Analysis
- user interaction
yes - max time kernel
66s - max time network
40s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 03:41
Behavioral task
behavioral1
Sample
CDXWin64v1.10.33.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
CDXWin64v1.10.33.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
General
- Target CDXWin64v1.10.33.exe
- Size 6.2MB
- Sample261002-d88saasanf
- SHA256 38352a6240b3407b43c6b21d70d0ec5fca12592ab68b869cbfa9a8efc8d36cff
- MD5 143b46cd55b0fc31ff65fa723ffa011f
- SHA1 161eafcbb180ce3ebf3a22a51e726ff6b13cb677
- SHA512 c30afc904d4eb4ac995b5327be57847118891b482310baa41cfa1a519fa84e04ef58766f91b637c60fc500fad01f0e56fd31df82872f2891add025747b33d784
- SSDEEP 196608:5YclOMjFkT8POvhW5qMdjug7GpgJ3hGINwYVzwG1E:mikTqOJWZjiKJ3hbvwG1E
- TLSH T174562313EA850472E89E0B3A09E3E322685E3E6529F2B00D0CD57E4F377B5D9497E761
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 2 IoCs
pid Process 3548 CDXWin64v1.10.33.tmp 1304 CDisplayEx.exe - Loads dropped DLL 10 IoCs
pid Process 3132 regsvr32.exe 3132 regsvr32.exe 3132 regsvr32.exe 1304 CDisplayEx.exe 1304 CDisplayEx.exe 1304 CDisplayEx.exe 1304 CDisplayEx.exe 1304 CDisplayEx.exe 1304 CDisplayEx.exe 1304 CDisplayEx.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 57 IoCs
description ioc Process File opened for modification C:\Program Files\CDisplayEx\LeapCSharp.dll CDXWin64v1.10.33.tmp File opened for modification C:\Program Files\CDisplayEx\msvcr100.dll CDXWin64v1.10.33.tmp File created C:\Program Files\CDisplayEx\is-QVQFG.tmp CDXWin64v1.10.33.tmp File created C:\Program Files\CDisplayEx\is-OTH13.tmp CDXWin64v1.10.33.tmp File opened for modification C:\Program Files\CDisplayEx\swscale-2.dll CDXWin64v1.10.33.tmp File created C:\Program Files\CDisplayEx\is-KP929.tmp CDXWin64v1.10.33.tmp File created C:\Program Files\CDisplayEx\is-48K74.tmp CDXWin64v1.10.33.tmp File created C:\Program Files\CDisplayEx\is-15UQP.tmp CDXWin64v1.10.33.tmp File created C:\Program Files\CDisplayEx\is-GD1SV.tmp CDXWin64v1.10.33.tmp File created C:\Program Files\CDisplayEx\is-6NMMF.tmp CDXWin64v1.10.33.tmp File created C:\Program Files\CDisplayEx\is-VSA2N.tmp CDXWin64v1.10.33.tmp File created C:\Program Files\CDisplayEx\is-RIM9P.tmp CDXWin64v1.10.33.tmp File created C:\Program Files\CDisplayEx\is-CIED8.tmp CDXWin64v1.10.33.tmp File created C:\Program Files\CDisplayEx\is-5G3JQ.tmp CDXWin64v1.10.33.tmp File created C:\Program Files\CDisplayEx\is-DUGCI.tmp CDXWin64v1.10.33.tmp File created C:\Program Files\CDisplayEx\is-PLMJS.tmp CDXWin64v1.10.33.tmp File created C:\Program Files\CDisplayEx\is-S8MQ1.tmp CDXWin64v1.10.33.tmp File opened for modification C:\Program Files\CDisplayEx\Leap.dll CDXWin64v1.10.33.tmp File created C:\Program Files\CDisplayEx\is-6CBKG.tmp CDXWin64v1.10.33.tmp File created C:\Program Files\CDisplayEx\is-GJH01.tmp CDXWin64v1.10.33.tmp File opened for modification C:\Program Files\CDisplayEx\7z.dll CDXWin64v1.10.33.tmp File opened for modification C:\Program Files\CDisplayEx\pdfreader.exe CDXWin64v1.10.33.tmp File opened for modification C:\Program Files\CDisplayEx\CDispShell.dll CDXWin64v1.10.33.tmp File created C:\Program Files\CDisplayEx\is-VSIHQ.tmp