plugx | 3a9c69009b81f3828ff4df44894b35b857cf8f50692b3da3bc269ab74cc74efa

Analysis

max time kernel
151s
max time network
173s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
31-05-2023 11:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MatrisSetup 2.5.0.0.exe
Size

654.3MB
MD5

917155e396b925d4d0d969d610c9c678
SHA1

a04ccb87946bacb13e6dea7db0531ba06ca226c6
SHA256

3a9c69009b81f3828ff4df44894b35b857cf8f50692b3da3bc269ab74cc74efa
SHA512

b8b8a2ea42e1a0d08d9d705b22c226df9d92e2517149b93a730fba8af9da598c01ff3adddf2ccfd23586ee07fa9bd99a4792a87cd5b9c7e73fa0b38cda208d3e
SSDEEP

12582912:g5r71/CNXYiFVhXIz6ND0rOvovsIhxr1Vt4/ltrvSjxlI5eR5A+KiiaGccamBx:gb6NoyVhYzcwrOvoUYytt8lNRh7nQx

Score

10^/10

plugx redline discovery infostealer persistence trojan

Malware Config

Signatures

Detects PlugX payload 1 IoCs

Processes:

resource	yara_rule
C:\defdf8cba70f410218bea74f8fe971\netfx_Full.mzz	family_plugx

PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
trojan plugx
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 7 IoCs

Processes:

MatrisSetup 2.5.0.0.exeMatrisSetup.exedotNET48_setup.exeSetup.exeSetupUtility.exeSetupUtility.exeMatris.BlockBundle.exe

pid	process
1076	MatrisSetup 2.5.0.0.exe
688	MatrisSetup.exe
1588	dotNET48_setup.exe
1732	Setup.exe
1932	SetupUtility.exe
2000	SetupUtility.exe
1616	Matris.BlockBundle.exe

Loads dropped DLL 10 IoCs

Processes:

MatrisSetup 2.5.0.0.exeMatrisSetup 2.5.0.0.exeMatrisSetup.exedotNET48_setup.exeSetup.exe

pid	process
1096	MatrisSetup 2.5.0.0.exe
1076	MatrisSetup 2.5.0.0.exe
1076	MatrisSetup 2.5.0.0.exe
688	MatrisSetup.exe
1588	dotNET48_setup.exe
1732	Setup.exe
1732	Setup.exe
1732	Setup.exe
1732	Setup.exe
688	MatrisSetup.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

MatrisSetup.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	MatrisSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{c77a4c4e-cd5c-44b0-98e8-5489f6f263f6} = "\"C:\\ProgramData\\Package Cache\\{c77a4c4e-cd5c-44b0-98e8-5489f6f263f6}\\MatrisSetup.exe\" /burn.runonce"	MatrisSetup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 6 IoCs

Processes:

MatrisSetup.exeDrvInst.exeSetup.exeSetupUtility.exe

description	ioc	process
File opened for modification	C:\Windows\WindowsUpdate.log	MatrisSetup.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\WindowsUpdate.log	Setup.exe
File opened for modification	C:\Windows\WindowsUpdate.log	SetupUtility.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Setup.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe

Modifies data under HKEY_USERS 43 IoCs

Processes:

DrvInst.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe

Modifies registry class 6 IoCs

Processes:

MatrisSetup.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{c77a4c4e-cd5c-44b0-98e8-5489f6f263f6}	MatrisSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{c77a4c4e-cd5c-44b0-98e8-5489f6f263f6}\ = "{c77a4c4e-cd5c-44b0-98e8-5489f6f263f6}"	MatrisSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{c77a4c4e-cd5c-44b0-98e8-5489f6f263f6}\Version = "2.5.0.0"	MatrisSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{c77a4c4e-cd5c-44b0-98e8-5489f6f263f6}\DisplayName = "MATRIS 2"	MatrisSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{c77a4c4e-cd5c-44b0-98e8-5489f6f263f6}\Dependents\{c77a4c4e-cd5c-44b0-98e8-5489f6f263f6}	MatrisSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{c77a4c4e-cd5c-44b0-98e8-5489f6f263f6}\Dependents	MatrisSetup.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

Setup.exe

pid process

1732 Setup.exe
1732 Setup.exe
1732 Setup.exe
1732 Setup.exe
1732 Setup.exe
1732 Setup.exe

pid	process
1732	Setup.exe
1732	Setup.exe
1732	Setup.exe
1732	Setup.exe
1732	Setup.exe
1732	Setup.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

Processes:

vssvc.exeDrvInst.exe

description	pid	process
Token: SeBackupPrivilege	1056	vssvc.exe
Token: SeRestorePrivilege	1056	vssvc.exe
Token: SeAuditPrivilege	1056	vssvc.exe
Token: SeRestorePrivilege	1320	DrvInst.exe
Token: SeRestorePrivilege	1320	DrvInst.exe
Token: SeRestorePrivilege	1320	DrvInst.exe
Token: SeRestorePrivilege	1320	DrvInst.exe
Token: SeRestorePrivilege	1320	DrvInst.exe
Token: SeRestorePrivilege	1320	DrvInst.exe
Token: SeRestorePrivilege	1320	DrvInst.exe
Token: SeLoadDriverPrivilege	1320	DrvInst.exe
Token: SeLoadDriverPrivilege	1320	DrvInst.exe
Token: SeLoadDriverPrivilege	1320	DrvInst.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

MatrisSetup 2.5.0.0.exe

pid process

1076 MatrisSetup 2.5.0.0.exe

Suspicious use of WriteProcessMemory 46 IoCs

Processes:

MatrisSetup 2.5.0.0.exeMatrisSetup 2.5.0.0.exeMatrisSetup.exedotNET48_setup.exeSetup.exe

