Overview

overview

8

Static

static

8

MSI%20Cent...4.appx

windows11-21h2-x64

8

Resubmissions

30/04/2026, 04:31

260430-e5jjnaew3j8

30/04/2026, 03:53

260430-ef6mwsev2p8

Analysis

  • user interaction
    yes
  • max time kernel
    300s
  • max time network
    318s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    30/04/2026, 04:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    MSI%20Center_2.0.69.0_x64.appx
  • Size 535.1MB
  • Sample260430-e5jjnaew3j
  • SHA256 10bf13d718115aee900c53a1334f1734129c221cc70bacb1f80ae14fee400f8d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
bootkitdefense_evasiondiscoveryexecutioninstallerpersistenceprivilege_escalationransomwarespywaretrojan

Malware Config

Signatures

  • Modifies Windows Firewall 2 TTPs 9 IoCs
    defense_evasion
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 51 IoCs
  • Loads dropped DLL 53 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 44 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 27 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 35 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 13 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 8 IoCs
  • Kills process with taskkill 7 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    defense_evasionspywaretrojan
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 14 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
    powershell start shell:AppsFolder\9426MICRO-STARINTERNATION.MSICenter_kzh8wxbdkxb8p!App
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4976
  • C:\Program Files\WindowsApps\9426MICRO-STARINTERNATION.MSICenter_2.0.69.0_x64__kzh8wxbdkxb8p\DCv2\DCv2.exe
    "C:\Program Files\WindowsApps\9426MICRO-STARINTERNATION.MSICenter_2.0.69.0_x64__kzh8wxbdkxb8p\DCv2\DCv2.exe"
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3316
    • C:\Users\Admin\AppData\Local\Packages\9426MICRO-STARINTERNATION.MSICenter_kzh8wxbdkxb8p\LocalCache\Local\MSI Center.exe
      "C:\Users\Admin\AppData\Local\Packages\9426MICRO-STARINTERNATION.MSICenter_kzh8wxbdkxb8p\LocalCache\Local\MSI Center.exe" a
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1356
      • C:\Users\Admin\AppData\Local\Packages\9426MICRO-STARINTERNATION.MSICenter_kzh8wxbdkxb8p\LocalCache\Local\MSI Center SDK.exe
        "C:\Users\Admin\AppData\Local\Packages\9426MICRO-STARINTERNATION.MSICenter_kzh8wxbdkxb8p\LocalCache\Local\MSI Center SDK.exe" /verysilent /norestart /log="C:\Program Files (x86)\MSI\MSI Center\Log\Setup\SDK_3.2026.0410.01_20260430054139.txt"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2840
        • C:\Users\Admin\AppData\Local\Temp\is-HC9NE.tmp\MSI Center SDK.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-HC9NE.tmp\MSI Center SDK.tmp" /SL5="$60060,233025655,379904,C:\Users\Admin\AppData\Local\Packages\9426MICRO-STARINTERNATION.MSICenter_kzh8wxbdkxb8p\LocalCache\Local\MSI Center SDK.exe" /verysilent /norestart /log="C:\Program Files (x86)\MSI\MSI Center\Log\Setup\SDK_3.2026.0410.01_20260430054139.txt"
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1932
          • C:\Users\Admin\AppData\Local\Temp\is-K9IP0.tmp\VC_redist.x86.exe
            "C:\Users\Admin\AppData\Local\Temp\is-K9IP0.tmp\VC_redist.x86.exe" /install /quiet /norestart
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1004
            • C:\Windows\Temp\{BD77FAD8-3085-4A82-B35B-27E5121A8918}\.cr\VC_redist.x86.exe
              "C:\Windows\Temp\{BD77FAD8-3085-4A82-B35B-27E5121A8918}\.cr\VC_redist.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-K9IP0.tmp\VC_redist.x86.exe" -burn.filehandle.attached=564 -burn.filehandle.self=572 /install /quiet /norestart
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2316
              • C:\Windows\Temp\{E3E7C2DE-C417-4457-9F54-7B8D8516A28F}\.be\VC_redist.x86.exe
                "C:\Windows\Temp\{E3E7C2DE-C417-4457-9F54-7B8D8516A28F}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{6B005E4B-A3E7-4F4B-85A2-7DC085B9097E} {6C23D088-11EA-43BB-955C-91D3DB150D14} 2316
                7⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:5888
                • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
                  "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={410c0ee1-00bb-41b6-9772-e12c2828b02f} -burn.filehandle.self=964 -burn.embedded BurnPipe.{87BEB316-9CB7-4688-96F2-A0E1A72944D0} {A60C2D7D-64C3-428C-A57C-71B83596856A} 5888
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:5828
                  • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
                    "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=544 -burn.filehandle.self=560 -uninstall -quiet -burn.related.upgrade -burn.ancestors={410c0ee1-00bb-41b6-9772-e12c2828b02f} -burn.filehandle.self=964 -burn.embedded BurnPipe.{87BEB316-9CB7-4688-96F2-A0E1A72944D0} {A60C2D7D-64C3-428C-A57C-71B83596856A} 5888
                    9⤵
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:1052
                    • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
                      "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{0B7CE055-55E5-4931-B0EC-DB88950FDAD0} {E4051799-1D54-4F70-92ED-AF42481A063E} 1052
                      10⤵
                      • System Location Discovery: System Language Discovery
                      • Modifies registry class
                      PID:2220
          • C:\Users\Admin\AppData\Local\Temp\is-K9IP0.tmp\VC_redist.x64.exe
            "C:\Users\Admin\AppData\Local\Temp\is-K9IP0.tmp\VC_redist.x64.exe" /install /quiet /norestart
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1544
            • C:\Windows\Temp\{5F0FA54A-AD94-447B-991C-DB3EA83BBC60}\.cr\VC_redist.x64.exe
              "C:\Windows\Temp\{5F0FA54A-AD94-447B-991C-DB3EA83BBC60}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-K9IP0.tmp\VC_redist.x64.exe" -burn.filehandle.attached=564 -burn.filehandle.self=572 /install /quiet /norestart
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4784
              • C:\Windows\Temp\{FFBA66AC-8D09-43BF-BA5D-C435CE0BF32C}\.be\VC_redist.x64.exe
                "C:\Windows\Temp\{FFBA66AC-8D09-43BF-BA5D-C435CE0BF32C}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{92E6A4E9-BE80-4F56-B4FC-47F700E682F9} {18AF5403-55E9-4187-9E02-3D5C65270280} 4784
                7⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • Modifies registry class
                • Suspicious use of WriteProcessMemory
                PID:1060
                • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                  "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={8bdfe669-9705-4184-9368-db9ce581e0e7} -burn.filehandle.self=952 -burn.embedded BurnPipe.{061F23C7-1233-43DA-A8B7-BCBD648A49EA} {95C4FAF7-D12A-4940-9D56-A2A679425E96} 1060
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:3732
                  • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                    "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=544 -burn.filehandle.self=560 -uninstall -quiet -burn.related.upgrade -burn.ancestors={8bdfe669-9705-4184-9368-db9ce581e0e7} -burn.filehandle.self=952 -burn.embedded BurnPipe.{061F23C7-1233-43DA-A8B7-BCBD648A49EA} {95C4FAF7-D12A-4940-9D56-A2A679425E96} 1060
                    9⤵
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:2632
                    • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                      "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{19F53487-1106-40B3-85BB-3189B96EBEFD} {0FFDFE02-FA71-417C-8F12-04D3D1447BB7} 2632
                      10⤵
                      • System Location Discovery: System Language Discovery
                      PID:1548
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im MSI.NotifyServer.exe /t
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:5096
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im MSI.ToastServer.exe /t
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:5492
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im MSI.CentralServer.exe /t
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:1036
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im MSI.TerminalServer.exe /t
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:4296
          • C:\Users\Admin\AppData\Local\Temp\is-K9IP0.tmp\PrePackage\Case_1.0.0.65.exe
            "C:\Users\Admin\AppData\Local\Temp\is-K9IP0.tmp\PrePackage\Case_1.0.0.65.exe" /VERYSILENT /norestart /Log="C:\Program Files (x86)\MSI\MSI Center\Log\Setup\Case_1.0.0.65_20260430054141.txt"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:568
            • C:\Users\Admin\AppData\Local\Temp\is-G0M17.tmp\Case_1.0.0.65.tmp
              "C:\Users\Admin\AppData\Local\Temp\is-G0M17.tmp\Case_1.0.0.65.tmp" /SL5="$90286,1508923,140800,C:\Users\Admin\AppData\Local\Temp\is-K9IP0.tmp\PrePackage\Case_1.0.0.65.exe" /VERYSILENT /norestart /Log="C:\Program Files (x86)\MSI\MSI Center\Log\Setup\Case_1.0.0.65_20260430054141.txt"
              6⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:1716
              • C:\Program Files (x86)\MSI\MSI Center\Case\MSI_Case_Service.exe
                "C:\Program Files (x86)\MSI\MSI Center\Case\MSI_Case_Service.exe" -msiinstall
