0511509f68956d4b1b66b80b7292131fab7815c86711255801f8884dbee2e811

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 16:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MP1-Fixpack NoTex v1.2025.1.exe
Size 13.2MB
Sample260818-vftlbsad33
SHA256 0511509f68956d4b1b66b80b7292131fab7815c86711255801f8884dbee2e811
MD5 1fdce6de589d1a405dd1fb2aa4e18b50
SHA1 e495705b8666065710c6478a6697440166038ecd
SHA512 9b3a94c089f26f7e61541b8660a3f7c0f49188ab83791ec9a00972d9d8aee9927cd81ddad4740b0a5b023d30aa6ec5f9ce4ca0f0ab46944d674fb503b76bb81f
SSDEEP 393216:lQGAi8VqsaYy7RUEaW8IypyoXLEQXAWM1:hAJVNiRUEaW8zpyyL9U
TLSH
T14AD62323F2CBE53EE05E1B3B0572A10494FB7A15A422AD5786ECB4ECCF716501D2E64B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery installer persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 5 IoCs

pid	Process
4516	MP1-Fixpack NoTex v1.2025.1.tmp
4800	dxwebsetup.exe
2316	dxwsetup.exe
4632	vcredist_x86.exe
3800	Setup.exe

Loads dropped DLL 3 IoCs

pid	Process
2316	dxwsetup.exe
3800	Setup.exe
3800	Setup.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	dxwebsetup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\L:	dxwsetup.exe
File opened (read-only)	\??\T:	dxwsetup.exe
File opened (read-only)	\??\W:	dxwsetup.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	dxwsetup.exe
File opened (read-only)	\??\P:	dxwsetup.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	dxwsetup.exe
File opened (read-only)	\??\O:	dxwsetup.exe
File opened (read-only)	\??\R:	dxwsetup.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\S:	dxwsetup.exe
File opened (read-only)	\??\X:	dxwsetup.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	dxwsetup.exe
File opened (read-only)	\??\J:	dxwsetup.exe
File opened (read-only)	\??\Y:	dxwsetup.exe
File opened (read-only)	\??\Z:	dxwsetup.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	dxwsetup.exe
File opened (read-only)	\??\K:	dxwsetup.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	dxwsetup.exe
File opened (read-only)	\??\Q:	dxwsetup.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\D:	dxwsetup.exe
File opened (read-only)	\??\G:	dxwsetup.exe
File opened (read-only)	\??\N:	dxwsetup.exe
File opened (read-only)	\??\U:	dxwsetup.exe
File opened (read-only)	\??\V:	dxwsetup.exe

Drops file in System32 directory 27 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\directx\websetup\dsetup.dll	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\DirectX\WebSetup	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\atl100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100chs.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100deu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100fra.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100ita.dll	msiexec.exe
File created	C:\Windows\SysWOW64\directx\websetup\SETC2BB.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\msvcr100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100esn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100jpn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100kor.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100rus.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\directx\websetup\SETC2AA.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\DirectX\WebSetup\filelist.dat	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\mfcm100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm100u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100cht.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100enu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcomp100.dll	msiexec.exe
File created	C:\Windows\SysWOW64\directx\websetup\SETC2AA.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\directx\websetup\SETC2BB.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\directx\websetup\dsetup32.dll	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\dxupdate.cab	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\mfc100.dll	msiexec.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File opened for modification	\??\c:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB568A7B6B61A4593.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0078B9A1AA9E0B7D.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF099A33CD9A741EAF.TMP	msiexec.exe
File created	C:\Windows\Installer\e5a3fbd.msp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE6F7070C27651A73.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI445E.tmp	msiexec.exe
File opened for modification	C:\Windows\Logs\DirectX.log	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS59C9F4.tmp\dxupdate.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS59C9F4.tmp	dxwsetup.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a3fbd.msp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF558B8BDD21102841.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF52A59AAC2F1FF3BE.TMP	msiexec.exe
File opened for modification	C:\Windows\msdownld.tmp\AS59C9F4.tmp\dxupdate.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5A1CE6.tmp	dxwsetup.exe
File opened for modification	C:\Windows\Installer\MSI40D3.tmp	msiexec.exe
File opened for modification	C:\Windows\msdownld.tmp	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5A1CE6.tmp\dxupdate.cab	dxwsetup.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5A1CE6.tmp\dxupdate.cab	dxwsetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxwebsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxwsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MP1-Fixpack NoTex v1.2025.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MP1-Fixpack NoTex v1.2025.1.tmp

