c31d93b7906fde924231180f76be0ecc61b953264e6da7dce8e7c5d6aaf61f53fa45723f08ad0f4539e1e03a8f29b2216048d3cb2704dc
TLSH
T194D09780A8882F2C08181F13F0E42ADA30948C3354F0A810DAB241388AFCDC81161D06
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\extensions.json
Size 16KB
SHA256 f99376be2a89b1f6a9273183f8dcbc2795fc35ea4ce236643120f57ba7746ec3
MD5 6bb348c369bd2be1d9733ab2c47bd056
SHA1 7f1261038aeccf8995d1b53c152fb86908c6938e
SHA512 a30fadd86b82f705dbe80f1b33ebd5ce34d714626965f258ce6e80afa78318c67770a919f15238d6df4abe51a1f0ef1a84ad2aafa16e63b3f906b9cfeb03c3f6
SSDEEP 384:ckI4v0jUmldvX8dhWS94zk96oDeL4HSDL4PupNL4HpL4HHL4Hk44hj:zI4gRf0Xz4c6Wk464WN4h4L4V4N
TLSH
T12B72421545008EB8294FA79AAA36BE01C37D473B60855C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\prefs-1.js
Size 6KB
SHA256 36ea2c57522ca24a5aae0dc2ce91c39a943a21d54fb4cd80e8b862e5c372de7d
MD5 12539d99bcb3df8998798c9d84e28f17
SHA1 f9c4ee418ab760ad6effa55e5cc1196ad4830859
SHA512 0d21948888ecc95404796ea2676270038f2a2b008777bd56398a21c8b8fef08be4e0bbd6419f7fa966822e9ec645c80bf8299d657f76baa508dd31e115cf4fc7
SSDEEP 96:xHdUTUZqGqofyYbFT1zSsnkSSlcdv9jWnUHgYETBw88u8L4cn7yTM:P0Rofy2FT0SSmgYeBw887
TLSH
T13FE11F7894088B7F74B677ACAC648C316AB2413BBBBF68D710B54485054CF3846F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\prefs.js
Size 6KB
SHA256 d83bd9daf44937bb6afca3136431adc6619e123ad716d17814b5e30302c720ae
MD5 613473da4668957277f69e296c233c44
SHA1 50ca08502eea48c89dcc82da5c0be22012ac42d3
SHA512 9386911698df4e2343a638c15a5f5d6f9c948f29a5b48ab32a95c04b34adbe6ea981c499ff2688d9746adc2ab96aacf5920a2e8e3ffcdea761e67c716a6592ed
SSDEEP 96:xHdUTUZqGqofyP21zS5lSSlcdv9jknUHgYETBw88u8L4cn7yTM:P0RofyP2OlSS4gYeBw887
TLSH
T126E1207890088B7F74B677ACAC648C316AB2017BBBBF68D710B55485054CF3846F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\prefs.js
Size 12KB
SHA256 0c53f3caedeb0f32153dc7ee974624f0bb829253d5d80e9aab91b5d1d56d60a3
MD5 32f2be4bb7bea2f6953ee96cdb9d4194
SHA1 6b3673764a226534b9209d46a9fb37d2074b999a
SHA512 308eee4c59363225783c7d1c5af37cf185f85aa6c731a09b50466fdada0b03c4d639dc0bcb01ea377d155107c42e2a1de4da090e79d9d8ac5731feea38ff92f5
SSDEEP 192:PxCRofU2FTrSSiLRyYJOBw88G0AcAI69JjbI07lr/U4Yg0i8LFNtjCIIBhyxfxit:vRURHWwlmp
TLSH
T17842977850458B3F25B732BDAC214DA119A14627B6FFBCD705FD8892045CF2841FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\prefs.js
Size 7KB
SHA256 685a615a7f489420a23f76e0dbedbf88fc60de07b47dae17eaa4aaf515513ba1
MD5 e0bdfc48998161613d5848cce4ea53cb
SHA1 f2481c8e34b324b1a92f8ececca244783a3c4f53
SHA512 aefa1c6e143e61cb3a2315eb52dfc57e37494cb2d1b5009e29ebd9baf63c308b999e1afd09299a6ee8d93d53e55013ff998dad0f639329d29025a1d0fa61c062
SSDEEP 96:xHds0t0KywTUZqGqofNaYbFTObzSsnkSSlcdv9jWnUHgYE8NlBw88+qvfqkqvhqg:PpRofU2FTrSSmgYfBw88J6/Ug
TLSH
T11CF1FD7C9004CB7F75B676ACAC64893159B2063BB7BF68D710B94485054CF3842FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\prefs.js
Size 7KB
SHA256 8fc82b8b0b01274b24dd5606b46851cd4e0940a288491c22e5658eed9383a8e0
MD5 6791ac177fcb327f547e4b1f8d3d32ca
SHA1 1851665170099e234f82d3a23923d6f3df69c223
SHA512 2702008cbc79a7e7c8677e30e317358242481dff7c31b3436f8135fec9feb3175ee6e7f6b14e05e0a62494ca95c1589386186ddede48cd3cacc64694acb6acd1
SSDEEP 96:xHdUTUZqGqofyYbFTObzSsnkSSlcdv9jWnUHgYETBw88u8L4cn7yT5GS:P0Rofy2FTrSSmgYeBw888
TLSH
T182E11F7C94088B7F75B676ACAC648C315AB2413B7BBF68D710B54484054CF3846FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 f3bf0a1137d16a72fb5f5775d64115ba73fdab2dc7fcea0c6d4d377151c4125c
MD5 7825a8d25a6ad27955b615c255b441c0
SHA1 b5d459357ed8268867ba6eb08afb9570194212fb
SHA512 9fdbf0884419450fdd8f80e59f50a80f2ae004ee81cbaebe8179e864fc34f57153b752c913bec1bbd211d5d241f5bc65aed04f65e9c37d98db2415cbbc5d1e5c
TLSH
T1FA210B839C2E57BD2651C4DAC2DABBE5C68671A58C3A50C1E568238201ECB07317E10C
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 5a71314f25d7c43372cb21b7c53a7a6d733317bee24002914193ce4f8635ccb7
MD5 60a21d8b18c12bc5e07911b2f7094f9b
SHA1 b853cdbc32f9f378d79e295234bc490b5e8db032
SHA512 0b60d223874e8dd4d65aed30c674a78e06713dae6b8dda80c115632381bebc768e30ae1386b78b1fecaf6282ed88ed77b748bb5d981cee3d065ed0f443614da3
TLSH
T18921D7A26D3E5DAF3702E2ABC1A85FF0C2953967CCB904B096AD074514DB62E732D618
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.0MB
SHA256 f05377331f7c36613b87e1de67f47f15623f0a29dfa63f109b52287e735939fd
MD5 b4c261be68484f6d4820b25e2160d86a
SHA1 ba8c32e864960b8a255c619b8f20b40ae190352e
SHA512 89d73fea6d9625b37d98f53e3fab58eb1320e65aade3de42af4c90fd28f378aefe9cd61acd686f43aa3287087d9e2e36dde7777c12c4b214100f18ade0f7acd1
SSDEEP 49152:cMewBxG7+CIUYSQiXqM8xK+o/ktCXooa:FRtiXHkKj/ktCXooa
TLSH
T11B362AF820D1A257F3814033664593EF21EFD00C6027DE085BA966E9A574CEF9E16B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DirectX.log

Path C:\Windows\DirectX.log
Size 4KB
SHA256 ab6325ac1aabb2519a939ad572c37b1bd21b886dc0ed34ce8c6246fcbfa7ad17
MD5 9dd8f023f777f028fd38f193dca67b3f
SHA1 b43e0539872c6cab0c9861c8e900589adf4b193c
SHA512 8a42463ca034598c5a5952df1e1b68cc567753a2c38369407bc3ea458592febc7ca28cc5a46d6fb8dc098f6b52cffefaa17cf3e38cf00af2b838d8a0e492b27b
SSDEEP 48:n2VA2Ew2kF2dq2hshk2+122VVXU2sM2DPXK82St2EcXK82h821xXKl2vq2fB1241:n1uvnYGkd/ESGHn8H5a2No915B
TLSH
T13491E85C0BD6C3273CC45EA28E5B3A159B25ACFE6732236027A65849D24110BFBF1A3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e6345cb.msi

Path C:\Windows\Installer\e6345cb.msi
Size 6.7MB
SHA256 e6c41d692ebcba854dad4b1c52bb7ddd05926bad3105595d6596b8bab01c25e7
MD5 97c2eebb30c5a88c68c8f24f37183f1d
SHA1 49efdc29f65fc8263c196338552c7009fc96c5de
SHA512 c9d1017b274ceb1b4ee624cf7e628787c32a727c64f715fbce1f1ae929d9114f8fe1291e34583cec615619b0128c01206b07efc878e7a5c57b792453f73fd0da
SSDEEP 98304:wynfL329J1XswfXO6wiBB+4RZg6aENaCZAU5PMO0MntfERyJGH2YPq/:wYD3C1XXfzH+4cLHU5PM/Mnt+YGlq
TLSH
T1906622A2751AFF41DDF406BCE970CA490925CF3782270C686929356A7BF7E1202E9D4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DirectX.log

Path C:\Windows\Logs\DirectX.log
Size 1KB
SHA256 7d25c26c3514fd48fa8c798f4a7508418d200f8edb33fa15953e54cc3c044c69
MD5 f32fdf699141b548bd1124e28e99c497
SHA1 1e2f8dcf13a0f64c2fb050b78c4e479944f0c41d
SHA512 d6a36ae4d9def61b6e4520d591a5343b7645c5a7c5ab9f9061968a18506921ddd0a51003acaf132238e0f3c57b77fe495d3f52983307e55dd4fd5707c05487dd
TLSH
T1D341E495BB7BC210BC902A05493BE9100ECBBAD71356472430953106A781F9AFF3F866
MD5 SHA1 SHA512 TLSH