CDXWin64v1.10.33.tmp File created C:\Program Files\CDisplayEx\is-RCRGH.tmp CDXWin64v1.10.33.tmp File created C:\Program Files\CDisplayEx\is-57P7U.tmp CDXWin64v1.10.33.tmp File created C:\Program Files\CDisplayEx\is-GACCL.tmp CDXWin64v1.10.33.tmp File created C:\Program Files\CDisplayEx\is-BH29V.tmp CDXWin64v1.10.33.tmp File created C:\Program Files\CDisplayEx\unins000.dat CDXWin64v1.10.33.tmp File created C:\Program Files\CDisplayEx\is-KGJ60.tmp CDXWin64v1.10.33.tmp File created C:\Program Files\CDisplayEx\is-NA0D4.tmp CDXWin64v1.10.33.tmp File created C:\Program Files\CDisplayEx\is-GELFC.tmp CDXWin64v1.10.33.tmp File created C:\Program Files\CDisplayEx\is-8URH9.tmp CDXWin64v1.10.33.tmp File created C:\Program Files\CDisplayEx\is-I0TUG.tmp CDXWin64v1.10.33.tmp File opened for modification C:\Program Files\CDisplayEx\unins000.dat CDXWin64v1.10.33.tmp File opened for modification C:\Program Files\CDisplayEx\CDisplayEx.exe CDXWin64v1.10.33.tmp File created C:\Program Files\CDisplayEx\is-11CCO.tmp CDXWin64v1.10.33.tmp File created C:\Program Files\CDisplayEx\is-9L2N0.tmp CDXWin64v1.10.33.tmp File created C:\Program Files\CDisplayEx\is-AD1I9.tmp CDXWin64v1.10.33.tmp File opened for modification C:\Program Files\CDisplayEx\libwebpdemux.dll CDXWin64v1.10.33.tmp File opened for modification C:\Program Files\CDisplayEx\msvcp100.dll CDXWin64v1.10.33.tmp File opened for modification C:\Program Files\CDisplayEx\pdf.dll CDXWin64v1.10.33.tmp File created C:\Program Files\CDisplayEx\is-HAASK.tmp CDXWin64v1.10.33.tmp File created C:\Program Files\CDisplayEx\is-CU06L.tmp CDXWin64v1.10.33.tmp File created C:\Program Files\CDisplayEx\is-BRFR9.tmp CDXWin64v1.10.33.tmp File created C:\Program Files\CDisplayEx\is-2UNFI.tmp CDXWin64v1.10.33.tmp File opened for modification C:\Program Files\CDisplayEx\avutil-52.dll CDXWin64v1.10.33.tmp File opened for modification C:\Program Files\CDisplayEx\libwebp.dll CDXWin64v1.10.33.tmp File created C:\Program Files\CDisplayEx\is-JPJM4.tmp CDXWin64v1.10.33.tmp File created C:\Program Files\CDisplayEx\is-8U56O.tmp CDXWin64v1.10.33.tmp File created C:\Program Files\CDisplayEx\is-LP4V1.tmp CDXWin64v1.10.33.tmp File created C:\Program Files\CDisplayEx\is-069IO.tmp CDXWin64v1.10.33.tmp File created C:\Program Files\CDisplayEx\is-HV0SV.tmp CDXWin64v1.10.33.tmp File created C:\Program Files\CDisplayEx\is-87577.tmp CDXWin64v1.10.33.tmp File created C:\Program Files\CDisplayEx\is-F74UK.tmp CDXWin64v1.10.33.tmp File created C:\Program Files\CDisplayEx\is-31J41.tmp CDXWin64v1.10.33.tmp File created C:\Program Files\CDisplayEx\is-O6M3F.tmp CDXWin64v1.10.33.tmp - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname CDXWin64v1.10.33.tmp Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain CDXWin64v1.10.33.tmp - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDXWin64v1.10.33.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDXWin64v1.10.33.tmp - Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