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/2024-1-0x00000000002C0000-0x000000000039C000-memory.dmp	innosetup
behavioral2/memory/2024-8-0x00000000002C0000-0x000000000039C000-memory.dmp	innosetup
behavioral2/memory/2024-3392-0x00000000002C0000-0x000000000039C000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 43 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Patches\2D0058F6F08A743309184BE1178C95B2\SourceList\Net\2 = "f:\\ca24c99819cadcb6cee73b\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\CLSID\{47D4D946-62E8-11CF-93BC-444553540000}\InprocServer32	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\CLSID\{47D4D946-62E8-11CF-93BC-444553540000}\InprocServer32\ = "dsound.dll"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\CLSID\{3901CC3F-84B5-4FA4-BA35-AA8172B8A09B}\InprocServer32\ = "dsound.dll"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\Patches\2D0058F6F08A743309184BE1178C95B2 = ":SP1.1;:#SP1.1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Patches\2D0058F6F08A743309184BE1178C95B2\SourceList	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\CLSID\{3901CC3F-84B5-4FA4-BA35-AA8172B8A09B}\InprocServer32	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\WOW6432Node	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1D5E3C0FEDA1E123187686FED06E995A\KB2565063 = "Servicing_Key"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1D5E3C0FEDA1E123187686FED06E995A\KB2549743 = "Servicing_Key"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\CLSID	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\CLSID\{47D4D946-62E8-11CF-93BC-444553540000}	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\WOW6432Node\CLSID	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\WOW6432Node\CLSID\{3901CC3F-84B5-4FA4-BA35-AA8172B8A09B}\InprocServer32	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\WOW6432Node\CLSID\{3901CC3F-84B5-4FA4-BA35-AA8172B8A09B}\InprocServer32\ = "dsound.dll"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\SourceList\LastUsedSource = "n;2;f:\\ca24c99819cadcb6cee73b\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\ProductName = "Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\SourceList\Net\2 = "f:\\ca24c99819cadcb6cee73b\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1D5E3C0FEDA1E123187686FED06E995A\Servicing_Key	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\CLSID\{3901CC3F-84B5-4FA4-BA35-AA8172B8A09B}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1D5E3C0FEDA1E123187686FED06E995A	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1D5E3C0FEDA1E123187686FED06E995A\KB2524860 = "Servicing_Key"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\WOW6432Node\CLSID\{47D4D946-62E8-11CF-93BC-444553540000}	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\WOW6432Node\CLSID\{47D4D946-62E8-11CF-93BC-444553540000}\InprocServer32\ = "dsound.dll"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\Version = "167812379"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1D5E3C0FEDA1E123187686FED06E995A\VCRedist_x86_enu	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	dxwsetup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\Patches\Patches = 3200440030003000350038004600360046003000380041003700340033003300300039003100380034004200450031003100370038004300390035004200320000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Patches\2D0058F6F08A743309184BE1178C95B2\SourceList\LastUsedSource = "n;2;f:\\ca24c99819cadcb6cee73b\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Patches\2D0058F6F08A743309184BE1178C95B2\SourceList\Net	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\WOW6432Node\CLSID\{47D4D946-62E8-11CF-93BC-444553540000}\InprocServer32	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\Patches	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1D5E3C0FEDA1E123187686FED06E995A\FT_VCRedist_x86_KB2565063_Detection	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\WOW6432Node\CLSID\{3901CC3F-84B5-4FA4-BA35-AA8172B8A09B}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1D5E3C0FEDA1E123187686FED06E995A\KB2544655 = "Servicing_Key"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4516	MP1-Fixpack NoTex v1.2025.1.tmp
4516	MP1-Fixpack NoTex v1.2025.1.tmp
3800	Setup.exe
3800	Setup.exe
3800	Setup.exe
3800	Setup.exe
3800	Setup.exe
3800	Setup.exe
3800	Setup.exe
3800	Setup.exe
3800	Setup.exe
3800	Setup.exe
3800	Setup.exe
3800	Setup.exe
1184	msiexec.exe
1184	msiexec.exe
1184	msiexec.exe
1184	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3800	Setup.exe
Token: SeIncreaseQuotaPrivilege	3800	Setup.exe
Token: SeSecurityPrivilege	1184	msiexec.exe
Token: SeCreateTokenPrivilege	3800	Setup.exe
Token: SeAssignPrimaryTokenPrivilege	3800	Setup.exe
Token: SeLockMemoryPrivilege	3800	Setup.exe
Token: SeIncreaseQuotaPrivilege	3800	Setup.exe
Token: SeMachineAccountPrivilege	3800	Setup.exe
Token: SeTcbPrivilege	3800	Setup.exe
Token: SeSecurityPrivilege	3800	Setup.exe
Token: SeTakeOwnershipPrivilege	3800	Setup.exe
Token: SeLoadDriverPrivilege	3800	Setup.exe
Token: SeSystemProfilePrivilege	3800	Setup.exe
Token: SeSystemtimePrivilege	3800	Setup.exe
Token: SeProfSingleProcessPrivilege	3800	Setup.exe
Token: SeIncBasePriorityPrivilege	3800	Setup.exe
Token: SeCreatePagefilePrivilege	3800	Setup.exe
Token: SeCreatePermanentPrivilege	3800	Setup.exe
Token: SeBackupPrivilege	3800	Setup.exe
Token: SeRestorePrivilege	3800	Setup.exe
Token: SeShutdownPrivilege	3800	Setup.exe
Token: SeDebugPrivilege	3800	Setup.exe
Token: SeAuditPrivilege	3800	Setup.exe
Token: SeSystemEnvironmentPrivilege	3800	Setup.exe
Token: SeChangeNotifyPrivilege	3800	Setup.exe
Token: SeRemoteShutdownPrivilege	3800	Setup.exe
Token: SeUndockPrivilege	3800	Setup.exe
Token: SeSyncAgentPrivilege	3800	Setup.exe
Token: SeEnableDelegationPrivilege	3800	Setup.exe
Token: SeManageVolumePrivilege	3800	Setup.exe
Token: SeImpersonatePrivilege	3800	Setup.exe
Token: SeCreateGlobalPrivilege	3800	Setup.exe
Token: SeRestorePrivilege	1184	msiexec.exe
Token: SeTakeOwnershipPrivilege	1184	msiexec.exe
Token: SeRestorePrivilege	1184	msiexec.exe
Token: SeTakeOwnershipPrivilege	1184	msiexec.exe
Token: SeRestorePrivilege	1184	msiexec.exe
Token: SeTakeOwnershipPrivilege	1184	msiexec.exe
Token: SeRestorePrivilege	1184	msiexec.exe
Token: SeTakeOwnershipPrivilege	1184	msiexec.exe
Token: SeRestorePrivilege	1184	msiexec.exe
Token: SeTakeOwnershipPrivilege	1184	msiexec.exe
Token: SeRestorePrivilege	1184	msiexec.exe
Token: SeTakeOwnershipPrivilege	1184	msiexec.exe
Token: SeRestorePrivilege	1184	msiexec.exe
Token: SeTakeOwnershipPrivilege	1184	msiexec.exe
Token: SeRestorePrivilege	1184	msiexec.exe
Token: SeTakeOwnershipPrivilege	1184	msiexec.exe
Token: SeRestorePrivilege	1184	msiexec.exe
Token: SeTakeOwnershipPrivilege	1184	msiexec.exe
Token: SeShutdownPrivilege	3800	Setup.exe
Token: SeIncreaseQuotaPrivilege	3800	Setup.exe
Token: SeCreateTokenPrivilege	3800	Setup.exe
Token: SeAssignPrimaryTokenPrivilege	3800	Setup.exe
Token: SeLockMemoryPrivilege	3800	Setup.exe
Token: SeIncreaseQuotaPrivilege	3800	Setup.exe
Token: SeMachineAccountPrivilege	3800	Setup.exe
Token: SeTcbPrivilege	3800	Setup.exe
Token: SeSecurityPrivilege	3800	Setup.exe
Token: SeTakeOwnershipPrivilege	3800	Setup.exe
Token: SeLoadDriverPrivilege	3800	Setup.exe
Token: SeSystemProfilePrivilege	3800	Setup.exe
Token: SeSystemtimePrivilege	3800	Setup.exe
Token: SeProfSingleProcessPrivilege	3800	Setup.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4516	MP1-Fixpack NoTex v1.2025.1.tmp

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1184	msiexec.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 4516	2024	MP1-Fixpack NoTex v1.2025.1.exe	89
PID 4516 wrote to memory of 4800	4516	MP1-Fixpack NoTex v1.2025.1.tmp	91
PID 4800 wrote to memory of 2316	4800	dxwebsetup.exe	92
PID 4516 wrote to memory of 4632	4516	MP1-Fixpack NoTex v1.2025.1.tmp	94
PID 4632 wrote to memory of 3800	4632	vcredist_x86.exe	96
PID 4516 wrote to memory of 5908	4516	MP1-Fixpack NoTex v1.2025.1.tmp	98

