d3e45a2072e77088eae79f771e6d51af30ff9d3154be2f462f788f28d6f1855a

Analysis

max time kernel
460s
max time network
450s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 21:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

pim_installmgr_mathcad.exe
Size

33.0MB
MD5

ba92d786191918c27deb99f33a9dbd90
SHA1

ac1a51b8f00166aeb4321991b59572af3824479f
SHA256

d3e45a2072e77088eae79f771e6d51af30ff9d3154be2f462f788f28d6f1855a
SHA512

cd0ccbde433568f15aab092648658b2ebd075ed0343ceea02782aaa357c995727a84ace1c08a2c4ff74b12b37b71ca91c7be70acd41befb035cdfde9b3ccb6ac
SSDEEP

786432:pY8sAt94hfMAknhrAXc0C5hZqigOtJsZWZPSsPhmjVt:68sA0eAcrAX/C5bjtSCPXJm7

Score

6^/10

discovery persistence

Malware Config

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
49	2520	msiexec.exe
56	2520	msiexec.exe
58	2520	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	setup.exe
File opened (read-only)	\??\V:	setup.exe
File opened (read-only)	\??\Y:	setup.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	setup.exe
File opened (read-only)	\??\K:	setup.exe
File opened (read-only)	\??\M:	setup.exe
File opened (read-only)	\??\S:	setup.exe
File opened (read-only)	\??\T:	setup.exe
File opened (read-only)	\??\W:	setup.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	setup.exe
File opened (read-only)	\??\H:	setup.exe
File opened (read-only)	\??\I:	setup.exe
File opened (read-only)	\??\N:	setup.exe
File opened (read-only)	\??\Z:	setup.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\B:	setup.exe
File opened (read-only)	\??\J:	setup.exe
File opened (read-only)	\??\Q:	setup.exe
File opened (read-only)	\??\L:	setup.exe
File opened (read-only)	\??\P:	setup.exe
File opened (read-only)	\??\U:	setup.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	setup.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\X:	setup.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	setup.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	pim_installmgr_mathcad.exe
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	MathcadPrime.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 1 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	setup.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\connect\css\search.css	setup.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\whatsNewMathcadPrime.html	setup.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\es\Ptc.Controls.Text.resources.dll	msiexec.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\images\example_matrix_factorization_lu32.png	setup.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\images\example_matrix_factorization_lu8.png	setup.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\example_arc_length_and_surf_area.html	setup.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\images\example_explaining_SIUnitsOf33.png	setup.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\images\example_moment_invariants12.gif	setup.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\images\example_time_response_of_digital_filters42.png	setup.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\images\formatting_math15.png	setup.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\pairs\pair811.js	setup.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\axiom\win_nt\x86e_win64\algebra\BTREE.fasl	msiexec.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\images\example_rational_func_regression210.png	setup.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\pairs\pair638.js	setup.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\images\nonlinear_least_squares_fitting4.png	setup.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\images\example_inverse_transform_icfft7.png	setup.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\images\example_median_smoothing8.gif	setup.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\images\example_tools_for_packed_matrices17.gif	setup.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\API\mcp_OMPs.html	setup.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\images\example_canny_edge_detector20.png	setup.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\images\example_cauchy_functions15.png	setup.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\pairs\pair119.js	setup.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\images\example_signal_windowing36.png	setup.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\images\program_operator_2.png	setup.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\images\using_keywords_for_symbolic_operations2.png	setup.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\images\example_symbolic_calculus_II7.png	setup.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\images\mprime.1.0415.40.jpg	setup.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\images\mprime.1.0471.21.jpg	setup.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\axiom\win_nt\x86e_win64\algebra\BINARY.fasl	msiexec.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\images\example_comb_permut0.png	setup.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\images\example_euclidean_distance_transform42.png	setup.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\images\example_using_money_units8.png	setup.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\images\solving_multiple_ODEs_with_solve_blocks14.png	setup.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\chartapp\x86e_win64\obj\coretools_sh.dll	msiexec.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\mkl_def.1.dll	msiexec.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\images\example_binarization_and_quantization0.gif	setup.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\images\symbolic_engine_differences62.png	setup.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\making_assumptions_about_variables.html	setup.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\pairs\pair37.js	setup.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\images\working_with_the_jacobian8.png	setup.exe
File created	C:\Program Files\PTC\DiagnosticTools\text\chinese_cn\PTC_Creo_Render_Studio.xslt	msiexec.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\images\example_siunitsof1.png	setup.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\images\example_tscore12.png	setup.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\example_display_of_int_decimal_results.html	setup.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\images\example_exponential_regression0.gif	setup.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\images\example_linear_prediction27.png	setup.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\pairs\pair503.js	setup.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\axiom\win_nt\x86e_win64\algebra\XRPOLY.fasl	msiexec.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\images\example_sums_and_products16.png	setup.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\images\excel_output_expression_short.png	setup.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\pairs\pair842.js	setup.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\images\example_tools_for_packed_matrices0.gif	setup.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\images\formatting_math6.png	setup.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\example_seed_for_random_numbers.html	setup.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\images\example_hls_hsv_color_systems34.gif	setup.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\images\example_reading_and_writing_data_files10.png	setup.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\images\to_control_the_number_of_decimal_places_in_results4.png	setup.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\images\example_modified_bessel_functions_1st_kind2.png	setup.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\to_add_format_legend_in_chart.html	setup.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\utl-mgd.dll	msiexec.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\images\example_cepstrum_and_complex_cepstrum35.png	setup.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\images\example_correlation_and_partial_autocorrelation43.png	setup.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\images\example_elementwise_phase14.png	setup.exe
File created	C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\images\nonconvergence_of_numerical_evaluation_of_integrals25.png	setup.exe

Drops file in Windows directory 32 IoCs

description	ioc	Process
File created	C:\Windows\Installer\SourceHash{D30CC61A-E841-401C-BF1D-B1BC5100BE8A}	msiexec.exe
File created	C:\Windows\Installer\{D30CC61A-E841-401C-BF1D-B1BC5100BE8A}\PTCIcon.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\{FC38B6C5-11F6-40E6-A8C5-D73D517F54FE}\MathcadPrimeIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4DAA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4F60.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBCE5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI99E9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e588ea4.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{FC38B6C5-11F6-40E6-A8C5-D73D517F54FE}	msiexec.exe
File opened for modification	C:\Windows\Installer\{D30CC61A-E841-401C-BF1D-B1BC5100BE8A}\PTCIcon.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\{D30CC61A-E841-401C-BF1D-B1BC5100BE8A}\QAgent_icon.exe	msiexec.exe
File created	C:\Windows\Installer\{FC38B6C5-11F6-40E6-A8C5-D73D517F54FE}\LicenseWizardIcon	msiexec.exe
File created	C:\Windows\Fonts\MathcadUniMathPrimeItalic.otf	msiexec.exe
File created	C:\Windows\Installer\{FC38B6C5-11F6-40E6-A8C5-D73D517F54FE}\MathcadPrimeIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBD43.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e588ea4.msi	msiexec.exe
File created	C:\Windows\Fonts\MathcadUniMathPrime.otf	msiexec.exe
File opened for modification	C:\Windows\Installer\e588e9f.msi	msiexec.exe
File created	C:\Windows\Installer\{D30CC61A-E841-401C-BF1D-B1BC5100BE8A}\QAgent_icon.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{FC38B6C5-11F6-40E6-A8C5-D73D517F54FE}\ConverterIcon	msiexec.exe
File created	C:\Windows\Installer\e588e9f.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\{FC38B6C5-11F6-40E6-A8C5-D73D517F54FE}\ConverterIcon	msiexec.exe
File created	C:\Windows\Installer\e588ea8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA7A3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB84E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB958.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBC19.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e588ea3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{FC38B6C5-11F6-40E6-A8C5-D73D517F54FE}\LicenseWizardIcon	msiexec.exe

Executes dropped EXE 4 IoCs

pid	Process
1568	setup.exe
4460	MSIBD43.tmp
3664	MathcadPrime.exe
4536	LicenseWizard.exe

Loads dropped DLL 64 IoCs

pid	Process
1568	setup.exe
1568	setup.exe
1568	setup.exe
1568	setup.exe
1568	setup.exe
1568	setup.exe
1568	setup.exe
1568	setup.exe
1568	setup.exe
1568	setup.exe
1568	setup.exe
1568	setup.exe
1568	setup.exe
1568	setup.exe
1568	setup.exe
1568	setup.exe
1568	setup.exe
1568	setup.exe
1568	setup.exe
1568	setup.exe
1568	setup.exe
1568	setup.exe
1568	setup.exe
1568	setup.exe
1568	setup.exe
1568	setup.exe
1568	setup.exe
1568	setup.exe
1568	setup.exe
1568	setup.exe
1568	setup.exe
1568	setup.exe
1568	setup.exe
5056	MsiExec.exe
400	MsiExec.exe
400	MsiExec.exe
400	MsiExec.exe
400	MsiExec.exe
400	MsiExec.exe
3664	MathcadPrime.exe
3664	MathcadPrime.exe
3664	MathcadPrime.exe
3664	MathcadPrime.exe
3664	MathcadPrime.exe
3664	MathcadPrime.exe
3664	MathcadPrime.exe
3664	MathcadPrime.exe
3664	MathcadPrime.exe
3664	MathcadPrime.exe
3664	MathcadPrime.exe
3664	MathcadPrime.exe
4536	LicenseWizard.exe
4536	LicenseWizard.exe
4536	LicenseWizard.exe
4536	LicenseWizard.exe
4536	LicenseWizard.exe
4536	LicenseWizard.exe
4536	LicenseWizard.exe
4536	LicenseWizard.exe
3664	MathcadPrime.exe
3664	MathcadPrime.exe
3664	MathcadPrime.exe
3664	MathcadPrime.exe
3664	MathcadPrime.exe