Submit Download

DirectX.log

Path C:\Windows\Logs\DirectX.log
Size 2KB
SHA256 a6702b104f9c289bfddb1401f48b5ad144ae12507d4d33464ab45f9c9ecf5109
MD5 194cd195eaefb1366e6875f1515c06f2
SHA1 e65e6e2e01e2d1609f351a25caa64824543f95cd
SHA512 d0c249df6b1921d00c181d65822b69d36e3d9a9c6daf5870c8d25d85a7cc1c449507e2d1a5bc07e02c251c67f532a455e53f5b9cf1f5b96a0c249af5e3263bd2
TLSH
T17C510894BEBBC6106C9029018A3BE5140FC7BED7234647216196250676C1F9FFF3F8AA
MD5 SHA1 SHA512 TLSH

Submit Download

DirectX.log

Path C:\Windows\Logs\DirectX.log
Size 3KB
SHA256 119f2da1fff1ceb9b7fc6b4b80f9f771d72f202cdae7be691d8c04b4fbe72d5c
MD5 d36638b48c7ebf6ea943b96345f1ea1d
SHA1 ed8944d223a14d8275c8698c9955fe87845a136b
SHA512 34264d59fc1bddcf6bd101adbff9d1ea60bf913ddd9db7035677151d8f537c93990dc43cfd2634c95c5d1d5ba00fc670b77bebb10d12aa8ca6abe9945bebd8a4
TLSH
T1FB614A94AEBBC6106C9025014A3BE5140FD7BED72346436061A6250677D1F9FFF3F8AA
MD5 SHA1 SHA512 TLSH

Submit Download

DirectX.log

Path C:\Windows\Logs\DirectX.log
Size 65KB
SHA256 a682e31faa70be0e9882c174c5a056b50b5d50efc64e8ba31c2de7ccd962d39b
MD5 f2783ee6f45359f06260342d7cb6fca0
SHA1 de98efa7e027ca328c23854b533064b7549acafb
SHA512 ff0edc566a93135afc646e0f1748e772204a15a0ec95953cb4b1994b1b8b994adce2727e926176ac490fe485148d495be65d8daf976f0880986f6bae16606169
SSDEEP 192:qxj3rKoiwVTqYLDG6Bm8Kb4cxMZJyfeytXzqurHGINYht8q0wZD20v5g50AJMJIs:qYg
TLSH
T1A763D85A6A27DB303D610144440A64C1255AB7A703406334E7ED7E4BAD62EBF6E3F4EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Xna.Framework.Graphics.dll

Path C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Xna.Framework.Graphics\v4.0_4.0.0.0__842cf8be1de50553\Microsoft.Xna.Framework.Graphics.dll
Size 417KB
SHA256 39aed7fd8e308ccace5ce9390256f1c829ca72c2eccd97d4a0f629f24015d3a5
MD5 c76b932d5308f2c33b2b25077fc93fdc
SHA1 3877403187dc35eb57cbe9940166e57021b2275b
SHA512 d84c39c2aaff47a0a9899a695ccf450b1c126388f25e9c186a313a31c81f584768d8a5928916fe6e0a7dafee66c7d11909ebdd1468b7b80a3892de1ddf252f74
SSDEEP 12288:7gKRqrd/5XPtFMiPN7xqbbpa36OBjoKGef1:hRu/qJa36OBjoKGef1
TLSH
T108945B4A37808A3BC26F57B694AB0724937BD143A74AE7CF185053ED3CAA7C4D931297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Xna.Framework.Xact.dll

Path C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Xna.Framework.Xact\v4.0_4.0.0.0__842cf8be1de50553\Microsoft.Xna.Framework.Xact.dll
Size 74KB
SHA256 6824bb0b7b42626d1ed5b7ab7e4dab4a380fa010175d4de0fadb1c3904e491d1
MD5 cf7788e795f1c743d6ee0bf8de3fa502
SHA1 db2bf000c096a91aca46da5fe35326761c63053f
SHA512 13cd0d8d7479d7bb9b721cbd8109764bfb58e4dc01661e8fd6819f1cb182e408766e7cc61103e95763bdc1e11ab4b901ae05c8748e18b5f730ec78c5868f7781
SSDEEP 1536:piWyY+tzyo5dDaYt9qsudKGef39D92YrSDyvG+:pijBzyo2YtMsudKGefZ92BJ+
TLSH
T188736C4533858A6BEBDF8B7278B0FA44013664A2AFD3FBD711A193E518563C0C935B93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Xna.Framework.dll

Path C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Xna.Framework\v4.0_4.0.0.0__842cf8be1de50553\Microsoft.Xna.Framework.dll
Size 657KB
SHA256 8b7aa4c4939f243b21432747281cc8aacdcda56191a16d9eaa036b4136cf0da4
MD5 343f79fe3dcfe0828f7ac2a13f8f7210
SHA1 8daafd2b9e44f0b46b2dc6ba4607ef155964db0e
SHA512 651d7acf8effe6a77ce094c88163adb950830d2f5779f900129391f2f9ca7393163749084e861fbd742e26f61c350225107d64dcf888c0b5d4ac9de8ae99d44a
SSDEEP 12288:NSC7r7PBfZ99ZJV3NzQhXV34zB6KGefjmqboY:J7HPBdZKa4KGefjmqboY
TLSH
T17DE44A18A7C8793FE19F5775B0284E3A2776A515A703EBCF04A053B92C6B7E0C931297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Xna.Framework.Avatar.dll

Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Xna.Framework.Avatar\v4.0_4.0.0.0__842cf8be1de50553\Microsoft.Xna.Framework.Avatar.dll
Size 24KB
SHA256 7688ebdffc98433eef8aada293a8c4beec6d6acfc0e1f91ca8eb2f1c350e7cec
MD5 7b26de335983eb8b800a67ef5ff077d5
SHA1 f614672dd8b25985a417ed339a6a6532c9e57800
SHA512 fc14dcda0703c8ade152bee32b4c4175c37e98500cc1370d4de0ffd0eac398edae3a42d29711e6ec841231fab0eed228fc6eba69347b54a8e125866ae6822043
SSDEEP 384:q4QsedMlPLtXTuZclArYIJT8gdRDY94dhuBW37sWl:8zdMlzxCiArZR8Gdnr
TLSH
T1B6B22946E7088631CBFF09776C7A3D4501BE7252F9D7CF6A172881963C4A7241A66F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Xna.Framework.GamerServices.dll

Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Xna.Framework.GamerServices\v4.0_4.0.0.0__842cf8be1de50553\Microsoft.Xna.Framework.GamerServices.dll
Size 70KB
SHA256 627e84c06cc4e409870b068c9ec9149adba425e47e64185f92d839db2aa35484
MD5 f1e460b7805cbc4901c410f2767912ab
SHA1 01e7f335e58af5140bc7953518739f43c59f1c98
SHA512 3f34bb839deb6af6b68946aaeac17fa3a1e419d2f8310f37d1f460bda329c2bd46e380fe18f883389dcc64e482e596a0b31e0291b202abefe1c6976d5dec8751
SSDEEP 768:99nzBVtN1ZbkfimxzhXR8IIlNfPh3tVBx3+mdaMty1FL5borGO4WBxCk3nfnRoCI:n1ZbkXxtOIILR9jx3k1FsGO48uPFXx
TLSH
T1C8634C005B48573ECBEE5979B4A32C1102B9D2D66593EFCF6EA892DF1CAB74442213C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Xna.Framework.Input.Touch.dll

Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Xna.Framework.Input.Touch\v4.0_4.0.0.0__842cf8be1de50553\Microsoft.Xna.Framework.Input.Touch.dll
Size 22KB
SHA256 2191bad4540b50723acbda55bd2c6e5d80cc6f84ad989ff89ddda672348577b2
MD5 911fbe5496efbaed4ea67497fa63c633
SHA1 570911a579cd752ceedbe9b07efc1c8c832cfda9
SHA512 6ffc30116c62f9a91e5d6fee4133e87417df14aafdf5443f7002b46c20ddbf0eca242ea54f8711b31defb42ad0ef3f5f11b16e699ce3dbdaa728ec1661e00d7d
SSDEEP 384:CDqti6XlMyIP0ZL8dOLuSneTbjRcuV81Vzh57WkroW:CfIK08T7XYzl
TLSH
T19CA2E917974C0336DFDB5E3D68AA388A12BBB666F4C3EBDA011C95561C437180E23757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Xna.Framework.Net.dll

Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Xna.Framework.Net\v4.0_4.0.0.0__842cf8be1de50553\Microsoft.Xna.Framework.Net.dll
Size 53KB
SHA256 3c0b37068ad56193fd613eb8f6bd321e7e08a99b9cf85606ccddf060afb1263b
MD5 378479eead647cedc6b74bf84e5514a2
SHA1 8dac9af1bec30f93a4aa6650ced1f64dd0791841
SHA512 6b0cb09a21121d2eed1277c0989d5ae142b6c724886ada5f713f762c61641901fadbb4fdea115cbdb662ceee220aa7d684e5a7a0613fc3a642bbad36e9c22e88
SSDEEP 768:vvTTIObJK98eL8PaEntvuh8tItI3CJUvKZTswdnXBr8H:fPGYaEntvyIIi3CJUvKZA8xr8H
TLSH
T1C2333A40464D473AD3EF4DBBF465343903F1F262B7E3EBC52EE890EA08A276509A5527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Xna.Framework.Storage.dll

Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Xna.Framework.Storage\v4.0_4.0.0.0__842cf8be1de50553\Microsoft.Xna.Framework.Storage.dll
Size 20KB
SHA256 7edbb80c699ce3ead8aee5a512ee34c7718cb5dceeb1d0577e788ad8d0ad9383
MD5 17c4074e1d0977182060959ec63e18a6
SHA1 af73bc4b90899793525ca472a1b90312c33063e9
SHA512 b7d7fc7b21f3fd480e6ee40cfb3682b898382ad2397cc38ef7258db68dcac31de0f64b8adae5ac92d0b31c3cf85c2489a04dfa77675104134d874fb4871e91b0
SSDEEP 384:OFMldl8akzAlg5asAq+P1BG89bbCuIQkB1kD+hpNWwLMW:GMl38tMOcsAq+POdp72+z
TLSH
T1F8920702A74C0236DFDF4D7968A63C4510BAF597F8C3EB865A29E49A1C677281963B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Xna.Framework.Video.dll

Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Xna.Framework.Video\v4.0_4.0.0.0__842cf8be1de50553\Microsoft.Xna.Framework.Video.dll
Size 17KB
SHA256 63c7673c936747abd9ebe779e8837c8b8add2c078a31216684fbf8c6bcab2745
MD5 94b8554692a89f1955b9219e0f26442b
SHA1 cd34862740a30b2f0fd391fa16b082edb79d155b
SHA512 9a6762e9cd8bd26dd347c8166dc59b31159c9e5295d39773c69228d73b5f3f850bbd41f733b1f880623bcd4c929f13d66e2168f2e1972842a6e031d069ec92b4
SSDEEP 192:DABS32p6Uhw/uO0Tab8uj1O9BQ6eVixgj4xxdhzg/L0Xc90OOSN1c1mWabsW:DABRpTC/3bM7Q6eeU4xx8hcEWabsW
TLSH
T19382E912A30C0236CFEF9A796C647C8511FB7667F8D3DFC66629859A1D827201D63B43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OpenAL32.new

Path C:\Windows\SysWOW64\OpenAL32.new
Size 106KB
SHA256 1797d150a2e23af4f390f5c33eb598c6f58d0454011d74941f5316add900bbdd
MD5 235355a8dd26903e75d5e812ecf50e53
SHA1 8316319341a0f9054e19e4a7b21df3dc49386fee
SHA512 5beb9343028790f993d0acb1007fd112b7e2ef6f9fbedfdb62b0140d2bbadf3b6368417ea19edb0bc8674d19418e5784fef4430ce1c329de8e83c304706d39ac
SSDEEP 1536:xYf99QAGcIq+pNocP6YI60qlW+kNvsy/mSvIfttnuQm6A41NbApkh:Hq+pKcPdUqWsyRIfttnu/y1Zk+
TLSH
T1B4B36C51FF824032E0C58E3D81A5CB969BBF19137F9254CBDF7419C85AA03D80A7A7E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

filelist.dat

Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
Size 111B
SHA256 9ee5f6b1a1202f3bbf64e7fbdd13963fadb2bf299630c17b1397ab2aa15d6731
MD5 24701b46dccc4ac0b74d23bf457b15a8
SHA1 2d82c069cc6e05fd6d0bcb7665171ffaf136f8ea
SHA512 4ee56e6cee09bd3e01f9574b01210402acf90f5efb2ff697dcff4eb8f26016462f9d7b1927aa8e34b8a2b3c8eccd7ae148a7c65a07cce663fe27a750249a1be5
TLSH
T1AAB012894241F5F9400DBB67487B38D511F902FBF4918C5D018B069D5B9156DC48CC25
MD5 SHA1 SHA512 TLSH

Submit Download

filelist.dat

Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
Size 137B
SHA256 34eda9073fd30d317a6a35e1989dbd74f400121faaa9b1f4c7da138f8686b243
MD5 e16ac2a22fdfb293c815c945eab28310
SHA1 66831191df79f5c3990436921b08dc2171b0ca57
SHA512 08480390b059545acb8ca1038c5060693a938c987a1ea1057e6f03951a7db0dee8d97d1540f646f8d249d38e54ea43fb49b01610801deaaacfbe29f4361cbe93
TLSH
T118C02B840100F4FD000E7716483734E000F401E7F8828C1C004B41881F4055C844CC35
MD5 SHA1 SHA512 TLSH

Submit Download

filelist.dat

Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
Size 384B
SHA256 e941ec82e23d8cff199e997f3bd563400fb07d0f7b86c702b8a88d204d4d9f7f
MD5 dff54547a2403616d2702d844d7dfee4
SHA1 3b20eff70f94888bd75fab2a991c189c41f387f9
SHA512 f5e4d6f72b36bd11a24d7a558608082dcc0ba320be2dfabf962b4de691195ab6141dadac13caf952a3b2017d0efa5288f70d11a140db761866539bfdf23dec7c
TLSH
T16EE092948341F5FF501E79AA0CBF38D6107902BBB891AC89048B81690A7198D836CC19
MD5 SHA1 SHA512 TLSH

Submit Download

filelist.dat

Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
Size 525B
SHA256 08c5c78b02c6e8c65b2de09ce8bc6e5439652493061323327dd690ef2d1ebe87
MD5 7a5e4b6d5503507290247f28bcb75a9a
SHA1 52ca91283734f5d49e4ea197aec2051b94eb291d
SHA512 6e6b8a552aefa9deabd2c461d483474a5fecd9fd3eecd2108bf2b9b184de0939c4c4ef1ec75e7228c6349e9a2c3e1db74d65d6cd9e1c1188627db0c6a7fe53c5
TLSH
T166F054959741F5FF501E7ABA0CFF2CDB117902BB78A1AD8914CB81690A7198D836CC19
MD5 SHA1 SHA512 TLSH

Submit Download

filelist.dat

Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
Size 666B
SHA256 a7755c5caf4fc735f6a7d964162057e8fb10528dcd9367a6633d989e90abc117
MD5 2044cce267a03939cca48148345eda9a
SHA1 730839f971ff42c7412ca7dd9c4020339a737d26
SHA512 df71fe7b7d8f50a0d335e0d0a204a5f9e640567e21d992a3c6d757907f2ef391c580ab452d1eb351816b50388d6e1a8fd5ff03098452652833af0a3d56960968
TLSH
T10F0162959741E5FF601E7ABA0CFF2CCA217902BB7890AD8914DB42690A7199D83ACC19
MD5 SHA1 SHA512 TLSH

Submit Download

filelist.dat

Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
Size 807B
SHA256 a581a74906e1a33fe2d3b5546d184fb8884ed6fbb0b0bccae695f93653f540b4
MD5 af983ce670890c8c32b08aabf36e724e
SHA1 7003166c74cf01deb731ce38edb0e28fa1f5576d
SHA512 631d179e62ae4c801794a32bd6b4b7d0937e6eb312ccb4220b542463b79bb687c59cf5757f5ffb4ea1f32ce5e6d9a2d2bf725d037cacb800a1acdf950bdb56cd
TLSH
T13C018495D741E5FF601E7AFA0CFF2CCA217902BB7890ADC914DB426D0A7199D83ACC05
MD5 SHA1 SHA512 TLSH

Submit Download

filelist.dat

Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
Size 952B
SHA256 bdfd2e8dd5a96a23070238ef3d030e9a51a4cd0631795e45062939d7f7ec10db
MD5 99a81da71459c150457f6bce09db72b3
SHA1 7c10481775f65d09a0da9ef398f7ec776d6269ff
SHA512 a09ecf49ea2cd29a123cfef982e78ec606d2010836efc7f41e8614ac3b31331995d7dc09159f4bb2fbc5244ec086da4c5887011afab7d396330646236abd690b
TLSH
T11F1193959742E5FBA01E79AA0CBF2CCA207901B77891ADC918DF416D097159C836CC05
MD5 SHA1 SHA512 TLSH

Submit Download

filelist.dat

Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
Size 1KB
SHA256 bc142220dfeccb55b3e303756adbcb12d5a7c0a6d6a03ed02efcdda716cc75d2
MD5 a3faba0e2d7af7bf0551f566f9a9c944
SHA1 91dd9549b0bb614c9d80aa0d1234037f5690714f
SHA512 29d044784b94180265253d3cdae8b425a30a0afdefeb56c9cd95191d75dc2d7d5875d8cb54c5b3565b9d5fba8e877d4189890757caf9456fcdd306bc7469ecef
TLSH
T186119F959342E5FBA01E7AEA0CBF3CCA207902BB7891ACC919DF426E197159C8368C05
MD5 SHA1 SHA512 TLSH

Submit Download

filelist.dat

Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
Size 1KB
SHA256 bae87fb2b59ff3ae40258d57d841b1df579e80fd91cd2fdae68358e306c6af99
MD5 bc15347a951ba082731561b1918a366e
SHA1 21823f0d7904a58637640bf8fcdc818066bac52e
SHA512 3a10bf6aa17b8bdf27714c6e67e960606df0d8ea23e7d5de23783df50e7f2247614f32e0b21631fb4aca69368b6277d7be09810b1df515d9cd570821c87e7ddf
TLSH
T17A21A194D742E5FBA01E79FA08BF2CCA207902BB7891ACC919DF416E1D7559C8368C05
MD5 SHA1 SHA512 TLSH

Submit Download

filelist.dat

Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
Size 1KB
SHA256 646e983d302e862166620596a5b7d90e5d6db97f0c5459253f633e0da30149a2
MD5 6fa8e6866270e57847607ee4f052a7c4
SHA1 040eb9937e24965feeb276621bc6c0b8c9fa3e01
SHA512 cfb060a7f8941543fbf2def7b724f4ec3874861fea087ff8741aa1d44985b9a8c7fdc43d3603034b4e65c71fabe042c16501f9586b8463e25650e59bd44c0afe
TLSH
T13121B194D742E5FBA01E7AFB08BF2CCA203902BB7891ACC918DF416E1D7599D8368C05
MD5 SHA1 SHA512 TLSH