C:\Users\Admin\AppData\Local\Temp\MP1-Fixpack NoTex v1.2025.1.exe
"C:\Users\Admin\AppData\Local\Temp\MP1-Fixpack NoTex v1.2025.1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Users\Admin\AppData\Local\Temp\is-VEN1T.tmp\MP1-Fixpack NoTex v1.2025.1.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-VEN1T.tmp\MP1-Fixpack NoTex v1.2025.1.tmp" /SL5="$50230,12865834,845824,C:\Users\Admin\AppData\Local\Temp\MP1-Fixpack NoTex v1.2025.1.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4516
- - C:\Max Payne\support\dxwebsetup.exe
    "C:\Max Payne\support\dxwebsetup.exe" /q
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4800
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe /windowsupdate
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Enumerates connected drives
      Drops file in System32 directory
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:2316
- - C:\Max Payne\support\vcredist_x86.exe
    "C:\Max Payne\support\vcredist_x86.exe" /q
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4632
  - - \??\f:\ca24c99819cadcb6cee73b\Setup.exe
      f:\ca24c99819cadcb6cee73b\Setup.exe /q
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3800
- - C:\Windows\SysWOW64\reg.exe
    "reg" import "C:\Max Payne\support\dsoundfix.reg" /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5908

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5a3fbc.rbs

Path C:\Config.Msi\e5a3fbc.rbs
Size 4KB
SHA256 8d8624ef0431571fe3e08aef332559666544b39e397740c8956bb27f23a6729d
MD5 0a9c4bf4c33feef5a835e9d4243e77bd
SHA1 8644f57e8b58be1cb0c3f6b508ec2c938cee41d8
SHA512 130225c06314461b93bb86aecb2f24275dc1bbb7daa8ca48293617fa0c5e6c3e8b0b49760f7a3dde1af861496ffbcfe6245c3313db060af9b1d092fbe5e082c1
SSDEEP 96:KsKrwKIHCx36tThq2236/KcKVThq22KcKQv+lw+C3+bv3+70r1+z:KrLYCtKWPb1dbQvYw9oP7ho
TLSH
T18D914A129604D3D3EDA61F30CD07076137BBC6E98316839B04CD91B44F4BBC96EAA65A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a3fc0.rbs

Path C:\Config.Msi\e5a3fc0.rbs
Size 31KB
SHA256 c286fc975f41776f41ee24ddd3c87749bab02095f7a80a848b72aa6ae4a4d408
MD5 cd0a5e2046d1ece51ebf2f18e5f8c81b
SHA1 e1aa74524fb7dd0c420d239375422751dacd2d46
SHA512 8bcb8aa2507bddab2ea0ef6f2172c22b1b8f9e1402ab63a35359ecf6188d31cde72b8dc1e387f5c47fb4bb8747d5da318f649eb124a4855e191708951fd524ea
SSDEEP 384:KrLZWRomipuUAaLM0hUulnxOfbyOSFLdRl/do8BdjR1k30AR1k30VGo0PbPbe9+l:K5WRomiIUAaLM0hUuNxtPZlb1Q1IYFC3
TLSH
T1CFE223026204E293D9BA1A30CE1717757F7BC3E59316876B01CE85608F83FC96E99B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dsoundfix.reg

Path C:\Max Payne\support\dsoundfix.reg
Size 524B
SHA256 5de28980d807eafda436d0280e0ab69b5f939847ab96a7e810e15720843d2d3e
MD5 a8b7abb7635d400a91ddc7337d53e5b1
SHA1 0069866182df0c209dd78f2ec367df33aefe9f61
SHA512 8e7360d5a14e76360d2011081916ec6649096266618a297006ac51ae8723b2bf80b034b615bc5a1bbac6e4f7a31b091706a90891c757cb18b96fe2f88fe6e615
TLSH
T160F05991D003F3662CC5A1146A101DAA53D233D9A5D75FC4AA5DA358245C8CD032E2EF
MD5 SHA1 SHA512 TLSH

Submit Download

dxwebsetup.exe

Path C:\Max Payne\support\dxwebsetup.exe
Size 288KB
SHA256 2cf71d098c608c56e07f4655855a886c3102553f648df88458df616b26fd612f
MD5 2cbd6ad183914a0c554f0739069e77d7
SHA1 7bf35f2afca666078db35ca95130beb2e3782212
SHA512 ff1af2d2a883865f2412dddcd68006d1907a719fe833319c833f897c93ee750bac494c0991170dc1cf726b3f0406707daa361d06568cd610eeb4ed1d9c0fbb10
SSDEEP 6144:kWK8fc2liXmrLxcdRDLiH1vVRGVOhMp421/7YQV:VcvgLARDI1KIOzO0
TLSH
T19654F15197E4817BE4FA1B311DF2025327797DE86CB9E32E838658881D71780BE35B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\Max Payne\support\vcredist_x86.exe
Size 8.6MB
SHA256 99dce3c841cc6028560830f7866c9ce2928c98cf3256892ef8e6cf755147b0d8
MD5 f45ade105f9c4fe754976c820230a9e5
SHA1 2222fc008e469fec77d0d291877f357c6e1eb16d
SHA512 243564043b0b5607f7a36bb5e64e434c5ad1a927706792dac6f56a2dbe790856a1f4e40b823fbf241d1a2a919e1be5bc8d7710ad99d154343da5ae2d4c87208b
SSDEEP 196608:u9A3DAnfudQZKuNK0kMp2Wxw2tr3aA5Jegn9kaK6Hj0aaNz9ZBJ70:d3DAnGKZKuNK0SvAn9kaK6gaaNRZb0
TLSH
T1C396339714300ADFFC07BB70F7558556D8ED496233A8D7EA0AC60CC89AEEAE4C1B6750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HFI3887.tmp.html

Path C:\Users\Admin\AppData\Local\Temp\HFI3887.tmp.html
Size 16KB
SHA256 50e2d89fddbae2c8b7b57b1b0279ebeb39f0ce89a813145f57d84edd90497685
MD5 425796c1b63da4030aa720b9f1857e1b
SHA1 df9597b2e381baf5088eb1b5538e4ea3d9835840
SHA512 ed3b12613f3f6beea5b3abe83f417559d6a9d4f6b383607890877bd621e7225295cc9e9d972f976e9b5404da88dd61f6ba496049c3edb96802150e212d671ef8
SSDEEP 192:7Ddx3KOTczFQ21Kp4n5DTx1iDecPeLHLHQFJFjZWblWUxFzJzcKHjq:fdsOT01KcBUFJFEWUxFzvHG
TLSH
T10A72675326E84248A1B6BE49AFB640750B79BD45AC3CCE7D05A0591E49E3F04F872FB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DXI1E18.tmp