resource yara_rule behavioral2/memory/4140-0-0x0000000000400000-0x000000000044A000-memory.dmp innosetup behavioral2/memory/4140-13-0x0000000000400000-0x000000000044A000-memory.dmp innosetup behavioral2/memory/4140-179-0x0000000000400000-0x000000000044A000-memory.dmp innosetup - Modifies registry class 51 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CDispShell.CDISPSHELL\Clsid\ = "{EF7605D6-C512-4F90-827B-5DE32DAB94F7}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cbz\shellex\{E357FCCD-A995-4576-B01F-234630154E96} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cbt\shellex\{E357FCCD-A995-4576-B01F-234630154E96}\ = "{EF7605D6-C512-4F90-827B-5DE32DAB94F7}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cb7\shellex\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}\ = "{EF7605D6-C512-4F90-827B-5DE32DAB94F7}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cbt\ = "CDISPSHELL" CDXWin64v1.10.33.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cb7\ = "CDISPSHELL" CDXWin64v1.10.33.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EF7605D6-C512-4F90-827B-5DE32DAB94F7}\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EF7605D6-C512-4F90-827B-5DE32DAB94F7}\ProgID\ = "CDispShell.CDISPSHELL" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cbr\shellex\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}\ = "{EF7605D6-C512-4F90-827B-5DE32DAB94F7}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cbr\shellex\{E357FCCD-A995-4576-B01F-234630154E96} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cb7\shellex\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cbz CDXWin64v1.10.33.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CDISPSHELL\DefaultIcon\ = "C:\\Program Files\\CDisplayEx\\CDisplayEx.exe,0" CDXWin64v1.10.33.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CDISPSHELL\shell\open CDXWin64v1.10.33.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CDispShell.CDISPSHELL\Clsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EF7605D6-C512-4F90-827B-5DE32DAB94F7}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cbz\shellex\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cbz\shellex regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cbt\shellex regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cbt CDXWin64v1.10.33.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CDISPSHELL CDXWin64v1.10.33.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CDISPSHELL\shell\open\command CDXWin64v1.10.33.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CDISPSHELL\shell\open\command\ = "\"C:\\Program Files\\CDisplayEx\\CDisplayEx.exe\" \"%1\"" CDXWin64v1.10.33.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EF7605D6-C512-4F90-827B-5DE32DAB94F7} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CDispShell.CDISPSHELL regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cbr\shellex regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cbt\shellex\{E357FCCD-A995-4576-B01F-234630154E96} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cbr\shellex\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cbr regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cbr\shellex\{E357FCCD-A995-4576-B01F-234630154E96}\ = "{EF7605D6-C512-4F90-827B-5DE32DAB94F7}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cbt\shellex\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}\ = "{EF7605D6-C512-4F90-827B-5DE32DAB94F7}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cb7 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cb7\shellex\{E357FCCD-A995-4576-B01F-234630154E96} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EF7605D6-C512-4F90-827B-5DE32DAB94F7}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CDispShell.CDISPSHELL\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cb7 CDXWin64v1.10.33.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cbt\shellex\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cb7\shellex regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cb7\shellex\{E357FCCD-A995-4576-B01F-234630154E96}\ = "{EF7605D6-C512-4F90-827B-5DE32DAB94F7}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CDISPSHELL\shell CDXWin64v1.10.33.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cbr CDXWin64v1.10.33.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cbz\ = "CDISPSHELL" CDXWin64v1.10.33.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CDISPSHELL\DefaultIcon CDXWin64v1.10.33.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cbz regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cbz\shellex\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}\ = "{EF7605D6-C512-4F90-827B-5DE32DAB94F7}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cbz\shellex\{E357FCCD-A995-4576-B01F-234630154E96}\ = "{EF7605D6-C512-4F90-827B-5DE32DAB94F7}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cbt regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cbr\ = "CDISPSHELL" CDXWin64v1.10.33.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CDISPSHELL\ = "Comic archive" CDXWin64v1.10.33.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EF7605D6-C512-4F90-827B-5DE32DAB94F7}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EF7605D6-C512-4F90-827B-5DE32DAB94F7}\InprocServer32\ = "C:\\PROGRA~1\\CDISPL~1\\CDISPS~1.DLL" regsvr32.exe - Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 12 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 2 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3548 CDXWin64v1.10.33.tmp 3548 CDXWin64v1.10.33.tmp 1304 CDisplayEx.exe 1304 CDisplayEx.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3548 CDXWin64v1.10.33.tmp - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1304 CDisplayEx.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4140 wrote to memory of 3548 4140 CDXWin64v1.10.33.exe 90 PID 3548 wrote to memory of 3132 3548 CDXWin64v1.10.33.tmp 92 PID 3548 wrote to memory of 1304 3548 CDXWin64v1.10.33.tmp 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\CDXWin64v1.10.33.exe"C:\Users\Admin\AppData\Local\Temp\CDXWin64v1.10.33.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\is-0RT8B.tmp\CDXWin64v1.10.33.tmp"C:\Users\Admin\AppData\Local\Temp\is-0RT8B.tmp\CDXWin64v1.10.33.tmp" /SL5="$401B6,5590790,254976,C:\Users\Admin\AppData\Local\Temp\CDXWin64v1.10.33.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\CDisplayEx\CDispShell.dll"3⤵
- Loads dropped DLL
- Modifies registry class
PID:3132
-
-