                7⤵
                • Executes dropped EXE
                • Drops file in Program Files directory
                • System Location Discovery: System Language Discovery
                PID:3280
          • C:\Users\Admin\AppData\Local\Temp\is-K9IP0.tmp\PrePackage\Coreliquid_4.2025.1229.01.exe
            "C:\Users\Admin\AppData\Local\Temp\is-K9IP0.tmp\PrePackage\Coreliquid_4.2025.1229.01.exe" /VERYSILENT /norestart /Log="C:\Program Files (x86)\MSI\MSI Center\Log\Setup\Coreliquid_4.2025.1229.01_20260430054141.txt"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2644
            • C:\Users\Admin\AppData\Local\Temp\is-OAJ48.tmp\Coreliquid_4.2025.1229.01.tmp
              "C:\Users\Admin\AppData\Local\Temp\is-OAJ48.tmp\Coreliquid_4.2025.1229.01.tmp" /SL5="$B0286,1755810,140800,C:\Users\Admin\AppData\Local\Temp\is-K9IP0.tmp\PrePackage\Coreliquid_4.2025.1229.01.exe" /VERYSILENT /norestart /Log="C:\Program Files (x86)\MSI\MSI Center\Log\Setup\Coreliquid_4.2025.1229.01_20260430054141.txt"
              6⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:3328
              • C:\Windows\SysWOW64\taskkill.exe
                "C:\Windows\System32\taskkill.exe" /f /im DetectFPS.exe
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                PID:2500
          • C:\Users\Admin\AppData\Local\Temp\is-K9IP0.tmp\PrePackage\Engine Lib_3.0.0.69.exe
            "C:\Users\Admin\AppData\Local\Temp\is-K9IP0.tmp\PrePackage\Engine Lib_3.0.0.69.exe" /VERYSILENT /norestart /Log="C:\Program Files (x86)\MSI\MSI Center\Log\Setup\Engine Lib_3.0.0.69_20260430054141.txt"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4328
            • C:\Users\Admin\AppData\Local\Temp\is-P4K2V.tmp\Engine Lib_3.0.0.69.tmp
              "C:\Users\Admin\AppData\Local\Temp\is-P4K2V.tmp\Engine Lib_3.0.0.69.tmp" /SL5="$D0286,31442887,140800,C:\Users\Admin\AppData\Local\Temp\is-K9IP0.tmp\PrePackage\Engine Lib_3.0.0.69.exe" /VERYSILENT /norestart /Log="C:\Program Files (x86)\MSI\MSI Center\Log\Setup\Engine Lib_3.0.0.69_20260430054141.txt"
              6⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of FindShellTrayWindow
              PID:4292
          • C:\Users\Admin\AppData\Local\Temp\is-K9IP0.tmp\PrePackage\Engine_3.2026.0410.01.exe
            "C:\Users\Admin\AppData\Local\Temp\is-K9IP0.tmp\PrePackage\Engine_3.2026.0410.01.exe" /VERYSILENT /norestart /Log="C:\Program Files (x86)\MSI\MSI Center\Log\Setup\Engine_3.2026.0410.01_20260430054141.txt"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2700
            • C:\Users\Admin\AppData\Local\Temp\is-0QJVT.tmp\Engine_3.2026.0410.01.tmp
              "C:\Users\Admin\AppData\Local\Temp\is-0QJVT.tmp\Engine_3.2026.0410.01.tmp" /SL5="$F0286,3773972,140800,C:\Users\Admin\AppData\Local\Temp\is-K9IP0.tmp\PrePackage\Engine_3.2026.0410.01.exe" /VERYSILENT /norestart /Log="C:\Program Files (x86)\MSI\MSI Center\Log\Setup\Engine_3.2026.0410.01_20260430054141.txt"
              6⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of FindShellTrayWindow
              PID:544
          • C:\Users\Admin\AppData\Local\Temp\is-K9IP0.tmp\PrePackage\Gaming Gear_2.0.0.113.exe
            "C:\Users\Admin\AppData\Local\Temp\is-K9IP0.tmp\PrePackage\Gaming Gear_2.0.0.113.exe" /VERYSILENT /norestart /Log="C:\Program Files (x86)\MSI\MSI Center\Log\Setup\Gaming Gear_2.0.0.113_20260430054141.txt"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1320
            • C:\Users\Admin\AppData\Local\Temp\is-Q0U8H.tmp\Gaming Gear_2.0.0.113.tmp
              "C:\Users\Admin\AppData\Local\Temp\is-Q0U8H.tmp\Gaming Gear_2.0.0.113.tmp" /SL5="$110286,95499837,140800,C:\Users\Admin\AppData\Local\Temp\is-K9IP0.tmp\PrePackage\Gaming Gear_2.0.0.113.exe" /VERYSILENT /norestart /Log="C:\Program Files (x86)\MSI\MSI Center\Log\Setup\Gaming Gear_2.0.0.113_20260430054141.txt"
              6⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              • System Location Discovery: System Language Discovery
              • Enumerates system info in registry
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:2040
              • C:\Program Files (x86)\MSI\MSI Center\Gaming Gear\MEG381_KC.exe
                "C:\Program Files (x86)\MSI\MSI Center\Gaming Gear\MEG381_KC.exe" /verysilent
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1032
                • C:\Users\Admin\AppData\Local\Temp\is-7PD0A.tmp\MEG381_KC.tmp
                  "C:\Users\Admin\AppData\Local\Temp\is-7PD0A.tmp\MEG381_KC.tmp" /SL5="$40312,1833640,140800,C:\Program Files (x86)\MSI\MSI Center\Gaming Gear\MEG381_KC.exe" /verysilent
                  8⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of WriteProcessMemory
                  PID:1944
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c taskkill /f /im "MEG381_KC.exe"
                    9⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:5712
                    • C:\Windows\SysWOW64\taskkill.exe
                      taskkill /f /im "MEG381_KC.exe"
                      10⤵
                      • System Location Discovery: System Language Discovery
                      • Kills process with taskkill
                      PID:1296
              • C:\Program Files (x86)\MSI\MSI Center\Gaming Gear\G_Key_Controller.exe
                "C:\Program Files (x86)\MSI\MSI Center\Gaming Gear\G_Key_Controller.exe" /verysilent /norestart
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:3136
                • C:\Users\Admin\AppData\Local\Temp\is-8935E.tmp\G_Key_Controller.tmp
                  "C:\Users\Admin\AppData\Local\Temp\is-8935E.tmp\G_Key_Controller.tmp" /SL5="$50312,181884,140800,C:\Program Files (x86)\MSI\MSI Center\Gaming Gear\G_Key_Controller.exe" /verysilent /norestart
                  8⤵
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of WriteProcessMemory
                  PID:1316
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c taskkill /f /im G_Key_Controller.exe
                    9⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:5868
                    • C:\Windows\SysWOW64\taskkill.exe
                      taskkill /f /im G_Key_Controller.exe
                      10⤵
                      • System Location Discovery: System Language Discovery
                      • Kills process with taskkill
                      PID:912
              • C:\Program Files (x86)\MSI\MSI Center\Gaming Gear\Nahimic.exe
                "C:\Program Files (x86)\MSI\MSI Center\Gaming Gear\Nahimic.exe" /verysilent /norestart
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:2388
                • C:\Users\Admin\AppData\Local\Temp\is-FPIBG.tmp\Nahimic.tmp
                  "C:\Users\Admin\AppData\Local\Temp\is-FPIBG.tmp\Nahimic.tmp" /SL5="$60312,275398,140800,C:\Program Files (x86)\MSI\MSI Center\Gaming Gear\Nahimic.exe" /verysilent /norestart
                  8⤵
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of WriteProcessMemory
                  PID:3088
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c regsvr32 /s /i "C:\Program Files (x86)\MSI\MSI Center\Nahimic\NahimicAPI.dll"
                    9⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:2832
                    • C:\Windows\SysWOW64\regsvr32.exe
                      regsvr32 /s /i "C:\Program Files (x86)\MSI\MSI Center\Nahimic\NahimicAPI.dll"
                      10⤵
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:4308
                      • C:\Windows\system32\regsvr32.exe
                        /s /i "C:\Program Files (x86)\MSI\MSI Center\Nahimic\NahimicAPI.dll"
                        11⤵
                        • Loads dropped DLL
                        • Modifies registry class
                        PID:4396
          • C:\Users\Admin\AppData\Local\Temp\is-K9IP0.tmp\PrePackage\My Device_2.0.0.34.exe
            "C:\Users\Admin\AppData\Local\Temp\is-K9IP0.tmp\PrePackage\My Device_2.0.0.34.exe" /VERYSILENT /norestart /Log="C:\Program Files (x86)\MSI\MSI Center\Log\Setup\My Device_2.0.0.34_20260430054141.txt"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5208
            • C:\Users\Admin\AppData\Local\Temp\is-1UTR9.tmp\My Device_2.0.0.34.tmp
              "C:\Users\Admin\AppData\Local\Temp\is-1UTR9.tmp\My Device_2.0.0.34.tmp" /SL5="$130286,1227650,140800,C:\Users\Admin\AppData\Local\Temp\is-K9IP0.tmp\PrePackage\My Device_2.0.0.34.exe" /VERYSILENT /norestart /Log="C:\Program Files (x86)\MSI\MSI Center\Log\Setup\My Device_2.0.0.34_20260430054141.txt"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of FindShellTrayWindow
              PID:1968
          • C:\Users\Admin\AppData\Local\Temp\is-K9IP0.tmp\PrePackage\Power Supply Unit_1.0.0.35.exe
            "C:\Users\Admin\AppData\Local\Temp\is-K9IP0.tmp\PrePackage\Power Supply Unit_1.0.0.35.exe" /VERYSILENT /norestart /Log="C:\Program Files (x86)\MSI\MSI Center\Log\Setup\Power Supply Unit_1.0.0.35_20260430054141.txt"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2396
            • C:\Users\Admin\AppData\Local\Temp\is-4C7DF.tmp\Power Supply Unit_1.0.0.35.tmp
              "C:\Users\Admin\AppData\Local\Temp\is-4C7DF.tmp\Power Supply Unit_1.0.0.35.tmp" /SL5="$150286,411911,140800,C:\Users\Admin\AppData\Local\Temp\is-K9IP0.tmp\PrePackage\Power Supply Unit_1.0.0.35.exe" /VERYSILENT /norestart /Log="C:\Program Files (x86)\MSI\MSI Center\Log\Setup\Power Supply Unit_1.0.0.35_20260430054141.txt"