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\DXI1E18.tmp
Size 56KB
SHA256 ed710d035ccaab0914810becf2f5db2816dba3a351f3666a38a903c80c16997a
MD5 2c4d9e4773084f33092ced15678a2c46
SHA1 bad603d543470157effd4876a684b9cfd5075524
SHA512 d2e34cac195cfede8bc64bdc92721c574963ff522618eda4d7172f664aeb4c8675fd3d4f3658391ee5eaa398bcd2ce5d8f80deecf51af176f5c4bb2d2695e04e
SSDEEP 768:eNIkdgBl0DBU0qwUqB7otN4PTHhy4m1Io/sF6UcmI2rIEoguD0dpY4rI8dgXl0dl:epECjtutVj072Xwt7O49vQzztSZs5KLz
TLSH
T15343FB00F0F22DEE405A5C5A27895D6A0C9F64557C5D202EB9CE83B89FFC1ED93899E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dsetup.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dsetup.dll
Size 93KB
SHA256 57bc22850bb8e0bcc511a9b54cd3da18eec61f3088940c07d63b9b74e7fe2308
MD5 984cad22fa542a08c5d22941b888d8dc
SHA1 3e3522e7f3af329f2235b0f0850d664d5377b3cd
SHA512 8ef171218b331f0591a4b2a5e68dcbae98f5891518ce877f1d8d1769c59c0f4ddae43cc43da6606975078f889c832f0666484db9e047782e7a0ae4a2d41f5bef
SSDEEP 1536:BG8tBKv1HCyODN2wjIqlLmqxY3AMVI4I9okOEvc0/c/sZRYltL26VVE2S+JJqsHM:BptQv1iyODswNLmqxY3AMV71Ev54EAxa
TLSH
T186937D107694D176D9D220BD718CD7715ABEA6B01FA880CBBB461BDA8C653C0BA3D30F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dsetup32.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dsetup32.dll
Size 1.5MB
SHA256 8a011da043a4b81e2b3d41a332e0ff23a65d546bd7636e8bc74885e8746927d6
MD5 a5412a144f63d639b47fcc1ba68cb029
SHA1 81bd5f1c99b22c0266f3f59959dfb4ea023be47e
SHA512 2679a4cb690e8d709cb5e57b59315d22f69f91efa6c4ee841943751c882b0c0457fd4a3376ac3832c757c6dfaffb7d844909c5665b86a95339af586097ee0405
SSDEEP 24576:GIQ+ddddddddddddddxOOOOOOOOOOOOOO2iWeXiWeXiWeXiWeXiWeXiWeXiWeXig:GIQsOOOOOOOOOOOOOO2iWeXiWeXiWeXV
TLSH
T1EB759D31B1D40332EA7103B177128AB7F63EEB9DE119D62579AE82592182B9CC37E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxupdate.cif

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxupdate.cif
Size 65KB
SHA256 c6c5e877e92d387e977c135765075b7610df2500e21c16e106a225216e6442ae
MD5 b36d3f105d18e55534ad605cbf061a92
SHA1 788ef2de1dea6c8fe1d23a2e1007542f7321ed79
SHA512 35ae00da025fd578205337a018b35176095a876cd3c3cf67a3e8a8e69cd750a4ccc34ce240f11fae3418e5e93caf5082c987f0c63f9d953ed7cb8d9271e03b62
SSDEEP 768:Wn+OeDyG6lG9CVGQM6UP8XUUkw8KlNxLkPkjdARflPp0VZRTBM9oZPFASJu71N1F:V
TLSH
T147633209734ED9FE900FF9A70EA66D4D686E81AB344D680E78FF52C50B3B4DD628D091
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxupdate.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxupdate.dll
Size 173KB
SHA256 fb4f297e295c802b1377c6684734b7249d55743dfb7c14807bef59a1b5db63a2
MD5 7ed554b08e5b69578f9de012822c39c9
SHA1 036d04513e134786b4758def5aff83d19bf50c6e
SHA512 7af5f9c4a3ad5c120bcdd681b958808ada4d885d21aeb4a009a36a674ad3ece9b51837212a982db6142a6b5580e5b68d46971b802456701391ce40785ae6ebd9
SSDEEP 3072:KU6LKKnw8i/9S7BLGKm/nuFV3uNgosUBxr+2y97CqGIpHtWMeJnQRLj+bTHyKaY:Iw8aIMrfuFVeNgosUBxra4rIZsqq
TLSH
T133047C19F640E871D4D20178311C6B3119FEA87017A980CBF3472BCEE9A97D5A67E36B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxupdate.inf

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxupdate.inf
Size 12KB
SHA256 93f5589499ee4ee2812d73c0d8feacbbcfe8c47b6d98572486bc0eff3c5906ca
MD5 e6a74342f328afa559d5b0544e113571
SHA1 a08b053dfd061391942d359c70f9dd406a968b7d
SHA512 1e35e5bdff1d551da6c1220a1a228c657a56a70dedf5be2d9273fc540f9c9f0bb73469595309ea1ff561be7480ee92d16f7acbbd597136f4fc5f9b8b65ecdfad
SSDEEP 384:eXTiDxtV0xxmBxbD6Ys7s6xHOJYwYdDxAp8xXZyUxIJM:eXiM
TLSH
T121429976B5168259F40EB3A016AF3EC95E3B008FB53164CD79EF11B0572E1ACA2FE464
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxwsetup.cif

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.cif
Size 56KB
SHA256 762ff640013db2bd4109d7df43a867303093815751129bd1e33f16bf02e52cce
MD5 7b1fbe9f5f43b2261234b78fe115cf8e
SHA1 dd0f256ae38b4c4771e1d1ec001627017b7bb741
SHA512 d21935a9867c0f2f7084917c79fbb1da885a1bfd4793cf669ff4da8c777b3a201857250bfb7c2b616625a8d3573c68395d210446d2c284b41cf09cc7cbb07885
SSDEEP 768:eNIkdgBl0DBU0qwUqB7otN4PTHhy4m1Io/sF6UcmI2rIEoguD0dpY4rI8dgXl0dL:epECjtutVj072Xwt7O49vQzztSZs5KLV
TLSH
T17443FB00F0F22DEE405A5C5A27895D6A0C9F64557C5D202EB9CE83B89FFC1ED93899E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxwsetup.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
Size 515KB
SHA256 8f5e89298e3dc2e22d47515900c37cca4ee121c5ba06a6d962d40ad6e1a595da
MD5 ac3a5f7be8cd13a863b50ab5fe00b71c
SHA1 eee417cd92e263b84dd3b5dcc2b4b463fe6e84d9
SHA512 c8bbe791373dad681f0ac9f5ab538119bde685d4f901f5db085c73163fc2e868972b2de60e72ccd44f745f1fd88fcde2e27f32302d8cbd3c1f43e6e657c79fba
SSDEEP 3072:diqLKVd9Aqq3Z/yKxAG2ur4IhUNJ4g3nO9hpRH0gQSpHt+akOC8BTDmsikzWX+us:DFAKJr4IWNJ4MOrpRBQS3kydI+xyS
TLSH
T1EEB4F05032F4D926F2F32B743ABDE26148BA7D90AA38C24D2502565D1BF3B40A56CF77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxwsetup.inf