description	pid	process	target process
PID 1096 wrote to memory of 1076	1096	MatrisSetup 2.5.0.0.exe	MatrisSetup 2.5.0.0.exe
PID 1096 wrote to memory of 1076	1096	MatrisSetup 2.5.0.0.exe	MatrisSetup 2.5.0.0.exe
PID 1096 wrote to memory of 1076	1096	MatrisSetup 2.5.0.0.exe	MatrisSetup 2.5.0.0.exe
PID 1096 wrote to memory of 1076	1096	MatrisSetup 2.5.0.0.exe	MatrisSetup 2.5.0.0.exe
PID 1096 wrote to memory of 1076	1096	MatrisSetup 2.5.0.0.exe	MatrisSetup 2.5.0.0.exe
PID 1096 wrote to memory of 1076	1096	MatrisSetup 2.5.0.0.exe	MatrisSetup 2.5.0.0.exe
PID 1096 wrote to memory of 1076	1096	MatrisSetup 2.5.0.0.exe	MatrisSetup 2.5.0.0.exe
PID 1076 wrote to memory of 688	1076	MatrisSetup 2.5.0.0.exe	MatrisSetup.exe
PID 1076 wrote to memory of 688	1076	MatrisSetup 2.5.0.0.exe	MatrisSetup.exe
PID 1076 wrote to memory of 688	1076	MatrisSetup 2.5.0.0.exe	MatrisSetup.exe
PID 1076 wrote to memory of 688	1076	MatrisSetup 2.5.0.0.exe	MatrisSetup.exe
PID 1076 wrote to memory of 688	1076	MatrisSetup 2.5.0.0.exe	MatrisSetup.exe
PID 1076 wrote to memory of 688	1076	MatrisSetup 2.5.0.0.exe	MatrisSetup.exe
PID 1076 wrote to memory of 688	1076	MatrisSetup 2.5.0.0.exe	MatrisSetup.exe
PID 688 wrote to memory of 1588	688	MatrisSetup.exe	dotNET48_setup.exe
PID 688 wrote to memory of 1588	688	MatrisSetup.exe	dotNET48_setup.exe
PID 688 wrote to memory of 1588	688	MatrisSetup.exe	dotNET48_setup.exe
PID 688 wrote to memory of 1588	688	MatrisSetup.exe	dotNET48_setup.exe
PID 688 wrote to memory of 1588	688	MatrisSetup.exe	dotNET48_setup.exe
PID 688 wrote to memory of 1588	688	MatrisSetup.exe	dotNET48_setup.exe
PID 688 wrote to memory of 1588	688	MatrisSetup.exe	dotNET48_setup.exe
PID 1588 wrote to memory of 1732	1588	dotNET48_setup.exe	Setup.exe
PID 1588 wrote to memory of 1732	1588	dotNET48_setup.exe	Setup.exe
PID 1588 wrote to memory of 1732	1588	dotNET48_setup.exe	Setup.exe
PID 1588 wrote to memory of 1732	1588	dotNET48_setup.exe	Setup.exe
PID 1588 wrote to memory of 1732	1588	dotNET48_setup.exe	Setup.exe
PID 1588 wrote to memory of 1732	1588	dotNET48_setup.exe	Setup.exe
PID 1588 wrote to memory of 1732	1588	dotNET48_setup.exe	Setup.exe
PID 1732 wrote to memory of 1932	1732	Setup.exe	SetupUtility.exe
PID 1732 wrote to memory of 1932	1732	Setup.exe	SetupUtility.exe
PID 1732 wrote to memory of 1932	1732	Setup.exe	SetupUtility.exe
PID 1732 wrote to memory of 1932	1732	Setup.exe	SetupUtility.exe
PID 1732 wrote to memory of 1932	1732	Setup.exe	SetupUtility.exe
PID 1732 wrote to memory of 1932	1732	Setup.exe	SetupUtility.exe
PID 1732 wrote to memory of 1932	1732	Setup.exe	SetupUtility.exe
PID 1732 wrote to memory of 2000	1732	Setup.exe	SetupUtility.exe
PID 1732 wrote to memory of 2000	1732	Setup.exe	SetupUtility.exe
PID 1732 wrote to memory of 2000	1732	Setup.exe	SetupUtility.exe
PID 1732 wrote to memory of 2000	1732	Setup.exe	SetupUtility.exe
PID 1732 wrote to memory of 2000	1732	Setup.exe	SetupUtility.exe
PID 1732 wrote to memory of 2000	1732	Setup.exe	SetupUtility.exe
PID 1732 wrote to memory of 2000	1732	Setup.exe	SetupUtility.exe
PID 688 wrote to memory of 1616	688	MatrisSetup.exe	Matris.BlockBundle.exe
PID 688 wrote to memory of 1616	688	MatrisSetup.exe	Matris.BlockBundle.exe
PID 688 wrote to memory of 1616	688	MatrisSetup.exe	Matris.BlockBundle.exe
PID 688 wrote to memory of 1616	688	MatrisSetup.exe	Matris.BlockBundle.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\MatrisSetup 2.5.0.0.exe
"C:\Users\Admin\AppData\Local\Temp\MatrisSetup 2.5.0.0.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\Temp\{3BD70326-B360-425B-9936-11B8A92C9D16}\.cr\MatrisSetup 2.5.0.0.exe
  "C:\Windows\Temp\{3BD70326-B360-425B-9936-11B8A92C9D16}\.cr\MatrisSetup 2.5.0.0.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\MatrisSetup 2.5.0.0.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1076
- - C:\Windows\Temp\{3FBBCDF9-B77A-4508-B6FE-3F29C9CCB809}\.be\MatrisSetup.exe
    "C:\Windows\Temp\{3FBBCDF9-B77A-4508-B6FE-3F29C9CCB809}\.be\MatrisSetup.exe" -q -burn.elevated BurnPipe.{F221D6D9-10A8-46DC-B165-1A5571637E17} {C1333FD1-ABD7-400C-AA44-452B8EB27C23} 1076
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in Windows directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:688
  - - C:\ProgramData\Package Cache\E322E2E0FB4C86172C38A97DC6C71982134F0570\Packages\dotNET\dotNET48_setup.exe
      "C:\ProgramData\Package Cache\E322E2E0FB4C86172C38A97DC6C71982134F0570\Packages\dotNET\dotNET48_setup.exe" /q /norestart
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1588
    - - C:\defdf8cba70f410218bea74f8fe971\Setup.exe
        
        C:\defdf8cba70f410218bea74f8fe971\\Setup.exe /q /norestart /x86 /x64 /redist
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1732
      - C:\defdf8cba70f410218bea74f8fe971\SetupUtility.exe
        
        SetupUtility.exe /aupause
        6⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1932
      - C:\defdf8cba70f410218bea74f8fe971\SetupUtility.exe
        
        SetupUtility.exe /screboot
        6⤵
        Executes dropped EXE
        
        PID:2000
  - - C:\ProgramData\Package Cache\29978190E358C030F405D28ADCAF6130DC5DCB81\Packages\Matris\Matris.BlockBundle.exe
      "C:\ProgramData\Package Cache\29978190E358C030F405D28ADCAF6130DC5DCB81\Packages\Matris\Matris.BlockBundle.exe" /v:1.0.0.6
      4⤵
      Executes dropped EXE
      PID:1616
  - - C:\ProgramData\Package Cache\37C93A0BBBE01688525A5AAF6315DBEED31B5830\Packages\Fido\FIDOSetup.exe
      "C:\ProgramData\Package Cache\37C93A0BBBE01688525A5AAF6315DBEED31B5830\Packages\Fido\FIDOSetup.exe" /app-installation /qn
      4⤵
      PID:1440

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1056

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "000000000000005C" "000000000000047C"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1320

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Package Cache\E322E2E0FB4C86172C38A97DC6C71982134F0570\Packages\dotNET\dotNET48_setup.exe

Filesize
115.7MB

MD5
7d2b599470e34481138444866b7e4ea6

SHA1
e322e2e0fb4c86172c38a97dc6c71982134f0570

SHA256
68c9986a8dcc0214d909aa1f31bee9fb5461bb839edca996a75b08ddffc1483f

SHA512
ffb6c226af4e5c8ffa7210d5115701883abf12a8b1cbae6e08122fb94dd93763468bff5b00060eabef19c147b0a4d8063dde318d2b928ce397c58f7949736c5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3068b523986d81cc425c9724d3a85f09