Registers COM server for autorun 1 TTPs 36 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{7EAB3A35-D5FF-4DDC-B5D5-E1D4366CF566}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3E4E622-5CFF-4973-96EB-1E3EAB5151C8}\InprocServer32\9.0.0.0\Class = "Ptc.MathcadPrime.Automation.ApplicationObsolete"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3E4E622-5CFF-4973-96EB-1E3EAB5151C8}\InprocServer32\Assembly = "Ptc.MathcadPrime.Automation, Version=9.0.0.0, Culture=neutral, PublicKeyToken=null"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3E4E622-5CFF-4973-96EB-1E3EAB5151C8}\InprocServer32\RuntimeVersion = "v4.0.30319"	regasm.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3E4E622-5CFF-4973-96EB-1E3EAB5151C8}\InprocServer32\9.0.0.0	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A00E8B95-D415-433F-A04E-D298A54A7BB7}\LocalServer32	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3E4E622-5CFF-4973-96EB-1E3EAB5151C8}\LocalServer32	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3E4E622-5CFF-4973-96EB-1E3EAB5151C8}\InprocServer32	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3E4E622-5CFF-4973-96EB-1E3EAB5151C8}\InprocServer32\ = "mscoree.dll"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3E4E622-5CFF-4973-96EB-1E3EAB5151C8}\InprocServer32\Class = "Ptc.MathcadPrime.Automation.ApplicationObsolete"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A00E8B95-D415-433F-A04E-D298A54A7BB7}\InprocServer32\Class = "Ptc.MathcadPrime.Automation.Application"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7EAB3A35-D5FF-4DDC-B5D5-E1D4366CF566}\InprocServer32\ServerExecutable = "C:\\Program Files\\PTC\\Mathcad Prime 9.0.0.0\\chartapp\\x86e_win64\\obj\\chartapp.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3E4E622-5CFF-4973-96EB-1E3EAB5151C8}\InprocServer32\9.0.0.0	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A00E8B95-D415-433F-A04E-D298A54A7BB7}\InprocServer32\9.0.0.0\Assembly = "Ptc.MathcadPrime.Automation, Version=9.0.0.0, Culture=neutral, PublicKeyToken=null"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A00E8B95-D415-433F-A04E-D298A54A7BB7}\InprocServer32\ = "mscoree.dll"	regasm.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A00E8B95-D415-433F-A04E-D298A54A7BB7}\InprocServer32\9.0.0.0	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3E4E622-5CFF-4973-96EB-1E3EAB5151C8}\InprocServer32	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3E4E622-5CFF-4973-96EB-1E3EAB5151C8}\LocalServer32\ = "C:\\Program Files\\PTC\\Mathcad Prime 9.0.0.0\\MathcadPrime.exe -EmbeddingObsolete"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7EAB3A35-D5FF-4DDC-B5D5-E1D4366CF566}\LocalServer32\ServerExecutable = "C:\\Program Files\\PTC\\Mathcad Prime 9.0.0.0\\chartapp\\x86e_win64\\obj\\chartapp.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3E4E622-5CFF-4973-96EB-1E3EAB5151C8}\InprocServer32\ThreadingModel = "Both"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A00E8B95-D415-433F-A04E-D298A54A7BB7}\InprocServer32\Class = "Ptc.MathcadPrime.Automation.ApplicationCreatorClass"	regasm.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{7EAB3A35-D5FF-4DDC-B5D5-E1D4366CF566}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A00E8B95-D415-433F-A04E-D298A54A7BB7}\InprocServer32\9.0.0.0\Class = "Ptc.MathcadPrime.Automation.ApplicationCreatorClass"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A00E8B95-D415-433F-A04E-D298A54A7BB7}\InprocServer32\ThreadingModel = "Both"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A00E8B95-D415-433F-A04E-D298A54A7BB7}\InprocServer32\9.0.0.0\Class = "Ptc.MathcadPrime.Automation.Application"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A00E8B95-D415-433F-A04E-D298A54A7BB7}\LocalServer32\ = "C:\\Program Files\\PTC\\Mathcad Prime 9.0.0.0\\MathcadPrime.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3E4E622-5CFF-4973-96EB-1E3EAB5151C8}\InprocServer32\9.0.0.0\Assembly = "Ptc.MathcadPrime.Automation, Version=9.0.0.0, Culture=neutral, PublicKeyToken=null"	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A00E8B95-D415-433F-A04E-D298A54A7BB7}\InprocServer32	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A00E8B95-D415-433F-A04E-D298A54A7BB7}\InprocServer32\RuntimeVersion = "v4.0.30319"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3E4E622-5CFF-4973-96EB-1E3EAB5151C8}\InprocServer32\9.0.0.0\RuntimeVersion = "v4.0.30319"	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A00E8B95-D415-433F-A04E-D298A54A7BB7}\InprocServer32\9.0.0.0	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A00E8B95-D415-433F-A04E-D298A54A7BB7}\InprocServer32\9.0.0.0\RuntimeVersion = "v4.0.30319"	regasm.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A00E8B95-D415-433F-A04E-D298A54A7BB7}\InprocServer32	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7EAB3A35-D5FF-4DDC-B5D5-E1D4366CF566}\InprocServer32\ = "C:\\Program Files\\PTC\\Mathcad Prime 9.0.0.0\\chartapp\\x86e_win64\\obj\\chartapp.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7EAB3A35-D5FF-4DDC-B5D5-E1D4366CF566}\LocalServer32\ = "\"C:\\Program Files\\PTC\\Mathcad Prime 9.0.0.0\\chartapp\\x86e_win64\\obj\\chartapp.exe\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A00E8B95-D415-433F-A04E-D298A54A7BB7}\InprocServer32\Assembly = "Ptc.MathcadPrime.Automation, Version=9.0.0.0, Culture=neutral, PublicKeyToken=null"	regasm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\hardware\description\system\centralprocessor	setup.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	setup.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\identifier	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\vendoridentifier	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	setup.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	regasm.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	regasm.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	regasm.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	regasm.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	regasm.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\23	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\24	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A0ECA09F-83C8-4536-B841-A33D981FBAFA}\ProxyStubClsid32	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A17D73E0-B985-470F-ABA9-D2298799A950}\TypeLib\ = "{A24EB614-A183-400F-8207-1E58D61945D6}"	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A2E041D6-4946-40AD-9AC9-56F0A2FFA3FF}\TypeLib	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A010504B-2FE6-402E-AD27-E24A8DE5C467}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{A6F2972D-1063-4BA4-BCEF-8BE357759897}	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A318D148-5D1D-4DFE-A0DE-A4AE28A4F3C2}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A354B202-81A1-4EC9-A920-1876641ACF26}	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A04DC5F4-5E16-4D82-AF5A-C8A4CA2EAF8C}\ProxyStubClsid32	regasm.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{7EAB3A35-D5FF-4DDC-B5D5-E1D4366CF566}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A00E8B95-D415-433F-A04E-D298A54A7BB7}\ = "Ptc.MathcadPrime.Automation.Application"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A24EB614-A183-400F-8207-1E58D61945D6}\9.0\0\win64\ = "C:\\Program Files\\PTC\\Mathcad Prime 9.0.0.0\\Ptc.MathcadPrime.Automation.tlb"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A31F2589-4FAD-4CA4-AB33-49672071CF29}\TypeLib\ = "{A24EB614-A183-400F-8207-1E58D61945D6}"	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A9E81270-B96E-4AD0-9037-9D4BFD11CCC1}\ProxyStubClsid32	regasm.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A00E8B95-D415-433F-A04E-D298A54A7BB7}\InprocServer32\9.0.0.0	reg.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{3087019E-28D3-46D6-B98A-CFA086BE642A}\1.0\0\win64	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{AF5935B2-9625-4639-8E46-6B9127CEA00D}\9.0.0.0	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A170C6A4-3DEB-43A7-A5C4-9164EF85D1C2}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A31F2589-4FAD-4CA4-AB33-49672071CF29}\TypeLib	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A317A530-6337-4309-8F1C-C155488EFE96}\ProxyStubClsid32	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A17F8C1D-A683-488D-AE43-3B0860FB5B2F}\TypeLib	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A010504B-2FE6-402E-AD27-E24A8DE5C467}\ = "IMathcadPrimeApplication3"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mctx\Content Type = "application/x-mathcad-mctx"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7EAB3A35-D5FF-4DDC-B5D5-E1D4366CF566}\ToolboxBitmap32\ = "C:\\Program Files\\PTC\\Mathcad Prime 9.0.0.0\\chartapp\\x86e_win64\\obj\\chartapp.exe, 1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A00E8B95-D415-433F-A04E-D298A54A7BB7}\ProgId\ = "MathcadPrime.Application"	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A170C6A4-3DEB-43A7-A5C4-9164EF85D1C2}\ProxyStubClsid32	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A31F2589-4FAD-4CA4-AB33-49672071CF29}\ = "IMathcadPrimeInputResult"	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A72DE956-7106-4921-BFE0-90FCBE0DCA5B}\ProxyStubClsid32	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A11258FF-2491-480C-9E3B-EBBF08AF1B72}\TypeLib\ = "{A24EB614-A183-400F-8207-1E58D61945D6}"	regasm.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MathcadPrime.exe\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MathcadPrime.ApplicationObsolete\CLSID\ = "{A3E4E622-5CFF-4973-96EB-1E3EAB5151C8}"	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A010504B-2FE6-402E-AD27-E24A8DE5C467}\TypeLib	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A31F2589-4FAD-4CA4-AB33-49672071CF29}\ProxyStubClsid32	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A3C56254-B233-48CD-86F7-5D8CE19A7097}\ = "IMathcadPrimeOutputMatrixResult"	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB5A25C9-8DFA-4F90-8C9F-FC297F3EDDB2}	regasm.