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.inf
Size 477B
SHA256 d63c35e9b43eb0f28ffc28f61c9c9a306da9c9de3386770a7eb19faa44dbfc00
MD5 ad8982eaa02c7ad4d7cdcbc248caa941
SHA1 4ccd8e038d73a5361d754c7598ed238fc040d16b
SHA512 5c805d78bafff06c36b5df6286709ddf2d36808280f92e62dc4c285edd9176195a764d5cf0bb000da53ca8bbf66ddd61d852e4259e3113f6529e2d7bdbdd6e28
TLSH
T191F05C5F6D438D0C30A535207AA346CBFF4C107051C5A08EB54DE05A87E87AD49AC0FF
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft Visual C++ 2010 x86 Redistributable Setup_20260818_175738796-MSI_vc_red.msi.txt

Path C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_20260818_175738796-MSI_vc_red.msi.txt
Size 1KB
SHA256 d15698e95e626ecd39c5fc7e74a39b7ee661d1c0975be0e362f8da0595955783
MD5 edb2bbce490836a6ff087005269b0a1d
SHA1 2c7c42d464ed4b01691661d2c2cdc54ea1a651fd
SHA512 1c093e3ade14ca8debad94b543e58ca79880b3cd77c0a01b74bbbf65f8dde455bb086f1b6a909ff27aa04e7b75be65829a1adc790ef7156394fb594b3de19364
TLSH
T1EF31D8662EE50859B1B3A607EFF3C0510E33BDC668358B4C2388C2190A6BD056DAC36A
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft Visual C++ 2010 x86 Redistributable Setup_20260818_175738796-Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219-MSP0.txt

Path C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_20260818_175738796-Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219-MSP0.txt
Size 1KB
SHA256 dcd0a3d6e2db8d7d0605c607469b398cbbe15ba7858ac18c09e3ec97100ef677
MD5 b4e31787c1926122989818a6e6b3b108
SHA1 c62e4f1ec031a8d70dac5eed176a5ab11e31b2f4
SHA512 ce2bb57436507b85c953a8cece13eb943dc23fcad9e39f457e6026ed00d5e5db5893d09544f01185ff205eda88309c4aa3b7e3de16cd01125d30fb3523efee43
TLSH
T1FA31E8615ED90809F2B6674BEFB3C0618F33BCD6A834DB4C23498119466BD059DAC3AE
MD5 SHA1 SHA512 TLSH

Submit Download

MP1-Fixpack NoTex v1.2025.1.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-VEN1T.tmp\MP1-Fixpack NoTex v1.2025.1.tmp
Size 3.2MB
SHA256 fa4c1699aa312ac726113832ed190d036acc8bab58b431dc0785cf0c62ef0fe6
MD5 eae89bdbd33c72efdd95e71b589798c0
SHA1 31210837b9938357bb6ba1df655d94d3ab7729d6
SHA512 518add2307877463c0e44c80116dcb220ba422d05e06cb4d1667ae9365c1d0f22b548b412009f35b039f6941857a8e1955704ac82db569af3998a0a708a9fe3e
SSDEEP 98304:nJYVM+LtVt3P/KuG2ONG9iqLRQE9333T:2VL/tnHGYiql5F
TLSH
T13EF56D17F389613ED05A1A392537D251583BBE70762A8C575BEC3A8C8F361486E3B34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DirectX.log

Path C:\Windows\Logs\DirectX.log
Size 1KB
SHA256 00ffa5638cb9dafb5b313e7303160ec45eee37146da2a3e71656df86bd1b3678
MD5 7a8f6ad3763fd93fb8d6cb7caece5eb0
SHA1 a9d3b76a14997c383393e1f4cd75cd11dca9cb61
SHA512 70da50978a93a14805126b71322c5975592e934ab5d1f24dab40481dc0e9e049dfc8485d3198f587184b69d167afd3d5d01df0e244242f9306345080d11aafff
TLSH
T18541F5D5BBFFD090BD801AA2422B4B111FE926772357703E50141284B513F98FD2F96E
MD5 SHA1 SHA512 TLSH

Submit Download

DirectX.log

Path C:\Windows\Logs\DirectX.log
Size 14KB
SHA256 2b8876de8149626722705f091e79ef0dae42b8d51d8b16d25882103addd22c62
MD5 a09702c94a39bc353e23ae877fa29125
SHA1 3533d15569b3c1180286fa9ac7103efd353174c2
SHA512 f3bd7540ed15b97788cf116b1b150abae547eca2233d7d23c5fb805dd5b359888c86fe39b63294d42c959ff37b77f09673a5d07d67488a8b082e21ffebff0c66
SSDEEP 96:gw6aeceEWa8JjZ24il4L9FDo956ZbkkYS8HOAHja1s67:gTJ28r2E8BHOAHjaN
TLSH
T11B52085EB945C9603D61018A400F26C1DA3953231342B03ED76D5A89BA73EFA792FDEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

filelist.dat

Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
Size 111B
SHA256 e60413bec64775bf1933ef4f9673c8bcfbe0ce71e950fd589bbd14c0f9a00359
MD5 d6f81567baaf05b557d9bc6c348cb5f1
SHA1 0c840165fcd34d996c85b6b44b00c7206bf772b6
SHA512 09b84cc9199592821d7de38cbe24332097b276bb25b6d09f7dcdc3a6b17369ee944a6f8120f13ea6a5c15eb759a90d7ce29cc845a5c0680ff2fa53e2623171e2
TLSH
T155B0128A4241F1BA000DBA67487B38D825F902FBB4818C5D018B06AD6B9156D84CCC14
MD5 SHA1 SHA512 TLSH

Submit Download

filelist.dat

Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
Size 137B
SHA256 f960075a7b1c2590e18700f3230f7baea9aced3e6ba5dc93dac193027b5cec48
MD5 cec960807fa5bec11ad4a31c3512da4d
SHA1 a3ac60a3518747d3bbead5edfd17e155cf7ce9f7
SHA512 2da2d935f9b96bd36536f3a7a494775c8ed9bfef6538ffe66307b73cd5c82210fc43bbe6706d74d99dd5b924fb78a0d1beceee8c0e22d91e17b1346dd85690ec
TLSH
T129C02B850100F0BE000E6616483734E410B401E778828C1C004A41982F4055C448CC24
MD5 SHA1 SHA512 TLSH