Submit Download

filelist.dat

Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
Size 1KB
SHA256 19b2c0c7e9f923a58b6f4c800f0d8a790fad5edc28314742c1ba2a604d3e44a3
MD5 862502b6651304422ceae720d549b40e
SHA1 122bc18e39825274322184b047b375ded9c283b9
SHA512 9c6fa7ac476d017e5ab5da8447dbecb002007c0532c96907d4c7b67a8484eb4f3f2b83990ee530bede07c58014c52f5674501304658d2fa7b45238e5bb6cef43
TLSH
T14B31A494D742E5FBA01E79BB0CBF3CCA203A02BB78919CC919DF426E1D7599D8368C05
MD5 SHA1 SHA512 TLSH

Submit Download

filelist.dat

Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
Size 1KB
SHA256 28d6c7f674d9217861a3b72293babd56475c5b5a4ff3a702435d30282f5e2557
MD5 430af9eda29455256b366af8715b2f29
SHA1 85eae02b662b00c15c508459dc95097cfe78d437
SHA512 2b8a888a60c98b96701c03e504471d603eef26d563cc8d5c0fd0b9b8ca52ab8683d87e976971665834ab44b2be876b46341e899e5ea794f4648821123731e9ec
TLSH
T1B331B495D742E5FBA01E79BB0CBF3CCA203A02BB78919CC919DF426E1D7599D8368C05
MD5 SHA1 SHA512 TLSH

Submit Download

filelist.dat

Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
Size 1KB
SHA256 db58834b375f276851805fc98cd816483eff56430b9774c280ac3046f4f97b4d
MD5 3b769a39b9c28d3b14160a89f0c0f3b6
SHA1 814e7887666335063447da71ed2156bcc592397f
SHA512 6223b37ab028398dc25f437f955edd0b20ef04794eaf201160973a622ee5dda07e882e9aaa584ea493b908e0cc70cc55b074941a4575a2a4e425149a0ff12e5e
TLSH
T11A31D5959742E5FBA01E79BB0CBF3CCA203A02BB78919CC915DF416E1D7599D8368C05
MD5 SHA1 SHA512 TLSH

Submit Download

filelist.dat

Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
Size 1KB
SHA256 20f5a6199f657e45060a21b6af5d99c3ad6f6794d86906a7c0d17ba729a0dda8
MD5 060a05344e897f1015d25f1430984800
SHA1 56aed5e0cee89a22b567615c9580f9e58f86de62
SHA512 0bdcb302aa4ce0cd2c175cbbaa8519970d504d0c4098eb84f9e9fdb07f47f38d7d7f187ce2f7dbdea2b1fd9663753d497c0aa6e70607fe4ca30f3bcb7b2fcd7b
TLSH
T1DB41E6919342E5FBA01E79BB0CBF3CCA603A02FB78919CC915DF416E1D7599D8368C05
MD5 SHA1 SHA512 TLSH

Submit Download

filelist.dat

Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
Size 2KB
SHA256 02670cf50e470de697d082714e18ac21dff3653924ecdfa6417f0f6160852191
MD5 b3862413fa200aaa2dc977ac919274ff
SHA1 0ae2f042a9e463637c4071a697f912dd677eea85
SHA512 1a09c233a99722c7c1e0f793cd0a67d0dd9cc98a6f661bbf606ef0558afe3cb10d7658f5dbf0b5b3fa71cfffed3d172ecca2b61ad1a191f68f2564c2c4782f23
TLSH
T1EA41D6A59342E5FBA01E79AB0CBF3CCA603A02FB7891ACC915DF416E1D7599D8368C05
MD5 SHA1 SHA512 TLSH

Submit Download

filelist.dat

Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
Size 2KB
SHA256 5bc09f07d2111bef67f5aa2a0ca267a2a4f55b4963df555224c70e5958e97803
MD5 c28722a424b2fdea955ac2c802dda6d6
SHA1 fdfc1f4ca0b700498c8f9f0fe32aeeee05f42c91
SHA512 0667145cba08d014ac8c096191ae44b0c3700351457b54fbe2e2ccb30f41b7ee83767cb057406b30f3c5a64befeb35e435d662c386c59cbf7c4730b27bb609f4
TLSH
T13441E8A59342E5FBA01E79AB0CBF3CCA603A02FB7891ACC915DF417E1D7599D8358C05
MD5 SHA1 SHA512 TLSH

Submit Download

filelist.dat

Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
Size 2KB
SHA256 a239638cc51ca969494a637fd81fcbf23eef4f908bcda2e4d77045e68ce30540
MD5 908bf30103523be33d5ccfdc46fd5d2b
SHA1 9a8a45f23896481a9ca59e42843596f2d6431425
SHA512 f705c646b697e1031c0b5f01d1138d81280d4c8e2ef135efb3d8a5e986ef8e75199b6bdce1edddabcdd7fff0c1db634ef4c6a2f85f2eb2c65989b18b1b03b0e1
TLSH
T12541F7A09342E6FBA01E79AB0CBF3CCA603A02FB7890ACC914DF417E0D7599D8358C05
MD5 SHA1 SHA512 TLSH

Submit Download

filelist.dat

Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
Size 2KB
SHA256 f1d90fa10d17980c8818ab20b73a7954c509923cfb662126d0591d0ead2b31de
MD5 6360d990cb7bf198a2dc89d0f52a89aa
SHA1 e542ea1e9a1b555dfe51191150ceb8ef45522583
SHA512 9704a205de60c8f67c354132f05eb9a59ae52b927cb629222426668e0e001b3f655a2eec54e59e38b98d3a8a4769019d5d6415675192370f4297607c582b0cb8
TLSH
T15751E7A59742E6FBB01E79AB0CBF3CCA603A02FB7891ACC914DF417E0D7599D8258C05
MD5 SHA1 SHA512 TLSH

Submit Download

filelist.dat

Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
Size 2KB
SHA256 0bbf96b915a196d8dca618e2ba03d94673284641bf84f86ffb7d14f6a23facdd
MD5 9a4064c55ee8b6569c440543bec52d02
SHA1 d347c2a9ee04b64821a5969c7a7bf3be6917017e
SHA512 0cfd25f9b79496054d38f463f67738d46736ec7042785986ecd5b1a7368d5240d8c3e7e4a13816c82dc78cf8eb7f7ca29b046675360365ba476f925f67b54389
TLSH
T11251E6A19342E6FBB01E79AB0CBF3CCA603A02FB7890ACC914DF417E0D7599D8258C05
MD5 SHA1 SHA512 TLSH

Submit Download

filelist.dat

Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
Size 2KB
SHA256 05c68730325cc790d457cb1189b81749e9031a88e238a6234f2ddd7dcdbf798b
MD5 162281db1b2f9199e75b44a053a51149
SHA1 6681ad2d578b60024c622c3a7b11f2931673befd
SHA512 37d6cf47fe70bb948261ee3ba568e2eb8d49e52ae6d45040fda5a4661a2bcb5b2ae51f7965171ca0512cca78407ff8fb1ef0efec222de7be3e956dcb05e52740
TLSH
T15E51C3A59342E6FBA01E79AB0CBF3CCA603A02FB7891ACC914DF516E1D7599D8258C05
MD5 SHA1 SHA512 TLSH

Submit Download

filelist.dat

Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
Size 2KB
SHA256 e10e7239ea34c99c47fd0372a5eef7a58b5bc43b784ba9d2f2d384ecfc467911
MD5 3d24180d74e5974707fe545e53694406
SHA1 27a08006284a460355be0807d317231f5014d5be
SHA512 d61e4568c10876d6c0c24aaa83434e21b45a2e6c462c4d7b1db3b7128ea4dd0e0d68c4d1481bd5c59f205894cd34c0bb0d030460fc586077c196171bc772feca
TLSH
T1B551B4A59342E6FBA01E79AB0CBF3CCA603A02FB7891ACC914DF516E1D7599D8258C05
MD5 SHA1 SHA512 TLSH

Submit Download

filelist.dat

Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
Size 2KB
SHA256 b0d092b1c1cf2a68685c5c517dcd77a162ec454a70ff2a88fa4fff5aaf391bbb
MD5 7170d6d38851107af7850301fb7846a8
SHA1 abeb13e64b321f850169afe7c246dd18a691e5cf
SHA512 d03bf2701537c18b59e8d04d4868aa8ba7155e94fb4cc9895713f79da57ff4c5d6943f944120cb7378b45c1e573d1ceb390bc024831c00712538fbe509403f71
TLSH
T13951C2A59342E6FBE01E79AB0CBF3CCA603A02FB7891ACC914DF516E1D759DD8258C05
MD5 SHA1 SHA512 TLSH

Submit Download

filelist.dat

Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
Size 3KB
SHA256 5519a59c4e403a8bd5d96950425a3cf053251ff2ee1b99b7ee2c5b70921e3e5d
MD5 1e3f21066caf8b16f2544a2ce4afb210
SHA1 302062c423f20738ea09ffd67cac262da89eb1c6
SHA512 dc0cdf6200177d24137812265cec55d1b59ddcc7454ca19a6aa134bca7550ef3c01de73fb7143e8f65797086e2527890e2827a25c594dcf564785778c8e85670
TLSH
T12161B2A59742E6FBE01E79AB0CBF3CCA603A02FB7891ACC914DF516E1D759DD8258C01
MD5 SHA1 SHA512 TLSH

Submit Download

filelist.dat

Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
Size 3KB
SHA256 fa3392da538031a00612741d69636171dcbae417a540b3ac99535c33b65c58c3
MD5 1c188fc5d6cc1be0416e1dea47d1b287
SHA1 46e755879399935159aec55d0b0f3c86aeb9b1d5
SHA512 91ec97bfa9585e3a23fde8661928148fda5aca2b7e2f4f8eb878a88c5af012e2dba82dc32781d9ab91ce9c0d88e4838235acce5ef0e766b81f543cd0d7178796
TLSH
T13C61A1A59642E6FBB01E79AB0CBF3CCA603A02FB7891ACC910DF516E1D759DD8258C01
MD5 SHA1 SHA512 TLSH