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MathcadPrime.exe	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{33F66BD7-0C5C-497F-B295-BE4C48FAE2C0}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6EB629A-AE39-4902-AFA8-76E1EFE632B6}\ = "IMathcadPrimeGetValueResult"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A3D8B0C9-9468-4650-804F-BF6D08297DE4}\TypeLib\ = "{A24EB614-A183-400F-8207-1E58D61945D6}"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A2E041D6-4946-40AD-9AC9-56F0A2FFA3FF}\ = "IMathcadPrimeWorksheets"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7EAB3A35-D5FF-4DDC-B5D5-E1D4366CF566}\InprocHandler32\ = "ole32.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{A0ECE3EF-0E9F-4F71-BB94-D3F082B8E0D0}\9.0.0.0	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{A07B4F49-17EB-4908-AB8F-C78478154541}\9.0.0.0	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A0ECA09F-83C8-4536-B841-A33D981FBAFA}	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A317A530-6337-4309-8F1C-C155488EFE96}\TypeLib\Version = "9.0"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A72DE956-7106-4921-BFE0-90FCBE0DCA5B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A17D73E0-B985-470F-ABA9-D2298799A950}\ProxyStubClsid32	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A3C56254-B233-48CD-86F7-5D8CE19A7097}\TypeLib\ = "{A24EB614-A183-400F-8207-1E58D61945D6}"	regasm.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MIME\Database\Content Type\application/x-mathcad-mctx	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A17F8C1D-A683-488D-AE43-3B0860FB5B2F}\ = "IMathcadPrimeWorksheet"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A11258FF-2491-480C-9E3B-EBBF08AF1B72}\ = "IMathcadPrimeWorksheetReadonlyOptions"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A027C8B4-F77A-4B1E-BE41-8B76FC865F25}\TypeLib\ = "{A24EB614-A183-400F-8207-1E58D61945D6}"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A354B202-81A1-4EC9-A920-1876641ACF26}\TypeLib\Version = "9.0"	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A3D8B0C9-9468-4650-804F-BF6D08297DE4}\TypeLib	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A04DC5F4-5E16-4D82-AF5A-C8A4CA2EAF8C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7EAB3A35-D5FF-4DDC-B5D5-E1D4366CF566}\MiscStatus	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0BC1AAF1-4482-4137-9C02-1573F772C866}\TypeLib\Version = "1.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB9C0902-3570-4697-89B4-F3887C6E978F}\TypeLib\ = "{A24EB614-A183-400F-8207-1E58D61945D6}"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB9C0902-3570-4697-89B4-F3887C6E978F}\ = "IMathcadPrimeInputsOutputsConflicts"	regasm.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{7EAB3A35-D5FF-4DDC-B5D5-E1D4366CF566}\VersionIndependentProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{AF5935B2-9625-4639-8E46-6B9127CEA00D}\9.0.0.0\Class = "Ptc.MathcadPrime.Automation.ValueResultTypes"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6EB629A-AE39-4902-AFA8-76E1EFE632B6}\ = "IMathcadPrimeGetValueResult"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A3C56254-B233-48CD-86F7-5D8CE19A7097}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A3740C2B-8863-420B-8AFC-086488EE7DBF}\TypeLib\Version = "9.0"	regasm.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8	MathcadPrime.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 040000000100000010000000e94fb54871208c00df70f708ac47085b0f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c0b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000006200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df8653000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c01400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b1d00000001000000100000005467b0adde8d858e30ee517b1a19ecd909000000010000000c000000300a06082b060105050703030300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b81900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b4200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82	MathcadPrime.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 5c0000000100000004000000001000001900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b40300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b809000000010000000c000000300a06082b060105050703031d00000001000000100000005467b0adde8d858e30ee517b1a19ecd91400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b53000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df860b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000000f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c040000000100000010000000e94fb54871208c00df70f708ac47085b200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82	MathcadPrime.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2520	msiexec.exe
2520	msiexec.exe
2520	msiexec.exe
2520	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1568	setup.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1712	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1712	msiexec.exe
Token: SeSecurityPrivilege	2520	msiexec.exe
Token: SeCreateTokenPrivilege	1712	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1712	msiexec.exe
Token: SeLockMemoryPrivilege	1712	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1712	msiexec.exe
Token: SeMachineAccountPrivilege	1712	msiexec.exe
Token: SeTcbPrivilege	1712	msiexec.exe
Token: SeSecurityPrivilege	1712	msiexec.exe
Token: SeTakeOwnershipPrivilege	1712	msiexec.exe
Token: SeLoadDriverPrivilege	1712	msiexec.exe
Token: SeSystemProfilePrivilege	1712	msiexec.exe
Token: SeSystemtimePrivilege	1712	msiexec.exe
Token: SeProfSingleProcessPrivilege	1712	msiexec.exe
Token: SeIncBasePriorityPrivilege	1712	msiexec.exe
Token: SeCreatePagefilePrivilege	1712	msiexec.exe
Token: SeCreatePermanentPrivilege	1712	msiexec.exe
Token: SeBackupPrivilege	1712	msiexec.exe
Token: SeRestorePrivilege	1712	msiexec.exe
Token: SeShutdownPrivilege	1712	msiexec.exe
Token: SeDebugPrivilege	1712	msiexec.exe
Token: SeAuditPrivilege	1712	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1712	msiexec.exe
Token: SeChangeNotifyPrivilege	1712	msiexec.exe
Token: SeRemoteShutdownPrivilege	1712	msiexec.exe
Token: SeUndockPrivilege	1712	msiexec.exe
Token: SeSyncAgentPrivilege	1712	msiexec.exe
Token: SeEnableDelegationPrivilege	1712	msiexec.exe
Token: SeManageVolumePrivilege	1712	msiexec.exe
Token: SeImpersonatePrivilege	1712	msiexec.exe
Token: SeCreateGlobalPrivilege	1712	msiexec.exe
Token: SeRestorePrivilege	2520	msiexec.exe
Token: SeTakeOwnershipPrivilege	2520	msiexec.exe
Token: SeRestorePrivilege	2520	msiexec.exe
Token: SeTakeOwnershipPrivilege	2520	msiexec.exe
Token: SeRestorePrivilege	2520	msiexec.exe
Token: SeTakeOwnershipPrivilege	2520	msiexec.exe
Token: SeRestorePrivilege	2520	msiexec.exe
Token: SeTakeOwnershipPrivilege	2520	msiexec.exe
Token: SeRestorePrivilege	2520	msiexec.exe
Token: SeTakeOwnershipPrivilege	2520	msiexec.exe
Token: SeRestorePrivilege	2520	msiexec.exe
Token: SeTakeOwnershipPrivilege	2520	msiexec.exe
Token: SeRestorePrivilege	2520	msiexec.exe
Token: SeTakeOwnershipPrivilege	2520	msiexec.exe
Token: SeRestorePrivilege	2520	msiexec.exe
Token: SeTakeOwnershipPrivilege	2520	msiexec.exe
Token: SeRestorePrivilege	2520	msiexec.exe
Token: SeTakeOwnershipPrivilege	2520	msiexec.exe
Token: SeRestorePrivilege	2520	msiexec.exe
Token: SeTakeOwnershipPrivilege	2520	msiexec.exe
Token: SeRestorePrivilege	2520	msiexec.exe
Token: SeTakeOwnershipPrivilege	2520	msiexec.exe
Token: SeRestorePrivilege	2520	msiexec.exe
Token: SeTakeOwnershipPrivilege	2520	msiexec.exe
Token: SeRestorePrivilege	2520	msiexec.exe
Token: SeTakeOwnershipPrivilege	2520	msiexec.exe
Token: SeRestorePrivilege	2520	msiexec.exe
Token: SeTakeOwnershipPrivilege	2520	msiexec.exe
Token: SeRestorePrivilege	2520	msiexec.exe
Token: SeTakeOwnershipPrivilege	2520	msiexec.exe
Token: SeRestorePrivilege	2520	msiexec.exe
Token: SeTakeOwnershipPrivilege	2520	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1568	setup.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4344 wrote to memory of 1568	4344	pim_installmgr_mathcad.exe	89
PID 4344 wrote to memory of 1568	4344	pim_installmgr_mathcad.exe	89
PID 1568 wrote to memory of 1712	1568	setup.exe	97
PID 1568 wrote to memory of 1712	1568	setup.exe	97
PID 1568 wrote to memory of 956	1568	setup.exe	100
PID 1568 wrote to memory of 956	1568	setup.exe	100
PID 2520 wrote to memory of 5056	2520	msiexec.exe	101
PID 2520 wrote to memory of 5056	2520	msiexec.exe	101
PID 2520 wrote to memory of 5056	2520	msiexec.exe	101
PID 5056 wrote to memory of 3640	5056	MsiExec.exe	102
PID 5056 wrote to memory of 3640	5056	MsiExec.exe	102
PID 2520 wrote to memory of 400	2520	msiexec.exe	105
PID 2520 wrote to memory of 400	2520	msiexec.exe	105
PID 2520 wrote to memory of 400	2520	msiexec.exe	105
PID 400 wrote to memory of 3276	400	MsiExec.exe	106
PID 400 wrote to memory of 3276	400	MsiExec.exe	106
PID 400 wrote to memory of 4672	400	MsiExec.exe	108
PID 400 wrote to memory of 4672	400	MsiExec.exe	108
PID 400 wrote to memory of 500	400	MsiExec.exe	110
PID 400 wrote to memory of 500	400	MsiExec.exe	110
PID 400 wrote to memory of 4708	400	MsiExec.exe	112
PID 400 wrote to memory of 4708	400	MsiExec.exe	112
PID 400 wrote to memory of 4260	400	MsiExec.exe	114
PID 400 wrote to memory of 4260	400	MsiExec.exe	114
PID 2520 wrote to memory of 4460	2520	msiexec.exe	116
PID 2520 wrote to memory of 4460	2520	msiexec.exe	116
PID 3664 wrote to memory of 4536	3664	MathcadPrime.exe	121
PID 3664 wrote to memory of 4536	3664	MathcadPrime.exe	121