Submit Download

dxupdate.cab

Path C:\Windows\msdownld.tmp\AS5A1CE6.tmp\dxupdate.cab
Size 98KB
SHA256 6e39b3fdb6722ea8aa0dc8f46ae0d8bd6496dd0f5f56bac618a0a7dd22d6cfb2
MD5 4afd7f5c0574a0efd163740ecb142011
SHA1 3ebca5343804fe94d50026da91647442da084302
SHA512 6f974acec7d6c1b6a423b28810b0840e77a9f9c1f9632c5cba875bd895e076c7e03112285635cf633c2fa9a4d4e2f4a57437ae8df88a7882184ff6685ee15f3f
SSDEEP 3072:lvknxJpNYAzRstaRkz0BwwnNbSa+vp5647S:FkZNXsERk6wwBSa+vnl2
TLSH
T16FA302EC8B5D8F93C5723CA5A1A8E90B7D7EF59E491CD02585B4F2442CA2BC9F3A045C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup.exe

Path F:\ca24c99819cadcb6cee73b\Setup.exe
Size 76KB
SHA256 531eb45798728cb741043b28b8c1a4f75536dc75f92d100f55f9109d2d63f0d7
MD5 2af2c1a78542975b12282aca4300d515
SHA1 3216c853ed82e41dfbeb6ca48855fdcd41478507
SHA512 4a70bd4b542f6001e46f827f341676c34af1ea216c50ad981dd04f547cd67f73aaa420fcbed379dc05dab199bf5ba00d899c49ff75da577613209f96226227eb
SSDEEP 1536:GgNItbBL5NWiiESvRexWZnqxMQP8ZOs0Jr6FrHU0:GgNAB9NWTZvwc/gBAFo0
TLSH
T14C738E027294C435D859163408ABDEB25E7E7D829BB048CB339877EF5F713C26A3835A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path \??\f:\ca24c99819cadcb6cee73b\1028\LocalizedData.xml
Size 29KB
SHA256 a27f809211ea1a2d5224cd01101aa3a59bf7853168e45de28a16ef7ed6acd46a
MD5 7fc06a77d9aafca9fb19fafa0f919100
SHA1 e565740e7d582cd73f8d3b12de2f4579ff18bb41
SHA512 466dcc6a5fb015be1619f5725fa62ca46eb0fb428e11f93fd9d82e5df61c3950b3fb62d4db7746cc4a2be199e5e69eaa30b6f3354e0017cfa14d127fad52f8cf
SSDEEP 384:4Y6C7xfsxMEYgPNRAsy50keJzH7o3oDPnv:MxLJz7
TLSH
T110D2A112AEEB3114F0BAAE19BD3314944EF779905C35C01E10992E4E9BB7FC28965F93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path \??\f:\ca24c99819cadcb6cee73b\1031\LocalizedData.xml
Size 40KB
SHA256 2aa6e8d402e44d9ee895b18195f46bf90259de1b6f44efd46a7075b110f2dcd6
MD5 b83c3803712e61811c438f6e98790369
SHA1 61a0bc59388786ced045acd82621bee8578cae5a
SHA512 e020f93e3a082476087e690ad051f1feb210e0915924bb4548cc9f53a7ee2760211890eb6036ce9e5e4a311abc0300e89e25efbbb894c2a621ffbc9d64cc8a38
SSDEEP 384:4nF+jpoHnZi8oO0GOJ2+8q6OUjEYJL/ZiITrKv:V03XjZJL/YIy
TLSH
T122139B11AFEA2214F1F6BF59BD7611944EB37E91AC35C40D01992D8E8AB3F81C921F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path \??\f:\ca24c99819cadcb6cee73b\1033\LocalizedData.xml
Size 38KB
SHA256 5d90345ff74e177f6da8fb6459c1cfcac080e698215ca75feb130d0d1f2a76b9
MD5 d642e322d1e8b739510ca540f8e779f9
SHA1 36279c76d9f34c09ebddc84fd33fcc7d4b9a896c
SHA512 e1e16ae14bc7cc1608e1a08d3c92b6d0518b5fabd27f2c0eb514c87afc3d6192bf7a793a583afc65f1899f03dc419263b29174456e1ec9ab0f0110e0258e0f0d
SSDEEP 192:4kVKhG9aX0SDpI53/asO0KMv+VXxwVcPIv5COQu4SLbpmQVX5FB0zJOkue6Jjfz3:4MKhJkeZsdlNl9SJOkR6NXaxu
TLSH
T196036602AEFE2154F1BBBE19BD7210954EB7BD915C39C11D00992D8E8AB3F81CD61B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path \??\f:\ca24c99819cadcb6cee73b\1036\LocalizedData.xml
Size 40KB
SHA256 43f913ff28d677316f560a0f45221f35f27cfaf5fc5bd645974a82dca589edbf
MD5 e382abc19294f779d2833287242e7bc6
SHA1 1ceae32d6b24a3832f9244f5791382865b668a72
SHA512 06054c8048cade36a3af54f9a07fd8fa5eb4f3228790996d2abea7ee1ee7eb563d46bd54ff97441f9610e778194082c44e66c5f566c9c50a042aba9eb9cae25e
SSDEEP 192:4GrYAOJoFbZZ0eQiFaD4EbJeiI5hJUPu2oBknXoFDYnZCoroUnAJJFHq20/kFR/0:4GZUoRZc5ryx2fHIJR0kbG52gjfVv
TLSH
T193137711ABEA2214F2FABF05BD7610944EBB7D919C35C01D01992D8E8EB3F85C971B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path \??\f:\ca24c99819cadcb6cee73b\1040\LocalizedData.xml
Size 39KB
SHA256 c4c7c0ddaa6d6a3a1dc260e9c5a24bdfaa98c427c69e8a65427dd7cac0a4b248
MD5 0af948fe4142e34092f9dd47a4b8c275
SHA1 b3d6dd5c126280398d9055f90e2c2c26dbae4eaa
SHA512 d97b5fe2553ca78a3019d53e33d2db80c9fa1cf1d8d2501d9ddf0576c7e6ea38dab754fe4712123abf34b97e10b18fb4bbd1c76d3dacb87b4682e501f93423d9
SSDEEP 384:4hZo3+Ma9e1JzNZNs4fneAEJ0o5H/PuRv:NaudsJ1u
TLSH
T1D6035811AFFA2214F1F7BE09BD3615984EB77E919C35C01D01992D8E8AB3F818961F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path \??\f:\ca24c99819cadcb6cee73b\1041\LocalizedData.xml
Size 33KB
SHA256 01e7d24dd8e00b5c333e96d1bb83813e02e96f89aad0c2f28f84551d28abbbe2
MD5 7fcfbc308b0c42dcbd8365ba62bada05
SHA1 18a0f0e89b36818c94de0ad795cc593d0e3e29a9
SHA512 cd6f912a037e86d9e1982c73f0f8b3c4d5a9a6b5b108a7b89a46e6691e430a7cb55718de9a0c05650bb194c8d4a2e309ad6221d638cfca8e16aa5920881ba649
SSDEEP 192:4OTOo45ZyAYcou3LDnmUjMFsrHZmxqJOXhNCGYHre3iR7v:4OTOoMhYcRaOXJ6koIv
TLSH
T12BF2D101AEEB3114F0FAAE55BD7310944EF7B9909C35C01D00996D4E9AB7FC58A26FA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path \??\f:\ca24c99819cadcb6cee73b\1042\LocalizedData.xml
Size 32KB
SHA256 cccda55294aeb4af166a8c0449bca2189ddf5aa9a43d5e939dd3803e61738331
MD5 71dfd70ae141f1d5c1366cb661b354b2
SHA1 c4b22590e6f6dd5d39e5158b831ae217ce17a776
SHA512 5000d62f3de41c3fb0ed8a8e9c37dbf4eb427c4f1e3ad3823d4716c6fe62250bac11b7987a302b8a45d91aabcf332457f7aff7d99f15edeffe540639e9440e8a
SSDEEP 192:4cdsW0fwUrh+UgYUDQhGAtPN/2JWCTJSIQvPaLWL2C4oH/Drv:4cdszvrBgYUDQhF5N7IJSIQvkQfLH/Pv
TLSH
T1D6E2A212AEEB3154B0BAAE15BD7314944EF779909C36C01E10992D8E9BB7FC1C921F93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path \??\f:\ca24c99819cadcb6cee73b\1049\LocalizedData.xml
Size 39KB
SHA256 beef0631c17a4fb1ff0b625c50c6cb6c8ce90a1ae62c5e60e14bf3d915ad509c
MD5 0eeb554d0b9f9fcdb22401e2532e9cd0
SHA1 08799520b72a1ef92ac5b94a33509d1eddf6caf8
SHA512 2180e46a5a2ea1f59c879b729806ca02a232c66660f29c338c1fa7fbee2afa4b13d8777d1f7b63cf831eb42f3e55282d70aa8e53f40616b8a6e4d695c36e313d
SSDEEP 384:4q0oG/2VrQa0inweNLvSli+CJA3aJW5cGUT3CT+v:DVFJl
TLSH
T19F03D40BFEFA7114B0B6EA55AE3304D109B77A501E35C08D109F2D5D9AA7FB19A21F83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path \??\f:\ca24c99819cadcb6cee73b\2052\LocalizedData.xml
Size 30KB
SHA256 d1735c8cfd8e10ba019d70818c19fa865e7c72f30ab6421a3748408f85fb96c3
MD5 52b1dc12ce4153aa759fb3bbe04d01fc
SHA1 bf21f8591c473d1fce68a9faf1e5942f486f6eba
SHA512 418903ae9a7baebf73d055e4774ff1917fbaab9ee7ed8c120c34bb10e7303f6dd7b7dae701596d4626387a30ae1b4d329a9af49b8718b360e2ff619c56c19623
SSDEEP 192:4Qn7cJwYTzOnyquEWTOAXUewfMcqQJywXk83GJPupIoxnb/2v:4Qn7cJxTC/uEWTfXUewiQJyoknJY9b+v
TLSH
T1ABE29C12AEEB3114F1BAAE15BD7314944EB779905C35C01E10992E8E9BB7FC28971F83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path \??\f:\ca24c99819cadcb6cee73b\3082\LocalizedData.xml
Size 39KB
SHA256 f124d318138ff084b6484deb354cca0f72296e1341bf01169792b3e060c89e89
MD5 5397a12d466d55d566b4209e0e4f92d3
SHA1 fcffd8961fb487995543fc173521fdf5df6e243b
SHA512 7708f5a2ad3e4c90c4c216600435af87a1557f60caf880a3dd9b5f482e17399af9f0b9de03ff1dbdd210583e0fec5b466e35794ac24d6d37f9bbc094e52fc77b
SSDEEP 384:4fgA4Ukd+uYW1HCD1GO/tja2QDu7Jr++dP8z3AzOrv:tUZW1iDDdWCJi8Pg32Y
TLSH
T106032811AEEA2214F1F7BF09BD7614944EB7BD919C39C00D01592E8E8AB3F85C961F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DHTMLHeader.html

