bfa5d4b1c9d726ee17d7f6cf600084df7b40b6ac8b1862c0680e75f661c21eba

Analysis

max time kernel
156s
max time network
163s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
08/05/2024, 14:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Hexaquest_Minidemo2_Windows.zip
Size

264.5MB
MD5

2f2e3a6dbd26c2ab09f527531dbfb57c
SHA1

be66753209316356f34f77745cceb8011fd9f0d0
SHA256

bfa5d4b1c9d726ee17d7f6cf600084df7b40b6ac8b1862c0680e75f661c21eba
SHA512

1ea78cbcd33a8c787a97ee4671fa426dffcdbe31ccf7ee0cff25a73ae33c1246f0d30035f21ca45a67f8d8f12b537c58e56381490e207108b0d4a8bb3705e3a4
SSDEEP

6291456:QFUKbKA0mSGzUdoJZfjbvIuogq4aUDC81eGjCd2m2lHkA6w+KZlNw6sm6y:Q2Kk5dobfjbrogq4aUDT22RTbZlNwrg

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 15 IoCs

pid	Process
4460	VC_redist.x86.exe
1916	VC_redist.x86.exe
4500	VC_redist.x86.exe
3988	VC_redist.x64.exe
1348	VC_redist.x64.exe
1388	VC_redist.x64.exe
1928	DXSetup.exe
3540	infinst.exe
6016	infinst.exe
1524	infinst.exe
4924	infinst.exe
1672	infinst.exe
4784	infinst.exe
5260	infinst.exe
5656	infinst.exe

Loads dropped DLL 17 IoCs

pid	Process
4560	UEPrereqSetup_x64.exe
1916	VC_redist.x86.exe
1348	VC_redist.x64.exe
1376	MsiExec.exe
3052	rundll32.exe
3052	rundll32.exe
3052	rundll32.exe
1928	DXSetup.exe
1928	DXSetup.exe
1928	DXSetup.exe
1928	DXSetup.exe
1928	DXSetup.exe
5524	regsvr32.exe
4184	UnrealGame-Win64-Shipping.exe
4184	UnrealGame-Win64-Shipping.exe
4184	UnrealGame-Win64-Shipping.exe
4184	UnrealGame-Win64-Shipping.exe