              6⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of FindShellTrayWindow
              PID:3912
          • C:\Users\Admin\AppData\Local\Temp\is-K9IP0.tmp\PrePackage\Service_1.0.0.05.exe
            "C:\Users\Admin\AppData\Local\Temp\is-K9IP0.tmp\PrePackage\Service_1.0.0.05.exe" /VERYSILENT /norestart /Log="C:\Program Files (x86)\MSI\MSI Center\Log\Setup\Service_1.0.0.05_20260430054141.txt"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5628
            • C:\Users\Admin\AppData\Local\Temp\is-D28KP.tmp\Service_1.0.0.05.tmp
              "C:\Users\Admin\AppData\Local\Temp\is-D28KP.tmp\Service_1.0.0.05.tmp" /SL5="$170286,157934,140800,C:\Users\Admin\AppData\Local\Temp\is-K9IP0.tmp\PrePackage\Service_1.0.0.05.exe" /VERYSILENT /norestart /Log="C:\Program Files (x86)\MSI\MSI Center\Log\Setup\Service_1.0.0.05_20260430054141.txt"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:5996
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MSI\MSI Center\Service\uninstall.bat" "
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4280
                • C:\Windows\SysWOW64\net.exe
                  net session
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:616
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 session
                    9⤵
                    • System Location Discovery: System Language Discovery
                    PID:6080
          • C:\Users\Admin\AppData\Local\Temp\is-K9IP0.tmp\PrePackage\Support_3.2026.0303.01.exe
            "C:\Users\Admin\AppData\Local\Temp\is-K9IP0.tmp\PrePackage\Support_3.2026.0303.01.exe" /VERYSILENT /norestart /Log="C:\Program Files (x86)\MSI\MSI Center\Log\Setup\Support_3.2026.0303.01_20260430054141.txt"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3952
            • C:\Users\Admin\AppData\Local\Temp\is-HVFBC.tmp\Support_3.2026.0303.01.tmp
              "C:\Users\Admin\AppData\Local\Temp\is-HVFBC.tmp\Support_3.2026.0303.01.tmp" /SL5="$190286,15855118,140800,C:\Users\Admin\AppData\Local\Temp\is-K9IP0.tmp\PrePackage\Support_3.2026.0303.01.exe" /VERYSILENT /norestart /Log="C:\Program Files (x86)\MSI\MSI Center\Log\Setup\Support_3.2026.0303.01_20260430054141.txt"
              6⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of FindShellTrayWindow
              PID:3280
          • C:\Program Files (x86)\MSI\MSI Center\MSI.TerminalServer.exe
            "C:\Program Files (x86)\MSI\MSI Center\MSI.TerminalServer.exe" LaunchPush
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5688
          • C:\Program Files (x86)\MSI\MSI Center\MSI_Central_Service.exe
            "C:\Program Files (x86)\MSI\MSI Center\MSI_Central_Service.exe" -msiinstall
            5⤵
            • Executes dropped EXE
            PID:5384
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:6132
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
      PID:5960
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Badlisted process makes network request
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1312
    • C:\ProgramData\Package Cache\{410c0ee1-00bb-41b6-9772-e12c2828b02f}\VC_redist.x86.exe
      "C:\ProgramData\Package Cache\{410c0ee1-00bb-41b6-9772-e12c2828b02f}\VC_redist.x86.exe" /burn.runonce
      1⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:6072
      • C:\ProgramData\Package Cache\{410c0ee1-00bb-41b6-9772-e12c2828b02f}\VC_redist.x86.exe
        "C:\ProgramData\Package Cache\{410c0ee1-00bb-41b6-9772-e12c2828b02f}\VC_redist.x86.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260430054142.log" /install
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1756
        • C:\ProgramData\Package Cache\{410c0ee1-00bb-41b6-9772-e12c2828b02f}\VC_redist.x86.exe
          "C:\ProgramData\Package Cache\{410c0ee1-00bb-41b6-9772-e12c2828b02f}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{410c0ee1-00bb-41b6-9772-e12c2828b02f}\VC_redist.x86.exe" -burn.filehandle.attached=544 -burn.filehandle.self=560 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260430054142.log" /install
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4768
          • C:\ProgramData\Package Cache\{410c0ee1-00bb-41b6-9772-e12c2828b02f}\VC_redist.x86.exe
            "C:\ProgramData\Package Cache\{410c0ee1-00bb-41b6-9772-e12c2828b02f}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{77EA7F7E-FEE2-4BD5-B550-8C11734DCB80} {13A4B1CE-167D-44AA-8FF8-0B274046F048} 4768
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            PID:5140
    • C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe" /burn.runonce
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2796
      • C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe
        "C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260430054203.log" /install
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3540
        • C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe
          "C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe" -burn.filehandle.attached=544 -burn.filehandle.self=560 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260430054203.log" /install
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5084
          • C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe
            "C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{7231C93A-592A-4B23-AFDA-E2AA802B357E} {EC363BB6-64F1-455D-8E45-D040836F449F} 5084
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            PID:5208
    • C:\Program Files (x86)\MSI\MSI Center\Case\MSI_Case_Service.exe
      "C:\Program Files (x86)\MSI\MSI Center\Case\MSI_Case_Service.exe"
      1⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      PID:2980
    • C:\Program Files (x86)\MSI\MSI Center\MSI_Central_Service.exe
      "C:\Program Files (x86)\MSI\MSI Center\MSI_Central_Service.exe"
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4076
      • C:\Program Files (x86)\MSI\MSI Center\MSI.CentralServer.exe
        "C:\Program Files (x86)\MSI\MSI Center\MSI.CentralServer.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Enumerates connected drives
        • Writes to the Master Boot Record (MBR)
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Checks SCSI registry key(s)
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Modifies system certificate store
        • Suspicious use of WriteProcessMemory
        PID:5692
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\system32\netsh.exe" advfirewall firewall del rule name="MSI Center Bridge"
          3⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:2800
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\system32\netsh.exe" advfirewall firewall del rule name="MSI Center - SyncServer"
          3⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:5496
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\system32\netsh.exe" advfirewall firewall del rule name="MSI Center Bridge"
          3⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:5008
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="MSI Center Bridge" dir=in protocol=tcp localport=32683 action=allow
          3⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          PID:2676
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\system32\netsh.exe" advfirewall firewall del rule name="MSI Center - SyncServer"
          3⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:3240
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="MSI Center - SyncServer" dir=in protocol=tcp localport=33683 action=allow
          3⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:2668
        • C:\Program Files (x86)\MSI\MSI Center\Engine\CC_Engine_x64.exe
          "C:\Program Files (x86)\MSI\MSI Center\Engine\CC_Engine_x64.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2172
        • C:\Program Files (x86)\MSI\MSI Center\Nahimic\NahimicMonitorX64.exe
          "C:\Program Files (x86)\MSI\MSI Center\Nahimic\NahimicMonitorX64.exe"
          3⤵
          • Executes dropped EXE
          PID:4416
    • C:\Program Files (x86)\MSI\MSI Center\MSI.TerminalServer.exe
      "C:\Program Files (x86)\MSI\MSI Center\MSI.TerminalServer.exe" Launch
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:1640
      • C:\Windows\SysWOW64\netsh.exe
        "C:\Windows\system32\netsh.exe" advfirewall firewall del rule name="MSI Center - Terminal Server"
        2⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:3152
      • C:\Windows\SysWOW64\netsh.exe
        "C:\Windows\system32\netsh.exe" advfirewall firewall del rule name="MSI Center - Terminal Server"
        2⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:2024
      • C:\Windows\SysWOW64\netsh.exe
        "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="MSI Center - Terminal Server" dir=in protocol=tcp localport=26822 action=allow
        2⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:4664
    • C:\Program Files (x86)\MSI\MSI Center\MSI.TerminalServer.exe
      "C:\Program Files (x86)\MSI\MSI Center\MSI.TerminalServer.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:764