C:\Users\Admin\AppData\Local\Temp\pim_installmgr_mathcad.exe
"C:\Users\Admin\AppData\Local\Temp\pim_installmgr_mathcad.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4344
- C:\Users\Admin\AppData\Local\Temp\7zS8F096737\setup.exe
  "C:\Users\Admin\AppData\Local\Temp\7zS8F096737\setup.exe" -mathcad -applications mathcad.xml:mathcadpdsi.xml:qualityagent.xml
  2⤵
  - Enumerates connected drives
  - Checks system information in the registry
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1568
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /qn /I "C:\Users\Admin\AppData\Roaming\PTC Download\MED-60893-CD-290_9-0-0-0\install\addon\qualityagent_64.msi" INSTALLDIR="C:\Program Files\PTC\DiagnosticTools"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1712
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /qn /norestart /I "C:\Users\Admin\AppData\Roaming\PTC Download\MED-60893-CD-290_9-0-0-0\ptcsh0\PrimeWixInstaller_64bit.msi" INSTALL_STANDALONE_WORKSHEET_CONVERTER=false /lv "C:\Users\Admin\Documents/pim_prime_msi.log" INSTALLDIR="C:\Program Files\PTC\Mathcad Prime 9.0.0.0"
    3⤵
    PID:956

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Registers COM server for autorun
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2EE59F44F6A2BD0257BF9E1AF65F2D6B
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:5056
- - C:\Windows\System32\reg.exe
    "C:\Windows\\System32\reg.exe" add "HKCU\Software\PTC\Mathcad Prime\Mathcad Prime 1.0\Addons" /f
    3⤵
    PID:3640
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 972CF6B581FD2D7B1EC89985EECF17C2 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:400
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe
    "C:\Windows\\Microsoft.NET\Framework64\v4.0.30319\regasm.exe" "C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Ptc.MathcadPrime.Automation.dll" /tlb: "C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Ptc.MathcadPrime.Automation.tlb"
    3⤵
    - Registers COM server for autorun
    - Modifies data under HKEY_USERS
    - Modifies registry class
    PID:3276
- - C:\Windows\System32\reg.exe
    "C:\Windows\\System32\reg.exe" delete HKCR\CLSID\{A00E8B95-D415-433F-A04E-D298A54A7BB7}\InprocServer32 /f
    3⤵
    - Registers COM server for autorun
    - Modifies registry class
    PID:4672
- - C:\Windows\System32\reg.exe
    "C:\Windows\\System32\reg.exe" delete HKCR\CLSID\{A3E4E622-5CFF-4973-96EB-1E3EAB5151C8}\InprocServer32 /f
    3⤵
    - Registers COM server for autorun
    PID:500
- - C:\Windows\System32\reg.exe
    "C:\Windows\\System32\reg.exe" add HKCR\CLSID\{A00E8B95-D415-433F-A04E-D298A54A7BB7}\LocalServer32 /ve /t REG_SZ /d "C:\Program Files\PTC\Mathcad Prime 9.0.0.0\MathcadPrime.exe" /f
    3⤵
    - Registers COM server for autorun
    PID:4708
- - C:\Windows\System32\reg.exe
    "C:\Windows\\System32\reg.exe" add HKCR\CLSID\{A3E4E622-5CFF-4973-96EB-1E3EAB5151C8}\LocalServer32 /ve /t REG_SZ /d "C:\Program Files\PTC\Mathcad Prime 9.0.0.0\MathcadPrime.exe -EmbeddingObsolete" /f
    3⤵
    - Registers COM server for autorun
    PID:4260
- C:\Windows\Installer\MSIBD43.tmp
  "C:\Windows\Installer\MSIBD43.tmp" CreateAppDataFolders "PTC" "Mathcad Prime"
  2⤵
  - Executes dropped EXE
  PID:4460

C:\Program Files\PTC\Mathcad Prime 9.0.0.0\MathcadPrime.exe
"C:\Program Files\PTC\Mathcad Prime 9.0.0.0\MathcadPrime.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Program Files\PTC\Mathcad Prime 9.0.0.0\LicenseWizard.exe
  "C:\Program Files\PTC\Mathcad Prime 9.0.0.0\LicenseWizard.exe" /culture:en-US /hostId:46-40-DA-9D-21-C7 /l:trial
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e588ea2.rbs

Filesize
70KB

MD5
1722c5c476725e253475a3a2ce906e72

SHA1
5dc8534428f1b98190add1ba310c6629795f9b98

SHA256
05aff01c5c3c132bd31f605f9ebc5c8144dbf5ada70f935a7da2d63968d9afd5

SHA512
26518b5d65d2f3d93f4f332b41effbadbbb55b357a898848bd6975376e24d1fe50f6b68a541cb04fd7bfedaada34eda09c12688e4dd1a9986545ee2653429ae2

Download Submit
C:\Config.Msi\e588ea7.rbs

Filesize
242KB

MD5
474b7f9a6ac6850582c98d3e77e39084

SHA1
f921fa97bdd017563b2ac2aa522c7e12463564be

SHA256
e2f348949cfa81e786101645566849fa1a2bb2d00972b65ebca66fa5aa6861e5

SHA512
b35331102e500a4d110e499a406b43200d68e2b5b2a30c15e0eabce2cf0ffaf86664a789701d3959293268a27bc2c7397a23ba15148f7d90ff49c23def9e9824

Download Submit
C:\Program Files\PTC\DiagnosticTools\text\portuguese_br\PTC_Windchill_Workgroup_Manager_11_2.xslt

Filesize
9KB

MD5
34f92b29697abd6795907145d91847a1

SHA1
98bbaa571dac9f4e4113f92dc23a6722fabeb58e

SHA256
23c90f260c0231bd577454967bd6e4b091dba1a4c81dcf90fa34210fe512f211

SHA512
23bb453b241ca3b8d2e241583f33fad3868f0b7170c8e28ebda27e94e6498679169b6b8c77ac67437cd6d9360d242b14d98aecb0748d0bfac71ce0587342e798

Download Submit
C:\Program Files\PTC\DiagnosticTools\text\spanish\PTC_Windchill_Workgroup_Manager_11_2.xslt

Filesize
9KB

MD5
0c512b0933b7c06065aecaed7ea5ee22

SHA1
29e0ba7e85837a4816e1a6d1bfcf13f6c6dea867

SHA256
45ae0e59562b848049f1afb67be778d64a75ac681f8ac0456e1d30be5acdef74

SHA512
183883f17b624cfa141e96a4dac73e841093e0316fab6164d1ce48441d170229a3a7604d43b2877a9a6ba7343984ce2c545dd15e3baee8f263e18244e87cf482

Download Submit
C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Doc\it\read_this_first.pdf

Filesize
175KB

MD5
78b145af3287a368ca39deb5d4de6940

SHA1
8085efb6fbffcd86ea16b3ce56a9ba6c247f3e5c

SHA256
7bc8777f3e741a055790f42da30b713b1135bf22120c7cef9f07a6883a7d72ab

SHA512
753f67339e393ccb9ec89bc27d1013d03f9f9c8a68096a4bf32d1f74e17d76fc8bae71a34647ab2d272380a8551ebd4464fa652be85bc5c0b6fd8381b1b0f6ee

Download Submit
C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\images\Using_the_Substitute_Keyword8.png

Filesize
803B

MD5
547c4a48fee30bc4da2cc3196ff0096a

SHA1
ac57505c4843f21419ad5e9636f83b3a14609039

SHA256
33bd3cd2e10571de23a3861ade5582b1d83d051549ddd5d0a29a95262e89c166

SHA512
99c673b8ac21d59d472eae706ed82319202b8d59353b9e928f8cb4e0b8287a6f4ae4070e0f78b8027227c195233c8c2e46055a324098d53082062ed3d8baafd9

Download Submit
C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\images\example_effect_of_tol_on_lookup_functions52.png

Filesize
1KB

MD5
efc8acbaf390058e99fb9185f5a32b67

SHA1
83bed61140fd27fafe0fe68facfd803af0fbc943

SHA256
9043638a9c1670c302468db447777aa37acc3f6b651a8084f93070e5399ada93

SHA512
4fbc2b370cc46cb38512ca6fc0b785b907f8c00c84bad9ffeca351c6e65c883964763326a3d4d15f8717370deb9b50c312d2fa6a7ee65a3f74a9231113166b1a

Download Submit
C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\images\example_filtering_in_the_frequency_domain1.png

Filesize
1KB

MD5
998113c62a0ca1da9445933202e25a9d

SHA1
e4e172963df1f675d101b76052872f86a9b9ed56

SHA256
1792b846c26fe17beccb201b60dca94205c23d803cb32c2d803e8ed6d729993a

SHA512
d27451db41d1bc65eafdf33a9748b697d130a9ae2ebd85a25b4f88bd30e935ef51e7c142d4fadcf1f9fd185158dfa63957e8eeb4a8df7ee717f2d6026f26ac22

Download Submit
C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\images\example_interpolation_and_sampling2.png

Filesize
893B

MD5
e6b4be4e033fb2e6de04bcd1a4b19015

SHA1
83daf0f6748af580d74d7553b98bb941bc67d8da

SHA256
d287650e30254e25aa70a0a9d9a5ec0623446a1ae823dd3700435fe9740e7d1f

SHA512
f106e8e98bd3953a99070e275064c745f788c2a907043c8542388d4157ee785d51ee92b34b90982e5d5ac3eeb4409659f13d5ac6843d2d686b58c4a9325c0b87

Download Submit
C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\images\example_plotting_large_data_sets_using_3D_plots0.png

Filesize
1KB

MD5
cee2464d2994bacb7bcadb84c6131d42

SHA1
c74af490f7b12707f28fdd9fcd9c93656fbf8dd4

SHA256
49c626b469decd8ded3f60ddee16c6ed32736de6adce778bb7009df77957b060

SHA512
f9e0f73f17c9a48491f1e0cd3e7e07ffe2087b9c8efa4bfdd0cee4afbf7a7b81a9bda17cc9238a2b43ae6a36ee810cccb3f7688f9c65ee7fcf1629400bc040b9

Download Submit
C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\images\example_row_and_column_gradients4.gif

Filesize
5KB

MD5
4cd34395a88adf4ca8857fbfdd8aa9bf

SHA1
3b0b6cc4580e0b0e67547d5661d96530bf363f8b

SHA256
d9f82482e16254c8143da8971c92131484930bd20ed2dbc01aa524fd5745774b

SHA512
86fc2bafa7f23aa3aaf16be03d3e5a023c6cf33d8b704ca90aa1fc97d394d58d1a5a00b25e7c688a1b06f71d1b65d5755fc9ee2f7fcf4d0c25972c6820b6e106

Download Submit
C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\images\example_spectral_analysis1.png

Filesize
1KB

MD5
e6b6f24b812c829d60cf4beae58abb50

SHA1
b9029cb5fa143f268c7f6068e9f4bce4368ecde2

SHA256
d0cf64032819783a5b0cc9fe19f5d2c43ac934b33d261dbd8052aa4a6f0f82a5

SHA512
150228c255334501ff36a86937b59d047d84d7985d080b752c768468e6ad7aeb847c64442cabba51b4e92842e04cbe52962c3e4c295b6643aabe3ca339811e2f

Download Submit
C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\images\example_symbolic_solutions_of_equations6.png