Submit Download

filelist.dat

Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
Size 3KB
SHA256 da3e3f8661388d4aba80fbd2cb24f5b149ce0be5363caeb337e383688339ea70
MD5 00c728f12cee3d8e7d4e942f82768144
SHA1 cd6de5bc5f0f98f22e7f55de12d64cf7885279f0
SHA512 0fb644904e544af94245b370cc6bd259501a4d4f11fb937d648b729276fa093b0def2297893402275870030387609291d9d2d4e97d85790f3498cfce69e91b7c
TLSH
T10061A2A5A742E6FBB01D79AB0CBF3CCA603A02FB78919CC914DF516E1D759DD8258C02
MD5 SHA1 SHA512 TLSH

Submit Download

filelist.dat

Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
Size 3KB
SHA256 108ec41d4ab46f93d6296c60520f2097a5d2991d8fc7a14d04745f52b17c05e1
MD5 bf198e4557e690c45a729c6c9ff52c99
SHA1 408634893e34feef21d04af54e7d04515925ca1b
SHA512 2e5a5b4435e3caf34012beb20a1007c77632af7724a5e3fbde3870e36fcca3db4535d2edea78bf6a2a2c5bec37be872130ac040886791c136e53651f73a77581
TLSH
T11D71A1A5A742E6FBF01D79AB08BF3CCA603602FB78919CC910DF516E1D759DD4258C06
MD5 SHA1 SHA512 TLSH

Submit Download

filelist.dat

Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
Size 3KB
SHA256 4256342b75f04fb40cb1121be6aefda8159d0ad9b5b161796ec6e23979042226
MD5 218005bb93b8d4b9408eadbde40a4636
SHA1 61f1660da7a40cc62851de06519819115e308a49
SHA512 021b77d68f3aa49dabd457011ca01a7bec91c3777a5e44a7b9d45f3b985ceaa0e39699f23550c6f39daaf256002183dd70e76352437cae4b076def32c7fe1179
TLSH
T16071A1A5A742E6FBF00D79AB08BF3CCA603602FB78919CC910DF516E1D759DD4298C06
MD5 SHA1 SHA512 TLSH

Submit Download

filelist.dat

Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
Size 3KB
SHA256 3016c5de8653be3b1b2d27d0cabcb34de27aaed63a7b0e29e1d4057ffbfc879d
MD5 e1450127781d2884225728160e4c1c79
SHA1 a5712abd68bc1ecbf3a7c3d5cef5f6b6c16021a0
SHA512 0716764a9d9a70e5c8e88a3719360a1aef3b3d31dde0c3e3f0b40b426f5a5b7de3e1c1d7a89d6b391bc54ac97de712881214d7c4865d05a76ed38dad62f8828a
TLSH
T11781A1A5A742E6FBF00D79AB08BF3CCA603602FB7891ACC914DF516E1D759DD4298C06
MD5 SHA1 SHA512 TLSH

Submit Download

filelist.dat

Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
Size 3KB
SHA256 86820e8b522e7df6e9a9767685352a05138b3a174cfd295aa3b5e15d1084db04
MD5 96d8749cce1e1ecb620326765d4b604d
SHA1 ac7571dbdce07f50bb823a019a4a960fc0a0b1da
SHA512 d38806dcc3f20236a5efdfdf72d94a8ad78968066224c82a3b4c34feadce540a822c70fedd78fc5e05a53f499b8cdf2ab26b4c82bbe551edad3fe1243ae44ce5
TLSH
T15981C2A4A346E6FBF00D79AB08BF3CCA603602FB78919CC910DF516E1D759DD4298C02
MD5 SHA1 SHA512 TLSH

Submit Download

filelist.dat

Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
Size 4KB
SHA256 beab261a0a08d6d5ae4069c0b7864e146c1cf2e34758e24a2313371f662db72e
MD5 d3f78dadca68e85e6c522e35dc815145
SHA1 76768327ef48cf61e0741c9847c4a1ec1ed63a09
SHA512 f809e1f185b6d482e5c69884d2bf891596b1d233154c1d6954da8cf44cd1814b2cd1e6b594bc19e4e00aa0901c1734e810faad352721164a6510202091827ef0
SSDEEP 96:1WtNC69hwety7h+IZpL51yFYy9NWzfQo1RaTwzxlWINXi:8NV2ety7h+IZpt1eJ9NWzfxRaTwzxlWt
TLSH
T13581B4A5A746E6FBF00D79AB08BF3CCA603602FB78919CC910DF516E1D759DD4258C02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrap_oal.new

Path C:\Windows\SysWOW64\wrap_oal.new
Size 434KB
SHA256 a4e46e6d09c4b0966824a2f6628ebf738e813672692a52a0d63d982e1030ef4f
MD5 d494267bc169604fac5e3679b9a97fed
SHA1 c093ce5a4f7dc40f7f604945bd1facfb2c805c4b
SHA512 7cfcfb570ecfa974054b5285c7d6ad3bccf502866ea70789750c3748394cb0991d1fa6dec9c50a506dbc697953663ec2605277a4451098bb8cd6699c4e506040
SSDEEP 6144:0AswvHbkHO2Qc7h3Ckr6A6u35n4boFnugPoHy5AObO5rvbykp:0A9qNyin35n4WugPoEc9ykp
TLSH
T116949E01E591C0F3C4AA48785873975A6B790F6113B9E9F3FFF03C9A9E602E4553624E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OpenAL32.new

Path C:\Windows\System32\OpenAL32.new
Size 120KB
SHA256 87802322c8e63555c26fe473ce234ce7099745ccb28c02766c2224c726454039
MD5 2ad7b4f3c8d2bb686d231edff404b7a4
SHA1 f29676b96d04bd2765925a3834d9babfdce6a0b3
SHA512 51a6c8cfe30e34c37437e6c5f8c602aa0759b65559a82521e2dbcf8a9865b826077854acb6497df6085d67b4c66083ae5f0f192b743a4b6f77ce7b18f01bf528
SSDEEP 3072:mQG3kfDcDKLIjVUl4ZjxNP7ZOqCA48gstZLsFusbdLakZ:ejsxlUVZ7ZOPstm1YkZ
TLSH
T1C9C36BE2715510F9D4EFA378C9A20682D37278249B21A3CF676081562F63BD8BFBD714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrap_oal.new

Path C:\Windows\System32\wrap_oal.new
Size 455KB
SHA256 5379373cf3eff41cdd8c912c65e27e1bd492bd84238d19a093aa846c9b1ce909
MD5 549347bcd4aacd63243d78e8f869dbb1
SHA1 efc00d2a7c5acfe17b8a58023826e6840aef39a6
SHA512 c6789376d05deb8c5050225c37c023055c107a72b49afddfd3f91e7e7429d38db9346e2e5d38986c2000c3828389cfbe5d74d80423a79eebd0367bcc81137cd5
SSDEEP 6144:ING0FBd3thlYIhSJyYvb3ahwNDx/+IJcaxjCz0G5suFrtxZO+jTyWQqlMfhGy6We:ILVkoWTNV/Qz0vWtxRHQqlM/kb
TLSH
T153A47C91E19184FAD1ABE1349A52AA17F7397C440B3847CB43B0A8711BE3BE469FF354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{1CEB3C8E-E1FE-4239-BF04-AA95B3B3D766}\.ba\wixstdba.dll
Size 191KB
SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
MD5 eab9caf4277829abdf6223ec1efa0edd
SHA1 74862ecf349a9bedd32699f2a7a4e00b4727543d
SHA512 45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
SSDEEP 3072:OXoiFK6b0k77I+QfaIl191rSJHvlalB+8BHkY6v53EfcUzN0m6I+WxBlnKzeZuqt:OXoQNb++gDrSJdr8BHkPh3wIgnK/IU1a
TLSH
T103149E11B5D0907AE7FB1A385938B5216D7FBA201B60C99E17589D6F2DF02C0AF35B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_2015-2019_x86.exe

Path C:\Windows\Temp\{2141E6DC-AB79-46DC-BFE6-DC4E3C9E2D7E}\.cr\vcredist_2015-2019_x86.exe
Size 632KB
SHA256 0009d3f27837c3af3f6fff7973faf07afaa4b53119846f55b6f2a79f1759c757
MD5 2f9d2b6ce54f9095695b53d1aa217c7b
SHA1 3f54934c240f1955301811d2c399728a3e6d1272
SHA512 692857f960f26039c7b0af6329e65a71e8588ff71eaac6b956bd6e437994a8d5a470c7e75dd776e0772e473967b64d5ea0e1d8396546691316daf4d6b8ccc237
SSDEEP 12288:snMwHskY7gjcjhVIEhqgM7bWvcsi6aVhPIyP3WRCzJ9ztLz5/YTDd:6MysZgjS1hqgSC/izxf+czJZhz5Qnd
TLSH
T19BD49E3295614032E6F206B3B958E2307E3CE218271489AEE3D8ED5D7EA849167F7357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{345812BA-1846-4EF5-A333-625BD7C65105}\.ba\license.rtf
Size 8KB
SHA256 e3156d170014ced8d17a02b3c4ff63237615e5c2a8983b100a78cb1f881d6f38
MD5 2eabbb391acb89942396df5c1ca2bad8
SHA1 182a6f93703549290bcde92920d37bc1dec712bb
SHA512 20d656a123a220cd3ca3ccbf61cc58e924b44f1f0a74e70d6850f39cecd101a69bce73c5ed14018456e022e85b62958f046aa4bd1398aa27303c2e86407c3899
SSDEEP 192:W8lZ1UVDWkgWZTIsvPhghtQ1Qf4lCfnEtHixEGx736wHqItfSpOy2:9T15WZMgAYlOnjt5HLoL2
TLSH
T1BF1297B8234783D143D203D7151694C2B71F07F6AE7AF64C34E4D52826E2E6CB6B91E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{345812BA-1846-4EF5-A333-625BD7C65105}\.ba\thm.wxl
Size 2KB
SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
MD5 fbfcbc4dacc566a3c426f43ce10907b6
SHA1 63c45f9a771161740e100faf710f30eed017d723
SHA512 063fb6685ee8d2fa57863a74d66a83c819fe848ba3072b6e7d1b4fe397a9b24a1037183bb2fda776033c0936be83888a6456aae947e240521e2ab75d984ee35e
TLSH
T11F519B6778CF639028335125EAD2966A6920C5DC923F2DF1FC4A914B838D522A373F57
MD5 SHA1 SHA512 TLSH