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          1
          T1059

          PowerShell

          1
          T1059.001

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Event Triggered Execution

          2
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Netsh Helper DLL

          1
          T1546.007

          Pre-OS Boot

          1
          T1542

          Bootkit

          1
          T1542.003

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Event Triggered Execution

          2
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Netsh Helper DLL

          1
          T1546.007

          Defense Evasion

          Impair Defenses

          1
          T1562

          Disable or Modify System Firewall

          1
          T1562.004

          Modify Registry

          2
          T1112

          Pre-OS Boot

          1
          T1542

          Bootkit

          1
          T1542.003

          Subvert Trust Controls

          1
          T1553

          Install Root Certificate

          1
          T1553.004

          Credential Access

          Discovery

          Peripheral Device Discovery

          2
          T1120

          Query Registry

          5
          T1012

          System Information Discovery

          4
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          Lateral Movement

          Collection

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e5a05e2.rbs
          • Path C:\Config.Msi\e5a05e2.rbs
          • Size 16KB
          • SHA256 bf73684d0b19c04eadba7d5e065e9d58dd33ec745c7b72b9abd939afb90b1644
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e5a05e7.rbs
          • Path C:\Config.Msi\e5a05e7.rbs
          • Size 18KB
          • SHA256 166f211f971acab07c4d7f460bcd67bec2bedcbbcaef5c969b5858e756bd5c9c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e5a05f4.rbs
          • Path C:\Config.Msi\e5a05f4.rbs
          • Size 20KB
          • SHA256 4e7ec3981fd1c0267ee088fc64035f6b2c0252199580930ebc74be97f48d1fd9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e5a0603.rbs
          • Path C:\Config.Msi\e5a0603.rbs
          • Size 19KB
          • SHA256 c96556acd01293d86b699c735e68d4dd33fa542c88827c5a1056df9b97b10dfd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e5a060a.rbs
          • Path C:\Config.Msi\e5a060a.rbs
          • Size 19KB
          • SHA256 c53ad6977db41a68609d592933b13843aec4edb8a61f0152d7b076c6296cead7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e5a0616.rbs
          • Path C:\Config.Msi\e5a0616.rbs
          • Size 19KB
          • SHA256 fa0c67d52765b10c42c6929e217a47a1fde6effe758d7c725f314938589c73db
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e5a061d.rbs
          • Path C:\Config.Msi\e5a061d.rbs
          • Size 21KB
          • SHA256 c7c9eb77172489f666454506975876656a2eca819c78265811ae1d4f698a791c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e5a062c.rbs
          • Path C:\Config.Msi\e5a062c.rbs
          • Size 21KB
          • SHA256 08d50af1115204c0afa60c562d4f8b57c3a3b369bdad94c1dc751b859a4eeb20
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSI_Case_Service.exe
          • Path C:\Program Files (x86)\MSI\MSI Center\Case\MSI_Case_Service.exe
          • Size 136KB
          • SHA256 32408c88f278a592c007b4eb55d993c4e8c6cf6283242e516dfc80ad5183c4da
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Device.dat
          • Path C:\Program Files (x86)\MSI\MSI Center\Data\Device.dat
          • Size 1KB
          • SHA256 fc4f652421af10217e732718525f71ee2d8ca053f27f10f71c0c41bd766e10d0
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          MEG_VisionX.dat
          • Path C:\Program Files (x86)\MSI\MSI Center\Data\MEG_VisionX.dat
          • Size 70KB
          • SHA256 bc191d27e1fb6bb8ec74a997ca7245419bfd3767a18569fbb77b2eb457c3cf03
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          OSDControl Online Data.dat
          • Path C:\Program Files (x86)\MSI\MSI Center\Data\OSDControl Online Data.dat
          • Size 10KB
          • SHA256 7483f763058315a7a607d7e2e8abbd469fdceb34b5405f889e964b1f5595facb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          PackageDataV2.dat
          • Path C:\Program Files (x86)\MSI\MSI Center\Data\PackageDataV2.dat
          • Size 282KB
          • SHA256 cf7311554680cfb22c0b3ec7d1ca22780f77b274416885d6e76ae91074ee914a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          PowerSupplyData.dat
          • Path C:\Program Files (x86)\MSI\MSI Center\Data\PowerSupplyData.dat
          • Size 455B
          • SHA256 f871516544de6ef6831f3e4ddde9917031bfbcd94a403fee69c7216412b0f9e3
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Trident_HMI.dat
          • Path C:\Program Files (x86)\MSI\MSI Center\Data\Trident_HMI.dat
          • Size 1KB
          • SHA256 f4f5c1c2a65542d3617063fa27dfd6ea2645be0f37a7522301bc93ca25492646
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          VGADataV2.dat
          • Path C:\Program Files (x86)\MSI\MSI Center\Data\VGADataV2.dat
          • Size 152KB
          • SHA256 920f994ed8550a3b0e10eb95396995946c3fb00fef2ca11675da031334476cc6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          is-3T7NE.tmp
          • Path C:\Program Files (x86)\MSI\MSI Center\Gaming Gear\MEG381_KC\is-3T7NE.tmp
          • Size 683KB
          • SHA256 7f912b28a07c226e0be3acfb2f57f050538aba0100fa1f0bf2c39f1a1f1da814
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          unins000.msg
          • Path C:\Program Files (x86)\MSI\MSI Center\Gaming Gear\unins000.msg
          • Size 20KB
          • SHA256 c6ce898d8f0e0da2e98a52fbd7f8cea57f39ec0c329429e4fd15c5595b189080
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ReleaseDriver.exe
          • Path C:\Program Files (x86)\MSI\MSI Center\Lib\ReleaseDriver.exe
          • Size 42KB
          • SHA256 98812b48f4cec60ee65389b70525d855267ea1d45ba00e714cc03d430c7de729
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          is-3A3F4.tmp
          • Path C:\Program Files (x86)\MSI\MSI Center\Lib\is-3A3F4.tmp
          • Size 2.0MB
          • SHA256 f1e2e40121af5b16328ed9b823e57b2d3d3f3a033963b660ae5a05ca3fdc9490
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          is-F7GAE.tmp
          • Path C:\Program Files (x86)\MSI\MSI Center\Lib\is-F7GAE.tmp
          • Size 110KB
          • SHA256 fd3b66570364ffb7c3f3f43b49e0c6c2d81104b82b9f40e6ed6b9b8eb0a7a381
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          is-IEJ3E.tmp
          • Path C:\Program Files (x86)\MSI\MSI Center\Lib\is-IEJ3E.tmp
          • Size 2.0MB
          • SHA256 da422ee89d4a2604a2d6f2a1c9741acaf0609b87299c12cdafc1a67ee031a89a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Case_2026_04_30.txt
          • Path C:\Program Files (x86)\MSI\MSI Center\Log\Case\Case_2026_04_30.txt
          • Size 432B
          • SHA256 51b09752954af10e4177a516dc8bc4f326fe7105a32190267f844c029f505419
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Service_04_30_2026.log
          • Path C:\Program Files (x86)\MSI\MSI Center\Log\Case\Service_04_30_2026.log
          • Size 232B
          • SHA256 2ad2879074c8ef0eab9a62fa7c56cd94309c9c7a0df0477a844d8bf5f4349777
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          MSI Center_2026_04_30.txt
          • Path C:\Program Files (x86)\MSI\MSI Center\Log\MSI Center\MSI Center_2026_04_30.txt
          • Size 1KB
          • SHA256 10ab3ed7912b3f382d671981042abed17215bae186b697d97dddcd2a6b93bbb0
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          MSI Center_2026_04_30.txt
          • Path C:\Program Files (x86)\MSI\MSI Center\Log\MSI Center\MSI Center_2026_04_30.txt
          • Size 3KB
          • SHA256 cc55ec6c831adf4d0511eb25a0b3f42833ba77a4986cff11bdd619798e8ae845
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          MSI Center_2026_04_30.txt
          • Path C:\Program Files (x86)\MSI\MSI Center\Log\MSI Center\MSI Center_2026_04_30.txt
          • Size 4KB
          • SHA256 8bb6df4e82539403a925bac4deb04e19d6d6022a47bf6cdf6a88f90db8b1bd3a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Log_CoolingWizard_04_30_2026.log
          • Path C:\ProgramData\MSI\MSI Center\Case\Log\Log_CoolingWizard_04_30_2026.log
          • Size 1KB
          • SHA256 426caa07ff51b91c3872b75c441e00742798c40486c618eb609a188c70f7bebf
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Log_CoolingWizard_04_30_2026.log
          • Path C:\ProgramData\MSI\MSI Center\Case\Log\Log_CoolingWizard_04_30_2026.log
          • Size 2KB
          • SHA256 b87be97359c35b86f89a1f56aa9c4a8061f10d4a02edbf32e73ffc3459d70be0
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Admin_DCv2_2026_04_30.txt
          • Path C:\ProgramData\MSI\MSI Center\DCv2\S-1-5-21-1456842261-3464001825-2855069093-1000\Admin_DCv2_2026_04_30.txt
          • Size 2KB
          • SHA256 b165c3d65bbc19c0cac5999ba34b74ebe939a41a84917c302d42b156b88e1704
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Admin_DCv2_2026_04_30.txt
          • Path C:\ProgramData\MSI\MSI Center\DCv2\S-1-5-21-1456842261-3464001825-2855069093-1000\Admin_DCv2_2026_04_30.txt
          • Size 4KB
          • SHA256 2ce9ec66cf3088b77f88d13b372078968d8b5b7733eeafa2cac00228c8e8a963
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Admin_DCv2_2026_04_30.txt
          • Path C:\ProgramData\MSI\MSI Center\DCv2\S-1-5-21-1456842261-3464001825-2855069093-1000\Admin_DCv2_2026_04_30.txt
          • Size 579B
          • SHA256 641063cfba1c954bf17c2843d568c685507a3e40ea8cbe804e784d91f8e39405
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          user.config
          • Path C:\ProgramData\MSI\MSI Center\DCv2\S-1-5-21-1456842261-3464001825-2855069093-1000\user.config
          • Size 3KB
          • SHA256 ca7769c7f10e7b9e4a0d6dd05c2e277b57b54a59301ecd00ee04c597677c97cd
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          user.config
          • Path C:\ProgramData\MSI\MSI Center\DCv2\S-1-5-21-1456842261-3464001825-2855069093-1000\user.config
          • Size 3KB
          • SHA256 75c322ca1a39413e49643698badeaf5726a990acb1e2acd4543957d964728a9f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          user.config