Filesize
641B

MD5
fc45d3e763f80bf4628143ff5634c716

SHA1
6fb4c18a7c4455f2a037072e85c10f5981177cf0

SHA256
c9c0bb4a579cc8658345ec8ae86e1a6eb17d413af78e7b09051e461b11757a30

SHA512
4e8f791ec0f2de7f3ba7e3a41a57c16b550c8c38a0ca86b4641493a182021b092a692942ad0b24f3163dd88ee4d6db42378b149537ddd068fcdb6bed1fc3a5d4

Download Submit
C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\images\example_symbolic_solutions_of_equations7.png

Filesize
789B

MD5
4187bc3c915c60db6c3d5ce2c1d607f0

SHA1
412020cf856a9c2b2f5f3e8d9f827d6582efb82b

SHA256
4a96364cfe8d1e354ea9154f16d4edca0d953b0b95d141d51b47d4396ceb8ba6

SHA512
6cd3b8b325afeba8c5a59cbc99f6525357855a768f14762f2566f26d838ce00cc164a61d0883cab61a7b478060e2d75086a67ccb49077bf646461bbdf862da37

Download Submit
C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\images\example_zooming_and_scaling0.gif

Filesize
2KB

MD5
f8883fa8b42f528bf13cb497f7bfd2f8

SHA1
3ecc883b8d6e7de6e1dd50571ffb0e3d5158f55a

SHA256
9134e6611b181299f821b989a7c393d97f9e8696deb9cb73b71654fdb3f7383c

SHA512
07cbb4ed1192f810d56979e9338f8599d0f0ab8ca8b9ae8f0058a23243f79a41e3e081c9a335c2b12f1518320876637c86ac7b9731efd4ca778b3ad097e53027

Download Submit
C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\images\mprime.1.0473.01.jpg

Filesize
5KB

MD5
187a8281b05441304a64fabcb3dcfc2e

SHA1
c2b994fabaacbe6a1b56d5c8723350e73af0440b

SHA256
e02f22cb1a127387983cce073b8ae2cd19904d42554e41845549b9d9e7aadf67

SHA512
b5c3fb86daedbba9567336ec5f9f7a5ec5d4129bcc678318afb818c90efd64da723bf3747e495d9baf6c67d50e7114d29f61b32e31004f272127164e332367b8

Download Submit
C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Help\en\PTC_Mathcad_Help\images\nonconvergence_of_numerical_evaluation_of_integrals5.png

Filesize
775B

MD5
9e3a6775c0994733b9dfcb107e1e4559

SHA1
c0bfefb2b0c556bdc781df88c753ed8599f39e3d

SHA256
c66f7f6a03b8933c3a33a0c9a6d74c3aa8965b11734a9e8eb4faa950df57be0a

SHA512
26683f41fe8a67ef09273ff7d86e5de8dacc42d3a07b8516a57fcb4980366a28a3a8eb11ce52833059ab964a6bb98b6cb61b1b4705dd79b885f39d2c1a091d03

Download Submit
C:\Program Files\PTC\Mathcad Prime 9.0.0.0\LicenseWizard.exe

Filesize
127KB

MD5
90e1ef9e403d3166762b48694e1a2393

SHA1
1b1c93734a6fcccd26275352fe8ed02cb43cabf9

SHA256
8d84935d2efa06e3713645dc6dd30b0db80571c61bc403f06b8348fff58405a4

SHA512
8187f3893df86152ffc8573ea371b65d4a5c0fb725dbdf90fffb808775b58548220b7a312816332b8f61f39f9fe04fa3f699c0a95942416ff9f091d2af72d186

Download Submit
C:\Program Files\PTC\Mathcad Prime 9.0.0.0\MathcadPrime.exe

Filesize
425KB

MD5
af02128a8e98ae3bcb3588c64db0782c

SHA1
4e5cce9b22c5f89353b2edc99aa773eea74893e4

SHA256
32d93ebc962aaa85d3a16e73db42d506a1c2dd530e01f33a1637fea3aca4e670

SHA512
ae643b7be5db6ead529ac106980f702c3865cf7eb3ab69345c1d0d3ecba64fc4a52ddaeb329e396a9a036f913adf7d27057fc5c5ad1e0b091cb12bc6db391643

Download Submit
C:\Program Files\PTC\Mathcad Prime 9.0.0.0\Misc\contact.vcf

Filesize
8KB

MD5
3e1b230cf151d8f276041b8f1e96d6ba

SHA1
6fbbfaf5cf38a6b4d13863ce39fd1c1774a5f9fd

SHA256
2019d9992bcb01d78d06578b20dd2d54c6c856e3b46c4859f2a44a32c13979f2

SHA512
97364a87bfeae64a27c86e74bd5f80ecac99ecd78ad1f708e81985b0183d34594914d9de9ba8f231a774877848275879099f3039120cab2751370232fc0cd04c

Download Submit
C:\Program Files\PTC\Mathcad Prime 9.0.0.0\bin\pim\xml\mathcad.p.xml

Filesize
11KB

MD5
8add4eb66358af4b110e3e7f5d2d5347

SHA1
c770f70c132983654cbf16a38750f75bce487271

SHA256
1fc87885682be7443574ae11b319ca258d841b04ddd1eff849c1a76b1ec6e099

SHA512
f2ea3a452752f81abe2e5ced2eccff1054fbd658b9cfa27cdd4083e8673a7fb9eee6c46064ff28a4ad89f4716dc6dacc0df199e6ee7487e76f916b03b174a36b

Download Submit
C:\Users\Admin\AppData\Local\PTC\MathcadPrime.exe_Url_gbop2sqkbrvaa4kged3qi3qilhouztw5\9.0.0.0\bvd0sq30.newcfg

Filesize
688B

MD5
a720460d7daff01e86d1d2bcabedf76e

SHA1
16dffe5ad919d55daea2bf9ac536abcb5f989fd8

SHA256
4ab7dd2f6147c6248b7eec705097237fc098130405e652d1b4b4f2b241e05dde

SHA512
732baa6379781dcfb85c681ac9240c8a7831da6d85cfccd6e18617ad0a7fa38a5833c07d0ed6db1e19617f9c2cbce5ec03697ddd65955caaca20a2e1d15ce8a3

Download Submit
C:\Users\Admin\AppData\Local\PTC\MathcadPrime.exe_Url_gbop2sqkbrvaa4kged3qi3qilhouztw5\9.0.0.0\rgdg3225.newcfg

Filesize
507B

MD5
7de86814216dc64cec11f3a930fdf327

SHA1
8f2a57d61fd53541691547e07c0753143d4b3984

SHA256
90874cb48047681d0cdf7134d8f6711a72d3a0bda1f46977cc8a3b9ce7c96ccf

SHA512
150bd66cb4cb6d97809680eedb173c4422f20cede157a8405acd9e6ae01b61aa67475b541a3e3e4351f958917c0d7b140585982bc750848624f603b4bebb080e

Download Submit
C:\Users\Admin\AppData\Local\PTC\MathcadPrime.exe_Url_gbop2sqkbrvaa4kged3qi3qilhouztw5\9.0.0.0\user.config

Filesize
911B

MD5
7841394d19422251da668dee7e17e426

SHA1
76acb17ff3ce372b54951e0a75046f2557dd3239

SHA256
e7e7ad514fbedf7702c7283afba8960f6cab58c5d62157f0555b279bcfb6d872

SHA512
eec294ea7e6e39ce98504fbf444373718c98ec0d4b080b3bbd8d8b2654e545322f6ca06ee28fdd0e9e65851cd56bf7a3a8647322c9405020da0860eabc705edb

Download Submit
C:\Users\Admin\AppData\Local\PTC\MathcadPrime.exe_Url_gbop2sqkbrvaa4kged3qi3qilhouztw5\9.0.0.0\user.config

Filesize
320B

MD5
16242b467c15f7ba87d4b26d67c21716

SHA1
efe34c2877ada6c489246036b6c090f242890e96

SHA256
78b6d70e0998658258fd0ff4df709f9bf3a20a5ad30f71d3bfed9ac2cd3bfc37

SHA512
2a123b2c5111cc070851c3d35916aa5290b885a8ed0c2441eb41e2997f51a0728dccc0ce4aec71413c05727feec003bf966f291f2711b4d899f1329c561ad0a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F096737\pim\text\compiled_resource\creo4.sdf

Filesize
140KB

MD5
68d23d043d18f78431c69049959a528a

SHA1
f3c46c482bdc88f600667b00d1ba8eea45b3362f

SHA256
d9261ac6dba894fb68b6a912cfe728d8a4b09c587a6f4b61643a61cd8c5f8702

SHA512
45970e92864d6f8a2db67f2ef6121b91fb76c395ca694bb7f49d4f6606c9d4540c5fce9d552d5e033475ea827849a21ca556d214533cd08f7bfa975650291762

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F096737\pim\text\french\pim.ndx

Filesize
60B

MD5
b4eec82250c2e23a39a23814d8b35ba1

SHA1
4d83ecac16145a579577fb784a6f9c4bd8167637

SHA256
b2769cc150c2ca6b48d92307dc2220b9bb766779a0c8bba81e5626bce89d82fd

SHA512
65f18cbf4386012486144fe8ac389e425857f588e6a93a767a6d158023ec848f4989680b6810957041ad7a4f189210e6ab45e9b53f3895c13c498a9d6bfc0da6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F096737\pim\text\french\pim_install_guide.pdf

Filesize
1.2MB

MD5
9f27847dc0546f66a76a583ae870aa5f

SHA1
8c1cd54472d3fc8305f0752fb1e0b0ed21d5e7c9

SHA256
90030a3425107d23e42ebf3b003b85eedce127dc582b362667223630c06dd900

SHA512
c8c05e2bb114b2b733818de9794a69e1ada8449dc0b2badb68cfc1ae4467b00dbc48e2a6f2c308023c30176d1c0617459c4bb0d17a0cdd4952cba0ca58bf2603

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F096737\pim\text\license.res

Filesize
50KB

MD5
b8511fe0316a9033186f4d76a5d860c4

SHA1
5565c499d7263018e457671d6bce69d2bfd10b0a

SHA256
a917c74e7b787b6dff7a3fa4252f7d2dcd85c2d9c5af59d0bc6f1a05722a05cc

SHA512
859e6a8055f0b157d803556cbc46ec088d6dbd5afe68c91ae7588d7bb0188f7857d52981157e950d67a25ec9810020d110e1925c44ec9d3119dad5b4365b7252