Registers COM server for autorun 1 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_7.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cac1105f-619b-4d04-831a-44e1cbf12d57}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_7.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_7.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cac1105f-619b-4d04-831a-44e1cbf12d57}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cac1105f-619b-4d04-831a-44e1cbf12d57}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}\InProcServer32	regsvr32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{b24cae82-bb64-4ad2-820a-dc2c4031c914} = "\"C:\\ProgramData\\Package Cache\\{b24cae82-bb64-4ad2-820a-dc2c4031c914}\\UEPrereqSetup_x64.exe\" /burn.log.append \"C:\\Users\\Admin\\AppData\\Local\\Temp\\UE_Prerequisites_(x64)_20240508202302.log\" /burn.runonce"	UEPrereqSetup_x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\SETEE28.tmp	DXSetup.exe
File opened for modification	C:\Windows\SysWOW64\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140ita.dll	msiexec.exe
File created	C:\Windows\system32\SETEDC6.tmp	infinst.exe
File created	C:\Windows\system32\SETF027.tmp	infinst.exe
File opened for modification	C:\Windows\system32\D3DCompiler_43.dll	infinst.exe
File created	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File created	C:\Windows\system32\mfc140u.dll	msiexec.exe
File created	C:\Windows\system32\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\d3dx11_43.dll	DXSetup.exe
File opened for modification	C:\Windows\system32\SETEE43.tmp	infinst.exe
File opened for modification	C:\Windows\system32\SETF102.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\mfc140rus.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140u.dll	msiexec.exe
File created	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\xinput1_3.dll	infinst.exe
File opened for modification	C:\Windows\system32\SETED59.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\xinput1_3.dll	DXSetup.exe
File opened for modification	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\system32\vcomp140.dll	msiexec.exe
File created	C:\Windows\system32\SETED59.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\d3dx10_43.dll	DXSetup.exe
File created	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140enu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File opened for modification	C:\Windows\system32\d3dx10_43.dll	infinst.exe
File created	C:\Windows\SysWOW64\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140fra.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\SETF0CC.tmp	DXSetup.exe
File created	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\system32\X3DAudio1_7.dll	infinst.exe
File opened for modification	C:\Windows\system32\d3dcsx_43.dll	infinst.exe
File opened for modification	C:\Windows\SysWOW64\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140kor.dll	msiexec.exe
File created	C:\Windows\system32\concrt140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File created	C:\Windows\system32\SETEE05.tmp	infinst.exe
File created	C:\Windows\SysWOW64\concrt140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File created	C:\Windows\SysWOW64\SETEDE8.tmp	DXSetup.exe
File created	C:\Windows\SysWOW64\SETF0CC.tmp	DXSetup.exe
File created	C:\Windows\system32\SETF113.tmp	infinst.exe
File created	C:\Windows\SysWOW64\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\D3DX9_43.dll	DXSetup.exe
File opened for modification	C:\Windows\system32\vcomp100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\SETF05C.tmp	DXSetup.exe
File opened for modification	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\SETF113.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\vcamp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\d3dcsx_43.dll	DXSetup.exe
File opened for modification	C:\Windows\SysWOW64\SETF0CB.tmp	DXSetup.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Installer\$PatchCache$\Managed\0215714CE313B764AA7A289597BCEA7E\1.0.20\F_CENTRAL_msvcr100_x86.DF495DFD_79F6_34DF_BB1E_E58DB5BDCF2C	msiexec.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File opened for modification	C:\Windows\Installer\e58c956.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\0215714CE313B764AA7A289597BCEA7E\1.0.20	msiexec.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File created	C:\Windows\Installer\SourceHash{0025DD72-A959-45B5-A0A3-7EFEB15A8050}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE8ED.tmp-\Feb2010_X3DAudio_x86.cab	rundll32.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\0215714CE313B764AA7A289597BCEA7E\1.0.20\F_CENTRAL_msvcr120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\0215714CE313B764AA7A289597BCEA7E\1.0.20\F_CENTRAL_vccorlib110_x86.F9D0B380_EB85_31D4_96AC_C6CB40086A55	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE8ED.tmp-\CustomAction.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIE8ED.tmp-\Jun2010_d3dx9_43_x64.cab	rundll32.exe
File opened for modification	C:\Windows\Logs\DirectX.log	DXSetup.exe
File created	C:\Windows\SystemTemp\~DFB45B00BA505AE8CD.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1FDCC29DF166775F.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE8ED.tmp-\Jun2010_D3DCompiler_43_x86.cab	rundll32.exe
File created	C:\Windows\Installer\e58c991.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE8ED.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\0215714CE313B764AA7A289597BCEA7E\1.0.20\F_CENTRAL_vccorlib110_x64.4006A2C6_1BD5_3759_9C0C_17A8FFBF6E3C	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\0215714CE313B764AA7A289597BCEA7E\1.0.20\F_CENTRAL_vccorlib120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID2BF.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\0215714CE313B764AA7A289597BCEA7E\1.0.20\F_CENTRAL_msvcr100_x64.1C11561A_11CB_36A7_8A47_D7A042055FA7	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\0215714CE313B764AA7A289597BCEA7E\1.0.20\F_CENTRAL_vccorlib120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE8ED.tmp-\Jun2010_d3dcsx_43_x64.cab	rundll32.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\0215714CE313B764AA7A289597BCEA7E\1.0.20\F_CENTRAL_msvcr100_x64.1C11561A_11CB_36A7_8A47_D7A042055FA7	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\0215714CE313B764AA7A289597BCEA7E\1.0.20\F_CENTRAL_vccorlib110_x64.4006A2C6_1BD5_3759_9C0C_17A8FFBF6E3C	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE8ED.tmp-\DXSETUP.exe	rundll32.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File created	C:\Windows\Installer\SourceHash{D5D19E2F-7189-42FE-8103-92CD1FA457C2}	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\0215714CE313B764AA7A289597BCEA7E\1.0.20\F_CENTRAL_msvcp110_x64.4006A2C6_1BD5_3759_9C0C_17A8FFBF6E3C	msiexec.exe
File created	C:\Windows\Installer\e58c9a6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\0215714CE313B764AA7A289597BCEA7E\1.0.20\F_CENTRAL_msvcp100_x64.1C11561A_11CB_36A7_8A47_D7A042055FA7	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\0215714CE313B764AA7A289597BCEA7E\1.0.20\F_CENTRAL_msvcp100_x86.DF495DFD_79F6_34DF_BB1E_E58DB5BDCF2C	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE8ED.tmp-\Jun2010_XAudio_x86.cab	rundll32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE06E.tmp	msiexec.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File created	C:\Windows\SystemTemp\~DFA630DB35103AD148.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE8ED.tmp-\dsetup32.dll	rundll32.exe
File created	C:\Windows\SystemTemp\~DF6F35C884FF56B4DF.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\0215714CE313B764AA7A289597BCEA7E\1.0.20\F_CENTRAL_msvcp120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C	msiexec.exe
File created	C:\Windows\Installer\e58c9ab.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICFEF.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C2C59CAB-8766-4ABD-A8EF-1151A36C41E5}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE8ED.tmp-\Jun2010_XAudio_x64.cab	rundll32.exe
File opened for modification	C:\Windows\Installer\e58c968.msi	msiexec.exe
File created	C:\Windows\Installer\e58c9a7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDD21.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE8ED.tmp-\dxdllreg_x86.cab	rundll32.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\0215714CE313B764AA7A289597BCEA7E\1.0.20\F_CENTRAL_vccorlib110_x86.F9D0B380_EB85_31D4_96AC_C6CB40086A55	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5C965CBD2AACF0C6.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\0215714CE313B764AA7A289597BCEA7E\1.0.20\F_CENTRAL_msvcr110_x64.4006A2C6_1BD5_3759_9C0C_17A8FFBF6E3C	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE8ED.tmp-\Jun2010_d3dx11_43_x86.cab	rundll32.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\0215714CE313B764AA7A289597BCEA7E\1.0.20\F_CENTRAL_msvcr120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA	msiexec.exe
File created	C:\Windows\SystemTemp\~DF899B92D2479CEEC8.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\0215714CE313B764AA7A289597BCEA7E\1.0.20\F_CENTRAL_msvcp100_x86.DF495DFD_79F6_34DF_BB1E_E58DB5BDCF2C	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\0215714CE313B764AA7A289597BCEA7E\1.0.20\F_CENTRAL_msvcp120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e58c97e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDB8A.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3338BB7CE0463636.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e58c9a7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\0215714CE313B764AA7A289597BCEA7E\1.0.20\F_CENTRAL_msvcr120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA	msiexec.exe
File opened for modification	C:\Windows\Installer\{C4175120-313E-467B-AAA7-825979CBAEE7}\Setup.ico	msiexec.exe
File created	C:\Windows\SystemTemp\~DF67D625F92BA8340D.TMP	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DXSetup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DXSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DXSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DXSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DXSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2f	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DXSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DXSetup.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\32\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	DXSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DXSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DXSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DXSetup.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\32	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\32\52C64B7E	DXSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DXSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DXSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DXSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DXSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DXSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DXSetup.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\30	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\30	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\31	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\32	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DXSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DXSetup.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DXSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\33	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DXSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DXSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DXSetup.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\31	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DXSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DXSetup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "4"	DXSetup.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DXSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DXSetup.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DXSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DXSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DXSetup.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\32\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DXSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DXSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DXSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DXSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DXSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DXSetup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DXSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DXSetup.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.36,bundle\Version = "14.36.32532.0"	VC_redist.x86.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BAC95C2C6678DBA48AFE11153AC6145E\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27DD5200959A5B540A3AE7EF1BA50805\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\27DD5200959A5B540A3AE7EF1BA50805\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cac1105f-619b-4d04-831a-44e1cbf12d57}	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0215714CE313B764AA7A289597BCEA7E\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cac1105f-619b-4d04-831a-44e1cbf12d57}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\Dependents\{410c0ee1-00bb-41b6-9772-e12c2828b02f}	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0215714CE313B764AA7A289597BCEA7E\ProductIcon = "C:\\Windows\\Installer\\{C4175120-313E-467B-AAA7-825979CBAEE7}\\Setup.ico"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}\ = "XAudio2"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F2E91D5D9817EF24183029DCF14A752C\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Dependents\{8bdfe669-9705-4184-9368-db9ce581e0e7}	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0215714CE313B764AA7A289597BCEA7E\SourceList\PackageName = "UEPrereqSetup_x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_7.dll"	DXSetup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{C4175120-313E-467B-AAA7-825979CBAEE7}	UEPrereqSetup_x64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0215714CE313B764AA7A289597BCEA7E\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4E77F3771A55E645ACFA860017427F5\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{73F77E4E-5A17-46E5-A5FC-8A061047725F}v14.36.32532\\packages\\vcRuntimeMinimum_x86\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27DD5200959A5B540A3AE7EF1BA50805\AuthorizedLUAApp = "0"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27DD5200959A5B540A3AE7EF1BA50805\ProductName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0215714CE313B764AA7A289597BCEA7E\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4E77F3771A55E645ACFA860017427F5\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BAC95C2C6678DBA48AFE11153AC6145E\AdvertiseFlags = "388"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4E77F3771A55E645ACFA860017427F5	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4E77F3771A55E645ACFA860017427F5\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4E77F3771A55E645ACFA860017427F5\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{73F77E4E-5A17-46E5-A5FC-8A061047725F}v14.36.32532\\packages\\vcRuntimeMinimum_x86\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BAC95C2C6678DBA48AFE11153AC6145E\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E4E77F3771A55E645ACFA860017427F5\Servicing_Key	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4E77F3771A55E645ACFA860017427F5\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}\InProcServer32	DXSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{C4175120-313E-467B-AAA7-825979CBAEE7}\Version = "1.0.20.0"	UEPrereqSetup_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{b24cae82-bb64-4ad2-820a-dc2c4031c914}\DisplayName = "UE Prerequisites (x64)"	UEPrereqSetup_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\ProductName = "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Dependents\{8bdfe669-9705-4184-9368-db9ce581e0e7}	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{b24cae82-bb64-4ad2-820a-dc2c4031c914}\Dependents\{b24cae82-bb64-4ad2-820a-dc2c4031c914}	UEPrereqSetup_x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0215714CE313B764AA7A289597BCEA7E\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}\InProcServer32\ThreadingModel = "Both"	DXSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4E77F3771A55E645ACFA860017427F5\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BAC95C2C6678DBA48AFE11153AC6145E\SourceList\PackageName = "vc_runtimeAdditional_x86.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\AdvertiseFlags = "388"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0215714CE313B764AA7A289597BCEA7E\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{C4175120-313E-467B-AAA7-825979CBAEE7}v1.0.20.0\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}\ = "AudioReverb"	DXSetup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F2E91D5D9817EF24183029DCF14A752C\Servicing_Key	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27DD5200959A5B540A3AE7EF1BA50805\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0215714CE313B764AA7A289597BCEA7E\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0215714CE313B764AA7A289597BCEA7E\ProductName = "UE Prerequisites (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\15E8B87C56C0E773581D82F286F95E50\BAC95C2C6678DBA48AFE11153AC6145E	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{D5D19E2F-7189-42FE-8103-92CD1FA457C2}v14.36.32532\\packages\\vcRuntimeMinimum_amd64\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\27DD5200959A5B540A3AE7EF1BA50805\Servicing_Key	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27DD5200959A5B540A3AE7EF1BA50805\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\15E8B87C56C0E773581D82F286F95E50	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BAC95C2C6678DBA48AFE11153AC6145E\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{C2C59CAB-8766-4ABD-A8EF-1151A36C41E5}v14.36.32532\\packages\\vcRuntimeAdditional_x86\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27DD5200959A5B540A3AE7EF1BA50805\SourceList\PackageName = "vc_runtimeAdditional_x64.msi"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe
4244	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeBackupPrivilege	3556	vssvc.exe
Token: SeRestorePrivilege	3556	vssvc.exe
Token: SeAuditPrivilege	3556	vssvc.exe
Token: SeShutdownPrivilege	4500	VC_redist.x86.exe
Token: SeIncreaseQuotaPrivilege	4500	VC_redist.x86.exe
Token: SeSecurityPrivilege	4244	msiexec.exe
Token: SeCreateTokenPrivilege	4500	VC_redist.x86.exe
Token: SeAssignPrimaryTokenPrivilege	4500	VC_redist.x86.exe
Token: SeLockMemoryPrivilege	4500	VC_redist.x86.exe
Token: SeIncreaseQuotaPrivilege	4500	VC_redist.x86.exe
Token: SeMachineAccountPrivilege	4500	VC_redist.x86.exe
Token: SeTcbPrivilege	4500	VC_redist.x86.exe
Token: SeSecurityPrivilege	4500	VC_redist.x86.exe
Token: SeTakeOwnershipPrivilege	4500	VC_redist.x86.exe
Token: SeLoadDriverPrivilege	4500	VC_redist.x86.exe
Token: SeSystemProfilePrivilege	4500	VC_redist.x86.exe
Token: SeSystemtimePrivilege	4500	VC_redist.x86.exe
Token: SeProfSingleProcessPrivilege	4500	VC_redist.x86.exe
Token: SeIncBasePriorityPrivilege	4500	VC_redist.x86.exe
Token: SeCreatePagefilePrivilege	4500	VC_redist.x86.exe
Token: SeCreatePermanentPrivilege	4500	VC_redist.x86.exe
Token: SeBackupPrivilege	4500	VC_redist.x86.exe
Token: SeRestorePrivilege	4500	VC_redist.x86.exe
Token: SeShutdownPrivilege	4500	VC_redist.x86.exe
Token: SeDebugPrivilege	4500	VC_redist.x86.exe
Token: SeAuditPrivilege	4500	VC_redist.x86.exe
Token: SeSystemEnvironmentPrivilege	4500	VC_redist.x86.exe
Token: SeChangeNotifyPrivilege	4500	VC_redist.x86.exe
Token: SeRemoteShutdownPrivilege	4500	VC_redist.x86.exe
Token: SeUndockPrivilege	4500	VC_redist.x86.exe
Token: SeSyncAgentPrivilege	4500	VC_redist.x86.exe
Token: SeEnableDelegationPrivilege	4500	VC_redist.x86.exe
Token: SeManageVolumePrivilege	4500	VC_redist.x86.exe
Token: SeImpersonatePrivilege	4500	VC_redist.x86.exe
Token: SeCreateGlobalPrivilege	4500	VC_redist.x86.exe
Token: SeRestorePrivilege	4244	msiexec.exe
Token: SeTakeOwnershipPrivilege	4244	msiexec.exe
Token: SeRestorePrivilege	4244	msiexec.exe
Token: SeTakeOwnershipPrivilege	4244	msiexec.exe
Token: SeRestorePrivilege	4244	msiexec.exe
Token: SeTakeOwnershipPrivilege	4244	msiexec.exe
Token: SeRestorePrivilege	4244	msiexec.exe
Token: SeTakeOwnershipPrivilege	4244	msiexec.exe
Token: SeRestorePrivilege	4244	msiexec.exe
Token: SeTakeOwnershipPrivilege	4244	msiexec.exe
Token: SeRestorePrivilege	4244	msiexec.exe
Token: SeTakeOwnershipPrivilege	4244	msiexec.exe
Token: SeRestorePrivilege	4244	msiexec.exe
Token: SeTakeOwnershipPrivilege	4244	msiexec.exe
Token: SeRestorePrivilege	4244	msiexec.exe
Token: SeTakeOwnershipPrivilege	4244	msiexec.exe
Token: SeRestorePrivilege	4244	msiexec.exe
Token: SeTakeOwnershipPrivilege	4244	msiexec.exe
Token: SeRestorePrivilege	4244	msiexec.exe
Token: SeTakeOwnershipPrivilege	4244	msiexec.exe
Token: SeRestorePrivilege	4244	msiexec.exe
Token: SeTakeOwnershipPrivilege	4244	msiexec.exe
Token: SeRestorePrivilege	4244	msiexec.exe
Token: SeTakeOwnershipPrivilege	4244	msiexec.exe
Token: SeRestorePrivilege	4244	msiexec.exe
Token: SeTakeOwnershipPrivilege	4244	msiexec.exe
Token: SeRestorePrivilege	4244	msiexec.exe
Token: SeTakeOwnershipPrivilege	4244	msiexec.exe
Token: SeRestorePrivilege	4244	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4560	UEPrereqSetup_x64.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4184	UnrealGame-Win64-Shipping.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 1504	2080	Hexaquest.exe	86
PID 2080 wrote to memory of 1504	2080	Hexaquest.exe	86
PID 2080 wrote to memory of 1504	2080	Hexaquest.exe	86
PID 1504 wrote to memory of 4560	1504	UEPrereqSetup_x64.exe	87
PID 1504 wrote to memory of 4560	1504	UEPrereqSetup_x64.exe	87
PID 1504 wrote to memory of 4560	1504	UEPrereqSetup_x64.exe	87
PID 1504 wrote to memory of 4460	1504	UEPrereqSetup_x64.exe	91
PID 1504 wrote to memory of 4460	1504	UEPrereqSetup_x64.exe	91
PID 1504 wrote to memory of 4460	1504	UEPrereqSetup_x64.exe	91
PID 4460 wrote to memory of 1916	4460	VC_redist.x86.exe	92
PID 4460 wrote to memory of 1916	4460	VC_redist.x86.exe	92
PID 4460 wrote to memory of 1916	4460	VC_redist.x86.exe	92
PID 1916 wrote to memory of 4500	1916	VC_redist.x86.exe	93
PID 1916 wrote to memory of 4500	1916	VC_redist.x86.exe	93
PID 1916 wrote to memory of 4500	1916	VC_redist.x86.exe	93
PID 1504 wrote to memory of 3988	1504	UEPrereqSetup_x64.exe	95
PID 1504 wrote to memory of 3988	1504	UEPrereqSetup_x64.exe	95
PID 1504 wrote to memory of 3988	1504	UEPrereqSetup_x64.exe	95
PID 3988 wrote to memory of 1348	3988	VC_redist.x64.exe	96
PID 3988 wrote to memory of 1348	3988	VC_redist.x64.exe	96
PID 3988 wrote to memory of 1348	3988	VC_redist.x64.exe	96
PID 1348 wrote to memory of 1388	1348	VC_redist.x64.exe	97
PID 1348 wrote to memory of 1388	1348	VC_redist.x64.exe	97
PID 1348 wrote to memory of 1388	1348	VC_redist.x64.exe	97
PID 4244 wrote to memory of 1376	4244	msiexec.exe	99
PID 4244 wrote to memory of 1376	4244	msiexec.exe	99
PID 1376 wrote to memory of 3052	1376	MsiExec.exe	100
PID 1376 wrote to memory of 3052	1376	MsiExec.exe	100
PID 3052 wrote to memory of 1928	3052	rundll32.exe	101
PID 3052 wrote to memory of 1928	3052	rundll32.exe	101
PID 3052 wrote to memory of 1928	3052	rundll32.exe	101
PID 1928 wrote to memory of 3540	1928	DXSetup.exe	103
PID 1928 wrote to memory of 3540	1928	DXSetup.exe	103
PID 1928 wrote to memory of 6016	1928	DXSetup.exe	104
PID 1928 wrote to memory of 6016	1928	DXSetup.exe	104
PID 1928 wrote to memory of 1524	1928	DXSetup.exe	105
PID 1928 wrote to memory of 1524	1928	DXSetup.exe	105
PID 1928 wrote to memory of 4924	1928	DXSetup.exe	106
PID 1928 wrote to memory of 4924	1928	DXSetup.exe	106
PID 1928 wrote to memory of 1672	1928	DXSetup.exe	107
PID 1928 wrote to memory of 1672	1928	DXSetup.exe	107
PID 1928 wrote to memory of 4784	1928	DXSetup.exe	108
PID 1928 wrote to memory of 4784	1928	DXSetup.exe	108
PID 1928 wrote to memory of 5260	1928	DXSetup.exe	109
PID 1928 wrote to memory of 5260	1928	DXSetup.exe	109
PID 1928 wrote to memory of 5656	1928	DXSetup.exe	110
PID 1928 wrote to memory of 5656	1928	DXSetup.exe	110
PID 1928 wrote to memory of 5524	1928	DXSetup.exe	111
PID 1928 wrote to memory of 5524	1928	DXSetup.exe	111
PID 2080 wrote to memory of 4184	2080	Hexaquest.exe	112
PID 2080 wrote to memory of 4184	2080	Hexaquest.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Hexaquest_Minidemo2_Windows.zip
1⤵
PID:1832