SHA1
b1ee13d993102f7b5ac23d1fe63252c1bb5960cb

SHA256
2966dd796020532e35d9a924ba2cd9da3cf6afb034c49236457e8a38342d95aa

SHA512
8c987ee4068e1efb44e759b282450f05178126d8deec01410f0ccf3f1f8a36de323bcf014580597d1236c357144d74064f4bd050b78e2a0205a621f045f20406

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7049.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\HFI346B.tmp.html

Filesize
15KB

MD5
cd131d41791a543cc6f6ed1ea5bd257c

SHA1
f42a2708a0b42a13530d26515274d1fcdbfe8490

SHA256
e139af8858fe90127095ac1c4685bcd849437ef0df7c416033554703f5d864bb

SHA512
a6ee9af8f8c2c7acd58dd3c42b8d70c55202b382ffc5a93772af7bf7d7740c1162bb6d38a4307b1802294a18eb52032d410e128072af7d4f9d54f415be020c9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\MATRIS_2_2023531134217_BlockBundle.log

Filesize
1KB

MD5
f313ee2791592ec564d782a0b167bd3c

SHA1
877a08d1e15e328d6a8fc0b9273f899f1cfa9f87

SHA256
0b5502084c8faa85b20bd3af47b51a7242bc979b0e483feaec510531ca4dac8f

SHA512
e7fe4ddff1f314525bfa8819d756786e88f15e393d5179852dfe4e2439c6bb9f51d15bfefeebc2d93139389adc0597de794c48f4180e5957dca8cd015877cd28

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7184.tmp

Filesize
161KB

MD5
73b4b714b42fc9a6aaefd0ae59adb009

SHA1
efdaffd5b0ad21913d22001d91bf6c19ecb4ac41

SHA256
c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd

SHA512
73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7D03.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_SetupUtility.txt

Filesize
3KB

MD5
8c7a6cb28ac24aa0690ba74ce11f40aa

SHA1
235fbbe92728cbe1cdfc6022849a7cb954bf1d84

SHA256
58206d85422005829592c75672abf3113898a84a51723b1d7e22373456f60e01

SHA512
3aa26402935357798439de7237314d62f6d99ffddff796ef19012b0f81056d24829f84831dab52853e73126a8ccca6e25f66e35a0d4512083055109a87a92128

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_SetupUtility.txt

Filesize
3KB

MD5
23864cd6374d046a543f549dbad56ea2

SHA1
cacf6d94841f22e4817026ed6f0047fca57ccece

SHA256
db2ad13f41b89ca2567cd8078b5843912935b96e62cb20317e643c82ab1ab102

SHA512
07fbd95674cf1ef608a22a2c8169f0f56fa9f4ff2ef5b1d75bf6d6ca0d4330b9e52cf51118d96e705069c8f6829b94685eae2156a273c7f33fc2d0b5514266d2

Download Submit
C:\Windows\Temp\{3BD70326-B360-425B-9936-11B8A92C9D16}\.cr\MatrisSetup 2.5.0.0.exe

Filesize
597KB

MD5
e201342321bd917dfe8f4180857b4ddf

SHA1
e7ccb0ffae9888a4f434f6caec54eac513f3f398

SHA256
0ed9320126326552f5b09bada9984e43a4eec81d78d30636dd0ad3ef72b07634

SHA512
9d9625bdb19aff94f266927e2ff1f38b1f2c518c50d22ffa784195ecbd8011116633faa6f6d88c1d33161fa659c30b2a7c28051ffcd40845e867b1b862ce4b86

Download Submit
C:\Windows\Temp\{3BD70326-B360-425B-9936-11B8A92C9D16}\.cr\MatrisSetup 2.5.0.0.exe

Filesize
597KB

MD5
e201342321bd917dfe8f4180857b4ddf

SHA1
e7ccb0ffae9888a4f434f6caec54eac513f3f398

SHA256
0ed9320126326552f5b09bada9984e43a4eec81d78d30636dd0ad3ef72b07634

SHA512
9d9625bdb19aff94f266927e2ff1f38b1f2c518c50d22ffa784195ecbd8011116633faa6f6d88c1d33161fa659c30b2a7c28051ffcd40845e867b1b862ce4b86

Download Submit
C:\Windows\Temp\{3FBBCDF9-B77A-4508-B6FE-3F29C9CCB809}\.ba\logo.png

Filesize
852B

MD5
8346e21859a269dccf1e408dc7593cca

SHA1
239f10674bf6022854c1f1bf7c91955bde34d3e4

SHA256
cd2e8ed1fbb308d9d166f49794d323a9b22efba1033cdf906d1f4b030319e01b

SHA512
de9a54e7067fe4feade10f48d7c2bb4169f50efa0b06d3310421376690712af4d55dbc24dc5accc5013379b11abb59cc8c85896fe9f2a7c6a7ea2e28f6feac9f

Download Submit
C:\Windows\Temp\{3FBBCDF9-B77A-4508-B6FE-3F29C9CCB809}\.be\MatrisSetup.exe

Filesize
597KB

MD5
e201342321bd917dfe8f4180857b4ddf

SHA1
e7ccb0ffae9888a4f434f6caec54eac513f3f398

SHA256
0ed9320126326552f5b09bada9984e43a4eec81d78d30636dd0ad3ef72b07634

SHA512
9d9625bdb19aff94f266927e2ff1f38b1f2c518c50d22ffa784195ecbd8011116633faa6f6d88c1d33161fa659c30b2a7c28051ffcd40845e867b1b862ce4b86

Download Submit
C:\Windows\Temp\{3FBBCDF9-B77A-4508-B6FE-3F29C9CCB809}\.be\MatrisSetup.exe

Filesize
597KB

MD5
e201342321bd917dfe8f4180857b4ddf

SHA1
e7ccb0ffae9888a4f434f6caec54eac513f3f398

SHA256
0ed9320126326552f5b09bada9984e43a4eec81d78d30636dd0ad3ef72b07634

SHA512
9d9625bdb19aff94f266927e2ff1f38b1f2c518c50d22ffa784195ecbd8011116633faa6f6d88c1d33161fa659c30b2a7c28051ffcd40845e867b1b862ce4b86

Download Submit
C:\Windows\Temp\{3FBBCDF9-B77A-4508-B6FE-3F29C9CCB809}\.be\MatrisSetup.exe

Filesize
597KB

MD5
e201342321bd917dfe8f4180857b4ddf

SHA1
e7ccb0ffae9888a4f434f6caec54eac513f3f398

SHA256
0ed9320126326552f5b09bada9984e43a4eec81d78d30636dd0ad3ef72b07634

SHA512
9d9625bdb19aff94f266927e2ff1f38b1f2c518c50d22ffa784195ecbd8011116633faa6f6d88c1d33161fa659c30b2a7c28051ffcd40845e867b1b862ce4b86

Download Submit
C:\Windows\Temp\{3FBBCDF9-B77A-4508-B6FE-3F29C9CCB809}\CLUP

Filesize
3.6MB

MD5
d40d8a16297a12f7d15015b9a3ffdf6c

SHA1
67a19a0a6a9a567df5f54fb1ccb8b1ef466c6d96

SHA256
8e05e64831fd69b0ac43fce99fc8fc05f4eefa9a081c82cd3cbd3c8c6a501e41

SHA512
5f4e8f10634709d3f64d9c0810cbf94f9a3bb9e406aaa9914e27d21fe30e1d619daf0564b75f789c9cb5d3628ab017e353717d6554204e31c8c632638ad4e4b7