C:\Program Files\CDisplayEx\CDisplayEx.exe"C:\Program Files\CDisplayEx\CDisplayEx.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1304
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4508
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\CDisplayEx\CDispShell.dll
- Size 649KB
- SHA256 b77b6e33f6c5ff75651fa65c396dae2b4ec57444a935637d061d30cffc3c3f9c
- MD5 8da5d2979aa116cf7ec3a0e1e741c975
- SHA1 be1e4c840d8722915d5f96e1714040a7dd2058d7
- SHA512 04e25bb3c54a6b8f23f4997feee270c137113aa50af4a7117c0d7db80c41932cf909a73f4554c8e14666c3d54d4ae7f4a73970e077da55bf1696aa99ed6a3732
- SSDEEP 6144:DX7KCjlBkTg8Hpl4Qg8sk1757PjHKuvFbQLZXP7y4ktxAuYD:reC5Y7HpyP8B1FPLK/ZXOSD
- TLSH T10DE4E767A298A67DC139C13A85ABCF00A03BB87583B3E1E71D890E2F5B455C55F3EB50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\CDisplayEx\CDisplayEx.exe
- Size 6.4MB
- SHA256 9a511870cee16bea1b188d530df03218ae8c6a10e18e588f9e8398d124ae7dd9
- MD5 0eb71749dab0c68b7a3abfc68e80c7ed
- SHA1 49bf0d5ec0f5fe1dc69debbf921750e71b829ace
- SHA512 47452fe9e699d621d14be30914b7ce6bc6b797bf29cc999442504f05561d29e77747eb77be49a4c83929f817dfe88c434941430270a02254008fe9fbaa028a3c
- SSDEEP 49152:snuRfii9XTVj2KlU2v9A9CEZCubR2Sswb9AeNtZFTQTxAHAwD43mkJ6+BQT:saBI9333SAHAws3s+B
- TLSH T1416619673264C13ACA698279C85F8F40E433BC651733D5EB11917E692BB2AC49E3E770
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\CDisplayEx\LeapCSharp.dll
- Size 108KB
- SHA256 5796b8bcda3840b5e2d049e0dcb3f681997f5939e4757c06aee14df722d50d1a
- MD5 021d42fe555fce0a2372fbbc64de887d
- SHA1 0fb1939a09f07120f1ad24c31984e012c6fab46c
- SHA512 da8c2edd06bdca1e79699ab8d8355a245c536363ac9514da1eb3a18761938ce189082ef06d50bd20820e1cae6cc7d30a1df5e149d071998a65e63dc00398cfeb
- SSDEEP 1536:O3/dP7O4G8M6DTsIOYKwQP+WOlLquZXpj2THWd4C4/huSp:WVTnGQs3PTOlfZb6x
- TLSH T1BBB3E503535220D2E8D293B8E4974BC2CB72B54223225BDB06A5057D4E877F9BE7E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\CDisplayEx\MSVCP100.dll
- Size 593KB
- SHA256 5bb420fbe28315f2117376052bb8488ce84a3398dda65005b8ae1f792017e9a8
- MD5 4f096d96285e06cd51aef7d2d3de04da
- SHA1 c90ef0eb5b1a0b1b85ad6792291747fb6307dcdb
- SHA512 80f558c50a71ad9c4930b3838b481e4fb453c38d57c91f7f70c1f86e4043b9a4fbcec27d7c025285504cbf3bde7c50b4770f18121d7818ac58e2ee9c2071f97c
- SSDEEP 12288:uoBFUsQ1H5FH3YUTd/dfePA7XrNvEKZm+aWodEEGblH6t2:LFUsQ1H5FHdggrNvEKZm+aWodEEIH6t2
- TLSH T143D41A23FB2906B0E162D37C65D6C341D3F13C8A4B22A7C752ABD52D2F276D9563B221
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\CDisplayEx\MSVCR100.dll
- Size 809KB
- SHA256 1d1a1ae540ba132f998d60d3622f0297b6e86ae399332c3b47462d7c0f560a36
- MD5 df3ca8d16bded6a54977b30e66864d33
- SHA1 b7b9349b33230c5b80886f5c1f0a42848661c883
- SHA512 951b2f67c2f2ef1cfcd4b43bd3ee0e486cdba7d04b4ea7259df0e4b3112e360aefb8dcd058becccacd99aca7f56d4f9bd211075bd16b28c2661d562e50b423f0
- SSDEEP 12288:3gzGPEett9Mw9HfBCddjMb2NQVmTW752fmyyKWeHQGokozS:QzJetPMw9HfBCrMb2Kc6ymyyKWewGzUS
- TLSH T13E059D9536A907F6D137D63DC996D606E2B2741513315BEB01A08BAF1F23BE09A3F312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\CDisplayEx\avutil-52.dll
- Size 382KB
- SHA256 e4b14ba6dd2161d45550618d1ac87028054d8c84ee369c1accc440d093d7e941
- MD5 319e12a20e3227c4dff0f654f476d92f