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3116

C:\Users\Admin\Desktop\Hexaquest_Minidemo2_Windows\Hexaquest.exe
"C:\Users\Admin\Desktop\Hexaquest_Minidemo2_Windows\Hexaquest.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Users\Admin\Desktop\Hexaquest_Minidemo2_Windows\Engine\Extras\Redist\en-us\UEPrereqSetup_x64.exe
  "C:\Users\Admin\Desktop\Hexaquest_Minidemo2_Windows\Engine\Extras\Redist\en-us\UEPrereqSetup_x64.exe"
  2⤵
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1504
- - C:\Users\Admin\Desktop\Hexaquest_Minidemo2_Windows\Engine\Extras\Redist\en-us\UEPrereqSetup_x64.exe
    "C:\Users\Admin\Desktop\Hexaquest_Minidemo2_Windows\Engine\Extras\Redist\en-us\UEPrereqSetup_x64.exe" -burn.unelevated BurnPipe.{390BE4BD-9D1A-4BA7-AAE2-4E1D96D8CC00} {0429A4FE-F55A-4FA1-8BA0-7FCDFB41E2B0} 1504
    3⤵
    - Loads dropped DLL
    - Suspicious use of FindShellTrayWindow
    PID:4560
- - C:\ProgramData\Package Cache\C9B5B7969E499A4FD9E580EF4187322778E1936A\VC_redist.x86.exe
    "C:\ProgramData\Package Cache\C9B5B7969E499A4FD9E580EF4187322778E1936A\VC_redist.x86.exe" /quiet /norestart -burn.embedded BurnPipe.{BD6A90E2-96DA-4ABA-8673-9114E51D4F01} {9B49287E-6099-4F18-BD6F-5C60733C4D77} 1504
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4460
  - - C:\Windows\Temp\{F35AB53B-561B-4FCC-BB03-BFF989BB6D61}\.cr\VC_redist.x86.exe
      "C:\Windows\Temp\{F35AB53B-561B-4FCC-BB03-BFF989BB6D61}\.cr\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\C9B5B7969E499A4FD9E580EF4187322778E1936A\VC_redist.x86.exe" -burn.filehandle.attached=592 -burn.filehandle.self=600 /quiet /norestart -burn.embedded BurnPipe.{BD6A90E2-96DA-4ABA-8673-9114E51D4F01} {9B49287E-6099-4F18-BD6F-5C60733C4D77} 1504
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1916
    - - C:\Windows\Temp\{0917146A-9470-4313-9D3E-320416D936E5}\.be\VC_redist.x86.exe
        
        "C:\Windows\Temp\{0917146A-9470-4313-9D3E-320416D936E5}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{4B167A17-F181-41EC-9C7B-2E3F86E4CA75} {2FD19B06-A7C3-46DD-93D8-2FF0964CB12F} 1916
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4500
- - C:\ProgramData\Package Cache\C483F66C48BA83E99C764D957729789317B09C6B\VC_redist.x64.exe
    "C:\ProgramData\Package Cache\C483F66C48BA83E99C764D957729789317B09C6B\VC_redist.x64.exe" /quiet /norestart -burn.embedded BurnPipe.{A32AF125-9970-4825-AF98-6FACB9076893} {14B2C529-6F09-4083-B311-AE6D661364B6} 1504
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3988
  - - C:\Windows\Temp\{E404D3E8-214F-4FD2-8F47-F14607B9954E}\.cr\VC_redist.x64.exe
      "C:\Windows\Temp\{E404D3E8-214F-4FD2-8F47-F14607B9954E}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\C483F66C48BA83E99C764D957729789317B09C6B\VC_redist.x64.exe" -burn.filehandle.attached=592 -burn.filehandle.self=600 /quiet /norestart -burn.embedded BurnPipe.{A32AF125-9970-4825-AF98-6FACB9076893} {14B2C529-6F09-4083-B311-AE6D661364B6} 1504
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1348
    - - C:\Windows\Temp\{C7BCD7F2-9141-43AC-B34D-6AF21FE30328}\.be\VC_redist.x64.exe
        
        "C:\Windows\Temp\{C7BCD7F2-9141-43AC-B34D-6AF21FE30328}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{AEEE24BD-4309-4B4D-B53F-7B411D15A324} {FB4456E8-D3ED-448A-A4BA-2BB5C040A5A3} 1348
        5⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1388
- C:\Users\Admin\Desktop\Hexaquest_Minidemo2_Windows\Engine\Binaries\Win64\UnrealGame-Win64-Shipping.exe
  "C:\Users\Admin\Desktop\Hexaquest_Minidemo2_Windows\Engine\Binaries\Win64\UnrealGame-Win64-Shipping.exe" ..\..\..\Hexaquest\Hexaquest.uproject
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:4184

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3556

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding B1471E2A8F2A74A28B994551737AB22F E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1376
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIE8ED.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240707859 10 CustomAction!CustomAction.CustomActions.InstallDirectX
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:3052
  - - C:\Windows\Installer\MSIE8ED.tmp-\DXSetup.exe
      "C:\Windows\Installer\MSIE8ED.tmp-\DXSetup.exe" /silent
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Drops file in Windows directory
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1928
    - - C:\Users\Admin\AppData\Local\Temp\DXEA7A.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DXEA7A.tmp\infinst.exe xinput1_3_x64.inf, Install_Driver
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3540
    - - C:\Users\Admin\AppData\Local\Temp\DXEA7A.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DXEA7A.tmp\infinst.exe X3DAudio1_7_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:6016
    - - C:\Users\Admin\AppData\Local\Temp\DXEA7A.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DXEA7A.tmp\infinst.exe D3DX9_43_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:1524
    - - C:\Users\Admin\AppData\Local\Temp\DXEA7A.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DXEA7A.tmp\infinst.exe d3dx10_43_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4924
    - - C:\Users\Admin\AppData\Local\Temp\DXEA7A.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DXEA7A.tmp\infinst.exe d3dx11_43_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:1672
    - - C:\Users\Admin\AppData\Local\Temp\DXEA7A.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DXEA7A.tmp\infinst.exe d3dcsx_43_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:4784
    - - C:\Users\Admin\AppData\Local\Temp\DXEA7A.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DXEA7A.tmp\infinst.exe D3DCompiler_43_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:5260
    - - C:\Users\Admin\AppData\Local\Temp\DXEA7A.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DXEA7A.tmp\infinst.exe XAudio2_7_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5656
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_7.dll
        5⤵
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:5524

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004E4
1⤵
PID:1108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e58c95b.rbs