Download Submit
C:\Windows\Temp\{3FBBCDF9-B77A-4508-B6FE-3F29C9CCB809}\Fido

Filesize
3.4MB

MD5
46bda01a857a9f5973859dbe2385371a

SHA1
37c93a0bbbe01688525a5aaf6315dbeed31b5830

SHA256
0eff644b556c17ba79bd304a70ce91f5d5489f2028ffc44b428276609e2f278e

SHA512
062f1a325227b592b3287d835e89b44ddbc79018b71d929e20bae25dccf3a0f6fe6ef9d4010dc33691f7cd02e180926b5e57f62b1c11f90fa1e90dbcab46ac78

Download Submit
C:\Windows\Temp\{3FBBCDF9-B77A-4508-B6FE-3F29C9CCB809}\MATRIS

Filesize
460.9MB

MD5
af9bd3aed79f6194d63e644e54d83b95

SHA1
e7ac92a8bda57ac42dfc2ef16f14c9e135060c62

SHA256
84725ac04a12bcb189d1d1fbdf037f4cf4010afc74c738cb078658cf14f1cc39

SHA512
d4bcea11567b909b2c3b62ce77dd3a66557613f55a22c44b5144f220d289061251c3dddebe511f4a755dcb2f9d878f11e4398d5ad91eebfc905b8ee35626fefb

Download Submit
C:\Windows\Temp\{3FBBCDF9-B77A-4508-B6FE-3F29C9CCB809}\MatrisBlockBundle

Filesize
16KB

MD5
df25875e664b7a631ddfa8b1634c3c63

SHA1
29978190e358c030f405d28adcaf6130dc5dcb81

SHA256
e4036502bf77646bd17fdfa371355913e5109eda7a02d59fb3fd5f6277f58577

SHA512
18b18e1e96333de1f0990c680c1c2bfcdb89038bf8e7a2418778e72262ea2206a053bc8515f47ccade548e26b6b717ccf00eee44e94d6eb55b0232d955cf285d

Download Submit
C:\Windows\Temp\{3FBBCDF9-B77A-4508-B6FE-3F29C9CCB809}\MatrisDeleteBundle

Filesize
15KB

MD5
8fe4affe1b72113cb74c9fa3036740d2

SHA1
14e4dee30a774bfe3d988889e40463d43ca7f6a9

SHA256
ef161c4eefc33ac23b367748adf596027dec2649c7d4ce312b54e9782380df43

SHA512
a708b1a6a2b859b3d7254c9cef009e1c0f39838cdb656215eee28ead6bf1ebe187047dd270655b0e8c61dad8229fd831e2d9131a45c67d1cc721704dec572156

Download Submit
C:\Windows\Temp\{3FBBCDF9-B77A-4508-B6FE-3F29C9CCB809}\SSCEx32

Filesize
3.0MB

MD5
86af6d36dff214718dcd35d851249d3d

SHA1
286a78faae68fcba8fba4edcd9fa201de1f25d12

SHA256
99b5f0c1cc7fe40120a36fb760cc7c646edef5916695d6ecd8d41e8bba9b1c60

SHA512
3642157f27bb4840a69dcb7cbd7298cf0865736e0a5c728ffc37330814bcb42d565c936432de4d87d361e3f42cac0b1872db7712a211333b5307acf1bbdf6abb

Download Submit
C:\Windows\Temp\{3FBBCDF9-B77A-4508-B6FE-3F29C9CCB809}\SSCEx64

Filesize
3.5MB

MD5
558f4ec3b1d25761399a81d3f14bdb6d

SHA1
a860cd0d9c39e8a8a756d1c5ac79dd08b610f958

SHA256
fcc1110c9ad0fb3e2f8787103a2a7549c16b0935e1808c2ee1ea016149fa08b8

SHA512
ff05ae0428b7880651b71f8e148e73828c83470b614045c2becabbbaeb870d41bfa5de049f00b148949de5b21e80c72b76dd04dd31e9017ec3e2044508799003

Download Submit
C:\Windows\Temp\{3FBBCDF9-B77A-4508-B6FE-3F29C9CCB809}\VOCOM1

Filesize
34.6MB

MD5
98a8ae93579360fe674ba5d643ff6119

SHA1
9aa207536cbc58081af82489fe57e799d77e0b9c

SHA256
966084f89402fa48eca9c442e559dd52a2f5c0c520b720cda3efa5fd575ad329

SHA512
4a323d3a3b3f6113c953bc8edfbe69f3efb70cbc677c27013a7293eccf3dad902884a3d9cdad0b1317f2daf0bd182a385471af931e774bd8daab3c21800f13a3

Download Submit
C:\Windows\Temp\{3FBBCDF9-B77A-4508-B6FE-3F29C9CCB809}\VOCOM1ClupReg

Filesize
7KB

MD5
d3ded2b1af6ac98537e3ef94fb90c37b

SHA1
87c3af4bb9026f4f62b58c298ef8fc36fbfa8e16

SHA256
77b7cf36f814fb10b519e95bb8d0e99465b7903e09e473a5bb47f8a8c9ad1a15

SHA512
1b0eb1201635b7e48114246191e81e10457266934a22cad75b9413a13e670b25c31b9597af5bc1d22b664f5678588bac6b901c9cf89e27fcb00818f5e11fe9d6

Download Submit
C:\Windows\Temp\{3FBBCDF9-B77A-4508-B6FE-3F29C9CCB809}\VOCOM2

Filesize
33.3MB

MD5
8f10c86e40abdbb2cbc97bcecf949adc

SHA1
f4d106ecbc7d6c9424024600d0c5db197a819624

SHA256
4197e5d9ea161a41238699da36c1f3e10b45ba9f593f44128a8f5948d1bdcfb4

SHA512
c7427dd820bf59a832fd8a3f74dad8db901c3437f9db7a3a9c4bc0d9594c8ab79cf5139549898931f3a74041548fca6f9fdf5f7a9e92b4bdcd9b0a12095dc9b4

Download Submit
C:\Windows\Temp\{3FBBCDF9-B77A-4508-B6FE-3F29C9CCB809}\dotNET

Filesize
115.7MB

MD5
7d2b599470e34481138444866b7e4ea6

SHA1
e322e2e0fb4c86172c38a97dc6c71982134f0570

SHA256
68c9986a8dcc0214d909aa1f31bee9fb5461bb839edca996a75b08ddffc1483f

SHA512
ffb6c226af4e5c8ffa7210d5115701883abf12a8b1cbae6e08122fb94dd93763468bff5b00060eabef19c147b0a4d8063dde318d2b928ce397c58f7949736c5f

Download Submit
C:\Windows\WindowsUpdate.log

Filesize
16KB

MD5
95b20edb99748402e77fc1c6086f3bdf

SHA1
34c379e4d8c54aa1d34725317928e537d63465e3

SHA256
a39bb5053ebf565b0443609f2505399dfb16bac3cf87c0f0980942e2f456e12f

SHA512
7684fef3ac531175e0341def0c048807a4ca5f25a518001f2f759d5af78803f7f00c218fb34d90e52c0786d972227e79cddcc0aaab68df1ba3046cd67adad4cd