- SHA1 fc3bd0ddb98ee8391189b4359dec7173cfd49646
- SHA512 192f2964e76d2206c26145b170fc8e3f7d7dd432f1a896ba61613c6c5f16d84b8cce45e31d5c6ed486541cf39ab00de768342d5dffab22f04b7186534378724c
- SSDEEP 6144:+J7FK1y+pDl6T87MWmnnUAXV6dPVlHB5oGeLDNz6XO9L:sapDIY7MFXV3GeHJ6XO9L
- TLSH T1C0849D57F25325FCC667C1304AAAA731A860B4155274BDFF5624DF303E21EA0AB6FB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\CDisplayEx\libwebp.dll
- Size 517KB
- SHA256 c43c04c019f61910a90ebb6be08eb85e1257ec8e24a1ce37b334be15ebf95f55
- MD5 1ee74076da9f7d18ac778c056663eaa9
- SHA1 d7adef601c5e35fe7123c2db20c46a3ac18b0b3b
- SHA512 935caecd69636aee00ab82f2f691becab9a6296befff5928cd90300615d9656d8f33084c71a8e8df0a8636efd3df318021a3285fc01aa2e0234ddada09240d7b
- SSDEEP 6144:0J0bqUc4C4/IH0/wb+GsFr5AKtC/dcnbwINAz83rE9lZEtTLpsj4sWohy6QNNYia:y0+iFQHjbBwr5AKdO86lZEvYWoo60
- TLSH T19EB47C4EE19626E4E47B847889AD120BF6743C1C4350E6FB07D0AE796E33BD4563BB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\CDisplayEx\libwebpdemux.dll
- Size 43KB
- SHA256 acf574c6b9906108ed308e6d19dbc47784170076548b0d4b3620c4f1834fa1c7
- MD5 ffdc5ced375549887556a8d163f49335
- SHA1 be39d16f72c6e97f9eea081bda99f8bf5d42b66c
- SHA512 f8dd4dd9358e19e9f724b31be26b2e095d58fb8334b9d500f9becaca9ca31194180154f12bb0a1d372e43027f5f6d8286675fa90f5c8bc87d850a06d5b69a8f3
- SSDEEP 768:iFUWGWTandRgyq7FTqYOVEEelbman+8nNIzAFCXjkDby2Ny16irhJUj:mGxCTqJLJ6VnNgIcupQvrh6j
- TLSH T1D5133B0963A40074E5A75375C8F39E45E773F8426375838F42A882AE1FA37C2693D776
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\CDisplayEx\swscale-2.dll
- Size 376KB
- SHA256 f356a1473303b611434dcb45aec742cccc82002ca78052c759d537c9f2bfe520
- MD5 bfdf8e5d5072e7939e1fc5ebe5b0e805
- SHA1 d11e84a7f2ae23641d1829366e9e542432e4d79f
- SHA512 859cde2c47abb89e61867721b76c85552d149791eb568713be468c1a8139436d30535d3eeca052258414791f600a23dbeadce90b5f0814ec3a25a00f3d5e051a
- SSDEEP 6144:gzwOdY4EncBjoysOnfzHp1u1pl7lXI9REWh2M89M:gzwOdY4EWovqrWkRjL89
- TLSH T18D848DE7F37B46EED6B385341296A2C37460703AA5399D7A49D0E63138B7C80261FF19
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\CDisplayEx\unins000.exe
- Size 2.2MB
- SHA256 279daf26863b994f915628284d2dc93ea3308634f5e5675cc2e48e14b19a6c08
- MD5 c1429d48945a80aa5c05636193476b23
- SHA1 221fafd177f426ca10c2c340554885fa0ce1edae
- SHA512 193b0f940e57eabb90769a6a0494622556798ffe128c1ece3172f076926bd0c9b154b1872755b363a2adf16138cf78f574c60a7bb7fbe5414bc0ff2d30a4b0be
- SSDEEP 49152:1a7RdMxc1vkL8taSuwtsSiwaC5zuF/FPwE1mioKIKzbt:w7nIc1vkL8tutFPz1mioNKzp
- TLSH T12FB55A13A690523BD4761B3A4CB7A394AC3FBE202A35994B2FE42C4D0F365817D3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-0RT8B.tmp\CDXWin64v1.10.33.tmp
- Size 2.2MB
- SHA256 ebe6f3090ff8cf50050f5ab436d3d662b577bb7ff51085619c3fbe30f9e11ce8
- MD5 2ef47c1cc07ff0b0ee7ebe16d525c22f
- SHA1 b4b915889e0ecccbaea84e2c4672f7eaf959b237
- SHA512 cf17ed49b07b0fcd232abf81e16712b0be26146fd1d243f190ac809c11bc77e40c483b32dcb99ffc6d0c8c75f2b6f96d12c1d8b84a748f8794d4d21920d80cb4
- SSDEEP 49152:Na7RdMxc1vkL8taSuwtsSiwaC5zuF/FPwE1mioKIKzbp:I7nIc1vkL8tutFPz1mioNKzl
- TLSH T19CB55B13A680523BC4761B3B4CA7A394AC3FBE202A759D4B2FE42D4D0F365817D3A657
- MD5 SHA1 SHA512 SSDEEP TLSH