Filesize
16KB

MD5
6f4124a36c6c78c167d85e57b94d3937

SHA1
6e25a5832a40771169f804a827e6806caf1e9ec2

SHA256
f35c8e8ab463a19c9e42af201dd83e80563a645512fcbfdc6c55e0491dbb238d

SHA512
d6d29e255b953bfcd2d31b078f5aff39856b33f349fd6e92080d6f6766e7dfd2350f99cdff75c16085d34b1431bc96731d045686ef839e9607bcac469e00815c

Download Submit
C:\Config.Msi\e58c960.rbs

Filesize
18KB

MD5
88ed94f1c46e67cac408cedeeba4e86e

SHA1
3d984ac01f08084650d5a0dccd1e63276067a42a

SHA256
cbaf565b23b8b6af40e53263b787af8de33b911548810e6b8c3ed9e21f15fbcb

SHA512
90662debc745b4290fc0d3c2f088312dce442cbae35f79326ea3e5905196ba773fb829e97eeb49a9dcf8abf8b0720dae2b7b2055e406854cd5e6da19b6b031a3

Download Submit
C:\Config.Msi\e58c96d.rbs

Filesize
20KB

MD5
fa1263d80dce4f422c5d6158fd48604a

SHA1
17514961f3ccf2dd98a095163791bb99d3dedc95

SHA256
5253ec96fc2435f15bd614f4bb938c59feca5524fd6d7228aaf71aaff7488f95

SHA512
29937f2baaa637a4b914c0469c286c3ea3212c722e7ba1cfce621ad45657db792e70f9206fdd7b92a6dfbbc4d6159f1d8badc3a0157e965a08137b4cdf0f596f

Download Submit
C:\Config.Msi\e58c97c.rbs

Filesize
19KB

MD5
9990f6dbcd12f6ca3e4862e733c55ee6

SHA1
d55eab6b3187ac93639e805139575b2483e85ff5

SHA256
6af65e8c8d2679ae4daa7a8e4cefa005e30adeb242dae2fd8d645d51d9b7fed4

SHA512
d8e82b5ed5cad0d2d2b633dd0078fd066a13c5638006d09ea8efbfd70d5ead1e5ca7c2086bf2f9f5e36d7ab1396f99351d4fbad06dd6d73d2faa361eb13f1f30

Download Submit
C:\Config.Msi\e58c983.rbs

Filesize
19KB

MD5
2fd28b756689fc02f45cd29b341529db

SHA1
a9bf238933d2c994e58af01d4ce1acdd982002c5

SHA256
bc21f0818791236da6dc6055b131a194aab77fb86f3ccc81b5a4be4eb4dee5cd

SHA512
ec090071736b44c5fbfdde16ea6752f91142adeaf55b1ddfbfc0ba7b2e60e064d45f6d9b37dfd21a0a080166a780f5b28d635a2c955d6cb3e1bad6b17c4a2ae2

Download Submit
C:\Config.Msi\e58c98f.rbs

Filesize
19KB

MD5
2ecd45287eed4d258028b11661ea8e04

SHA1
98ed7d3f0a0dd9ea83bd00bf5617299ff816e926

SHA256
246e4fe38d12449959f26b8ab43d58e61fb9d25d0a459fc6622a30a43be73b88

SHA512
d57a8bffc88826b7b34638ac67f314b3f199deba1819a30e48e7130ca07549944acb64ebf3416e274c6510f2f77dae8ff7eae912ca81b13a265f9bcec8cc5e35

Download Submit
C:\Config.Msi\e58c996.rbs

Filesize
21KB

MD5
64ccc5434c364f3c84186123c5215ebc

SHA1
4069b140c45bfe60aab0be2e40a1161c68192a36

SHA256
a9653e462d5fa12623be5bbef56b17da8db1bfd70354f6817dbe472193ffb853

SHA512
8fb379b0161789075608f41cda4b3775ff6094bc2d8e6a7e23ab43ecc6dbc9e66ba32bc8112982221963590aa62fa0204514168ab33f1d0f16fda1c7c0ef7f4b

Download Submit
C:\Config.Msi\e58c9a5.rbs

Filesize
21KB

MD5
5aab3ac02ad3e385bdf3975585a2d1c2

SHA1
713e2e9a022c5667fb646e1f5a22ecae93d3ea3d

SHA256
ad1169cfa958df23368333e374d9fc5b7fc9a70304c1f673c7bcc6c7d4e646bb

SHA512
da0a8353b0858cdadb412f113499e660404485f07abb8c05b29c1bb3c0452a605beca3e1bf806882621eb58a70fe0c5bb7eed3a8cb3fec7ecc236352b0f37e31

Download Submit
C:\Config.Msi\e58c9aa.rbs

Filesize
22KB

MD5
4e8fd1a7f1322a5c17ba6a13d1c7bf4a

SHA1
9fe38fcd562142435e512fa451ca7fc0b50f3aeb

SHA256
f1d98627b0cf995b18b3ba59f8b3192975044577c42f783b459f64ee6a1f2c7e

SHA512
a2156bbffff479bc2ee078a55b86030e2b4ae2ecf9a65010940f1269bc27e97176634dbc54537fbcf024c31db2599dbe7757d112a92b126787914a4b3eb2906a

Download Submit
C:\ProgramData\Package Cache\{410c0ee1-00bb-41b6-9772-e12c2828b02f}\state.rsm

Filesize
1KB

MD5
72942c2f9969ee5f44e14934e9a75563

SHA1
a3a8b61b5212b26cbc06992ad8a3fe689d84f5de

SHA256
d2f9176bb90b62b379708fbdb25d8f363010d4fffebec36e4d12b7a341ed9cc9

SHA512
0dc35f33ac8b7984e4af9a5e516c901a15ba52d88e0a7aa4349fff16863d2687b156a0dc2c0d639a228a53d6ac1fb99fc08f4cf3d65e583ec7efe2065bce49de

Download Submit
C:\ProgramData\Package Cache\{b24cae82-bb64-4ad2-820a-dc2c4031c914}\state.rsm

Filesize
738B

MD5
5bd587b153cbfe42b576c5eada33b5a1

SHA1
79f3f4bf36d2dd366ffabfc1c29ebb6a638821e6

SHA256
cffb41237576981f439fe4b11a61b7459642bef32220f857d4971a92c9ea7b16

SHA512
5d3f74c432c96ce4dd503e2a46333d7debcce9446310e8bf2194930ff8d3bb037b4a9768e1153f639dbf594557ee9d9e4e1825a945ae4dba9e851e4ac41bface

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5

Filesize
471B

MD5
4002ce675dddba684b4ca580fad695fc

SHA1
9bf02235759f0db2942040160bafc4a75bc14b8a

SHA256
4bea0830da47ecf752111b9d1d494815b53440e8860abf572538d8a7b1dcbb9e

SHA512
b3144add7001b527d131fe0e4fe51f82373ba96dcfeddadb0444b9e66679b595555de87a4476bf9a761103eddae987e83ac19dff7b5a87417379ce565b951df1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66AE3BFDF94A732B262342AD2154B86E_9040490E275779DE86373A998E4711FB

Filesize
471B

MD5
74c3ed68e3c07697663dba1e8a942553

SHA1
8482997dabb4e818dc9d43323877953a016ea958

SHA256
de1ec322880fb012b61569db2c93d370e729a3cdf7121d63f4728356f5e0ab0c

SHA512
e6eb277ea8ead838ae5cc1280c36c9320774dec832b0e41cd9a1ace9a7690ed965591cb6b30df1b71b17a985900745dd140289886937cc792e534cf48df8d043

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5

Filesize
404B

MD5
d41e41513f02f6c1f6da28ad0c0ccb44

SHA1
29ae2e5c192498b4bda7864661c9b4ad8100d6d8

SHA256
6e854946fd6dc6bc6eb419383e7af2d9b890455efa42ced34ec1a59973aced05

SHA512
85e64dbb86bb1dbea0fde1c1c8f947a0439d98b07c12d41dd67e1411d92d3f42e0101b8de59e05ca0bcc4c5f5df783bc64b60ffee070c650bf5c2e62289a2bee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_9040490E275779DE86373A998E4711FB

Filesize
404B

MD5
ac6867b5b6a8b73a7931046fd6db4704

SHA1
11017adae9357597d0b5c11bb8ed3c66d5aa515b

SHA256
825a567ac8ca0ba7aeff88da5719c45a93fc290c27428f2f1f889e8d8758970f

SHA512
9a8c2220c35c519f27b56367071c8a89f25e62f63ace113448c510b64a21f72578c97da49b98432fbdb53f35954d892f3e317040ea2328da723f835b78edb43d

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXEA7A.tmp\D3DCompiler_43.dll

Filesize
2.0MB

MD5
1c9b45e87528b8bb8cfa884ea0099a85

SHA1
98be17e1d324790a5b206e1ea1cc4e64fbe21240

SHA256
2f23182ec6f4889397ac4bf03d62536136c5bdba825c7d2c4ef08c827f3a8a1c

SHA512
b76d780810e8617b80331b4ad56e9c753652af2e55b66795f7a7d67d6afcec5ef00d120d9b2c64126309076d8169239a721ae8b34784b639b3a3e2bf50d6ee34

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXEA7A.tmp\FEB2010_X3DAudio_x64.inf

Filesize
815B

MD5
49460e9297b0faab5a5d73e7aa2caa67

SHA1
a7e211f3d4ae808f67a798924c4d3314183df873

SHA256
68351f03f4ef83e4b8c359e3e130441081690a1866b838a1b35d64674ef3abbf

SHA512
92c4c0751e9123e1eb09da312bc44041d13262e26cefb807dcd1b354c5bd12c0d7197f1d3d457ddef89714b77ffe45db9c717332963c6daa507ae02a6d5fc941

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXEA7A.tmp\FEB2010_X3DAudio_x86.inf

Filesize
1KB

MD5
e84adf38d499ae39090ad60fd76d76e3

SHA1
6af4d58bc04aac2723e8b97649f1b35fb1aca84c

SHA256
d4da3e530982812d1e2a31570b80af541fac1b13c72997d2aad7ea3bfeaf4a4a

SHA512
6714992e7aee7bd0798fbec68f92c97ee502127580e21e1b6693ed6737312b44dbc9fd9ef579fe552590e9e5a4904df94e4116334265a34699a04aa76ab87c24

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXEA7A.tmp\JUN2010_D3DCompiler_43_x64.inf