Download Submit
C:\defdf8cba70f410218bea74f8fe971\1025\LocalizedData.xml

Filesize
80KB

MD5
d8165beb3b8433921d0d5611b85bfa35

SHA1
bef57e3511e18170ebbc9ae3aefd73ce3f50f8f4

SHA256
b092668e0825f7f498acdc1bf10e1d2cb6ca99497389142cf9af815f25a4b712

SHA512
9fa221f549b4e660c4f40c7ab0e483e3d9a9204248da51675058f32f4f56667c782667295decbb441a581f582a099fe34c6cc569d0c4ec13e85c680abf5870b0

Download Submit
C:\defdf8cba70f410218bea74f8fe971\1028\LocalizedData.xml

Filesize
69KB

MD5
f3a4fd6968658a18882cf300553f2f89

SHA1
b75ccaeff41bf9c8586bca612550cb9dca6b09ea

SHA256
53742293b25149b19d8677b15f6424fc71e308014b1bcf883e6949d1dab3961c

SHA512
9692c8577034c0e628a42d581f634ed174b4af684ee87c947556888027215bbf4c92286a3ad1cb1792fc6f7392190719ebef85b60fce48e20239abcb58d04d97

Download Submit
C:\defdf8cba70f410218bea74f8fe971\1029\LocalizedData.xml

Filesize
85KB

MD5
d6801174849373cde3f1d214d80fe834

SHA1
50caf47aa60b999ca7b43d3ceb75d0dbffd2278a

SHA256
cbb0da2d1efa7de6736e67c978848d53acf8b502bf3daf43ce40b05076145a7c

SHA512
a4cf812dc4fac888dad4ca986fcb07b93f45633fe5931f24afff4558d9a29734a0ac5d647f3bc631c377fba816c19bd44178398bb6166f6f84e5f05acb8e0a18

Download Submit
C:\defdf8cba70f410218bea74f8fe971\1030\LocalizedData.xml

Filesize
83KB

MD5
03b1e582ec5454b2fa3599e788569dfa

SHA1
75845acdd04fb17011218b06fd7c28830641f021

SHA256
59884541554376a26143b105fa924b9f9961254d22db8dedf7de7f3495d7a1dd

SHA512
23d1b1c2e2c78692a48b959bdb70c3c321a76792885b19805cafd543c0ef25856f8f115af766ea46f20eb2c440eaf31e656726710b12ae5f362779bea28035bc

Download Submit
C:\defdf8cba70f410218bea74f8fe971\1031\LocalizedData.xml

Filesize
88KB

MD5
afb4b1d7103ddca43ea723acbcdd31fd

SHA1
c4d95dfd4869df636091e979c8b3bd7684004a48

SHA256
961efe11e9e3e553269cb14dc1b942e9ac68b86740d59aa35e4ff6e5913532dd

SHA512
bde563d158e38f7a46abe564e365bbc9cfa235f4735f668a532919f0575bead27bdd6fa11ac50802c989f2f69371c2e9179c9affbc85954a9b4050f9122e26a5

Download Submit
C:\defdf8cba70f410218bea74f8fe971\1032\LocalizedData.xml

Filesize
90KB

MD5
71bdb323a746a4adab9ce42498e937bc

SHA1
8e58d4ba5623a50610bd99e82df135708a9f130e

SHA256
6c5a6e11a85c9e172e7748a9a9f19f8598870a63a103a7ac18cbbd0cdf026475

SHA512
b7d66fa4f1a1b7130cdd801447fe0c4965cba1618c01d4ff64b9707e3e132fb13858aa498ea26fb1e54b56daf83e5e7958c6a4fcc1a4ad6dd6c2ffa966e58b76

Download Submit
C:\defdf8cba70f410218bea74f8fe971\1033\LocalizedData.xml

Filesize
83KB

MD5
47703bed025228689a1032edae56b4c4

SHA1
a2aba33c7e8915025251574c81fe2e5ac6bc0893

SHA256
05fc9352b918a710d51f68873fc522528265455b77014e8b0cd66c5e7aa71dc3

SHA512
9d6eda9fc3be6116371d1b86b54b8b65ccd58c182105e0954870f75e2a6f4d7e8fc84462bfd3584175c0f849066e47d82cd18ae3bf1671e60cc237347b7cc00d

Download Submit
C:\defdf8cba70f410218bea74f8fe971\1035\LocalizedData.xml

Filesize
84KB

MD5
ad67691b3b5474154f65400e53ddfef2

SHA1
dc8dc683bf9fee12a5ab7297789a5c087e98facc

SHA256
1e828840ae8728ac809624845597406d4025d6da7797b38f02946a30a48bfe7c

SHA512
64ee113f0c3e173fee6047cc41ff3e84181aba2eb2b02ca5cc717caaf1392e5e2f0eed7e7c469d821d86878443bc8ec64c66e2afb1d850fb4c7e9823c3a5ea73

Download Submit
C:\defdf8cba70f410218bea74f8fe971\1036\LocalizedData.xml

Filesize
87KB

MD5
2c77cbaaf9c3ed0c4410c4b8c3c29c30

SHA1
110775ca1c6e252b4e8c8bf39b593dfb4d66206c

SHA256
ab3d5571b57b7bb705bffe13f37bd73894b0d12d09cc1fb1b438493a863c324c

SHA512
c1438b9b95bd16503f5a14d743e9c6c40cb46cd24a4bb48adf6f9162c61e8979c370e7e1eff8989db05ff5a496415a68b58cc16912a7c8215fecb72d252c5285

Download Submit
C:\defdf8cba70f410218bea74f8fe971\1037\LocalizedData.xml

Filesize
78KB

MD5
631011d665ad08220fe248d9f8a103ba

SHA1
652c56998d0e8bf0c43f136fd90c69728bb0e111

SHA256
e9877973bef23498b586a9cf03230fc45a9ea8a3f75decfa062b03bd31974b06

SHA512
cf479c0c5167e011721bd6b0f5829a62c0c269b1e1be13e5bb750516b8441a1d8ca20fafd0d539066f84d669f6f5e9401c223b82e200501716c719d268c3c1a0

Download Submit
C:\defdf8cba70f410218bea74f8fe971\1038\LocalizedData.xml

Filesize
86KB

MD5
28e8a2833f3d5302a1f5c2a84fa8990a

SHA1
08977251eb62c6df447c6754b2ec27a73d9071f1

SHA256
e4261c9b8c779d58883820a531a19594d238f0ca9ecac399505c569b0cccdbc7

SHA512
4a62afe84d4eb03bf2c65826b5765f270b3c9a3403b972bb00db66cb40b70d1809334fc3a8edf012c1ea31e4e3b8c6fed6423e9da14dd62ad76a12d525e515b9