Path \??\f:\ca24c99819cadcb6cee73b\DHTMLHeader.html
Size 15KB
SHA256 e139af8858fe90127095ac1c4685bcd849437ef0df7c416033554703f5d864bb
MD5 cd131d41791a543cc6f6ed1ea5bd257c
SHA1 f42a2708a0b42a13530d26515274d1fcdbfe8490
SHA512 a6ee9af8f8c2c7acd58dd3c42b8d70c55202b382ffc5a93772af7bf7d7740c1162bb6d38a4307b1802294a18eb52032d410e128072af7d4f9d54f415be020c9a
SSDEEP 192:7Ddx3KOTczFQ21Kp4n5DTx1iDecPeLHLHQFJFjZWblWUxFzJzcKHjT:fdsOT01KcBUFJFEWUxFzvHH
TLSH
T1B672765326E84248A1B6BE49AFB640750B79BD45A83CCE7D05A0591F49E3F04F872FB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ParameterInfo.xml

Path \??\f:\ca24c99819cadcb6cee73b\ParameterInfo.xml
Size 21KB
SHA256 4eae293ca91b31aaa206e5a1c655714f0fe84e39f9331cb759d2236cdb915523
MD5 13f8768c289476fdd103ff689d73cd2d
SHA1 ddebcecc02c6b1b996423d62d0def8760f031f58
SHA512 c72998f30ebff8f4a757248639cf0351d03f5502be475b4cb8f02b09ad800dbbe2f9a82c7d9bde6d7bd748e0ee6e61b86e369192773fe726421a564e793a0139
SSDEEP 384:R3vG8G6KGXaNR1ydfaWZy1EwtKRliehOxnCGYCrKFl:R3OfQqNR1ydfaWZy1EwtKRliehOxndY7
TLSH
T16EA2918317FE5055B2F34A4CAEB224674E137D525E38C86D00EC694DCBE3D929862BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetupEngine.dll