Filesize
830B

MD5
6494a3b568760c8248b42d2b6e4df657

SHA1
700f27ee4c74e9b9914f80b067079e09ec7c6a7f

SHA256
3e779533a273e3395109c7efac13ba1c804c01b3ddb16938406fbdf90d851216

SHA512
2bf68b123d7823ad7182e132d9e55f8de7580229e8e1b3b40030da50bb9bdeaf67bb9727ce2171fa83b7f804c24d9728ffabb44cb5017b16b771bb19e62b1b42

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXEA7A.tmp\JUN2010_D3DCompiler_43_x86.inf

Filesize
1KB

MD5
1a86443fc4e07e0945904da7efe2149d

SHA1
37a6627dbf3b43aca104eb55f9f37e14947838ce

SHA256
5dd568919e1b3cbcb23ab21d0f2d6c1a065070848aba5d2a896da39e55c6cbbf

SHA512
c9faa6bb9485b1a0f8356df42c1efe1711a77efa566eee3eb0c8031ece10ffa045d35adb63e5e8b2f79f26bf3596c54c0bd23fea1642faae11baf2e97b73cf5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXEA7A.tmp\JUN2010_XAudio_x64.inf

Filesize
923B

MD5
dd987135dcbe7f21c973077787b1f4f8

SHA1
ed8c2426c46c4516e37b5f9aac30549916360f7e

SHA256
1a0f1b929724f8b71d5ce922f19b9d539d2d804c89af947d5927b049ef0fd3d8

SHA512
f0469c94219b4df99d7b9b693161a736fa8eec88a3f6c7f2cf92fab2ade048dfe61fcde3a4cf4f7a2aaf841d079a46b17259dea22cfb02831983f55bd7f61899

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXEA7A.tmp\JUN2010_XAudio_x86.inf

Filesize
1KB

MD5
31d8732ac2f0a5c053b279adc025619f

SHA1
c8d6d2e88b13581b6638002e6f7f0c3a165fff3c

SHA256
d786d06a709d5dc26067132b9735fc317763fcf8064442d6f77f65012ba179da

SHA512
abc37922307f081a1ffdc956ce59598c19ad1939ecfb6ea3280aa6aa7a99c3eba5462731586ca262f7d7257d7d2a74ff57a45abf6b93521eb6f1c9f22f8eb244

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXEA7A.tmp\JUN2010_d3dcsx_43_x64.inf

Filesize
815B

MD5
e1f150f570b3fc5208f3020c815474c8

SHA1
7c75fc0cf3e3c4fd5045a94b624171d4e0d3b25c

SHA256
5289b5ad22146d7cc0c35cdb2c9662742693550de8f013d1ec40e944288d155a

SHA512
a53618ed6ebcd50ef074b320eb3ebd38af4770a82caa808e47cba6a81982ced46cf954a1c5a383f171006e727d8211b4fce54c9faf27b4c14a770a45a09037b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXEA7A.tmp\JUN2010_d3dcsx_43_x86.inf

Filesize
1KB

MD5
cf70b3dd13a8c636db00bd4332996d1a

SHA1
48dd8fc6fa3dae23cb6ca8113bc7ad837b4570d7

SHA256
d5200b332caf4fff25eb3d224527a3944878c5c3849512779a2afcfeae4c3ca1

SHA512
ae31a9e20743a2052deec5d696a555460a03d400720679ed103759241b25d55e2fbc247170da3c0c0891f32b131ab6a6845de56c2d3387ad233aa11db970b313

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXEA7A.tmp\JUN2010_d3dx10_43_x64.inf

Filesize
815B

MD5
13c1907a2cd55e31b7d8fb03f48027ec

SHA1
ca37872b9372543f1dbe09b8aa4e0e211a8e2303

SHA256
a65f370a741d62c2be0ca588758d089dd976092cb910bb6b1b7d008741e18377

SHA512
545aaf268d141e2aae6800e095a1ae4eafe6bfe492d95dfe03789ccb245cc3ef3f50f43b10a41a3b0efdc7f8c63621b437323e133ba881f90a3b940095b80208

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXEA7A.tmp\JUN2010_d3dx10_43_x86.inf

Filesize
1KB

MD5
53a24faee760e18821ef0960c767ab04

SHA1
4548db4234dbacbfb726784b907d08d953496ff9

SHA256
4d4263cbb11858c727824c4a071f992909675719be3076b4a47852bf6affd862

SHA512
8371471624f54db0aca3ea051235937fc28575c0f533b89f7d2204c776814d4cd09ee1a37b41163239885e878fb193133ad397fe3c18232ad3469626af2d2ed1

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXEA7A.tmp\JUN2010_d3dx11_43_x64.inf

Filesize
815B

MD5
590fe1ea1837b4bfb80dc8cb09e7815f

SHA1
792b5b0521c34c6b723a379dd6b3acf82f8afb1f

SHA256
2c4cf75b76203cba6378693668c8c00b564871c8bfd7fbda01e1e841477b2a3b

SHA512
80bee8f1ad5bfaba6b3ac5a39302a1427dbaa5919d76c89b279dc753170ec443924eadf454746ce331a6682ee729ab79bd390a5d3b55db8d08fd6f4869101f53

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXEA7A.tmp\JUN2010_d3dx11_43_x86.inf

Filesize
1KB

MD5
fb5d27c88b52dcbdbc226f66f0537573

SHA1
2cbf1012fbdcbbd17643f7466f986ecd3ce2688a

SHA256
3925c924eb4ec4f5a643b2d14d2eda603341fbbd22118cdd8ae04aaa96f443c0

SHA512
8aa2200f91eca91d7ee3221bc7c8f2a9c8d913a5d633aa00835d5fb243d9cb8afa60fe34a4c3daa0731a21914bc52266d05d6b80bfc30b2a255d7acdf0d18eb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXEA7A.tmp\JUN2010_d3dx9_43_x64.inf

Filesize
812B

MD5
ce097963fc345e9baa1c3b42f4bfa449

SHA1
e7624afc3a7718b02533b44edfe4f90d1afda62a

SHA256
272650a2d9b1cfea17021f4bf941b21f2206791e279070d4e906ce0ce56ac16f

SHA512
f3c4f00eebd9d465bc2415d59c417bca0f5a07c8e13880b28704f770763609a653d4b06f53d98325b66c2c7094895190900c47980f81463215e919f00966ee7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXEA7A.tmp\JUN2010_d3dx9_43_x86.inf

Filesize
1KB

MD5
a11deb327119b65bacce49735edc4605

SHA1
0be2d7fa6254b138aa53d9146cda8fedbba93764

SHA256
6b33d32da02f664092d44b05237990f825b4062c105a063badcf978648b5e95b

SHA512
b0134a3d6f2d576e5fafb601014ab66fef91d661013acc8a7a9129940369a1d9ed5c0f228bb1666a4e891f09b4b18e83f0cb2080047aa84fa45ab663e5739a31

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXEA7A.tmp\X3DAudio1_7.dll

Filesize
21KB

MD5
c811e70c8804cfff719038250a43b464

SHA1
ec48da45888ccea388da1425d5322f5ee9285282

SHA256
288c701bdedf1d45c63dd0b7d424a752f8819f90feb5088c582f76bc98970ba3

SHA512
09f2f4d412485ef69aceacc90637c90fad25874f534433811c5ed88225285559db1d981a3ab7bc3a20336e96fb43b4801b4b48a3668c64c21436ee3ea3c32f45

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXEA7A.tmp\XAPOFX1_5.dll

Filesize
72KB

MD5
8a4cebf34370d689e198e6673c1f2c40

SHA1
b7e3d60f62d8655a68e2faf26c0c04394c214f20

SHA256
becfdcd6b16523573cb52df87aa7d993f1b345ba903d0618c3b36535c3800197

SHA512
d612e2d8a164408ab2d6b962f1b6d3531aed8a0b1aba73291fa5155a6022d078b353512fb3f6fff97ee369918b1802a6103b31316b03db4fa3010b1bf31f35fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXEA7A.tmp\XAudio2_7.dll

Filesize
514KB

MD5
81dfddfb401d663ba7e6ad1c80364216

SHA1
c32d682767df128cd8e819cb5571ed89ab734961

SHA256
d1690b602cb317f7f1e1e13e3fc5819ad8b5b38a92d812078afb1b408ccc4b69

SHA512
7267db764f23ad67e9f171cf07ff919c70681f3bf365331ae29d979164392c6bc6723441b04b98ab99c7724274b270557e75b814fb12c421188fb164b8ca837c

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXEA7A.tmp\apr2007_xinput_x64.inf

Filesize
860B

MD5
94563a3b9affb41d2bfd41a94b81e08d

SHA1
17cad981ef428e132aa1d571e0c77091e750e0dd

SHA256
0d6e1c0e961d878b319ac30d3439056883448dcf26774003b73920f3377ecac8

SHA512
53cac179d7e11c74772e7b9bd7dd94ffbc810cfc25e28326e4d0844f3f59fd10d9089b44a88358ac6dbd09fb8b456a0937778f78ecc442645764f693ccd620b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXEA7A.tmp\apr2007_xinput_x86.inf

Filesize
1KB

MD5
e188f534500688cec2e894d3533997b4

SHA1
f073f8515b94cb23b703ab5cdb3a5cfcc10b3333

SHA256
1c798cb80e9e46ce03356ea7316e1eff5d3a88ccdd7cbfbfcdce73cded23b4e5

SHA512
332ccb25c5ed92ae48c5805a330534d985d6b41f9220af0844d407b2019396fcefea7076b409439f5ab8a9ca6819b65c07ada7bd3aa1222429966dc5a440d4f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXEA7A.tmp\d3dcsx_43.dll

Filesize
1.8MB

MD5
83eba442f07aab8d6375d2eec945c46c

SHA1
c29c20da6bb30be7d9dda40241ca48f069123bd9

SHA256
b46a44b6fce8f141c9e02798645db2ee0da5c69ea71195e29f83a91a355fa2ca

SHA512
288906c8aa8eb4d62440fe84deaa25e7f362dc3644dafc1227e45a71f6d915acf885314531db4757a9bf2e6cb12eaf43b54e9ff0f6a7e3239cabb697b07c25ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXEA7A.tmp\d3dx10_43.dll

Filesize
459KB

MD5
20c835843fcec4dedfcd7bffa3b91641

SHA1
5dd1d5b42a0b58d708d112694394a9a23691c283

SHA256
56fcd13650fd1f075743154e8c48465dd68a236ab8960667d75373139d2631bf

SHA512
561eb2bb3a7e562bab0de6372e824f65b310d96d840cdaa3c391969018af6afba225665d07139fc938dcff03f4f8dae7f19de61c9a0eae7c658a32800dc9d123