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F096737\pim\text\usascii\coreutils.cmp

Filesize
3KB

MD5
41e769273551f2bdab78e8ed21b0b302

SHA1
0750411acdac1a82081dc55d7d74693f40bc8bf0

SHA256
a770c7e54288d60ce5d05d415d1c463ee118d070ff2e77c0fdebb8558429c466

SHA512
501080c8079c49e9149b8536c431f55115b370996c8f65a57f3666c3dd6bb86460be78ddc9641d411c594cb1bba204130f641e45e1cb19f2847196e254ec88f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F096737\pim\text\usascii\pim.cmp

Filesize
24KB

MD5
ae2e8503b6a864cae883c0205645971f

SHA1
fc36e19ffe98185c707ff1d46fc58963b045f6fc

SHA256
ed22932d2bda873ce3f44a9a74a4d99aecd812f796f9b5f27b6c14e2e854c108

SHA512
a10e870d4549d74b12a5826f489bc3e5368dc25beb6565d428258f2c3655afa85ecef76a1a6c18cc42bb0c4d3cb0112f7d1b89cf874057fb8db08bf7ea45f9bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F096737\pim\text\usascii\ui.cmp

Filesize
2KB

MD5
ce1a5874bfe387428ed83108f10ae191

SHA1
e98a6d5e8fe010ba7b0ba25c37adaed83a80e891

SHA256
873e02af30e3663a276f612059b7a21d0a124eb8fd1fa3718275cf273a7ebb8e

SHA512
a13d4a2dc3cfef64f540767015f6ef81de2b83039386fb385e547955a8d35551e6e3fb6f464f08b48cac37c5878b17e1d31cfea05ff6604b4faeb4dad7c7b151

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F096737\pim\text\usascii\ui_comdlg.cmp

Filesize
3KB

MD5
26b8f37e6e9b80dd13d4fbe0e9c1c1ab

SHA1
4022a52172204eb49e9c8f58d5b57c78a70ae273

SHA256
8b326a70c78ae4e8ccfe82fdd83de5fc1b49a0cdf57a840d882b5d3a60969346

SHA512
03383b7b67b4fff093eceea31315ad4c4623979ee12e515c7ba61b9c0afdf890ec7704b42b417fad871a91fe888c3d0e6131d4cb93a65c189106db1917bbc1b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F096737\pim\text\usascii\uitools.cmp

Filesize
24KB

MD5
cd1f29106569806bba0d92dcb11ea07c

SHA1
57159eabb74a48ddf26879c7b65a81a4c7ff5ae3

SHA256
832278404dc5cabc4c04a54cab7d115eef0daf7817012b0508ff2fd6ad04e747

SHA512
9675bba850abb1543db9e73f08efbf7a64a9e61f3e6314a6d7960a3e25981262f6fc86f3df84186902a0e940ee200d3061306a42cc87f9cdaaee84eb47781a6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F096737\pim\x86e_win64\asyncoremt.dll

Filesize
475KB

MD5
2014eebb9e10b8aba24793fe7ccc6d5e

SHA1
d6567a406111bb3720e1f37bf7631e279289b10c

SHA256
597940411941234cb2bd3669780527b235a12073f6964a99e451d1f52bb30726

SHA512
83559c9542e7a6f2337342b5363f6190f573c1354bc1b637c4f44c79af55e087e50b4d9bb27b0ca59f3e5b96795c24177a11c255e410430fa2e3c9a143f5feb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F096737\pim\x86e_win64\baselibmt.dll

Filesize
1.7MB

MD5
1610368add2d723b0b9ab1f2fb73850d

SHA1
03bd3ee6563462c998d47242ff4679818ba78f84

SHA256
d852a8d537806d2e8aff960b8b30e95ff2ff9cf23c42d4d46e51beef8faab826

SHA512
e2e783ecabe3038a5831b8a4b065c63e15f594889b86c6ee084a98dab77a462747ec8a93275f426fbc1de171c3bd8cd540450cca077f2f092e98379d60ccfb2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F096737\pim\x86e_win64\browser_stream_sh.dll

Filesize
173KB

MD5
2a9126ffc9aae4af25e3ac98a76e6dc2

SHA1
3f02d985a0930428cffc966a76729aee879b6c0a

SHA256
a137adf72b155d22b38042bdd83eaaa114f7da23423a0715a046fb8034f3378d

SHA512
9f0fd6332d00a4667e3ed03ef8005b6247047414e355c48a4bf51348c785e26a05c3c3225a4d60570199f54d29c72263691d1889f856808ea38cb7b9611db9b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F096737\pim\x86e_win64\coretools_sh.dll

Filesize
1.3MB

MD5
a163d973547ddd55748f960d8560709d

SHA1
84fa9e509c0d28c4f18ec34d029f9182a1647577

SHA256
437967b685bd0a2c9ec005bdcef91c56c28375031b44acd4ff03a4abca4c0cd3

SHA512
2600e368a0fefc5be27ecd718c1e63ceb6fddc6e31e9bf274c67e6f3671ac1e9e7dc18be33d93c260f6038f39a375a2528428cbc4294fe859cec5bafff56202a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F096737\pim\x86e_win64\coreutils_sh.dll

Filesize
2.7MB

MD5
1625fc5e24b192210aab107b0d310701

SHA1
ea2448b568985438dc6ec9af88ace5dc2b21c402

SHA256
53dcd6f4e8b30ca7ed7840a4121fa72af96bd49cfd5d5d691f80e702a8339729

SHA512
fb8cf19f634ba18513ea66965adcf881b9723d0e8044f704ec260ce55eeeef8864b321006e5c604908f9fa87ffed642cf98f6087a4f27baacbe3e43940b6014d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F096737\pim\x86e_win64\dlmmgrmt.dll

Filesize
144KB

MD5
ea16a3ae8a709100640549253a0680f2

SHA1
6d7ad2202ad0a07fef47f5389882fc3ea58601e7

SHA256
c09ae930aaec7c678bca69a4d2f18c4af56f4a8bbda4da4ab3fbbcb17f96f31d

SHA512
2e9f65178a1ff61b3b1979466d89e407cfc4f4fda1031e2e9774a778e51aac421f153fe8a649eb3cba32974e8d5da28bc95d8c0795877927a679a61726487c2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F096737\pim\x86e_win64\i18nmt.dll

Filesize
299KB

MD5
9c2b29fe0b05f66b574e9e49d8852933

SHA1
c1b75eff6cd776a71c72890beba4d4b7b289af30

SHA256
f9d1b156cfee04c5fa0e62bfdd2bdaab124bd21a3fa0599c49dba73742a8672f

SHA512
89f484ec426700b1cdccb26514d06579916ddc801a21df1fce4094eb97708e66e2a587589cdcdc04f4e59c691d460baf4f81e1f23d2a60bfb9daf9f011f5f3e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F096737\pim\x86e_win64\ic_sh.dll

Filesize
383KB

MD5
355a598359c86721260d9fd3f655fbc1

SHA1
b7f208292c760adbd5efa10d2172f818780caf60

SHA256
030b834793ec42f172f865dffcf13080378f3c3de66363516dd36719d7e5815e

SHA512
f0e9c31da6bdcdea386b518a8a4ed6e09392fd23ebc1fac5a50d3aa78ebd4918ffcfa77da7daf4e323b2d35dfd6ebb28b9e251b63834c040d003a7bf03bf8ec4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F096737\pim\x86e_win64\installmgr.dll

Filesize
2.8MB

MD5
f5f357941741724a7fb15000c7bcec75

SHA1
96d609f439a3460a6671466b386621864c04256c

SHA256
672c131108ac1a4ad2f7c9e5f16f1828a29f929ff6387e25e9d5302a7632f0f9

SHA512
d50e7cd9f77cd5a9bea07c149e34c559877102daf36fe34a4d2b1d3905900fbb018785583ee6f8d84483814e3d08061e9bc7efd760c553e042ecb080d1995ed7

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F096737\pim\x86e_win64\libgifmt.dll

Filesize
40KB

MD5
3d6cf1c33db067c390779e2c773eb35a

SHA1
6b9a71202a3e6be3e80656f8f69aae189165f86e

SHA256
b35ca6ce4cbbff8d22091089a64cb1dd27dc7ccb303946b57b8a7df5f288fb93

SHA512
9e5df939314134f50f921c2a12265ae0afbb3731c4d90857d31818f6d1ace45a226c22bf0a967d5aa538e458f260ab5d3789f9ae096c4aef4f65ebedfe567882

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F096737\pim\x86e_win64\libjpegmt.dll

Filesize
294KB

MD5
1296137627d18a4f8b563699419292f3

SHA1
de9712b30961b693993d597369a62288e0c72d33

SHA256
6d2375e59dfed88e7716ac50bf3ea5ef01173affffd8cde66362a13b0e026c70

SHA512
17c3b3bb88f82ba95cfb3b0b2c2ebdc8386c920350ea07c6666d8e032de8c961948d7c6f492b7106ae827b9a1d84e51efcdd12b687b4937abbe29a2e019c3c29

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F096737\pim\x86e_win64\libpngmt.dll

Filesize
195KB

MD5
618ad6865d3557d27db01eaab2ece9d6

SHA1
f74052e41cbdf63427c57f189c28694a687ed63a

SHA256
155b5a41d9132cb5cab79a5e108258bbc9f110ce4aace0ff9e623a1509c1fab5

SHA512
1fdeabf2bc36090067150d25dbf8b7e7e9d2be49c8524be697948be9ac6d1d408783cf20d48ccb04ba65132d3ff358c1ca3231e424729bf595cd39200ce98282

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F096737\pim\x86e_win64\libtiffmt.dll

Filesize
406KB

MD5
e2f66f3f44fdaadf47a7834827c72f69

SHA1
71e974f45d2f1b8a6a23c493030f403fa5128e7c

SHA256
aef5eee7ef86bd7bdd5710eac82e3b834757a0231691b859da062e54881d22f4

SHA512
00a79ee2da4f81806f7cbf6c602511181442e0c91abefc27828102667aa3cdcd88c24b7962b23d12aa0443c3d000e6e88af4b02573e31f35883746fd61403a78

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F096737\pim\x86e_win64\libui_sh.dll