Path \??\f:\ca24c99819cadcb6cee73b\SetupEngine.dll
Size 789KB
SHA256 a5116ccb17b242713e5645c2374abf5827c0d2752b31553e3540c9123812e952
MD5 63e7901d4fa7ac7766076720272060d0
SHA1 72dec0e4e12255d98ccd49937923c7b5590bbfac
SHA512 de2e63bc090121484191cbf23194361d761b01c0fd332f35f0dfdfd0b11431b529e5c7f542031a0e7e26f31497d94b8baacfbf1c84c6493e66ac2ab76c11d0a0
SSDEEP 24576:hS62AlYAxM20z7TzuO5cEewDODLzNu/6K8lxvSU1CcweD:hS62AlYA8TEpNuV8LvSU1Ccwe
TLSH
T1D4054B2267F98135E2FF1372753A676957BAF9A14B30CACF12815B5E0E356D08C38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UiInfo.xml

Path \??\f:\ca24c99819cadcb6cee73b\UiInfo.xml
Size 35KB
SHA256 66a0299ce7ee12dd9fc2cfead3c3211e59bfb54d6c0627d044d44cef6e70367b
MD5 4f90fcef3836f5fc49426ad9938a1c60
SHA1 89eba3b81982d5d5c457ffa7a7096284a10de64a
SHA512 4ce2731c1d32d7ca3a4f644f4b3111f06223de96c1e241fcc86f5fe665f4db18c8a241dae4e8a7e278d6afbf91b235a2c3517a40d4d22d9866880e19a7221160
SSDEEP 768:S4UR0d5v1SguJQvFQXvDINJh6Fmhvk71sO0Nep3UL9Eu+dOtOcOdOjT5fuPkfuS:S4UR0d5v1QYQLIN/6Fmhvk71sO0Nep3q
TLSH
T1EFF216535BEB0118E2F6AA4D69B304705F5B7A45093AD13C04EC354DEFE7E628CA07AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msp_kb2565063.msp

Path \??\f:\ca24c99819cadcb6cee73b\msp_kb2565063.msp
Size 3.8MB
SHA256 7c969fcda6ef09d2eb7bbbc8d81795eb60c9c69ed835fd16538369ad0a6e0f10
MD5 9843dc93ea948cddc1f480e53bb80c2f
SHA1 d6ec9db8b8802ec85dd0b793565401b67ad8e5e0
SHA512 79008cfdd8ae1ea27675588e7ba8123d08ce14047e5f167b3b5f6fbcdadeb45515bd72e18e59abf632ecbfbb42243fbcbebe4cbe0ed6ba195d0b2ca6d88676f9
SSDEEP 98304:lEpd3qZ0G3garI8w8xhB2TU01SHMMV6ZArX:KaZtC8vBy10M4
TLSH
T1F216335BE3CBDF2AE4DA9A705B8D02031E2D4A01BA07448672CD7D98373397BD74525E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqmapi.dll

Path \??\f:\ca24c99819cadcb6cee73b\sqmapi.dll
Size 141KB
SHA256 bd6395a58f55a8b1f4063e813ce7438f695b9b086bb965d8ac44e7a97d35a93c
MD5 3f0363b40376047eff6a9b97d633b750
SHA1 4eaf6650eca5ce931ee771181b04263c536a948b
SHA512 537be86e2f171e0b2b9f462ac7f62c4342beb5d00b68451228f28677d26a525014758672466ad15ed1fd073be38142dae478df67718908eae9e6266359e1f9e8
SSDEEP 3072:uochw/MFWrJjKOMxRSepuBaqn/NlnBh2Lx0JVzx1wWobn1ek8F7HncO5hK9YSHlN:zDFB47UhXBh2yJ5HcOSSSHZqG
TLSH
T1BAE34C18F7B695F2C56322300E0E72BAEB7DD92C3E99BE872380F6567430580D729756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vc_red.cab

Path \??\f:\ca24c99819cadcb6cee73b\vc_red.cab
Size 4.0MB
SHA256 71c0acc75eecdf39051819dc7c26503583f6be6c43ab2c320853de15bece9978
MD5 c580a38f1a1a7d838076a1b897c37011
SHA1 c689488077d1c21820797707078af826ea676b70
SHA512 ea3a62bd312f1ddeebe5e3c7911eb3a73bc3ee184abb7e9b55bc962214f50bbf05d2499caf151d0bd00735e2021fbea9584bf3e868a1d4502b75ec3b62c7ff56
SSDEEP 98304:buCaO1KF/Zn4LkYytTHmuzfgnKZ9zWs2wU2Td:buCf1KF/94Lk9TPzf9Os2wU25
TLSH
T1CE1633F4083381A1D412BD7DFE2B8B2568F984B941899EEC75FC08545AD7F7282F3560
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vc_red.msi

Path \??\f:\ca24c99819cadcb6cee73b\vc_red.msi
Size 160KB
SHA256 9ecf3980b29c6aa20067f9f45c64b45ad310a3d83606cd9667895ad35f106e66
MD5 3ff9acea77afc124be8454269bb7143f
SHA1 8dd6ecab8576245cd6c8617c24e019325a3b2bdc
SHA512 8d51f692747cfdd59fc839918a34d2b6cbbb510c90dea83ba936b3f5f39ee4cbd48f6bb7e35ed9e0945bf724d682812532191d91c8f3c2adb6ff80a8df89ff7a
SSDEEP 3072:0oTMYRradauoCcJg95gTdmmYdwYNRTK0+E4mN2E2275V495u:7RWd1odm4mmYdwT1
TLSH
T100F36D027951C237EC82A33115AEA76A2F3CBC654B6541C73199B2DC5FB27C0973A3E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2024-3392-0x00000000002C0000-0x000000000039C000-memory.dmp

Download

memory/2024-8-0x00000000002C0000-0x000000000039C000-memory.dmp

Download

memory/2024-1-0x00000000002C0000-0x000000000039C000-memory.dmp

Download

memory/4516-143-0x0000000000620000-0x0000000000963000-memory.dmp

Download

memory/4516-10-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/4516-14-0x0000000000620000-0x0000000000963000-memory.dmp

Download

memory/4516-9-0x0000000000620000-0x0000000000963000-memory.dmp

Download

memory/4516-120-0x0000000000620000-0x0000000000963000-memory.dmp

Download

memory/4516-6-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/4516-118-0x0000000000620000-0x0000000000963000-memory.dmp

Download

memory/4516-3390-0x0000000000620000-0x0000000000963000-memory.dmp

Download

memory/4516-3391-0x0000000000620000-0x0000000000963000-memory.dmp

Download

memory/4516-12-0x0000000000620000-0x0000000000963000-memory.dmp

Download