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXEA7A.tmp\d3dx11_43.dll

Filesize
242KB

MD5
8e0bb968ff41d80e5f2c747c04db79ae

SHA1
69b332d78020177a9b3f60cb672ec47578003c0d

SHA256
492e960cb3ccfc8c25fc83f7c464ba77c86a20411347a1a9b3e5d3e8c9180a8d

SHA512
7d71cb5411f239696e77fe57a272c675fe15d32456ce7befb0c2cf3fc567dce5d38a45f4b004577e3dec283904f42ae17a290105d8ab8ef6b70bad4e15c9d506

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXEA7A.tmp\d3dx9_43.dll

Filesize
1.9MB

MD5
86e39e9161c3d930d93822f1563c280d

SHA1
f5944df4142983714a6d9955e6e393d9876c1e11

SHA256
0b28546be22c71834501f7d7185ede5d79742457331c7ee09efc14490dd64f5f

SHA512
0a3e311c4fd5c2194a8807469e47156af35502e10aeb8a3f64a01ff802cd8669c7e668cc87b593b182fd830a126d002b5d5d7b6c77991158bffdb0b5b997f6b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXEA7A.tmp\dxdllreg_x86.inf

Filesize
724B

MD5
8272579b6d88f2ee435aeea19ec7603d

SHA1
6d141721b4b3a50612b4068670d9d10c1a08b4ac

SHA256
54e098294ef0ad3b14b9c77642838b5992fe4573099d8397a1ef566d9e36da40

SHA512
9f1311803db1607e079b037f49d8643daa43b59ce6eafb173b18d5a40239a5515091c92b244ffe9cfef2da20530fb15deb6cf5937633b434c3262e765d5a3b21

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXEA7A.tmp\dxupdate.dll

Filesize
168KB

MD5
94202f25810812f72953938552255fb8

SHA1
c1e88f196935d8affc1783ccf8b8954d7f2bfb62

SHA256
6dcad858cc3ff78d58c1dae5e93caf7d8bacb4f2fcf9e71bccb250bf32c7f564

SHA512
65b66d07ef68e0d1e79f236a4800c857e991ee3ff80ece4cfdd0b5f6083ea16f8a52d351c3af721cb05c06394ec91b4b5e3cfa4b0f0879f7549f3e3ed035e79e

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXEA7A.tmp\dxupdate.inf

Filesize
12KB

MD5
e6a74342f328afa559d5b0544e113571

SHA1
a08b053dfd061391942d359c70f9dd406a968b7d

SHA256
93f5589499ee4ee2812d73c0d8feacbbcfe8c47b6d98572486bc0eff3c5906ca

SHA512
1e35e5bdff1d551da6c1220a1a228c657a56a70dedf5be2d9273fc540f9c9f0bb73469595309ea1ff561be7480ee92d16f7acbbd597136f4fc5f9b8b65ecdfad

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXEA7A.tmp\infinst.exe

Filesize
81KB

MD5
a7ba8b723b327985ded1152113970819

SHA1
50be557a29f3d2d7300b71ab0ed4831669edd848

SHA256
8c62fe8466d9a24a0f1924de37b05d672a826454804086cddc7ed87c020e67ff

SHA512
60702f08fb621bf256b1032e572a842a141cf4219b22f98b27cb1da058b19b44cc37fb8386019463a7469961ca71f48a3347aaf1c74c3636e38d2aea3bca9967

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXEA7A.tmp\xinput1_3.dll

Filesize
79KB

MD5
77f595dee5ffacea72b135b1fce1312e

SHA1
d2a710b332de3ef7a576e0aed27b0ae66892b7e9

SHA256
8d540d484ea41e374fd0107d55d253f87ded4ce780d515d8fd59bbe8c98970a7

SHA512
a8683050d7758c248052c11ac6a46c9a0b3b3773902cca478c1961b6d9d2d57c75a8c925ba5af4499989c0f44b34eaf57abafafa26506c31e5e4769fb3439746

Download Submit
C:\Users\Admin\AppData\Local\Temp\UE_Prerequisites_(x64)_20240508202302_2_PrereqSetup.log

Filesize
2KB

MD5
9ee362a91202cbd2f278034c6774a468

SHA1
57c910146392d0d4c73cf7a87164d03e501ad80b

SHA256
e3f487a794d81131443290cae911f8099ae8be6a3d622821551fabe96db8f0c8

SHA512
d4e16d78b92253e6336cd7fb851c616a064c697da970db4cf71ece7f5a77b6dd400cca6396f99497f1e145fb70fa1902285ac9767eb0874817cd606765396ae0

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20240508202313_000_vcRuntimeMinimum_x64.log

Filesize
4KB

MD5
fca1b58b0d9ad72ac4e51bc10b3ffcbc

SHA1
e09534596499f45813875c93cdd2edf67bf6d29b

SHA256
975cc20f40d38f78c6d3bebd0763bf33559142be9398efcf8933ddb9ac6cea18

SHA512
d2e8c9e547a2e1ecb6a9e5dd70b20abe0527072f051daf471d072db7f068bf1bae13b60640d1c141ea026a4d5fad5ac80607564d31c9e282773c170afa1fadd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20240508202313_001_vcRuntimeAdditional_x64.log

Filesize
2KB

MD5
9fe913ac0a3679c4e3ef1e1dec119987

SHA1
0c9a13ba542747e34de16bd1de0042b67965e805

SHA256
119e372abe1115a3e61e66cf165af19383b085ba64a9cd2be5a75a1c4bc20d62

SHA512
69136a10780306c17c699fba8a56828e599edb569efb6bc27db0cf357ca43f77eb063a1d575534c206c524e0f78ee5486e31ed696b64fd4cc532d8756ed5726f

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20240508202308_000_vcRuntimeMinimum_x86.log

Filesize
2KB

MD5
b29c9392d55de4307599e2e794ac7e6e

SHA1
88ddd2299e85d11e33a7e3b09430591b6cb7ee45

SHA256
c6df08f600389ca966e2bd759f6872a00801c8baf9d76878f7d72f31521522e6

SHA512
4c3db3376d14c99cae934e3cc3839f657feaf30c7357cb21a0819bcadadcf2f53e9503551c6afbb2a08707b08670408b294a1b3fc6fd5702ef81f20956e6b86b

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20240508202308_001_vcRuntimeAdditional_x86.log

Filesize
2KB

MD5
0d4b1afd3efd03b9e37fa161ab78f1b4

SHA1
cf1612fdd15c8e4345e6cb572c5afbedf55800a5

SHA256
c319f8dd20fc36799489d074d7507ea6b34ca7a1f514875419901f32bfb7585d

SHA512
d55d609a9743a2d2de437a34c912fb47b4bf1ed1e33641df589ba7a3d78d385443ddc9869d63cfb9cab8cca021c706fe61d556d8db96f36af315b16bca9c58fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\{b24cae82-bb64-4ad2-820a-dc2c4031c914}\.ba1\Banner.bmp

Filesize
123KB

MD5
87300b4c1b1d79f75e3c406043d73acb

SHA1
de7ed5119f1caf8d11d30810c28031b37d1485aa

SHA256
b76bbf9f7b8da4ca886f3b97d7db00ab1d38a9bb3b9567f4e1c3e30203098add

SHA512
1d482404dcbcb3326e0efa4cdf46253be374f83d5c0f1051c15d4b1625b4e1e61adf017d037f8f4cc643e205be657cf5cc4edeb566f7eb44a89729ee050280da

Download Submit
C:\Users\Admin\AppData\Local\Temp\{b24cae82-bb64-4ad2-820a-dc2c4031c914}\.ba1\LogoSide.png

Filesize
6KB

MD5
702684ff196740ebaedb34beca30346f

SHA1
1f3af4bdac42b973b05dc121fc00c804aa3c28ec

SHA256
988c657d1cc77aceb4804c5217bf756eaa2b4defcb4d03f47aea83ccda3d3672

SHA512
ff4eec96f733ed32280123f5a6bff4a488eab4586a9740416125ceef1b4e1ce85dddb4524589111d1c6c57fb9d561a3586b637f8b17e8ff8dd2bf736b484b676

Download Submit
C:\Users\Admin\AppData\Local\Temp\{b24cae82-bb64-4ad2-820a-dc2c4031c914}\.ba1\wixstdba.dll

Filesize
135KB

MD5
36b53c5299a3b39e5c9cdbbd28a09506

SHA1
9f4c767ef7ea887a88a698bcd66e4ba691e1c17a

SHA256
97f1901e7c928b9231e503cd3a1315f0d8449356b9f25e7eb4c2cebeee72012a

SHA512
af4c7cea8bebe0f125b59eed11fa0053178dd546784f68ad7a642eb128ed0d05dd6ccfe685b912381b61becf9c336dcbbc8c4ce56884a511f3f0a69826d8de83

Download Submit
C:\Users\Admin\AppData\Local\Temp\{b24cae82-bb64-4ad2-820a-dc2c4031c914}\.be\UEPrereqSetup_x64.exe

Filesize
497KB

MD5
def79c36658e7d5bb8065d280190a564

SHA1
0807f08fa7681fb534af77d761861a200a111162

SHA256
43fe3b23e59b950dac1d8fedf7f5d2e99dcef6f40afab161fe0686637f1ff1d5

SHA512
456603d960c8cbe87c33ac26ecbe63a1730036b8799cf3551afa654924d9e01e6f86253ec1a38f30ed94bcce92190da7b91b2467c108a8f83d3a24df473fba6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\{b24cae82-bb64-4ad2-820a-dc2c4031c914}\PrereqSetup

Filesize
11.4MB

MD5
7930d3b684b94f1a46b31586def75e03

SHA1
c0cd7dcca2b3cc1ea69bf5ba7de36617fca0d071

SHA256
d4a01987dfb3c754183e39fe5b91ad005c404b5207ec04cb5006f930fe1c425e

SHA512
c0c2ac227e00a00b5a74863b307b424595aabc79171f5e98a39cab0bf490ffb140a1dfe2ec10f8ab5cd0962ff3b5dc582948a05ff1504d2b325efbe9146a161c

Download Submit
C:\Users\Admin\AppData\Local\Temp\{b24cae82-bb64-4ad2-820a-dc2c4031c914}\VisualStudioRedist_X64