Download Submit
C:\defdf8cba70f410218bea74f8fe971\1040\LocalizedData.xml

Filesize
85KB

MD5
e74a35a00e0228de37ee911f93411ed2

SHA1
c1c0901eb552c21ce2817b7edb94af611b571a49

SHA256
2ec36fb871853f60085bc972e08156483384f8c1d6e000f5db1cc8cccad05f8c

SHA512
8876e39093448d1ae5a1f53499272323747789fbaefdf9bd852fee161fa9c18ce0721164473a5a2279643b34a2727d870e0b802635288f2e32b15c40660ad06f

Download Submit
C:\defdf8cba70f410218bea74f8fe971\1041\LocalizedData.xml

Filesize
75KB

MD5
32e4d6f895a69bb2c373ff4c688d6b27

SHA1
57738235363c5f1a1c5651c65832396e3aef4414

SHA256
ae28910c1ef16ce70a5e97c5d02390ad8d64f80966e2be3c4a56db0c4038442d

SHA512
5052e8a218cf71b0e08de33665a58f9219282e00f2e4f6c19897a07863556a2408dc273ad3cc9257d98d6a57765321e0f1b051bed051f188947deda9d32dbdbe

Download Submit
C:\defdf8cba70f410218bea74f8fe971\1042\LocalizedData.xml

Filesize
73KB

MD5
47f8082069c52d2f7db1fc6aac2886df

SHA1
4b5c371e9006c10685f2c59ca9a7ebfb4a597a0a

SHA256
e86656ef2092c0e6caf5b8b0bca2d6ce5def273609c22187ae91236605d2e273

SHA512
7bdaf721e561c46609054f6786624149fd824abb1e3126b2a6b6385b56c6fe11414af216fca3ee2b1fe6a4b42ca8a19f46186ab1d4e70fb81b6f9af013c40018

Download Submit
C:\defdf8cba70f410218bea74f8fe971\1043\LocalizedData.xml

Filesize
85KB

MD5
e939717e7eaf1b7f53c4b752e62a22e7

SHA1
ca5a66c452ec6ca8bc04de95eac1616cf3980992

SHA256
8afdf3d2c0fd2370889e3fd96bc2742831cdc6041af0a407123c27f8d76d68a6

SHA512
ebfa725b8efc4448d669beea6f56eab9a317793ff1e21cbc51e015a1a31dfb8b1408e9df15023b878aca220465dbede09254f9a524ef7f6060877844994e17aa

Download Submit
C:\defdf8cba70f410218bea74f8fe971\1044\LocalizedData.xml

Filesize
84KB

MD5
b0d9e4dac3935bb596bb83b7d8474f8f

SHA1
29ce971b1a3ccf6f09eced6bff8e778df13f3d35

SHA256
3c309a5509d42e6485e9123bc6af5ec43cf2faa8afead5062676e85ab7f96add

SHA512
af4e4032a3b4a1696a3f252c03c8f5364089320e4181ebccd39d569d7577b11b70b4ae694d4a74e09bb61505664a01733dccb2d80aed64cb7142225dddd997e2

Download Submit
C:\defdf8cba70f410218bea74f8fe971\1045\LocalizedData.xml

Filesize
87KB

MD5
c3a238ffbf2dbb9f758e5c5b33948971

SHA1
56ceb241f3780dc4a9814332f44369188ded3e77

SHA256
2f0beba8a56cccaddfe6e0ecc3130d0efafb7f84cc0fa4e8db9d85c840e24241

SHA512
2def165951b958195a339f8b4a38aba310c428fbf89f0d7e708d44255f3cf59953550f8e4772626aa125e4a2cb3328601b5ca097f5e355423f4d5094cb8155ea

Download Submit
C:\defdf8cba70f410218bea74f8fe971\1046\LocalizedData.xml

Filesize
84KB

MD5
4a892aa3fedbfe5991b6ff46c00af55c

SHA1
421fe8f80432c56d022ff2911c4a5708093184c3

SHA256
aadbd1df74fc82a43f86f1f40d5065a802b2db71652525a78d258fda3197a743

SHA512
9391096ad6c721b50a300f3c8285291086c0f302f77a7edee7283ec8eb7432171edde5998d5c76587c6431eb3c7e5cba176d0c31f6963acd8d954ea9c6a6e619

Download Submit
C:\defdf8cba70f410218bea74f8fe971\1049\LocalizedData.xml

Filesize
86KB

MD5
d46f34e95e94fbfa4cb4a8dcc7ba3211

SHA1
3e2150c9dd44c4b3416051534ccf84968f2737cd

SHA256
a787b2f493c3248991877f61e210bb0231d357d06aa2671917d2ad4e528c9f67

SHA512
c740f7eba5187699b39265ba2238121a20d935d1320c0e344b767d537618cc2954bb7a6bacae12e7121cd1b4bca1ceb84e11bb80a347e7c2c79e87eb899adb7a

Download Submit
C:\defdf8cba70f410218bea74f8fe971\1053\LocalizedData.xml

Filesize
83KB

MD5
cb2e2edf7d7fefde9b3894923407f8c0

SHA1
541ec570f26bb30f4be35f1a87d4ccf6bc660f67

SHA256
874e5d7e45603ad70ca353e8dc6bf42944594f911d17c79be8966dc01d27eb73

SHA512
045fadda432280ec961da53b914adc9d9a31d02140282b3b37e89f01723d64b5659e3c1a61e9344f4440813efb8b932cf45f859b97cfbdc158c0802d70c5ecda

Download Submit
C:\defdf8cba70f410218bea74f8fe971\1055\LocalizedData.xml

Filesize
83KB

MD5
f020b0e38f1295924f1833e77859fc9a

SHA1
17467f2ebb8cbca89119d30b3ba7ae30691921e1

SHA256
8ce790eca06bae1b01f40f732580adea86d4c22b28d1e701e033c6c9983500c2

SHA512
bf01aea04827a46cb60cacf97993b319643e90aca82e1abc2c6750f01de0d638fc1b73931fe80e5441128eba70f364c1000b4ccd053b2e241c0a3916b75d670a

Download Submit
C:\defdf8cba70f410218bea74f8fe971\2052\LocalizedData.xml

Filesize
69KB

MD5
6cc370b95c9f3e3d28315759b496e977

SHA1
09e4aad0a389f0f876d21e132123dbbd83dc1314

SHA256
93e519e8cc173a3f1aa8dd8113ad4a1be0b5b8d40e1d0a1563dba2054b50433a

SHA512
3b2f19f97cb07f5c845d85cee1a0932c19ddd0efc0433e4b6f092e0e7782e9454c6ff43eb54a943e1e85764ca2ce8ff36a239ac319b09fd8042669d24af27f91

Download Submit
C:\defdf8cba70f410218bea74f8fe971\2070\LocalizedData.xml

Filesize
86KB

MD5
5b73409a0f1cbb707cd62a7956bc2f92

SHA1
1ce52fd3746c5bee7a3c3ef5aa8958e44b8761e3

SHA256
193090f4472f1a1c5ed10ab97fa4bf77bd4ff3f172f380ef4a53fef39989159a

SHA512
ecc775f665b7f0a192d04bd372542e3fadf89b47e4cc5373d2597b9df321b386e89f6fa695c0871fd56691be126e16443af91a7da34de018ceb47f90aa30e3f7