Filesize
3.7MB

MD5
31da54622fc266adcaced202b3d18b03

SHA1
800e13f3292cca5877ad6fa25f2c0602d50940ad

SHA256
f50b412f7284976d33f961028cfa1336a51f968fb027989ce91817d0c3aee168

SHA512
73e852534055e140fae289d3b2866dfd3bd0a141c3864d2f238c9908c3d84dfce4e93267fd5f5d9bebfee7f77830279ada527fbee5292d7258234cc8da77edac

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F096737\pim\x86e_win64\licommonmt.dll

Filesize
93KB

MD5
b24d67260f474e51b282811ca459d006

SHA1
0847cef895eb4ff78e63f0b3ad880ac601aa2469

SHA256
8d6a730426c1cb93b6e8d81d8857aa3f75395cc90c02f4ba41cf82eae4dc437a

SHA512
8d0133569cc488b5ce69662aa3f0e8fc162870596517fe7544f709e74c0361a8bb933378325a08ef0a8345b58f22b6e017a09613f49ba5e020abfa3b5da95dac

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F096737\pim\x86e_win64\limanifestmt.dll

Filesize
158KB

MD5
d2bcd2977366b05bea30ca3320975738

SHA1
9f3a9e4a609fe7d68b58a4cfe73f9528859f48e5

SHA256
27c0bfb90abee60a0c55a6f880c41716fc2ceb46efa24a439f61aa942988a7b4

SHA512
7b1be6a2f73333803e4c4133f0ef5e21fc3d2c91ecb5088b0fd57c9f8c5bca7ea2ca12fef1059e0b341f667df468bbc7caaf89d15fa7716ea8cbff5067779e2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F096737\pim\x86e_win64\lutilsmt.dll

Filesize
199KB

MD5
c7e2ce3f3dc0fb34fbcc52c295792897

SHA1
d94c47413bc0de5aaae2048346070f28dd106883

SHA256
a2efe9dc34128400f54bd57848ff6fda5969f1e1bb76bc5d2bd0d8c421339973

SHA512
e153a999b0ed574e40e86f707bbbea7cd52ab389166c035656aabccbf58e79183c217998a3eb076f2ad09b1b9071d96b7c44f176c78b3ffaf078c1d88d4b8259

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F096737\pim\x86e_win64\rtlcoremt.dll

Filesize
330KB

MD5
95faa3649e6e4a4c6e40b2b6e7e62fd3

SHA1
14522c138de623564b3db1726f50da75adb3c427

SHA256
f85933658ba0fd60396861de682050fa02cb9b561a2a2441aa75f24be1dfbe70

SHA512
46611eec52ca9100a3501953953f2155e1e10663495ec0b7a3d4acca69707f844e3e7eb756da21f691e3d7fb84ef306db4ad3ef30bb11e36984ee583bd606aa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F096737\pim\x86e_win64\srvcmgrmt.dll

Filesize
282KB

MD5
40549405997e884e15ea7e50adc12198

SHA1
0ca342be2167cfa847b95b125e706c8816988c20

SHA256
6df084e961f9d076fb237a0d42e64e8dceffe220cb125f61b7ef14194c5abb5c

SHA512
d6e88af484960bd5db0816f604e832e485a12bf070cc820e2d607753fcf137af749cada45e8a34898006455b1b379128fb489bba115ce3fae7fb00989f126ae4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F096737\pim\x86e_win64\ucore68.dll

Filesize
1.6MB

MD5
b2b2254574031a9b99060893d97b51de

SHA1
bf66deb9980ff4159cea93883ca931567f0bffd8

SHA256
d61472f994dcc7acf3e27e973c3ba24c560af878d9b2f18fc9ea32ecda967b5e

SHA512
1e7f14f7b0189d26c1dbc39e415b43cae507ab381d6000f9d646dab157d628941d4e63674c02961a43128da6586ac2c5d73bea2dee667c038a5fc0684de372b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F096737\pim\x86e_win64\udata68.dll

Filesize
27.3MB

MD5
5a0462b5da16a9027cb7b7608553c664

SHA1
2e6240e54f4a6352b01ffda9147a6b2e35f32b86

SHA256
8529c1909003089579915db6b24b80cacbf0e266a6b9870634d6dc1526bb7aab

SHA512
d77b8905d7c931ba054f080baa1f59eac70df178417373f5f8b8e7274c613abdcd4f9947835bdd8cce8fb2aed5c88241cfa3e2a300481719c604f2600bb6bb8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F096737\pim\x86e_win64\uitools_sh.dll

Filesize
6.4MB

MD5
c671968141fab45451a0eae1256fefac

SHA1
8430e1b62c31dd05c096df910373c3c10c778d1e

SHA256
c723f2215e7df93ef08cf81c1ca5119b028c87e100a3721b56e0b1610891c43a

SHA512
097619d4ba34c5ffd9e445563613472060bf789eff34b010a51c4e1bc2bb329bbebe871b9f0809e4c2f612ccab3ff2e388f6b51d55484f794a6af49117d2078d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F096737\pim\x86e_win64\utfstrmt.dll

Filesize
92KB

MD5
3d20a180b2a152e35fd6dfe07eff34b5

SHA1
c9e245cf0267ed5b4269eab0f956d55ff0596f82

SHA256
f6dc59fc92902c05e40cdf0ba1715d0e15bbfa89f5f2a7bbe8ea8bb50e2278d8

SHA512
78032b728588af8dbf00eb287f73923759d7d837199e20307cd4b094a6b88e1390f5abfb92db441c4dd0d5d95244c76dde934c5808c31aee6b1714a5a5352033

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F096737\pim\x86e_win64\xercescmt.dll

Filesize
2.7MB

MD5
ad6cbc2c9d94e5180eba7fbb265b89ac

SHA1
2da1eda71626f111176c308e25d300daaaff0966

SHA256
292be88c26cb6e084d8933f330eaffc811248209c11905bc6ba0118bf28ad304

SHA512
c9720055991a8c906f23a8d2b8ab335eda7739eb448bf408bbfc1667a157f2246242e0545e55c16ea68f7b56c3b410f42d7962b7657ed1c3dcade2b45e02db97

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F096737\pim\x86e_win64\zlib-ngmt.dll

Filesize
107KB

MD5
e16a7017d4b39edf9f95467932e3b9ea

SHA1
2680037ad2500c3978ff6566f751d6d36098b999

SHA256
e69921eadc219723e78d2a1f29e88ecba7adba0047f7ce2d159ed1765ba1fc6c

SHA512
3db6d061d4a8304236dddea36ed0fd9e9cac7e9998df8094c35390bcbdf2890456e8426888e85a48ca401d479bbb0ea275b3d25c0c86dd95a23aeab14eb0cbb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F096737\setup.exe

Filesize
178KB

MD5
dd43608e8f78987f61cf3e21a7c45833

SHA1
a4dcd3544c1a02aa36868b6a055264c3adffa0bd

SHA256
b103eb2d567a6381436b46798cf53e9d92c16b64b7d213be8a434853577388f8

SHA512
4f5ad583bf312ecf75905919090afe10007af8275c99380ecdea3e219b75114b6012a0330e7885ec8cb847139db694386e3582e87ba4c88b761090bc2304f38e

Download Submit
C:\Users\Admin\AppData\Roaming\PTC Download\MED-60893-CD-290_9-0-0-0\ptcsh0\ptc1.cab

Filesize
45.3MB

MD5
ece44f25d907eff78f45cd4ff922a497

SHA1
db024d9dae4fcbdcfc2662850eee0362e3a4dc8a

SHA256
d0ba0031432b7176fc8f749b0b7b9bad6f76e7b577399bfe57986ab356cf0f4f

SHA512
9cb2118631e5af3886c722d6608eaf0ee26960bdd07beed8f4843e0408b0fa89edd77ec93a6a21f5134e1c149e8d2c751ed97e3ce7a0e3161452df5768470ade

Download Submit
C:\Users\Admin\AppData\Roaming\pim\mathcad.xml

Filesize
11KB

MD5
86db6ac29bd063f234bde7ec2be49a7e

SHA1
e5b72e8c02edca6eb84f10acfbec0dafa3873f28

SHA256
2a0e5ea061945ce12407afea7f2b87703811851be63e831be4dfd18d9996a13c

SHA512
68dff3fad1431f5c64187d6be90caef8860709984b90873966d1fae8a123d9fcbef89de53efefc5693ae59afa143980c65bd728034c4779d382d1fc218cc8707

Download Submit
C:\Users\Admin\AppData\Roaming\pim\qualityagent.xml

Filesize
3KB

MD5
e6538d14e8ce96ad5f7eab38eb4ce01f

SHA1
ba77cf27ed6f5b70fca80db0fe1c54015c9da97c

SHA256
8edc9d9f5e501d157b1e9ff8e77020f10f7a9ba84987d1e06f4e4b02271c5679

SHA512
d314732a19982f22dcb252c64cf77002f091ff59b724613fb1ea05e8776113acf7edad226bf285f81fedaa253471a9d9ce5cf59b65d29612336f4ead02ca7b03

Download Submit
C:\Users\Admin\AppData\Roaming\pim\qualityagent.xml

Filesize
3KB

MD5
c458f5e508f30e01000487e8b9c0505e

SHA1
1e4e6d82cb4cb3acf25c501868b2c2979ebc335f

SHA256
be3b971245491f4b2dba4fde19ba67dbea8392573cd878b3a8ae5d73f7e7da13

SHA512
8a4fc4505e6fc0c49ee0d86358b4c3c80f8895bea77aed5d35c13190a3d0af4be64233d8998c5af45acfd4ae6aa4205217555dc739a751c46943d6c7390b5097

Download Submit
C:\Users\Admin\AppData\Roaming\pim\sessioninfo.xml

Filesize
5KB

MD5
f678cfb43747f9b131cb0102f456ecf9

SHA1
7907c749e94ad4d8caff2a51dffe829540aeeaeb

SHA256
dff684f6ba52a30756a2fb04aef2415a2fd3393ebcddc7a06de8b8d6eb937163

SHA512
80b43a204bb7812172c4f94ccd06534e48c8dba6e981e597111543078608562e638a482bf638eb5fddc23bb483466577990a83f3d35262b0c026cfa9632e37f7