          • Path C:\ProgramData\MSI\MSI Center\DCv2\S-1-5-21-1456842261-3464001825-2855069093-1000\user.config
          • Size 3KB
          • SHA256 3626e311179d5393b6eb54192d4e20f77401a6de550e64b92dc84985090588b0
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          user.config
          • Path C:\ProgramData\MSI\MSI Center\DCv2\S-1-5-21-1456842261-3464001825-2855069093-1000\user.config
          • Size 3KB
          • SHA256 0c51ee67c9ab6f1fcf88120e7b2dfbbd493ea3d92a96f0dc25aa39cf1d8a621f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          user.config
          • Path C:\ProgramData\MSI\MSI Center\DCv2\S-1-5-21-1456842261-3464001825-2855069093-1000\user.config
          • Size 3KB
          • SHA256 cc1f5379b87da96d2a42f648af12c1aad4851a2bcb4794feff7e34475aea21ae
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          user.config
          • Path C:\ProgramData\MSI\MSI Center\DCv2\S-1-5-21-1456842261-3464001825-2855069093-1000\user.config
          • Size 3KB
          • SHA256 3db73f9ec8d5f350171b8d85e5a67c7ce2efd7c5941d49afeab1b6e44742b36c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          M-VISION DASHBOARD_2026_04_30.txt
          • Path C:\ProgramData\MSI\MSI Center\M-VISION DASHBOARD\M-VISION DASHBOARD_2026_04_30.txt
          • Size 355B
          • SHA256 7ca3ae4a5d17ae35924429a22e0229db9093cc17e52526f855164eef3151c60b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          System Diagnosis_UI_2026_04_30.txt
          • Path C:\ProgramData\MSI\MSI Center\System Diagnosis\System Diagnosis_UI_2026_04_30.txt
          • Size 334B
          • SHA256 938bb126b975acad8726233836b59202a0413acbd4c99ebe443cfd1e918de7bd
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          PackageData.dat
          • Path C:\ProgramData\MSI\MSI Center\Utility\PackageData.dat
          • Size 280KB
          • SHA256 33beb77a3f79e5602e4d0eefa32b54ebbf59c2bcedc7196442064880e2e9e90c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Utility_2026_04_30.txt
          • Path C:\ProgramData\MSI\MSI Center\Utility\Utility_2026_04_30.txt
          • Size 625B
          • SHA256 3c0f58f301d0519f20a92207560cea65035974b6b1ba8e4da0595b2b94558cf3
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Utility_2026_04_30.txt
          • Path C:\ProgramData\MSI\MSI Center\Utility\Utility_2026_04_30.txt
          • Size 2KB
          • SHA256 cad4e697424925cb13eca2cf7dc1d6a65b41d8d0f8384480c938582068c3542d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Utility_2026_04_30.txt
          • Path C:\ProgramData\MSI\MSI Center\Utility\Utility_2026_04_30.txt
          • Size 3KB
          • SHA256 fd21a4cabdbed812ef1f29ecfd5f147c4227e53ffb3f6a7bfb06ad3d34511b95
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Utility_2026_04_30.txt
          • Path C:\ProgramData\MSI\MSI Center\Utility\Utility_2026_04_30.txt
          • Size 4KB
          • SHA256 9840e3b281dcb24544e9dd9dcd973892a4d28a95de2c2a3bf53de6cd4577265f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          state.rsm
          • Path C:\ProgramData\Package Cache\{410c0ee1-00bb-41b6-9772-e12c2828b02f}\state.rsm
          • Size 960B
          • SHA256 71c25e780ba784b60e34f953f354bee5733a68983b8db0784a3872ba24ef2b68
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          state.rsm
          • Path C:\ProgramData\Package Cache\{410c0ee1-00bb-41b6-9772-e12c2828b02f}\state.rsm
          • Size 940B
          • SHA256 73e65e20cd06c5368498c0d1fac6dd62bf2a7a1a68669a9702c1eb98a97f88f3
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          state.rsm
          • Path C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\state.rsm
          • Size 964B
          • SHA256 ba255b1506a3bfc4c36ff9f19dd5f4d0c762838ff1b0d2c6f907250eb0f9f154
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ModuleAnalysisCache
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
          • Size 61KB
          • SHA256 4672b83e99a529fa94a87cd0b606c76bb88df0d87edfb05954a66303e0e49014
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSI Center.exe
          • Path C:\Users\Admin\AppData\Local\Packages\9426MICRO-STARINTERNATION.MSICenter_kzh8wxbdkxb8p\LocalCache\Local\MSI Center.exe
          • Size 265KB
          • SHA256 132ede190bbf85d86ce0f7ece3c350f2864d331dc96afc65f6e46dd612c51a92
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          __PSScriptPolicyTest_wsfnusyo.2vf.ps1
          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wsfnusyo.2vf.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dd_vcredist_amd64_20260430054203.log
          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260430054203.log
          • Size 18KB
          • SHA256 c500c2e3c2422a244094b81838e457cba75c011b3e3a4d414d0cf6503e5aded6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dd_vcredist_amd64_20260430054203_000_vcRuntimeMinimum_x64.log
          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260430054203_000_vcRuntimeMinimum_x64.log
          • Size 2KB
          • SHA256 8e513c55d433fc6abcc5544ddd0caf08b3f502a4339ce95eae2d8f0c061f1cbc
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dd_vcredist_amd64_20260430054203_001_vcRuntimeAdditional_x64.log
          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260430054203_001_vcRuntimeAdditional_x64.log
          • Size 2KB
          • SHA256 48c33053940892afdcad87785be7c38376e37f8dc82f9aad324cf57373bcf816
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dd_vcredist_x86_20260430054142.log
          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260430054142.log
          • Size 17KB
          • SHA256 bc8fb7f086a0822a3e5f309c77bed70fde96c5624e5212e8e783c0703d0ff8a2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dd_vcredist_x86_20260430054142_000_vcRuntimeMinimum_x86.log
          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260430054142_000_vcRuntimeMinimum_x86.log
          • Size 4KB
          • SHA256 1c07c584800413429e1d8ab819a86781b23dbed050cb86c71c80718264de5cca
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dd_vcredist_x86_20260430054142_001_vcRuntimeAdditional_x86.log
          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260430054142_001_vcRuntimeAdditional_x86.log
          • Size 2KB
          • SHA256 9dd3700f811b8c454c558695cb25c74a4ecae535eae98c3e3d8299e66ff96bd6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          _shfoldr.dll
          • Path C:\Users\Admin\AppData\Local\Temp\is-6JVL5.tmp\_isetup\_shfoldr.dll
          • Size 22KB
          • SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _setup64.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\is-AU1TB.tmp\_isetup\_setup64.tmp
          • Size 6KB
          • SHA256 a4c86fc4836ac728d7bd96e7915090fd59521a9e74f1d06ef8e5a47c8695fd81
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Case_1.0.0.65.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\is-G0M17.tmp\Case_1.0.0.65.tmp
          • Size 1.4MB
          • SHA256 fe65e1505a7c3cbe23ae4627cad5aab8cf5e53f14bc58b92d8c683fa2978d565
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSI Center SDK.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\is-HC9NE.tmp\MSI Center SDK.tmp
          • Size 1.9MB
          • SHA256 3c2b5450a2446c85245a9136d20f40521ec5c83d1ff100ebff212771ef72d3c3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Case_1.0.0.65.exe
          • Path C:\Users\Admin\AppData\Local\Temp\is-K9IP0.tmp\PrePackage\Case_1.0.0.65.exe
          • Size 2.0MB
          • SHA256 5710fc1065b49980befc35e755679095dd99419f532a8328933f2e371d188505
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Coreliquid_4.2025.1229.01.exe
          • Path C:\Users\Admin\AppData\Local\Temp\is-K9IP0.tmp\PrePackage\Coreliquid_4.2025.1229.01.exe
          • Size 2.2MB
          • SHA256 6b42929b7b0e40393d24079fb3cc835d2d3a84318d03b7646aac0816ff342ac3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Engine Lib_3.0.0.69.exe
          • Path C:\Users\Admin\AppData\Local\Temp\is-K9IP0.tmp\PrePackage\Engine Lib_3.0.0.69.exe
          • Size 30.5MB
          • SHA256 4aa8d2acce2ad8b955d72f5058d8c1aebe3fa3a8c5eae5b1977df1b12f3a118a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Engine_3.2026.0410.01.exe
          • Path C:\Users\Admin\AppData\Local\Temp\is-K9IP0.tmp\PrePackage\Engine_3.2026.0410.01.exe
          • Size 4.1MB
          • SHA256 06dd68537d5c55598c6c93097e15e0a0010101a752bfe1fbee91b83467e75195
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          My Device_2.0.0.34.exe
          • Path C:\Users\Admin\AppData\Local\Temp\is-K9IP0.tmp\PrePackage\My Device_2.0.0.34.exe
          • Size 1.6MB
          • SHA256 0cec609fde4a3ccc177d8eb06f2e73551fabef3b7b7daf21bc648e5a1c2fe9fb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Power Supply Unit_1.0.0.35.exe
          • Path C:\Users\Admin\AppData\Local\Temp\is-K9IP0.tmp\PrePackage\Power Supply Unit_1.0.0.35.exe
          • Size 956KB
          • SHA256 4b507e9796fb6bab5ba236ae7cdb2e08112b23217a8d0f01dcb010ff991ef90d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Service_1.0.0.05.exe
          • Path C:\Users\Admin\AppData\Local\Temp\is-K9IP0.tmp\PrePackage\Service_1.0.0.05.exe
          • Size 709KB
          • SHA256 2012f23e68d579f728a6c6539412a0f524262c7ba8a3c56312f6728c94e22cca
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Support_3.2026.0303.01.exe
          • Path C:\Users\Admin\AppData\Local\Temp\is-K9IP0.tmp\PrePackage\Support_3.2026.0303.01.exe
          • Size 15.7MB
          • SHA256 7589eaf05433cbea1c284931f4c1a0dbf2f091933a9103a6719998843b5d356c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VC_redist.x64.exe
          • Path C:\Users\Admin\AppData\Local\Temp\is-K9IP0.tmp\VC_redist.x64.exe
          • Size 24.2MB
          • SHA256 917c37d816488545b70affd77d6e486e4dd27e2ece63f6bbaaf486b178b2b888
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VC_redist.x86.exe
          • Path C:\Users\Admin\AppData\Local\Temp\is-K9IP0.tmp\VC_redist.x86.exe
          • Size 13.2MB
          • SHA256 5365a927487945ecb040e143ea770adbb296074ece4021b1d14213bde538c490