Download Submit
C:\defdf8cba70f410218bea74f8fe971\3082\LocalizedData.xml

Filesize
85KB

MD5
e2fc9d2a4fc56b64e3981dd7e0b076d5

SHA1
1660468ac360a0a52f1a84887a9bb9c6ca3c9d8d

SHA256
9e224a5f7a5c83df1ab31743520a05252c3cdcc9e97526264da716166d2b29f9

SHA512
ca9098a09a7450d02bda76f1d64480f27679610441e3df0858b231de4599f53ddf245b69d181d3fdd37ee846eb085dda0ec85cf1825ec2c7f0eaeea8423fefd3

Download Submit
C:\defdf8cba70f410218bea74f8fe971\DHTMLHeader.html

Filesize
15KB

MD5
cd131d41791a543cc6f6ed1ea5bd257c

SHA1
f42a2708a0b42a13530d26515274d1fcdbfe8490

SHA256
e139af8858fe90127095ac1c4685bcd849437ef0df7c416033554703f5d864bb

SHA512
a6ee9af8f8c2c7acd58dd3c42b8d70c55202b382ffc5a93772af7bf7d7740c1162bb6d38a4307b1802294a18eb52032d410e128072af7d4f9d54f415be020c9a

Download Submit
C:\defdf8cba70f410218bea74f8fe971\NetFx451\netfx_Full_GDR_x86.msi

Filesize
904KB

MD5
813dbf717700ec79ce7586dc2fab7148

SHA1
1d25ad52b0fc7c7fc269faddd4f826500e3569a9

SHA256
6e96d285fd9412b5754644cc12c4eeb662d509e0926eb2254f8b57ad3a2d73ca

SHA512
90877d8a266d8928886fb481d66e88ab6b36c8edc9e415f8bebae345f72b144d5989965ea64446c7e847fffec7197518b44db097c2ba9bbc6d473afd0d11ecf0

Download Submit
C:\defdf8cba70f410218bea74f8fe971\ParameterInfo.xml

Filesize
2.7MB

MD5
1d9839d2aa01c91005752000749cf5cf

SHA1
540698e77846d1316c2c15ac858a31bd083ac037

SHA256
3dbf5ef577ea2d96461dcfd31d5be2f3066519a154a5000691e9596ff438d3e7

SHA512
1fc8c30eb287d7048b36bd7133c7665672efef2e674357b55b8d62ea85214e43dfe2ce73b9bc060de91ab8e738949db58b0aea9274c6b86ad141f0fa45f43ede

Download Submit
C:\defdf8cba70f410218bea74f8fe971\Setup.exe

Filesize
119KB

MD5
057ce4fb9c8e829af369afbc5c4dfd41

SHA1
094f9d5f107939250f03253cf6bb3a93ae5b2a10

SHA256
60dd7d10b3f88f1b17e39464bb2d7ca77c9267b846d90cf5728a518a117bd21b

SHA512
cae4df73a5b28863c14a5207fbbe4e0630e71215aa1271fe61117523cc32b8b82cd1ba63f698907fbfeb36d4007bb0f463828025957505cfcbb200f4ed5d3a52

Download Submit
C:\defdf8cba70f410218bea74f8fe971\Setup.exe

Filesize
119KB

MD5
057ce4fb9c8e829af369afbc5c4dfd41

SHA1
094f9d5f107939250f03253cf6bb3a93ae5b2a10

SHA256
60dd7d10b3f88f1b17e39464bb2d7ca77c9267b846d90cf5728a518a117bd21b

SHA512
cae4df73a5b28863c14a5207fbbe4e0630e71215aa1271fe61117523cc32b8b82cd1ba63f698907fbfeb36d4007bb0f463828025957505cfcbb200f4ed5d3a52

Download Submit
C:\defdf8cba70f410218bea74f8fe971\SetupEngine.dll

Filesize
893KB

MD5
f9618535477ddfef9fe8b531a44be1a3

SHA1
c137a4c7994032a6410ef0a7e6f0f3c5acb68e03

SHA256
236bf2b5cf6014b8ee22484afe172ace512cc99dba85080b082d47e9e189ea5c

SHA512
b85ae1a9cc334e9352c51aa94b2c74c6c067957e0e6021f7309a1c194fc64c0c50bb5efeaef7030e8689d75a22798f74cf719366a2fdcce26e23692510bfe064

Download Submit
C:\defdf8cba70f410218bea74f8fe971\SetupUtility.exe

Filesize
304KB

MD5
2a20ff4988db90ae0632d898916950ca

SHA1
f822b12f4efb31a99ec4df9a4d9c9806c55648fa

SHA256
289e23983692bdbd58ab0cb3b1668b5158d90a9937721185a75247a44d0c3243

SHA512
02003b403ec2375b9ee004978d522c91666f4aa642288ead9963ff0e5701d2ab8efa9b3854f13dca8d85cf7b6b2890b000148a24d3565c9e4399b27936b691b0

Download Submit
C:\defdf8cba70f410218bea74f8fe971\SetupUtility.exe

Filesize
304KB

MD5
2a20ff4988db90ae0632d898916950ca

SHA1
f822b12f4efb31a99ec4df9a4d9c9806c55648fa

SHA256
289e23983692bdbd58ab0cb3b1668b5158d90a9937721185a75247a44d0c3243

SHA512
02003b403ec2375b9ee004978d522c91666f4aa642288ead9963ff0e5701d2ab8efa9b3854f13dca8d85cf7b6b2890b000148a24d3565c9e4399b27936b691b0

Download Submit
C:\defdf8cba70f410218bea74f8fe971\SetupUtility.exe

Filesize
304KB

MD5
2a20ff4988db90ae0632d898916950ca

SHA1
f822b12f4efb31a99ec4df9a4d9c9806c55648fa

SHA256
289e23983692bdbd58ab0cb3b1668b5158d90a9937721185a75247a44d0c3243

SHA512
02003b403ec2375b9ee004978d522c91666f4aa642288ead9963ff0e5701d2ab8efa9b3854f13dca8d85cf7b6b2890b000148a24d3565c9e4399b27936b691b0

Download Submit
C:\defdf8cba70f410218bea74f8fe971\UiInfo.xml

Filesize
63KB

MD5
c99059acb88a8b651d7ab25e4047a52d

SHA1
45114125699fa472d54bc4c45c881667c117e5d4

SHA256
b879f9bc5b79349fa7b0bdbe63167be399c5278454c96773885bd70fbfe7c81d

SHA512
b23a7051f94d72d5a1a0914107e5c2be46c0ddee7ca510167065b55e2d1cb25f81927467370700b1cc7449348d152e9562566de501f3ea5673a2072248572e3b

Download Submit
C:\defdf8cba70f410218bea74f8fe971\netfx_Full.mzz

Filesize
217.5MB

MD5
362a8efe7130cbd32414e1f6e9697d78

SHA1
752d2e07043366663ff8a045192e7a2f74754d64

SHA256
e9a20e972c7d2a193279373ec076cea2629d485c70a58d5694c8d1af11765315

SHA512
cb0e0c089453caeeca3dbef27101b90050192d7e6140364abaa1b04a8907fdbe61e93983a2313adc477d818a0f70ee3ccf624d2dcabc6ef12809677d81427d60