Submit Download

thm.xml

Path C:\Windows\Temp\{345812BA-1846-4EF5-A333-625BD7C65105}\.ba\thm.xml
Size 8KB
SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
MD5 f62729c6d2540015e072514226c121c7
SHA1 c1e189d693f41ac2eafcc363f7890fc0fea6979c
SHA512 cbbfbfa7e013a2b85b78d71d32fdf65323534816978e7544ca6cea5286a0f6e8e7e5ffc4c538200211f11b94373d5658732d5d8aa1d01f9ccfdbf20f154f1471
SSDEEP 96:8L2HdQG+3VzHfz96zYFGaPSWXdhRAmImlqFQKFBiUxn7Ke5A82rkO/pWk3nswP:ZHAzZ/3
TLSH
T1D30259B546DDB801D232FB1166E231D27F126971C0C46E59F90C2AFB5FE1140A8B72BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{698EB242-72D3-4EF1-BAE9-8FFC1CED17A5}\.ba\1028\license.rtf
Size 17KB
SHA256 32585b93e69272b6d42dac718e04d954769fe31ac9217c6431510e9eead78c49
MD5 b7f65a3a169484d21fa075cca79083ed
SHA1 5dbfa18928529a798ff84c14fd333cb08b3377c0
SHA512 eda2f946c2e35464e4272b1c3e4a8dc5f17093c05dab9a685dbefd5a870b9d872d8a1645ed6f5b9a72bbb2a59d22dfa58fbf420f6440278ccbe07b6d0555c283
SSDEEP 192:xaz+aCQbjdBCLCgfvtfLEmmVxJzLKLIW7cBFCoSM0fvJ93eyryH1MqG1xcRY/c5f:seh/IMHexG4q2
TLSH
T1D3822625F434AE8D06C2563F8B2B90D53AEE060BDDB99913AD6F33070C2755ED5C3A92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{698EB242-72D3-4EF1-BAE9-8FFC1CED17A5}\.ba\1028\thm.wxl
Size 2KB
SHA256 8e2e660dfb66cb453e17f1b6991799678b1c8b350a55f9ebe2ba0028018a15ad
MD5 472abbedcbad24dba5b5f5e8d02c340f
SHA1 974f62b5c2e149c3879dd16e5a9dbb9406c3db85
SHA512 676e29378aaed25de6008d213efa10d1f5aad107833e218d71f697e728b7b5b57de42e7a910f121948d7b1b47ab4f7ae63f71196c747e8ae2b4827f754fc2699
TLSH
T17F519BAA7CDF16D096335110E8825ABA1520D6AC527B6CF1FE0A09479B8D8376373F17
MD5 SHA1 SHA512 TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{698EB242-72D3-4EF1-BAE9-8FFC1CED17A5}\.ba\1029\license.rtf
Size 12KB
SHA256 21ddcbb0b0860e15ff9294cbb3c4e25b1fe48619210b8a1fdec90bdcdc8c04bc
MD5 b408556a89fce3b47cd61302eca64ac9
SHA1 aac1cdaf085162eff5eaabf562452c93b73370cb
SHA512 bde33918e68388c60750c964cdc213ec069ce1f6430c2aa7cf1626e6785c7c865094e59420d00026918e04b9b8d19fa22ac440f851adc360759977676f8891e7
SSDEEP 192:TKwfs7OUpXLa5HEXQwNCNvZSjotXxiwH++3kamdEj6ZDbugDHgbGNlv6NbrYGY9x:Lfs7c5DRH0aHmJGpafU0AliwGra2
TLSH
T1F142821A5F7D85CF2717428E0B42200BBF4E7A481E36D3F4368BB99950B34BCE5952D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{698EB242-72D3-4EF1-BAE9-8FFC1CED17A5}\.ba\1029\thm.wxl
Size 3KB
SHA256 07fb3ec174f25dfbe532d9d739234d9dfda8e9d34f01fe660c5b4d56989fa779
MD5 16343005d29ec431891b02f048c7f581
SHA1 85a14c40c482d9351271f6119d272d19407c3ce9
SHA512 ff1ae9c21dcfb018dd4ec82a6d43362cb8c591e21f45dd1c25955d83d328b57c8d454bbe33fbc73a70dadf1dfb3ae27502c9b3a8a3ff2da97085ca0d9a68ab03
TLSH
T16A611C5778CF678065336115FDE216682A04C5D8423B6CF2FD8B8A07878992B6333F27
MD5 SHA1 SHA512 TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{698EB242-72D3-4EF1-BAE9-8FFC1CED17A5}\.ba\1031\license.rtf
Size 11KB
SHA256 f861db23b972faaa54520558810387d742878947057cf853dc74e5f6432e6a1b
MD5 c2cfa4ce43dff1fcd200edd2b1212f0a
SHA1 e8286e843192802e5ebf1be67ae30bcad75ac4bb
SHA512 6fdf02a2dc9ef10dd52404f19c300429e7ea40469f00a43ca627f3b7f3868d1724450f99c65b70b9b7b1f2e1fa9d62b8be1833a8c5aa3cd31c940459f359f30b
SSDEEP 192:+XkOmRUOl6WBsl4kA+sn+mvtI0qHl4qj+iPqk6kVV9iX9GzYNvQ8yOejIpRMrhC2:DDHMFPCeV3i4zOHyOejIpkC2
TLSH
T1E232E871B6D79288977A33A717224C92370E03BF9B60F86CA5C8C1312616AF5D5ED1E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{698EB242-72D3-4EF1-BAE9-8FFC1CED17A5}\.ba\1031\thm.wxl
Size 3KB
SHA256 8e0dca6e085744bfcbff46f7dcbcfa6fbd722dfa52013ee8ceeaf682d7509581
MD5 561f3f32db2453647d1992d4d932e872
SHA1 109548642fb7c5cc0159beddbcf7752b12b264c0
SHA512 cef8c80bef8f88208e0751305df519c3d2f1c84351a71098dc73392ec06cb61a4aca35182a0822cf6934e8ee42196e2bcfe810cc859965a9f6f393858a1242df
TLSH
T14661ED9778CF3B8464336221EA825A6A2914C189427B1DF5FD4B869B874D4339327F63
MD5 SHA1 SHA512 TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{698EB242-72D3-4EF1-BAE9-8FFC1CED17A5}\.ba\1036\license.rtf
Size 11KB
SHA256 4d9b7f06be847e9e135ab3373f381ed7a841e51631e3c2d16e5c40b535da3bcf
MD5 f0ff747b85b1088a317399b0e11d2101
SHA1 f13902a39ceae703a4713ac883d55cfee5f1876c
SHA512 aa850f05571ffc361a764a14ca9c1a465e2646a8307deee0589852e6acc61af145aef26b502835724d7245900f9f0d441451dd8c055404788ce64415f5b79506
SSDEEP 192:aRAbNYjVk+z5GUSLse5GgALEXmAWL+/3FEShP9sJgi8+Ra8woh+89EQdhwQPely6:K4yrPqm9LcVEg9sVp2ohHVdKoXJXci9a
TLSH
T10332C8A856E940CA138F117357429527B71DC384F438EB28D0DAC5A722959ACF3E71FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{698EB242-72D3-4EF1-BAE9-8FFC1CED17A5}\.ba\1036\thm.wxl
Size 3KB
SHA256 704ddf2e60c1f292be95c7c79ee48fe8ba8534ceb7ccf9a9ea68b1ad788ae9d4
MD5 7b46ae8698459830a0f9116bc27de7df
SHA1 d9bb14d483b88996a591392ae03e245cae19c6c3
SHA512 fc536dfadbcd81b42f611ac996059a6264e36ecf72a4aee7d1e37b87aefed290cc5251c09b68ed0c8719f655b163ad0782acd8ce6332ed4ab4046c12d8e6dbf6
TLSH
T16761CF9374EF57A06873121BFD8359692830D188433F59F1FD47890B828A836A377B63
MD5 SHA1 SHA512 TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{698EB242-72D3-4EF1-BAE9-8FFC1CED17A5}\.ba\1040\license.rtf
Size 11KB
SHA256 a3f745c01dea84ce746ba630814e68c7c592b965b048ddc4b1bbe1d6e533be22
MD5 9d98044bac59684489c4cf66c3b34c85
SHA1 36aae7f10a19d336c725cafc8583b26d1f5e2325
SHA512 d849bbb6c87c182cc98c4e2314c0829bb48bad483d0cd97bf409e75457c3695049c3a8adfe865e1ecbc989a910096d2c1cdf333705aac4d22025df91b355278e
SSDEEP 192:WBGNX6UXR2+5SmgS/ChMErYkQvowHVw6zdgkycEGCDLQ+n3YJ2d8XSiej+T4Ma8f:gAzSVARBR5jEPLQY3YJpSjTP2
TLSH
T10532C83462C3128953D313EB42728449B76F47EEED69F528F8D8663C20DEA88F15A1DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{698EB242-72D3-4EF1-BAE9-8FFC1CED17A5}\.ba\1040\thm.wxl
Size 3KB
SHA256 0c57f40cc2091554307aa8a7c35dd38e4596e9513e9efae00ac30498ef4e9bc2
MD5 d90bc60fa15299925986a52861b8e5d5
SHA1 fadfca9ab91b1ab4bd7f76132f712357bd6db760
SHA512 11764d0e9f286b5aa7b1a9601170833e462a93a1e569a032fcba9879174305582bd42794d4131b83fbcfbf1cf868a8d5382b11a4bd21f0f7d9b2e87e3c708c3f
TLSH
T19461E26378DF575425736208E982956A6918D8DDD73F2DF0FC87464B838A822632BF13
MD5 SHA1 SHA512 TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{698EB242-72D3-4EF1-BAE9-8FFC1CED17A5}\.ba\1041\license.rtf
Size 27KB
SHA256 7355367b7c48f1bbacc66dffe1d4bf016c16156d020d4156f288c2b2207ed1c2
MD5 8c49936ec4cf0f64ca2398191c462698
SHA1 cc069fe8f8bc3b6ee2085a4eacf40db26c842bac
SHA512 4381147ff6707c3d31c5ae591f68bc61897811112cb507831eff5e71dd281009400eda3300e7d3efde3545b89bcb71f2036f776c6fdfc73b6b2b2b8fbc084499
SSDEEP 192:Qkb65jNkzrUJVbpEiTskXHH1AZWoJxfnVnkDYUqfQFXBue6hX2JSfR7q05kWZxhY:epCD3y/ybox2yrk2
TLSH
T112C2292774A4B87C2AC4569E8F17E4F87BDF19038B72F107B84D6713091A15EDB872A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{698EB242-72D3-4EF1-BAE9-8FFC1CED17A5}\.ba\1041\thm.wxl
Size 3KB
SHA256 6b9bbf90d75cfa7d943f036c01602945fe2fa786c6173e22acb7afe18375c7ea
MD5 dc81ed54fd28fc6db6f139c8da1bded6
SHA1 9c719c32844f78aae523adb8ee42a54d019c2b05
SHA512 fd759c42c7740ee9b42ea910d66b0fa3f813600fd29d074bb592e5e12f5ec09db6b529680e54f7943821cefe84ce155a151b89a355d99c25a920bf8f254aa008
TLSH
T14781C06DB6DA219199331160B8825AE52511CC99C63B2CF1F90EC857BA8C47FD233F37
MD5 SHA1 SHA512 TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{698EB242-72D3-4EF1-BAE9-8FFC1CED17A5}\.ba\1042\license.rtf
Size 27KB
SHA256 a4c25da9e3fbced47464152c10538f16ee06d8e06bc62e1cf4808d293aa1afa2
MD5 184d94082717e684eaf081cec3cba4b1
SHA1 960b9da48f4cddf29e78bbae995b52204b26d51b