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          license.rtf
          • Path C:\Windows\Temp\{3A52A18A-4737-4D0B-8DD3-3341CB4C3D98}\.ba\license.rtf
          • Size 9KB
          • SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{3A52A18A-4737-4D0B-8DD3-3341CB4C3D98}\.ba\thm.wxl
          • Size 2KB
          • SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          thm.xml
          • Path C:\Windows\Temp\{3A52A18A-4737-4D0B-8DD3-3341CB4C3D98}\.ba\thm.xml
          • Size 8KB
          • SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VC_redist.x64.exe
          • Path C:\Windows\Temp\{5F0FA54A-AD94-447B-991C-DB3EA83BBC60}\.cr\VC_redist.x64.exe
          • Size 635KB
          • SHA256 9a6c005e1a71e11617f87ede695af32baac8a2056f11031941df18b23c4eeba6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          license.rtf
          • Path C:\Windows\Temp\{88580AFC-C3C0-4582-BAFC-E27CA3EFAC96}\.ba\1028\license.rtf
          • Size 17KB
          • SHA256 44c76290f7a2e45940e8338912feb49bcf4e071cfa85d2d34762857743acbc8d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{88580AFC-C3C0-4582-BAFC-E27CA3EFAC96}\.ba\1028\thm.wxl
          • Size 2KB
          • SHA256 8e2e660dfb66cb453e17f1b6991799678b1c8b350a55f9ebe2ba0028018a15ad
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          license.rtf
          • Path C:\Windows\Temp\{88580AFC-C3C0-4582-BAFC-E27CA3EFAC96}\.ba\1029\license.rtf
          • Size 12KB
          • SHA256 503c433dcde2f3a9e7d388a5ff2b0612e7d8f90f5188d5b2b60228db33044fde
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{88580AFC-C3C0-4582-BAFC-E27CA3EFAC96}\.ba\1029\thm.wxl
          • Size 3KB
          • SHA256 07fb3ec174f25dfbe532d9d739234d9dfda8e9d34f01fe660c5b4d56989fa779
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          license.rtf
          • Path C:\Windows\Temp\{88580AFC-C3C0-4582-BAFC-E27CA3EFAC96}\.ba\1031\license.rtf
          • Size 12KB
          • SHA256 28f63bad9c2960395106011761993049546607f8a850d344d6a54042176bf03f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{88580AFC-C3C0-4582-BAFC-E27CA3EFAC96}\.ba\1031\thm.wxl
          • Size 3KB
          • SHA256 8e0dca6e085744bfcbff46f7dcbcfa6fbd722dfa52013ee8ceeaf682d7509581
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          license.rtf
          • Path C:\Windows\Temp\{88580AFC-C3C0-4582-BAFC-E27CA3EFAC96}\.ba\1036\license.rtf
          • Size 12KB
          • SHA256 5c13a65870d770d1642a4259eecb436257ca39016a0500f747be9c79be0c7009
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{88580AFC-C3C0-4582-BAFC-E27CA3EFAC96}\.ba\1036\thm.wxl
          • Size 3KB
          • SHA256 704ddf2e60c1f292be95c7c79ee48fe8ba8534ceb7ccf9a9ea68b1ad788ae9d4
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          license.rtf
          • Path C:\Windows\Temp\{88580AFC-C3C0-4582-BAFC-E27CA3EFAC96}\.ba\1040\license.rtf
          • Size 11KB
          • SHA256 70ecf23c03b66a2b18e173332586afa8f00f91e02a80628f4f9cb2521e27f6ac
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{88580AFC-C3C0-4582-BAFC-E27CA3EFAC96}\.ba\1040\thm.wxl
          • Size 3KB
          • SHA256 0c57f40cc2091554307aa8a7c35dd38e4596e9513e9efae00ac30498ef4e9bc2
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          license.rtf
          • Path C:\Windows\Temp\{88580AFC-C3C0-4582-BAFC-E27CA3EFAC96}\.ba\1041\license.rtf
          • Size 29KB
          • SHA256 c3061a334bfd5f02b7085f8f454d5d3d97d477af14bab497bf31a7887bc90c5b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{88580AFC-C3C0-4582-BAFC-E27CA3EFAC96}\.ba\1041\thm.wxl
          • Size 3KB
          • SHA256 6b9bbf90d75cfa7d943f036c01602945fe2fa786c6173e22acb7afe18375c7ea
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          license.rtf
          • Path C:\Windows\Temp\{88580AFC-C3C0-4582-BAFC-E27CA3EFAC96}\.ba\1042\license.rtf
          • Size 27KB
          • SHA256 3d4e9c165cbeab829d608106f0e96450f839ffa8adbd755f0b51867e89da2ae0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{88580AFC-C3C0-4582-BAFC-E27CA3EFAC96}\.ba\1042\thm.wxl
          • Size 3KB
          • SHA256 ad7608b87a7135f408abf54a897a0f0920080f76013314b00d301d6264ae90b2
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          license.rtf
          • Path C:\Windows\Temp\{88580AFC-C3C0-4582-BAFC-E27CA3EFAC96}\.ba\1045\license.rtf
          • Size 13KB
          • SHA256 6f94a99072061012c5626a6dd069809ec841d6e3102b48394d522a0c2e3aa2b5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{88580AFC-C3C0-4582-BAFC-E27CA3EFAC96}\.ba\1045\thm.wxl
          • Size 3KB
          • SHA256 440b309fcdf61ffc03b269fe3815c60cb52c6ae3fc6acad14eac04d057b6d6ea
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          license.rtf
          • Path C:\Windows\Temp\{88580AFC-C3C0-4582-BAFC-E27CA3EFAC96}\.ba\1046\license.rtf
          • Size 10KB
          • SHA256 27891eec899be859e3b4d3b29247fc6b535d7e836def0329111c48741ec6e701
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{88580AFC-C3C0-4582-BAFC-E27CA3EFAC96}\.ba\1046\thm.wxl
          • Size 3KB
          • SHA256 f52b54a0e0d0e8f12cba9823d88e9fd6822b669074dd1dc69dad6553f7cb8913
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          license.rtf
          • Path C:\Windows\Temp\{88580AFC-C3C0-4582-BAFC-E27CA3EFAC96}\.ba\1049\license.rtf
          • Size 31KB
          • SHA256 1bb3fb55b8a13fa3bafffe72f5b1ed8b57a63bd4d8654bb6dc5b9011ce803b44
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{88580AFC-C3C0-4582-BAFC-E27CA3EFAC96}\.ba\1049\thm.wxl
          • Size 4KB
          • SHA256 7333bc8e52548821d82b53dbd7d7c4aa1703c85155480cb83cefd78380c95661
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          license.rtf
          • Path C:\Windows\Temp\{88580AFC-C3C0-4582-BAFC-E27CA3EFAC96}\.ba\1055\license.rtf
          • Size 13KB
          • SHA256 f80926604e503697247353f56856b31de0b3fc1319f1c94068363952549cc9b1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{88580AFC-C3C0-4582-BAFC-E27CA3EFAC96}\.ba\1055\thm.wxl
          • Size 3KB
          • SHA256 e5abe3cb3bf84207dac4e6f5bba1e693341d01aea076dd2d91eaa21c6a6cb925
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          license.rtf
          • Path C:\Windows\Temp\{88580AFC-C3C0-4582-BAFC-E27CA3EFAC96}\.ba\2052\license.rtf
          • Size 17KB
          • SHA256 a808b4933ce3b3e0893504dbef43ebf90b8b567f94bd6481b6315ed9141e1b11
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{88580AFC-C3C0-4582-BAFC-E27CA3EFAC96}\.ba\2052\thm.wxl
          • Size 2KB
          • SHA256 2ac8b7c19a5189662de36a0581c90dbad96df259ec00a28f609b644c3f39f9ca
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          license.rtf
          • Path C:\Windows\Temp\{88580AFC-C3C0-4582-BAFC-E27CA3EFAC96}\.ba\3082\license.rtf
          • Size 10KB
          • SHA256 abc11bb2b04dff6afe2d4d4f40d95a7d62e5af352928af90daa3dade58dd59bd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{88580AFC-C3C0-4582-BAFC-E27CA3EFAC96}\.ba\3082\thm.wxl
          • Size 3KB
          • SHA256 9cbb2b312c100b309a1b1495e84e2228b937612885f7a642fbbd67969b632c3a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          VC_redist.x86.exe
          • Path C:\Windows\Temp\{BD77FAD8-3085-4A82-B35B-27E5121A8918}\.cr\VC_redist.x86.exe
          • Size 634KB
          • SHA256 e0e642106c94fd585782b75d1f942872d2bf99d870bed4216e5001e4ba3374c0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          logo.png
          • Path C:\Windows\Temp\{E3E7C2DE-C417-4457-9F54-7B8D8516A28F}\.ba\logo.png
          • Size 1KB
          • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          wixstdba.dll
          • Path C:\Windows\Temp\{E3E7C2DE-C417-4457-9F54-7B8D8516A28F}\.ba\wixstdba.dll
          • Size 191KB
          • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cab54A5CABBE7274D8A22EB58060AAB7623
          • Path C:\Windows\Temp\{E3E7C2DE-C417-4457-9F54-7B8D8516A28F}\cab54A5CABBE7274D8A22EB58060AAB7623
          • Size 800KB
          • SHA256 7be2d324f0cb063be8335982096f17ed4f08a7592130e04459ae818824016589
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cabB3E1576D1FEFBB979E13B1A5379E0B16
          • Path C:\Windows\Temp\{E3E7C2DE-C417-4457-9F54-7B8D8516A28F}\cabB3E1576D1FEFBB979E13B1A5379E0B16
          • Size 4.9MB
          • SHA256 e38280421473e79ebaaa8398d86974fc7100cc8ec1c3273fb9bfe4f672c918a6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcRuntimeAdditional_x86
          • Path C:\Windows\Temp\{E3E7C2DE-C417-4457-9F54-7B8D8516A28F}\vcRuntimeAdditional_x86
          • Size 180KB
          • SHA256 ff8884498c3174b7d2bd35bd1a43d75d3538dca2c0821ca5876fa45eb2c8a47f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcRuntimeMinimum_x86
          • Path C:\Windows\Temp\{E3E7C2DE-C417-4457-9F54-7B8D8516A28F}\vcRuntimeMinimum_x86
          • Size 180KB
          • SHA256 c78bc45113d0270c2154930761c3b74db714987a16c0fbe5e7a05fa3a853d0c8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cab2C04DDC374BD96EB5C8EB8208F2C7C92
          • Path C:\Windows\Temp\{FFBA66AC-8D09-43BF-BA5D-C435CE0BF32C}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
          • Size 5.4MB
          • SHA256 2de285c0fc328d30501cad8aa66a0ca9556ad5e30d03b198ebdbc422347db138
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cab5046A8AB272BF37297BB7928664C9503
          • Path C:\Windows\Temp\{FFBA66AC-8D09-43BF-BA5D-C435CE0BF32C}\cab5046A8AB272BF37297BB7928664C9503
          • Size 935KB
          • SHA256 b8b4732a600b741e824ab749321e029a07390aa730ec59401964b38105d5fa11
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcRuntimeAdditional_x64
          • Path C:\Windows\Temp\{FFBA66AC-8D09-43BF-BA5D-C435CE0BF32C}\vcRuntimeAdditional_x64
          • Size 188KB
          • SHA256 1c450cacdbf38527c27eb2107a674cd9da30aaf93a36be3c5729293f6f586e07
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcRuntimeMinimum_x64
          • Path C:\Windows\Temp\{FFBA66AC-8D09-43BF-BA5D-C435CE0BF32C}\vcRuntimeMinimum_x64
          • Size 188KB
          • SHA256 ee130110a29393dcbc7be1f26106d68b629afd2544b91e6caf3a50069a979b93
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/544-1070-0x0000000000400000-0x0000000000577000-memory.dmp
          Download