Download Submit
C:\defdf8cba70f410218bea74f8fe971\netfx_Full_x64.msi

Filesize
1.7MB

MD5
ae21a58bf369355a47e410d4c12f8268

SHA1
82ee9f591bf02003c9d3402c14017f0e50e58d32

SHA256
605ac363fa1ea76b2a7fe6148c6fdeb3c524570a143771ba0e3edc78f32c8e08

SHA512
d8a5dc4608e3390d307a62986f78a486b021efe9c389b32db889e8b684b96d9f9a122f25533936fc42422ebef195d7d1588b770f3d6d21d89fc668d5b9498a0d

Download Submit
C:\defdf8cba70f410218bea74f8fe971\sqmapi.dll

Filesize
223KB

MD5
0c0e41efeec8e4e78b43d7812857269a

SHA1
846033946013f959e29cd27ff3f0eaa17cb9e33f

SHA256
048d51885874d62952e150d69489bcfb643a5131ce8b70a49f10dfb34832702c

SHA512
e11da01852a92833c1632e121a2f2b6588b58f4f2166339a28dd02dad6af231a2260a7e5fc92e415d05aa65b71e8bbda065e82a2db49bb94b6cf2fe82b646c28

Download Submit
\ProgramData\Package Cache\E322E2E0FB4C86172C38A97DC6C71982134F0570\Packages\dotNET\dotNET48_setup.exe

Filesize
115.7MB

MD5
7d2b599470e34481138444866b7e4ea6

SHA1
e322e2e0fb4c86172c38a97dc6c71982134f0570

SHA256
68c9986a8dcc0214d909aa1f31bee9fb5461bb839edca996a75b08ddffc1483f

SHA512
ffb6c226af4e5c8ffa7210d5115701883abf12a8b1cbae6e08122fb94dd93763468bff5b00060eabef19c147b0a4d8063dde318d2b928ce397c58f7949736c5f

Download Submit
\Windows\Temp\{3BD70326-B360-425B-9936-11B8A92C9D16}\.cr\MatrisSetup 2.5.0.0.exe

Filesize
597KB

MD5
e201342321bd917dfe8f4180857b4ddf

SHA1
e7ccb0ffae9888a4f434f6caec54eac513f3f398

SHA256
0ed9320126326552f5b09bada9984e43a4eec81d78d30636dd0ad3ef72b07634

SHA512
9d9625bdb19aff94f266927e2ff1f38b1f2c518c50d22ffa784195ecbd8011116633faa6f6d88c1d33161fa659c30b2a7c28051ffcd40845e867b1b862ce4b86

Download Submit
\Windows\Temp\{3FBBCDF9-B77A-4508-B6FE-3F29C9CCB809}\.ba\wixstdba.dll

Filesize
184KB

MD5
fe7e0bd53f52e6630473c31299a49fdd

SHA1
f706f45768bfb95f4c96dfa0be36df57aa863898

SHA256
2bea14d70943a42d344e09b7c9de5562fa7e109946e1c615dd584da30d06cc80

SHA512
feed48286b1e182996a3664f0facdf42aae3692d3d938ea004350c85764db7a0bea996dfddf7a77149c0d4b8b776fb544e8b1ce5e9944086a5b1ed6a8a239a3c

Download Submit
\Windows\Temp\{3FBBCDF9-B77A-4508-B6FE-3F29C9CCB809}\.be\MatrisSetup.exe

Filesize
597KB

MD5
e201342321bd917dfe8f4180857b4ddf

SHA1
e7ccb0ffae9888a4f434f6caec54eac513f3f398

SHA256
0ed9320126326552f5b09bada9984e43a4eec81d78d30636dd0ad3ef72b07634

SHA512
9d9625bdb19aff94f266927e2ff1f38b1f2c518c50d22ffa784195ecbd8011116633faa6f6d88c1d33161fa659c30b2a7c28051ffcd40845e867b1b862ce4b86

Download Submit
\defdf8cba70f410218bea74f8fe971\Setup.exe

Filesize
119KB

MD5
057ce4fb9c8e829af369afbc5c4dfd41

SHA1
094f9d5f107939250f03253cf6bb3a93ae5b2a10

SHA256
60dd7d10b3f88f1b17e39464bb2d7ca77c9267b846d90cf5728a518a117bd21b

SHA512
cae4df73a5b28863c14a5207fbbe4e0630e71215aa1271fe61117523cc32b8b82cd1ba63f698907fbfeb36d4007bb0f463828025957505cfcbb200f4ed5d3a52

Download Submit
\defdf8cba70f410218bea74f8fe971\SetupEngine.dll

Filesize
893KB

MD5
f9618535477ddfef9fe8b531a44be1a3

SHA1
c137a4c7994032a6410ef0a7e6f0f3c5acb68e03

SHA256
236bf2b5cf6014b8ee22484afe172ace512cc99dba85080b082d47e9e189ea5c

SHA512
b85ae1a9cc334e9352c51aa94b2c74c6c067957e0e6021f7309a1c194fc64c0c50bb5efeaef7030e8689d75a22798f74cf719366a2fdcce26e23692510bfe064

Download Submit
\defdf8cba70f410218bea74f8fe971\SetupUtility.exe

Filesize
304KB

MD5
2a20ff4988db90ae0632d898916950ca

SHA1
f822b12f4efb31a99ec4df9a4d9c9806c55648fa

SHA256
289e23983692bdbd58ab0cb3b1668b5158d90a9937721185a75247a44d0c3243

SHA512
02003b403ec2375b9ee004978d522c91666f4aa642288ead9963ff0e5701d2ab8efa9b3854f13dca8d85cf7b6b2890b000148a24d3565c9e4399b27936b691b0

Download Submit
\defdf8cba70f410218bea74f8fe971\SetupUtility.exe

Filesize
304KB

MD5
2a20ff4988db90ae0632d898916950ca

SHA1
f822b12f4efb31a99ec4df9a4d9c9806c55648fa

SHA256
289e23983692bdbd58ab0cb3b1668b5158d90a9937721185a75247a44d0c3243

SHA512
02003b403ec2375b9ee004978d522c91666f4aa642288ead9963ff0e5701d2ab8efa9b3854f13dca8d85cf7b6b2890b000148a24d3565c9e4399b27936b691b0

Download Submit
\defdf8cba70f410218bea74f8fe971\sqmapi.dll

Filesize
223KB

MD5
0c0e41efeec8e4e78b43d7812857269a

SHA1
846033946013f959e29cd27ff3f0eaa17cb9e33f

SHA256
048d51885874d62952e150d69489bcfb643a5131ce8b70a49f10dfb34832702c

SHA512
e11da01852a92833c1632e121a2f2b6588b58f4f2166339a28dd02dad6af231a2260a7e5fc92e415d05aa65b71e8bbda065e82a2db49bb94b6cf2fe82b646c28

Download Submit
memory/1440-673-0x00000000009B0000-0x0000000000D1E000-memory.dmp

Filesize
3.4MB

Download
memory/1616-655-0x0000000001310000-0x000000000131A000-memory.dmp

Filesize
40KB

Download