SHA512 e4016c0ca348299b5ef761f456e3b5ad9b99e5e100c07acab1369dfec214e75aa88e9ad2a0952c0cc1b707e2732779e6e3810b3da6c839f0181dc81e3560cbda
SSDEEP 384:kKIgbA2uBsarNG/HxPvCL1ewjxsXmEw4C7C7R4jAeqCBO968y7yNRylBSFfQv9yH:d3ar8Xa/XAeqoc0wfBB4qN
TLSH
T15FC2F941B4F66B4D4966E52E522600DB7BB6810F8CF9C310AFAB720F7C2B50EF587991
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{698EB242-72D3-4EF1-BAE9-8FFC1CED17A5}\.ba\1042\thm.wxl
Size 3KB
SHA256 ad7608b87a7135f408abf54a897a0f0920080f76013314b00d301d6264ae90b2
MD5 b3399648c2f30930487f20b50378cec1
SHA1 ca7bdab3bfef89f6fa3c4aaf39a165d14069fc3d
SHA512 c5b0ecf11f6dadf2e68bc3aa29cc8b24c0158dae61fe488042d1105341773166c9ebabe43b2af691ad4d4b458bf4a4bf9689c5722c536439ca3cdc84c0825965
TLSH
T17161DD6338DB56C0A5736404AD92A6B66610C2D8637B1CF1FE469987CB8C8335373F67
MD5 SHA1 SHA512 TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{698EB242-72D3-4EF1-BAE9-8FFC1CED17A5}\.ba\1045\license.rtf
Size 12KB
SHA256 8cb5eb330aa07accd6d1c8961f715f66a4f3d69fb291765f8d9f1850105af617
MD5 5b9df97fc98938bf2936437430e31eca
SHA1 ab1da8fecdf85cf487709774033f5b4b79dff8de
SHA512 4ef61a484df85c487be326ab4f95870813b9d0644df788ce22d3beb6e062cdf80732cb0b77fcda5d4c951a0d67aecf8f5dcd94ea6fa028cfca11d85aa97714e3
SSDEEP 192:TKpWRd0NE41Y/od7V/sHFos7YLQY9DbLM5D+Vw1VAOb0P4/sHLS7VHwHMPw95a+Q:uy0CG9KZ7qQCw1VAOZ/sHOJfcY2wf6p2
TLSH
T1F952B79EEA4680C8E353529B91E31926374D97C59C34D76CB89F2C2B0075EBCF69C274
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{698EB242-72D3-4EF1-BAE9-8FFC1CED17A5}\.ba\1045\thm.wxl
Size 3KB
SHA256 440b309fcdf61ffc03b269fe3815c60cb52c6ae3fc6acad14eac04d057b6d6ea
MD5 15172eaf5c2c2e2b008de04a250a62a1
SHA1 ed60f870c473ee87df39d1584880d964796e6888
SHA512 48aa89cf4a0b64ff4dcb82e372a01dff423c12111d35a4d27b6d8dd793ffde130e0037ab5e4477818a0939f61f7db25295e4271b8b03f209d8f498169b1f9bae
TLSH
T1CA61ED4778EAAAD06A331154ED8369652804C99C423B1EF5FD8B141BC78E9626333F5B
MD5 SHA1 SHA512 TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{698EB242-72D3-4EF1-BAE9-8FFC1CED17A5}\.ba\1046\license.rtf
Size 10KB
SHA256 9bf79b54f4d62be501ff53eedeb18683052a4ae38ff411750a764b3a59077f52
MD5 360fc4a7ffcdb915a7cf440221afad36
SHA1 009f36bbdad5b9972e8069e53855fc656ea05800
SHA512 9550a99641f194bb504a76de011d07c1183ee1d83371ee49782fc3d05bf779415630450174dd0c03cb182a5575f6515012337b899e2d084203717d9f110a6ffe
SSDEEP 192:WIPAufWXXF0+YkR6E0/CiTS0CsGlHIMqf29H7KxLY/aYzApT3anawLXCBX2:VPAufb+YSSCYrCb5BmW4UDaTqzLwX2
TLSH
T1732295781BC14288031312865793C407B64F43C9DDB9F9C9F9ED996E31CAAACF66329D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{698EB242-72D3-4EF1-BAE9-8FFC1CED17A5}\.ba\1046\thm.wxl
Size 3KB
SHA256 f52b54a0e0d0e8f12cba9823d88e9fd6822b669074dd1dc69dad6553f7cb8913
MD5 be27b98e086d2b8068b16dbf43e18d50
SHA1 6faf34a36c8d9de55650d0466563852552927603
SHA512 3b7c773ef72d40a8b123fdb8fc11c4f354a3b152cf6d247f02e494b0770c28483392c76f3c222e3719cf500fe98f535014192acddd2ed9ef971718ea3ec0a73e
TLSH
T13551DC6339CF169026335215F9935A6A2400D9D8823B5DF5FD8B8A4787CE963A337F23
MD5 SHA1 SHA512 TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{698EB242-72D3-4EF1-BAE9-8FFC1CED17A5}\.ba\1049\license.rtf
Size 31KB
SHA256 0ec8368e87b3dfc92141885a2930bdd99371526e09fc52b84b764c91c5fc47b8
MD5 a59c893e2c2b4063ae821e42519f9812
SHA1 c00d0b11f6b25246357053f6620e57d990efc698
SHA512 b9ad8223dda2208ec2068dbb85742a03be0291942e60d4498e3dab4ddf559aa6dcf9879952f5819223cfc5f4cb71d4e06e4103e129727aacfb8efe48403a04fa
SSDEEP 384:ntaMxngQEqQUaAEJxkSjjujcme51oVwuZOFsrnkGxunWxGc9wtvVYgCzkSxN1S2:npgnmWWNEvVYgCzxD
TLSH
T119E28A58AD35758F168215BD0B6F168247ECA51ECDF18141EEEF93470E6F8AD82B30A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{698EB242-72D3-4EF1-BAE9-8FFC1CED17A5}\.ba\1049\thm.wxl
Size 4KB
SHA256 7333bc8e52548821d82b53dbd7d7c4aa1703c85155480cb83cefd78380c95661
MD5 17c652452e5ee930a7f1e5e312c17324
SHA1 59f3308b87143d8ea0ea319a1f1a1f5da5759dd3
SHA512 53fd207b96d6bcf0a442e2d90b92e26cbb3ecc6ed71b753a416730e8067e831e9eb32981a9e9368c4cca16afbcb2051483fdcfc474ea8f0d652fca934634fbe8
SSDEEP 48:c5DiTlDhQt9esbrohDTWJt49kAr7DHN3m5GNDCNvNLIkflhrWncPingGdZwK1Kqp:uDiTlDYVgmt4xJ88k193ipzjvL
TLSH
T1C681DE12289E21DD1522B127DC408D5C3DA690FE673B5AF2BD416E6FB2E64328333B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{698EB242-72D3-4EF1-BAE9-8FFC1CED17A5}\.ba\1055\license.rtf
Size 13KB
SHA256 62a07232017702a32f4b6e43e9c6f063b67098a1483eeddb31d7c73eaf80a6af
MD5 bd2dc15dfee66076bba6d15a527089e7
SHA1 8768518f2318f1b8a3f8908a056213042a377cc4
SHA512 9c9467a2f2d0886ff4302a44aea89734fcefbd3cbe04d895bceacba1586ab746e62391800e07b6228e054014be51f14ff63ba71237268f94019063c8c8b7ef74
SSDEEP 192:1fGkc01jIjZTUDUTvXt2QpfC5VAlCPpDwuOfH7df3YwnnbZIWG2XjQeoO9uBO8CA:Iiqx4Uh2QpMVA8haDdv9nbZzG6oQR2
TLSH
T1195220970EE6B6C51B121DFF4DE410E3FACD091B3A31FD589C8A292D2131BAF7AA5105
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{698EB242-72D3-4EF1-BAE9-8FFC1CED17A5}\.ba\1055\thm.wxl
Size 3KB
SHA256 e5abe3cb3bf84207dac4e6f5bba1e693341d01aea076dd2d91eaa21c6a6cb925
MD5 defbea001dc4eb66553630ac7ce47cca
SHA1 90ced64ec7c861f03484b5d5616fdbcda8f64788
SHA512 b3b7a22d0cdada21a977f1dceaf2d73212a4cddbd298532b1ac97575f36113d45e8d71c60a6d8f8cc2e9dbf18ee1000167cfbf0b2e7ed6f05462d77e0bca0e90
TLSH
T18061FC4338CB5A9859332266FD92562A6918C4C8933B6DF2FD4B9547878D4332373F17
MD5 SHA1 SHA512 TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{698EB242-72D3-4EF1-BAE9-8FFC1CED17A5}\.ba\2052\license.rtf
Size 17KB
SHA256 e95ca64c326a0ef7ef3ced6cdab072509096356c15d1761646e3c7fda744d0e0
MD5 3cf16377c0d1b2e16ffd6e32bf139ac5
SHA1 d1a8c3730231d51c7bb85a7a15b948794e99bdce
SHA512 e9862fd0e8ec2b2c2180183d06535a16a527756f6907e6a1d2db85092636f72c497508e793ee8f2cc8e0d1a5e090c6ccf465f78bc1fa8e68daf7c68815a0ee16
SSDEEP 192:BxoqPyOj+/8Tk5VigWgijAlk5xWvSCI5lgios0EhGXxGMLVGW+uUoqyLZDvAJxMx:vbIeaE7q3KGgzD2
TLSH
T18682DE54A539AE9D45C29A7FD72B90D57AEA061FDEFD5012CE6F2303083396EC2874C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{698EB242-72D3-4EF1-BAE9-8FFC1CED17A5}\.ba\2052\thm.wxl
Size 2KB
SHA256 2ac8b7c19a5189662de36a0581c90dbad96df259ec00a28f609b644c3f39f9ca
MD5 3d1e15deeace801322e222969a574f17
SHA1 58074c83775e1a884fed6679acf9ac78abb8a169
SHA512 10797919845c57c5831234e866d730ebd13255e5bf8ba8087d53f1d0fc5d72dc6d5f6945dbebee69acc6a2e20378750c4b78083ae0390632743c184532358e10
TLSH
T12151ACE778DB1AE09A332050B99215B92420D288537BADF1FE4B5947978C83353B3F1B
MD5 SHA1 SHA512 TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{698EB242-72D3-4EF1-BAE9-8FFC1CED17A5}\.ba\3082\license.rtf
Size 10KB
SHA256 1fec058e374c20cb213f53eb3c44392ddfb2caa1e04b7120ffd3fa7a296c83e2
MD5 fbf293ee95afef818eaf07bb088a1596
SHA1 bba1991ba6459c9f19b235c43a9b781a24324606
SHA512 6971f20964ef74b19077ee81f953342dc6d2895a8640ec84855ceccea5aeb581e6a628bcd3ba97a5d3acb6cbe7971fdf84ef670bddf901857c3cd28855212019
SSDEEP 192:WthGE/9wd8eQF/hJOmQeNrXT77uOlQ+v3AqHqc3wpXGYdjvsk2cwBb2:mhGuhj+ed388Bb2
TLSH
T12E22B67415C583C003A323974253C857F56E23D9DC2EE9A8A9EEDB3D20CA9ACE1975CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{698EB242-72D3-4EF1-BAE9-8FFC1CED17A5}\.ba\3082\thm.wxl
Size 3KB
SHA256 9cbb2b312c100b309a1b1495e84e2228b937612885f7a642fbbd67969b632c3a
MD5 47f9f8d342c9c22d0c9636bc7362fa8f
SHA1 3922d1589e284ce76ab39800e2b064f71123c1c5
SHA512 e458df875e9b0622aebe3c1449868aa6a2826a1f851db71165a872b2897cf870ccf85046944ff51ffc13bb15e54e9d9424ec36caf5a2f38ce8b7d6dc0e9b2363
TLSH
T14861E16738CF5B9079735018F8C2953A5810C4A8623B9DF1FE87495783CA9665333F63
MD5 SHA1 SHA512 TLSH