          memory/568-817-0x0000000000400000-0x000000000042D000-memory.dmp
          Download

          memory/568-861-0x0000000000400000-0x000000000042D000-memory.dmp
          Download

          memory/1032-1469-0x0000000000400000-0x000000000042D000-memory.dmp
          Download

          memory/1032-1455-0x0000000000400000-0x000000000042D000-memory.dmp
          Download

          memory/1052-458-0x00000000000A0000-0x0000000000117000-memory.dmp
          Download

          memory/1316-1496-0x0000000000400000-0x0000000000577000-memory.dmp
          Download

          memory/1320-1522-0x0000000000400000-0x000000000042D000-memory.dmp
          Download

          memory/1320-1080-0x0000000000400000-0x000000000042D000-memory.dmp
          Download

          memory/1356-287-0x00000201C6BB0000-0x00000201C6BC2000-memory.dmp
          Download

          memory/1356-211-0x00000201E0F70000-0x00000201E1023000-memory.dmp
          Download

          memory/1356-177-0x00000201C6720000-0x00000201C6766000-memory.dmp
          Download

          memory/1548-706-0x0000000000A30000-0x0000000000AA7000-memory.dmp
          Download

          memory/1640-2236-0x0000000005AB0000-0x0000000005AC5000-memory.dmp
          Download

          memory/1640-2234-0x0000000005560000-0x000000000557A000-memory.dmp
          Download

          memory/1716-860-0x0000000000400000-0x0000000000577000-memory.dmp
          Download

          memory/1932-771-0x0000000000400000-0x00000000005EC000-memory.dmp
          Download

          memory/1932-983-0x0000000000400000-0x00000000005EC000-memory.dmp
          Download

          memory/1932-1454-0x0000000000400000-0x00000000005EC000-memory.dmp
          Download

          memory/1932-290-0x0000000000400000-0x00000000005EC000-memory.dmp
          Download

          memory/1932-480-0x0000000000400000-0x00000000005EC000-memory.dmp
          Download

          memory/1932-798-0x0000000000400000-0x00000000005EC000-memory.dmp
          Download

          memory/1932-1669-0x0000000000400000-0x00000000005EC000-memory.dmp
          Download

          memory/1944-1482-0x0000000000400000-0x0000000000577000-memory.dmp
          Download

          memory/1968-1548-0x0000000000400000-0x0000000000526000-memory.dmp
          Download

          memory/2040-1521-0x0000000000400000-0x0000000000577000-memory.dmp
          Download

          memory/2220-456-0x00000000000A0000-0x0000000000117000-memory.dmp
          Download

          memory/2388-1519-0x0000000000400000-0x000000000042D000-memory.dmp
          Download

          memory/2388-1499-0x0000000000400000-0x000000000042D000-memory.dmp
          Download

          memory/2396-1580-0x0000000000400000-0x000000000042D000-memory.dmp
          Download

          memory/2396-1558-0x0000000000400000-0x000000000042D000-memory.dmp
          Download

          memory/2632-708-0x0000000000A30000-0x0000000000AA7000-memory.dmp
          Download

          memory/2644-872-0x0000000000400000-0x000000000042D000-memory.dmp
          Download

          memory/2644-912-0x0000000000400000-0x000000000042D000-memory.dmp
          Download

          memory/2700-1029-0x0000000000400000-0x000000000042D000-memory.dmp
          Download

          memory/2700-1071-0x0000000000400000-0x000000000042D000-memory.dmp
          Download

          memory/2840-289-0x0000000000400000-0x0000000000467000-memory.dmp
          Download

          memory/2840-1670-0x0000000000400000-0x0000000000467000-memory.dmp
          Download

          memory/2840-214-0x0000000000400000-0x0000000000467000-memory.dmp
          Download

          memory/2980-852-0x0000000004500000-0x0000000004566000-memory.dmp
          Download

          memory/3088-1518-0x0000000000400000-0x0000000000577000-memory.dmp
          Download

          memory/3136-1471-0x0000000000400000-0x000000000042D000-memory.dmp
          Download

          memory/3136-1497-0x0000000000400000-0x000000000042D000-memory.dmp
          Download

          memory/3280-848-0x00000000002B0000-0x00000000002D6000-memory.dmp
          Download

          memory/3280-1654-0x0000000000400000-0x0000000000577000-memory.dmp
          Download

          memory/3280-849-0x0000000002870000-0x0000000002892000-memory.dmp
          Download

          memory/3316-3182-0x000002029ECB0000-0x000002029FCB0000-memory.dmp
          Download

          memory/3316-2981-0x00000202FAB50000-0x00000202FAFA0000-memory.dmp
          Download

          memory/3316-3437-0x00000202F4A80000-0x00000202F4ACA000-memory.dmp
          Download

          memory/3316-3432-0x00000202FD990000-0x00000202FDAF0000-memory.dmp
          Download

          memory/3316-3427-0x00000202FD750000-0x00000202FD82A000-memory.dmp
          Download

          memory/3316-3422-0x00000202FE1D0000-0x00000202FE520000-memory.dmp
          Download

          memory/3316-3414-0x0000020299780000-0x0000020299A62000-memory.dmp
          Download

          memory/3316-3407-0x00000202FCD80000-0x00000202FCE4E000-memory.dmp
          Download

          memory/3316-3402-0x00000202F8510000-0x00000202F8584000-memory.dmp
          Download

          memory/3316-163-0x00000202F7410000-0x00000202F7418000-memory.dmp
          Download

          memory/3316-3392-0x00000202F7760000-0x00000202F7812000-memory.dmp
          Download

          memory/3316-3387-0x00000202FCE70000-0x00000202FD02C000-memory.dmp
          Download

          memory/3316-3375-0x0000020299470000-0x000002029977E000-memory.dmp
          Download

          memory/3316-3370-0x00000202FDC90000-0x00000202FE1C2000-memory.dmp
          Download

          memory/3316-3364-0x0000020298810000-0x0000020298912000-memory.dmp
          Download

          memory/3316-3343-0x00000202FE610000-0x00000202FF4CC000-memory.dmp
          Download