Download Submit
C:\Windows\Installer\MSIB84E.tmp

Filesize
155KB

MD5
84fe6543a5357793615375e62914c76a

SHA1
3e80ecbc17359e2a5d6691abb86f1e6526e1d980

SHA256
e8be4bebbec150dea0fffe4ad32dd4b7f2a2cee317efb3fe8f127e49e64794e7

SHA512
f666166006c3c8d54fd42b09777dd3039244fbe9f48e5d1a76259b35c5eb8490d7dea868ca7080c9e8f04ffca395a0c028a2d86ae5bfd2b7dbdf8a2d555b71e1

Download Submit
C:\Windows\Installer\e588e9f.msi

Filesize
20.8MB

MD5
f6c6fc7df537d61d2b3ef00e9f656496

SHA1
2c9b033f5a08a95a5924a73dc884fa99bdf71100

SHA256
9f78777a113e554c93af2ccf2f9371b2d3598301f3bf4606f8031a7f6937488b

SHA512
29b350d77018e860b6eb34754e3475a0cb9bed1e279580ec25f74a22d658a95b73a32ec0323a6cc7fe6dffae901e9d7b47124bf845c25c3bc4a87a40fa6bb775

Download Submit
C:\Windows\Installer\e588ea4.msi

Filesize
328.7MB

MD5
63363efa818f9a633715d74f19b4beef

SHA1
e5d906b45c94443571ae29b3f8a4e1c3510423c3

SHA256
ef23d6192ef04c8a4bdcfc679e5c8b02ea738b257a1d4537839287c7218f3d5d

SHA512
f43c21a958a6cae57887950b723b2c0f3e3bf67d2505bab793e601ec3952c9cc4a24ee9ba89b65ee7a3423ff2c8bb413f6f85e412e73c6dbd189eebb25e7abdc

Download Submit
memory/3276-3089-0x00007FFC720A0000-0x00007FFC72B61000-memory.dmp

Filesize
10.8MB

Download
memory/3276-3086-0x000001F14C300000-0x000001F14C310000-memory.dmp

Filesize
64KB

Download
memory/3276-3085-0x00007FFC720A0000-0x00007FFC72B61000-memory.dmp

Filesize
10.8MB

Download
memory/3276-3084-0x000001F14C2D0000-0x000001F14C2E2000-memory.dmp

Filesize
72KB

Download
memory/3276-3083-0x000001F14BEA0000-0x000001F14BEB0000-memory.dmp

Filesize
64KB

Download
memory/3664-14151-0x00000279CCDF0000-0x00000279CCE1C000-memory.dmp

Filesize
176KB

Download
memory/3664-14176-0x00000279CEF30000-0x00000279CEF52000-memory.dmp

Filesize
136KB

Download
memory/3664-14143-0x00000279CD360000-0x00000279CD922000-memory.dmp

Filesize
5.8MB

Download
memory/3664-14144-0x00000279CCF10000-0x00000279CD082000-memory.dmp

Filesize
1.4MB

Download
memory/3664-14145-0x00000279CCD90000-0x00000279CCDE2000-memory.dmp

Filesize
328KB

Download
memory/3664-14146-0x00000279CCE80000-0x00000279CCF0A000-memory.dmp

Filesize
552KB

Download
memory/3664-14147-0x00000279B4270000-0x00000279B4280000-memory.dmp

Filesize
64KB

Download
memory/3664-14148-0x00000279CD180000-0x00000279CD202000-memory.dmp

Filesize
520KB

Download
memory/3664-14149-0x00000279CCC30000-0x00000279CCC46000-memory.dmp

Filesize
88KB

Download
memory/3664-14150-0x00000279CCC50000-0x00000279CCC64000-memory.dmp

Filesize
80KB

Download
memory/3664-14141-0x00007FFC720A0000-0x00007FFC72B61000-memory.dmp

Filesize
10.8MB

Download
memory/3664-14152-0x00000279CCE20000-0x00000279CCE40000-memory.dmp

Filesize
128KB

Download
memory/3664-14153-0x00000279CD210000-0x00000279CD24A000-memory.dmp

Filesize
232KB

Download
memory/3664-14154-0x00000279B42D0000-0x00000279B42E0000-memory.dmp

Filesize
64KB

Download
memory/3664-14155-0x00000279B42E0000-0x00000279B42F0000-memory.dmp

Filesize
64KB

Download
memory/3664-14156-0x00000279CCE60000-0x00000279CCE7E000-memory.dmp

Filesize
120KB

Download
memory/3664-14157-0x00000279CD280000-0x00000279CD2A6000-memory.dmp

Filesize
152KB

Download
memory/3664-14158-0x00000279CD2B0000-0x00000279CD2DC000-memory.dmp

Filesize
176KB

Download
memory/3664-14161-0x00000279CE7E0000-0x00000279CEE08000-memory.dmp

Filesize
6.2MB

Download
memory/3664-14162-0x00000279CE510000-0x00000279CE538000-memory.dmp

Filesize
160KB

Download
memory/3664-14163-0x00000279CEE10000-0x00000279CEE78000-memory.dmp

Filesize
416KB

Download
memory/3664-14164-0x00000279CE4E0000-0x00000279CE4F8000-memory.dmp

Filesize
96KB

Download
memory/3664-14165-0x00000279CEE80000-0x00000279CEEFC000-memory.dmp

Filesize
496KB

Download
memory/3664-14166-0x00000279CE580000-0x00000279CE5C0000-memory.dmp

Filesize
256KB

Download
memory/3664-14167-0x00000279CDA30000-0x00000279CDA40000-memory.dmp

Filesize
64KB

Download
memory/3664-14168-0x00000279CE560000-0x00000279CE57C000-memory.dmp

Filesize
112KB

Download
memory/3664-14169-0x00000279CF030000-0x00000279CF0BA000-memory.dmp

Filesize
552KB

Download
memory/3664-14170-0x00000279CEFA0000-0x00000279CEFF0000-memory.dmp

Filesize
320KB

Download
memory/3664-14171-0x00000279CF3E0000-0x00000279CF470000-memory.dmp

Filesize
576KB

Download
memory/3664-14172-0x00000279CDA40000-0x00000279CDA48000-memory.dmp

Filesize
32KB

Download
memory/3664-14173-0x00000279B4270000-0x00000279B4280000-memory.dmp

Filesize
64KB

Download
memory/3664-14174-0x00000279CFC10000-0x00000279CFCAE000-memory.dmp

Filesize
632KB

Download
memory/3664-14175-0x00000279CE5C0000-0x00000279CE5DC000-memory.dmp

Filesize
112KB

Download
memory/3664-14142-0x00000279B4270000-0x00000279B4280000-memory.dmp

Filesize
64KB

Download
memory/3664-14177-0x00000279CEF00000-0x00000279CEF16000-memory.dmp

Filesize
88KB

Download
memory/3664-14178-0x00000279B4270000-0x00000279B4280000-memory.dmp

Filesize
64KB

Download
memory/3664-14179-0x00000279CEF20000-0x00000279CEF28000-memory.dmp

Filesize
32KB

Download
memory/3664-14278-0x00007FFC64CE0000-0x00007FFC680F3000-memory.dmp

Filesize
52.1MB

Download
memory/3664-14254-0x00000279D0810000-0x00000279D08F3000-memory.dmp

Filesize
908KB

Download
memory/3664-14253-0x00000279D07C0000-0x00000279D07E6000-memory.dmp

Filesize
152KB

Download
memory/3664-14252-0x00000279D0730000-0x00000279D07AD000-memory.dmp

Filesize
500KB

Download
memory/3664-14249-0x00000279D0620000-0x00000279D0657000-memory.dmp

Filesize
220KB

Download
memory/3664-14244-0x00000279CF3A0000-0x00000279CF3C7000-memory.dmp

Filesize
156KB

Download
memory/3664-14140-0x00000279B2640000-0x00000279B26AA000-memory.dmp

Filesize
424KB

Download
memory/3664-14193-0x00000279B4270000-0x00000279B4280000-memory.dmp

Filesize
64KB

Download
memory/3664-14187-0x00007FFC720A0000-0x00007FFC72B61000-memory.dmp

Filesize
10.8MB

Download
memory/3664-14189-0x00000279B4270000-0x00000279B4280000-memory.dmp

Filesize
64KB

Download
memory/3664-14192-0x00000279B4270000-0x00000279B4280000-memory.dmp

Filesize
64KB

Download
memory/3664-14191-0x00000279B4270000-0x00000279B4280000-memory.dmp

Filesize
64KB

Download
memory/4460-9660-0x00007FFC720A0000-0x00007FFC72B61000-memory.dmp

Filesize
10.8MB

Download
memory/4460-3100-0x0000017FE9520000-0x0000017FE9528000-memory.dmp

Filesize
32KB

Download
memory/4460-3103-0x00007FFC720A0000-0x00007FFC72B61000-memory.dmp

Filesize
10.8MB

Download
memory/4536-14196-0x0000021732030000-0x0000021732040000-memory.dmp

Filesize
64KB

Download
memory/4536-14190-0x0000021732030000-0x0000021732040000-memory.dmp

Filesize
64KB

Download
memory/4536-14197-0x0000021732030000-0x0000021732040000-memory.dmp

Filesize
64KB

Download
memory/4536-14186-0x0000021719600000-0x000002171960E000-memory.dmp

Filesize
56KB

Download
memory/4536-14195-0x0000021732030000-0x0000021732040000-memory.dmp

Filesize
64KB

Download
memory/4536-14194-0x00007FFC720A0000-0x00007FFC72B61000-memory.dmp

Filesize
10.8MB

Download
memory/4536-14188-0x0000021732030000-0x0000021732040000-memory.dmp

Filesize
64KB

Download
memory/4536-14185-0x0000021719680000-0x00000217196B8000-memory.dmp

Filesize
224KB

Download
memory/4536-14184-0x0000021732030000-0x0000021732040000-memory.dmp

Filesize
64KB

Download
memory/4536-14183-0x0000021719590000-0x00000217195BC000-memory.dmp

Filesize
176KB

Download
memory/4536-14182-0x0000021732030000-0x0000021732040000-memory.dmp

Filesize
64KB

Download
memory/4536-14180-0x00007FFC720A0000-0x00007FFC72B61000-memory.dmp

Filesize
10.8MB

Download
memory/4536-14181-0x0000021717980000-0x00000217179A2000-memory.dmp

Filesize
136KB

Download