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\Temp\{698EB242-72D3-4EF1-BAE9-8FFC1CED17A5}\.ba\BootstrapperApplicationData.xml
Size 12KB
SHA256 f8e9cf237eb91588a02b0a77d6512ad0cf2eccb18b54c375d6073b4c6133efcf
MD5 947ca1888d6b3e455b0c2481f85895e6
SHA1 7fad486e7d0be3db6252e07ca83a3c177d5d05bb
SHA512 1498de4c5ba1787c4ac57044677dcd04eb60ab341896da6d5f13ee08cd07f4a26d01bb2ec7b2a2b0749a61dc3a2d6e4da5e769f744a754a2faa33795068ddc03
SSDEEP 192:X0s1HBDnH5zHqQHG0Hd8Hz7HE06HA0rH3pEpzcxLU76zLG0LICrcBx7z8NkzzkvL:X0s19dLbmnoNAQkmJJruVEpJEo
TLSH
T17D42C3142AFD0059F1F34F88EAB945566B76FC963E38C85D01611E0E48B3E819972FBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_2015-2019_x64.exe

Path C:\Windows\Temp\{A4680C08-9DB7-491D-8AA4-256C3D308236}\.cr\vcredist_2015-2019_x64.exe
Size 632KB
SHA256 82c3e3423e48bafcdd726624eb7fd3e00674e50e4b6acdcac408fe8fae43b022
MD5 843288fd72a1152b50b4e4b7344bb592
SHA1 648416c53721a85666abaf71c6682fcc1da70b48
SHA512 04b61bb0a6e748ab78b1037db68bc9ec1745bb3efaca0b8fb6d99e01abbe08a67168cbf3f714b72daf00da26084ec6f6f707c3cd08fa8243023e6924719a4e41
SSDEEP 12288:SnMwHskY7gjcjhVIEhqgM7bWvcsi6aVj7Iy41wXK4Qzh+jMlWCEht:cMysZgjS1hqgSC/izvf0wiz0wyt
TLSH
T1FCD49E3291614036E6F206B3B958E2307E3CD2186714C9AEE3E8ED5D7EA848177F7257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Windows\Temp\{D2FF1E39-B483-4A14-B3F2-D99D1C2622A8}\.ba\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
TLSH
T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft.DirectX.AudioVideoPlayback.dll

Path C:\Windows\assembly\GAC\Microsoft.DirectX.AudioVideoPlayback\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.AudioVideoPlayback.dll
Size 52KB
SHA256 406f473429573e9f0084aae125ef8f19f59291aa4c33cf7d40e7d996995a3238
MD5 75933586afd94ea24c5acd3dbc89a272
SHA1 970fd4b49d1368330c10279798991b901a233c2a
SHA512 c096f0f11fb306c6a84886826306fe9c2862c3c79b14a8991a174224b41c2a68b76e5be506494d23d354384c715c5d82a1cacffff9644de9d6b93e9478087a1d
SSDEEP 768:/BJPuUm+QFYqG9se2k5R7vtv8+80t2TxJNdfr83A/E9t3DAsm:7u8qYqK6k5R7O+80tKxJN983aErm
TLSH
T1DB33B8054784C167D36E07B6907A13718739A1B187A6F7C3141A42E22D7B3EDEB782EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.DirectX.Diagnostics.dll

Path C:\Windows\assembly\GAC\Microsoft.DirectX.Diagnostics\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Diagnostics.dll
Size 12KB
SHA256 8c9685959706750091b0094522cec8644de1d1c6309e7a2fe02cef130d3a2b9c
MD5 c0843f0f45edeef233b1e581ae75e3bb
SHA1 04569c78868eaa8927ba64f93312720117152843
SHA512 8fc293f5c5de65893d92c54f921c84f8a3f44fc733445dda7907ee09d062371ef05c11d014ba2017fd15908b911d0185a14b89d0a311a870fa33650c3176e442
SSDEEP 192:9X3NgxSDOjWs65Cxa+vFeWR0TYTCCp0LASNx6fd4pG7SHQTDruA7eWFVrWS:9XdgSDOjWTCnCOp5+ICQvruA7eWFVrW
TLSH
T13042B70287ACC237ECB60A3C446706790727E696C7B2CBDB5159172958A2BD8EC71373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__AssemblyInfo__.ini

Path C:\Windows\assembly\GAC\Microsoft.DirectX.Diagnostics\1.0.2902.0__31bf3856ad364e35\__AssemblyInfo__.ini
Size 312B
SHA256 b7407f112811567a99cb7bd89f3afaf2e4ed1373d4dd04e109409acb467ad164
MD5 afa31fde52e0cb2539df73adcbbb1162
SHA1 36c16e93e65ea3c48f2807528a20832532f9bcfa
SHA512 e51401158704ec5392da0fae59611fe93f7b7431ace3630d7de7558bc3da1f9085cd8ada2d6acf288c46646d1c7a3bd0ae5196d8751ae923d8ef53f4dc4e8a25
TLSH
T1C9E07D12D0455A5B4D026CA25681000863AF074B66C82F88D544FB1DC022D5BB3470A1
MD5 SHA1 SHA512 TLSH

Submit Download