Filesize
24.2MB

MD5
077f0abdc2a3881d5c6c774af821f787

SHA1
c483f66c48ba83e99c764d957729789317b09c6b

SHA256
917c37d816488545b70affd77d6e486e4dd27e2ece63f6bbaaf486b178b2b888

SHA512
70a888d5891efd2a48d33c22f35e9178bd113032162dc5a170e7c56f2d592e3c59a08904b9f1b54450c80f8863bda746e431b396e4c1624b91ff15dd701bd939

Download Submit
C:\Users\Admin\AppData\Local\Temp\{b24cae82-bb64-4ad2-820a-dc2c4031c914}\VisualStudioRedist_X86

Filesize
13.2MB

MD5
ae427c1329c3b211a6d09f8d9506eb74

SHA1
c9b5b7969e499a4fd9e580ef4187322778e1936a

SHA256
5365a927487945ecb040e143ea770adbb296074ece4021b1d14213bde538c490

SHA512
ec70786704ead0494fab8f7a9f46554feaca45c79b831c5963ecc20243fa0f31053b6e0ceb450f86c16e67e739c4be53ad202c2397c8541365b7252904169b41

Download Submit
C:\Windows\Installer\MSIE8ED.tmp

Filesize
6.7MB

MD5
e69270f3abf17b33c77c3c32b6c76386

SHA1
11416941e1bcd9a09933b65c686757c67c22b6e8

SHA256
6c6caebaad811afccb12245b82ea20fa4a252f53c7ed473cb487fd3880d88539

SHA512
e17fee04d64679d6ee6216a8a4b74c045f83e6cd25d536b2ae8df117cbbb7df2d65268828c3df393cadedbe60af3bba526cfdd853622493b75a6920814b37e46

Download Submit
C:\Windows\Installer\MSIE8ED.tmp-\CustomAction.dll

Filesize
4KB

MD5
4893ad3c056c8c1c3e917e96d1147581

SHA1
2ff48310044f7942d6f869162ac6dc3c2fdb39bf

SHA256
70fe34100f7c39a5853f37f60a5d10c2ddb8c83b61a14ddd7fa52ae8bb50d6ce

SHA512
9530e1ec1e1fad90e660d86f70851b13e9989f50f1997522c3886a13520dbc5ef19ee8f58ee1f5ab27cd5be9e76e2b151ed493d5a8b28873454eae0cdee8886d

Download Submit
C:\Windows\Installer\MSIE8ED.tmp-\DSETUP.dll

Filesize
87KB

MD5
9e0711bed229b60a853bcc5d10deaafc

SHA1
2bea53988bd35c5df5c9edcef0bc234c37289477

SHA256
def6f245762be36cf18b435ba8b7ebc224b9c21d1a1db606a8e8fafdaa97bba0

SHA512
c0b31872e52c8f4270d991c70d1a1c9ef9a4bbee4807c54c05a449cd1607506ab16ff1e74b378651b36e3276322c86cd843565c8a1aa33a49c47322ef4df0185

Download Submit
C:\Windows\Installer\MSIE8ED.tmp-\DXSETUP.exe

Filesize
524KB

MD5
ddce338bb173b32024679d61fb4f2ba6

SHA1
50e51f7c8802559dd9787b0aebc85f192b7e2563

SHA256
046041aba6ba77534c36bb0c2496408d23c6a09f930c46b392f1edc70dfd66de

SHA512
7a63925278332c8e7949555383b410d8848a7834b85f34d659e351ba78cbe4d2ec09caccb2178d801b9b68725c9cbae48a6a1f07f0804a0c41eb51df79b7eca4

Download Submit
C:\Windows\Installer\MSIE8ED.tmp-\dsetup32.dll

Filesize
1.7MB

MD5
0f58ccd58a29827b5d406874360e4c08

SHA1
ba804292580be6186774e7f92e6dfb104e46bf25

SHA256
642d9e7db6d4fc15129f011dce2ea087bf7f7fb015aececf82bf84ff6634a6fb

SHA512
3e3d4f2de5dc5addc86765a2f888487ea0c9ee0208fac60187ddaa9a2bfd73cfd7734836d32805fa43222470c8f6cb9a10e2a099aef72c67ad7c789096e57ce4

Download Submit
C:\Windows\Installer\MSIE8E~1.TMP\Apr2007_xinput_x64.cab

Filesize
94KB

MD5
743b333c2db3d4cf190fb39c29f3c346

SHA1
26b3616d7321978bd45656391a75ee231196a4a2

SHA256
e7a09f8235cc587cc63f583e39fbc75008d9677c8bb4dcc11cb8d0178a5153ac

SHA512
77fbdb86c79d7228bca2982a3285a417a365af980488a5ac2d470b532fa59fcc15e0e8dbee6eb1a3a5256fc29e0e3391529cd2ac13e0f72987ee0da136000957

Download Submit
C:\Windows\Installer\MSIE8E~1.TMP\Apr2007_xinput_x86.cab

Filesize
52KB

MD5
c234df417c9b12e2d31c7fd1e17e4786

SHA1
92f32e74944e5166db72d3bfe8e6401d9f7521dd

SHA256
2acea6c8b9f6f7f89ec51365a1e49fbd0d8c42c53418bd0783dbf3f74a744e6d

SHA512
6cbae19794533ad9401f92b10bd9549638ba20ce38375de4f9d0e20af20d78819e46856151cc6818325af9ac774b8128e18fbebd2da5da4efbd417fc2af51dab

Download Submit
C:\Windows\Installer\MSIE8E~1.TMP\Feb2010_X3DAudio_x64.cab

Filesize
53KB

MD5
db47136a200e326174ce790359596eb6

SHA1
fabca8c0aa28164ef4fdb7ee4ae8942a275b1713

SHA256
832b6d48e169b4725ae482ea4d1c3360a09631a89b2fac3aba81a50805a50adc

SHA512
f3b04168ca14ad4586493ea985417cce43ee11f37aa1856e714f44e132a31dbb84934943b947cf0b2aa39344e183cba8b6f49431b4471bd0e623926def94cb8f

Download Submit
C:\Windows\Installer\MSIE8E~1.TMP\Feb2010_X3DAudio_x86.cab

Filesize
20KB

MD5
88dfbb4c1876e80a1864265c61c7a7fd

SHA1
c6ee8cff225019a93308c896146d94b00fd5417e

SHA256
acba5c4d4ac90e1df1c8404be5ff780e24238153cb410af909cd4364d213f2a9

SHA512
35e564aeeb6e462221a36cfa680e7e932333b0b92b0115ce5306ff59784abb13b8f7527fdd686737170425f2719f2d3a6901dc9822af4d537d9b5377b6bf89e4

Download Submit
C:\Windows\Installer\MSIE8E~1.TMP\Jun2010_d3dcsx_43_x86.cab

Filesize
744KB

MD5
44dba9557f956787b66f285776c3dccb

SHA1
4560c64f8b6bbdeedd85398f2e18404c389e4d8b

SHA256
e2c5a2cbba7f211b6ca72ff8e5f69cba1f83be06357311b19e64f582fd3d14e4

SHA512
25fbc95346bac890fee8d2a0805015af1eda5e0bb17b12d4eef52ca446775d08898fe5c13239e983a0f8c8dd13f8f2a5247a70e8e785e2bae42ff5ab1cca4156

Download Submit
C:\Windows\Installer\MSIE8E~1.TMP\Jun2010_d3dx10_43_x64.cab

Filesize
230KB

MD5
2d9586b276a561924ff2335fccaee914

SHA1
3b8114a8820a8df9df2321d6c4da8ea155ce736f

SHA256
efce48d425c07f1faad4a55d7061a01ed6245aac17f43163cf2a23cbc9a3054b

SHA512
d78ad87685eb71d2eb8c68e1e2c7fd5a90250f04059dd0016e4c8ca01bf53c02dea01998fe6de9ae3a3f76b2964d14a61e694546a2e6844bb304c315ae5b80e2

Download Submit
C:\Windows\Installer\MSIE8E~1.TMP\Jun2010_d3dx10_43_x86.cab

Filesize
192KB

MD5
a89b98ab89e0d4ff9dae412d49e27c51

SHA1
18803d4bcc83ad39f25ff9f899baf136c89c10f1

SHA256
a8cf71ffb80b683616d0621be96d3795b0ffda3877ed2d80cd958bfa393ddcfc

SHA512
0b96a04663d2fbfb21901af832a5362785fb0270d1be0ef136549f07e2625653f8facd129889a5f3489fc8a1270abe474e4f1626ea630a3185a36812545b4dfd

Download Submit
C:\Windows\Installer\MSIE8E~1.TMP\Jun2010_d3dx11_43_x64.cab

Filesize
134KB

MD5
96e7847a914afcb489194940b06a5c23

SHA1
9439907a1000b9dcb8989ffbd828e6294c277fba

SHA256
c1d0d56b83bfb09a5e1a89e1898bb74446a847b30a968f3664ec2d87368eb63e

SHA512
638485084884fab9d8952af17b24c4aef16dd026c75256026859bfe4f24d7f11fd2240cde8c5de0dab8968885a6d344da7335be257570e947bf5da8ac06f61ad

Download Submit
C:\Windows\Installer\MSIE8E~1.TMP\Jun2010_d3dx11_43_x86.cab

Filesize
106KB

MD5
758c5a459978cb2c68a300a60da153be

SHA1
66d12509137f2b5e1a668df39e6ccce6402822c3

SHA256
a58cefe822e371d078eaf89319f832693352ba7d62079320074397f0f3425961

SHA512
f33d6fd3354310e6cc4b483eae955a9652e7f71ceef7c444bdef84251ffa6ec0b89886a2344d18e0a1ad5285123ad808904372289e1e1c8d14242483f0426588

Download Submit
C:\Windows\Installer\MSIE8E~1.TMP\Jun2010_d3dx9_43_x64.cab

Filesize
915KB

MD5
063fa6f7061324eac1c4de0350c20e80

SHA1
daccf01b4b7493b88f04f9e50fe37c03846335ad

SHA256
9b98a1269af7f3a0007bfdc73206a47a6ee158d34ba8a87009396c18186bb06a

SHA512
3ad31100cbca4da52e46518e577dca94b595f9d47a3e9552cd764905ffc2876f9127b69a97bac44dbd754021e14ddec65480b7628a3768f03e53de8fbb08c547