          memory/3316-3313-0x00000202F4A40000-0x00000202F4A80000-memory.dmp
          Download

          memory/3316-3318-0x00000202986C0000-0x000002029880C000-memory.dmp
          Download

          memory/3316-3307-0x00000202FCBB0000-0x00000202FCCAE000-memory.dmp
          Download

          memory/3316-12-0x00000202EF6D0000-0x00000202F03D8000-memory.dmp
          Download

          memory/3316-3294-0x00000202FB4C0000-0x00000202FB5A2000-memory.dmp
          Download

          memory/3316-149-0x00000202F89D0000-0x00000202F89EC000-memory.dmp
          Download

          memory/3316-148-0x00000202F88F0000-0x00000202F89A3000-memory.dmp
          Download

          memory/3316-3289-0x00000202985C0000-0x00000202986B2000-memory.dmp
          Download

          memory/3316-3284-0x00000202F7470000-0x00000202F751C000-memory.dmp
          Download

          memory/3316-3276-0x00000202FD180000-0x00000202FD74E000-memory.dmp
          Download

          memory/3316-147-0x00000202F88D0000-0x00000202F88EC000-memory.dmp
          Download

          memory/3316-1845-0x00000202F43B0000-0x00000202F4460000-memory.dmp
          Download

          memory/3316-3271-0x0000020298460000-0x00000202985B2000-memory.dmp
          Download

          memory/3316-127-0x00000202F2F80000-0x00000202F2F92000-memory.dmp
          Download

          memory/3316-126-0x00000202F7F10000-0x00000202F7F18000-memory.dmp
          Download

          memory/3316-3261-0x00000202F46C0000-0x00000202F46D4000-memory.dmp
          Download

          memory/3316-3266-0x00000202FB300000-0x00000202FB3DE000-memory.dmp
          Download

          memory/3316-113-0x00000202F6B40000-0x00000202F6B4E000-memory.dmp
          Download

          memory/3316-3255-0x00000202F4690000-0x00000202F46BE000-memory.dmp
          Download

          memory/3316-3245-0x00000202F4660000-0x00000202F4684000-memory.dmp
          Download

          memory/3316-3239-0x0000020307200000-0x000002030C434000-memory.dmp
          Download

          memory/3316-3234-0x00000202FB150000-0x00000202FB2F8000-memory.dmp
          Download

          memory/3316-3226-0x00000202FC940000-0x00000202FCBB0000-memory.dmp
          Download

          memory/3316-3221-0x00000202FAFA0000-0x00000202FB150000-memory.dmp
          Download

          memory/3316-3214-0x00000202F4630000-0x00000202F4656000-memory.dmp
          Download

          memory/3316-3206-0x0000020298A30000-0x0000020299158000-memory.dmp
          Download

          memory/3316-3201-0x0000020298280000-0x00000202982F8000-memory.dmp
          Download

          memory/3316-112-0x00000202F6B80000-0x00000202F6BB8000-memory.dmp
          Download

          memory/3316-3196-0x0000020298080000-0x00000202980F6000-memory.dmp
          Download

          memory/3316-3191-0x0000020298140000-0x0000020298272000-memory.dmp
          Download

          memory/3316-111-0x00000202F6B30000-0x00000202F6B38000-memory.dmp
          Download

          memory/3316-3168-0x00000202FC410000-0x00000202FC938000-memory.dmp
          Download

          memory/3316-3167-0x0000020300000000-0x0000020301FB6000-memory.dmp
          Download

          memory/3316-3154-0x00000202F45D0000-0x00000202F45F6000-memory.dmp
          Download

          memory/3316-3149-0x00000202F49E0000-0x00000202F4A3C000-memory.dmp
          Download

          memory/3316-3153-0x00000202F8400000-0x00000202F8502000-memory.dmp
          Download

          memory/3316-2922-0x00000202F4310000-0x00000202F4318000-memory.dmp
          Download

          memory/3316-3141-0x00000202F45B0000-0x00000202F45C4000-memory.dmp
          Download

          memory/3316-108-0x00000202F2FD0000-0x00000202F2FE4000-memory.dmp
          Download

          memory/3316-3142-0x00000202F85D0000-0x00000202F8792000-memory.dmp
          Download

          memory/3316-16-0x00000202F2DA0000-0x00000202F2DB2000-memory.dmp
          Download

          memory/3316-15-0x00000202F2D70000-0x00000202F2D96000-memory.dmp
          Download

          memory/3316-14-0x00000202F29F0000-0x00000202F29FA000-memory.dmp
          Download

          memory/3316-13-0x00000202F2D30000-0x00000202F2D68000-memory.dmp
          Download

          memory/3316-3114-0x00000202F46F0000-0x00000202F48AA000-memory.dmp
          Download

          memory/3316-3122-0x00000202FB5E0000-0x00000202FBC20000-memory.dmp
          Download

          memory/3328-911-0x0000000000400000-0x0000000000577000-memory.dmp
          Download

          memory/3732-709-0x0000000000A30000-0x0000000000AA7000-memory.dmp
          Download

          memory/3912-1579-0x0000000000400000-0x0000000000577000-memory.dmp
          Download

          memory/3952-1618-0x0000000000400000-0x000000000042D000-memory.dmp
          Download

          memory/3952-1655-0x0000000000400000-0x000000000042D000-memory.dmp
          Download

          memory/4076-2173-0x0000000001560000-0x00000000015DA000-memory.dmp
          Download

          memory/4292-1019-0x0000000000400000-0x0000000000577000-memory.dmp
          Download

          memory/4308-1517-0x0000000002660000-0x00000000026DA000-memory.dmp
          Download

          memory/4328-1020-0x0000000000400000-0x000000000042D000-memory.dmp
          Download

          memory/4328-921-0x0000000000400000-0x000000000042D000-memory.dmp
          Download

          memory/4416-2821-0x000001B668580000-0x000001B668588000-memory.dmp
          Download

          memory/4976-11-0x000001AE29600000-0x000001AE29612000-memory.dmp
          Download

          memory/4976-0-0x000001AE297F0000-0x000001AE29800000-memory.dmp
          Download

          memory/4976-1-0x000001AE297F0000-0x000001AE29800000-memory.dmp
          Download

          memory/4976-9-0x000001AE297F0000-0x000001AE29800000-memory.dmp
          Download

          memory/4976-7-0x000001AE41C80000-0x000001AE41CA2000-memory.dmp
          Download

          memory/5208-1549-0x0000000000400000-0x000000000042D000-memory.dmp
          Download

          memory/5208-1531-0x0000000000400000-0x000000000042D000-memory.dmp
          Download

          memory/5384-1667-0x0000000001300000-0x000000000137A000-memory.dmp
          Download

          memory/5628-1589-0x0000000000400000-0x000000000042D000-memory.dmp
          Download

          memory/5628-1609-0x0000000000400000-0x000000000042D000-memory.dmp
          Download

          memory/5688-1659-0x0000000004FE0000-0x0000000005018000-memory.dmp
          Download

          memory/5688-1662-0x0000000000DC0000-0x0000000000DD9000-memory.dmp
          Download

          memory/5688-1657-0x0000000000520000-0x00000000005B6000-memory.dmp
          Download

          memory/5692-2795-0x0000000001050000-0x000000000106A000-memory.dmp
          Download

          memory/5692-2174-0x00000000046B0000-0x0000000004996000-memory.dmp
          Download

          memory/5692-1674-0x0000000000870000-0x00000000008A6000-memory.dmp
          Download

          memory/5692-1784-0x0000000005890000-0x0000000005940000-memory.dmp
          Download

          memory/5692-1785-0x00000000050D0000-0x00000000050F2000-memory.dmp
          Download

          memory/5692-1786-0x0000000005940000-0x0000000005C97000-memory.dmp
          Download

          memory/5692-1854-0x00000000066E0000-0x00000000066F2000-memory.dmp
          Download

          memory/5692-2116-0x0000000005F50000-0x0000000005F5A000-memory.dmp
          Download

          memory/5692-2145-0x0000000006A00000-0x0000000006A24000-memory.dmp
          Download

          memory/5692-2176-0x0000000004C50000-0x0000000004C65000-memory.dmp
          Download

          memory/5692-2175-0x0000000004C20000-0x0000000004C3A000-memory.dmp
          Download

          memory/5692-1677-0x0000000003F00000-0x0000000003F12000-memory.dmp
          Download

          memory/5692-2789-0x0000000000FA0000-0x0000000000FBA000-memory.dmp
          Download

          memory/5692-2803-0x0000000003D90000-0x0000000003D9A000-memory.dmp
          Download

          memory/5692-2799-0x0000000004BE0000-0x0000000004C02000-memory.dmp
          Download

          memory/5692-2930-0x0000000006F00000-0x00000000070C2000-memory.dmp
          Download

          memory/5692-2814-0x0000000004F00000-0x0000000004F3C000-memory.dmp
          Download

          memory/5692-2885-0x0000000006030000-0x0000000006068000-memory.dmp
          Download

          memory/5692-2835-0x0000000004AC0000-0x0000000004ACA000-memory.dmp
          Download

          memory/5692-2838-0x0000000004EA0000-0x0000000004EB8000-memory.dmp
          Download

          memory/5692-2861-0x0000000005F80000-0x0000000005F9A000-memory.dmp
          Download

          memory/5828-459-0x00000000000A0000-0x0000000000117000-memory.dmp
          Download

          memory/5996-1608-0x0000000000400000-0x0000000000577000-memory.dmp
          Download