Download Submit
C:\Windows\Installer\MSIE8E~1.TMP\Jun2010_d3dx9_43_x86.cab

Filesize
750KB

MD5
7749862c307e527366b6868326db8198

SHA1
bce9f21cdb1e101c7223c9e62eca61ec22d6bb81

SHA256
fcc6cf0966b4853d6fa3d32ab299cde5a9824feaecb0d4f34ea452fb9fd1c867

SHA512
b65a84535b749ade0f8ea1a8ab6239df8e82ad59cbdb07487fdbfcfcf57a565f493f56378e216859a081d23ddf7c671636f53ef821289d66452f09218080f02b

Download Submit
C:\Windows\Installer\MSIE8E~1.TMP\dxdllreg_x86.cab

Filesize
41KB

MD5
a025c67403dc2c2bcd709aa9435faeb1

SHA1
0433ee289e96a0d83a0c66ec35cf906a3e063884

SHA256
8ad77a4d9c76f65cd62337588f847cc1e0ca6ca9735937f3a781f7395e9566a1

SHA512
56bced81de59d413238b01396fafa6442ef6db0afaf237a699966df4753ed1a0b555450fa308f6965689a67f9fb5efb5d377d5f602a8d453ecceddca41072b45

Download Submit
C:\Windows\Installer\MSIE8E~1.TMP\dxupdate.cab

Filesize
91KB

MD5
8adf5a3c4bd187052bfa92b34220f4e7

SHA1
b52be74c4489159bd343d3c647f28da1fd13d9b9

SHA256
13393a91201e69e70a9f68d21428453fff3951535dec88f879270269cfe54d6f

SHA512
3e2f2fe4b5742a4cf6ee2f6b8c0ca734fd0b3c5431dff112c907231846dd3eebee7b9b8117f0256119614282cc7a4896474a199563078481d48a1204ca96f92d

Download Submit
C:\Windows\Logs\DirectX.log

Filesize
77KB

MD5
1d6d06ae051680aa4eb475faad8d1e69

SHA1
04f69f1d24a05e822fdeb97d19d43200e054ce37

SHA256
08e566d37aa712df323405288da2cf631bd7985327169257ba4ba74dcbc3fc02

SHA512
d8767772364c3e8d638e4e1c6f117c9532e5ff5a9041da9e837cb683bd1ca6fa312466cf2e829b664c08879a06e1973ad58d222802dadc1dc867efcaf88e8cc9

Download Submit
C:\Windows\Temp\{0917146A-9470-4313-9D3E-320416D936E5}\.ba\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Windows\Temp\{0917146A-9470-4313-9D3E-320416D936E5}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
C:\Windows\Temp\{0917146A-9470-4313-9D3E-320416D936E5}\cab54A5CABBE7274D8A22EB58060AAB7623

Filesize
800KB

MD5
f706d550cf905648ccb55b47e1364022

SHA1
3c382bfe0c4c14c1ed6cbe88d6a69ad6be28a08f

SHA256
7be2d324f0cb063be8335982096f17ed4f08a7592130e04459ae818824016589

SHA512
3c946d88447504c94227fec259bbeed7ef458a0740c12345e425821644f8e0d9358b68582a1f6e1b74597b5dfd2976f328b706a72df30e3c76c899cd435a349a

Download Submit
C:\Windows\Temp\{0917146A-9470-4313-9D3E-320416D936E5}\cabB3E1576D1FEFBB979E13B1A5379E0B16

Filesize
4.9MB

MD5
d141d64b6a3287548847abf5b4c1bc7e

SHA1
a161b984bb24d135353701e445a6a0babc5d25b3

SHA256
e38280421473e79ebaaa8398d86974fc7100cc8ec1c3273fb9bfe4f672c918a6

SHA512
282f64d928e19cf107b19ad39da1150045b60efb9ad599d827f9dde5f20a5bb499ea5996464a1f2ac79c21ec9af9307a363072f172f92c6669ea00c0ec48753f

Download Submit
C:\Windows\Temp\{0917146A-9470-4313-9D3E-320416D936E5}\vcRuntimeAdditional_x86

Filesize
180KB

MD5
df1b1ee46deb824a89f18e228f8a4a41

SHA1
001d86480ce0a9e1b2fed8c48296bb3384dad793

SHA256
ff8884498c3174b7d2bd35bd1a43d75d3538dca2c0821ca5876fa45eb2c8a47f

SHA512
6587452fa6ebef2eac6634cd3c6d8629cdcd9f214a5a13cfbebfd232318a3a5d3cd5d3c9baa721270f5283d3127d36475d40071132ba063bdda49bc48cc21fab

Download Submit
C:\Windows\Temp\{0917146A-9470-4313-9D3E-320416D936E5}\vcRuntimeMinimum_x86

Filesize
180KB

MD5
7c87329a66d4c22f03acea4e817971f9

SHA1
12a2134fa09fd7df026ffc20bfe58a7d30d6ae73

SHA256
c78bc45113d0270c2154930761c3b74db714987a16c0fbe5e7a05fa3a853d0c8

SHA512
73f11aa3f9b3dbfba157a0d47dc61ff2a22509b61339882a9c2cee53ee335b18820700d7a413b81b426e71c83443f0d99bea8b3638b8b87ee9a42f01f404f955

Download Submit
C:\Windows\Temp\{C7BCD7F2-9141-43AC-B34D-6AF21FE30328}\cab2C04DDC374BD96EB5C8EB8208F2C7C92

Filesize
5.4MB

MD5
46efc5476e6d948067b9ba2e822fd300

SHA1
d17c2bf232f308e53544b2a773e646d4b35e3171

SHA256
2de285c0fc328d30501cad8aa66a0ca9556ad5e30d03b198ebdbc422347db138

SHA512
58c9b43b0f93da00166f53fda324fcf78fb1696411e3c453b66e72143e774f68d377a0368b586fb3f3133db7775eb9ab7e109f89bb3c5e21ddd0b13eaa7bd64c

Download Submit
C:\Windows\Temp\{C7BCD7F2-9141-43AC-B34D-6AF21FE30328}\cab5046A8AB272BF37297BB7928664C9503

Filesize
935KB

MD5
c2df6cb9082ac285f6acfe56e3a4430a

SHA1
591e03bf436d448296798a4d80f6a39a00502595

SHA256
b8b4732a600b741e824ab749321e029a07390aa730ec59401964b38105d5fa11

SHA512
9f21b621fc871dd72de0c518174d1cbe41c8c93527269c3765b65edee870a8945ecc2700d49f5da8f6fab0aa3e4c2db422b505ffcbcb2c5a1ddf4b9cec0e8e13

Download Submit
C:\Windows\Temp\{C7BCD7F2-9141-43AC-B34D-6AF21FE30328}\vcRuntimeAdditional_x64

Filesize
188KB

MD5
dd070483eda0af71a2e52b65867d7f5d

SHA1
2b182fc81d19ae8808e5b37d8e19c4dafeec8106

SHA256
1c450cacdbf38527c27eb2107a674cd9da30aaf93a36be3c5729293f6f586e07

SHA512
69e16ee172d923173e874b12037629201017698997e8ae7a6696aab1ad3222ae2359f90dea73a7487ca9ff6b7c01dc6c4c98b0153b6f1ada8b59d2cec029ec1a

Download Submit
C:\Windows\Temp\{C7BCD7F2-9141-43AC-B34D-6AF21FE30328}\vcRuntimeMinimum_x64

Filesize
188KB

MD5
a4075b745d8e506c48581c4a99ec78aa

SHA1
389e8b1dbeebdff749834b63ae06644c30feac84

SHA256
ee130110a29393dcbc7be1f26106d68b629afd2544b91e6caf3a50069a979b93

SHA512
0b980f397972bfc55e30c06e6e98e07b474e963832b76cdb48717e6772d0348f99c79d91ea0b4944fe0181ad5d6701d9527e2ee62c14123f1f232c1da977cada

Download Submit
C:\Windows\Temp\{E404D3E8-214F-4FD2-8F47-F14607B9954E}\.cr\VC_redist.x64.exe

Filesize
635KB

MD5
35e545dac78234e4040a99cbb53000ac

SHA1
ae674cc167601bd94e12d7ae190156e2c8913dc5

SHA256
9a6c005e1a71e11617f87ede695af32baac8a2056f11031941df18b23c4eeba6

SHA512
bd984c20f59674d1c54ca19785f54f937f89661014573c5966e5f196f776ae38f1fc9a7f3b68c5bc9bf0784adc5c381f8083f2aecdef620965aeda9ecba504f3

Download Submit
C:\Windows\Temp\{F35AB53B-561B-4FCC-BB03-BFF989BB6D61}\.cr\VC_redist.x86.exe

Filesize
634KB

MD5
415e8d504ea08ee2d8515fe87b820910

SHA1
e90f591c730bd39b8343ca3689b2c0ee85aaea5f

SHA256
e0e642106c94fd585782b75d1f942872d2bf99d870bed4216e5001e4ba3374c0

SHA512
e51f185c0e9d3eb4950a4c615285c6610a4977a696ed9f3297a551835097b2122566122231437002c82e2c5cf72a7a8f67362bff16b24c0abe05fe35dddbf6a1

Download Submit
memory/3052-530-0x000001FB3DF50000-0x000001FB3DF80000-memory.dmp

Filesize
192KB

Download
memory/3052-534-0x000001FB3DF40000-0x000001FB3DF46000-memory.dmp

Filesize
24KB

Download
memory/4184-2296-0x000001F5B8520000-0x000001F5B8521000-memory.dmp

Filesize
4KB

Download
memory/4184-2288-0x000001F5B8520000-0x000001F5B8521000-memory.dmp

Filesize
4KB

Download
memory/4184-2287-0x000001F5B8520000-0x000001F5B8521000-memory.dmp

Filesize
4KB

Download
memory/4184-2286-0x000001F5B8520000-0x000001F5B8521000-memory.dmp

Filesize
4KB

Download
memory/4184-2298-0x000001F5B8520000-0x000001F5B8521000-memory.dmp

Filesize
4KB

Download
memory/4184-2297-0x000001F5B8520000-0x000001F5B8521000-memory.dmp

Filesize
4KB

Download
memory/4184-2295-0x000001F5B8520000-0x000001F5B8521000-memory.dmp

Filesize
4KB

Download
memory/4184-2294-0x000001F5B8520000-0x000001F5B8521000-memory.dmp

Filesize
4KB

Download
memory/4184-2293-0x000001F5B8520000-0x000001F5B8521000-memory.dmp

Filesize
4KB

Download
memory/4184-2292-0x000001F5B8520000-0x000001F5B8521000-memory.dmp

Filesize
4KB

Download