84183a32ea37f628d71ee3c8f990eac8bc1affa08904b421be9256be7d0e048b

Analysis

user interaction
yes
max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 03:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MTInstaller.exe
Size 24.4MB
Sample260910-dv3n4swajg
SHA256 84183a32ea37f628d71ee3c8f990eac8bc1affa08904b421be9256be7d0e048b
MD5 6648f6bf8d2597a28e05936e19ac7cb6
SHA1 3630175e0afb4892654d38271313c604077ec0f3
SHA512 da2281c6aa1d54f4d40669e412bad084d5037be8e97ca37c4b7d7626fd20a4b5d2219e1e5170fa4f7c84f5b954b25e0a290a56c5f1e507ffdde772e094d30918
SSDEEP 393216:hL5Qwz9r14dpyDcr8sX/NCzmZLPf7C3I2DPyzFUeeTH4xhCiyN5q9zM:Rz5G6DXsVCatf/2DPyGeTxDM
TLSH
T1624723A96C044399C36143F48F16F5896E3AFC1414F5889472EFF2BB287F998D2774A2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	MTInstaller.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	MT.exe

Executes dropped EXE 1 IoCs

pid	Process
2556	MT.exe

Loads dropped DLL 9 IoCs

pid	Process
2940	MsiExec.exe
3884	MsiExec.exe
1120	MsiExec.exe
2940	MsiExec.exe
2940	MsiExec.exe
2556	MT.exe
2556	MT.exe
2556	MT.exe
2556	MT.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\System.Data.SQLite.Linq.dll	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\Drivers\x64\WdfCoInstaller01009.dll	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\WPF.JoshSmith.dll	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\ActiproSoftware.Editors.Wpf.dll	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\Drivers\USBXpressInstaller_x64.exe	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\Drivers\USBXpressInstaller_x86.exe	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\Drivers\mtiUSBXp.inf	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\Microsoft.Exchange.WebServices.Data.dll	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\MT.exe.config	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\GongSolutions.Wpf.DragDrop.dll	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\Documentation\MadgeTech_ReadMe.cs.txt	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\Drivers\run.bat	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\MadgeTech Help.cs.chm	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\MadgeTech Help.pl.chm	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\x64\SLABHIDtoUART.dll	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\Newtonsoft.Json.dll	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\PresentationFramework.Aero.dll	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\Documentation\MadgeTech_ReadMe.ru.txt	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\x64\SQLite.Interop.dll	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\CircularDependencyTool.dll	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\EPPlus.dll	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\MadgeTech Help.pt.chm	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\MTControls.dll	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\Documentation\MadgeTech_ReadMe.ko.txt	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\DeviceComm.dll	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\ActiproSoftware.DataGrid.Contrib.Wpf.dll	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\ActiproSoftware.Docking.Wpf.dll	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\MadgeTech Help.de.chm	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\MadgeTech Help.fr.chm	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\MadgeTech Help.ru.chm	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\msvcp100.dll	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\Documentation\MadgeTech_ReadMe.txt	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\ActiproSoftware.Wizard.Wpf.dll	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\MadgeTech Help.uk.chm	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\x86\SLABHIDDevice.dll	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\x86\SLABHIDtoUART.dll	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\MvvmFoundation.Wpf.dll	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\Documentation\MadgeTech_ReadMe.lt.txt	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\Documentation\MadgeTech_ReadMe.pt.txt	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\Documentation\MadgeTech_ReleaseNotes.txt	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\ActiproSoftware.Shared.Wpf.dll	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\FileStore	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\Documentation\MadgeTech_ReadMe.uk.txt	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\Documentation\MadgeTech_ReadMe.zh-cn.txt	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\x64\SiUSBXp.dll	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\x86\Legacy\SiUSBXp.dll	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\WPFLocalizeExtension.dll	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\Newtonsoft.Json.Bson.dll	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\Documentation\MadgeTech_ReadMe.fr.txt	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\Documentation\MadgeTech_ReadMe.pl.txt	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\x64\Legacy\SiUSBXp.dll	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\x86\SQLite.Interop.dll	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\System.Memory.dll	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\System.Threading.Tasks.Extensions.dll	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\Drivers\x86\winusbcoinstaller2.dll	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\ActiproSoftware.Ribbon.Wpf.dll	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\Documentation\DDD.txt	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\MadgeTech Help.es.chm	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\XAMLMarkupExtensions.dll	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\DynamicDataDisplay.dll	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\Documentation\GongSolutions.Wpf.DragDrop.txt	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\MadgeTech Help.chm	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\MadgeTech Help.ja.chm	msiexec.exe
File created	C:\Program Files (x86)\MadgeTech\MadgeTech 4\x86\SiUSBXp.dll	msiexec.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e58dcce.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6BED8C3A-B64E-494B-82CB-5DB62EC34A5A}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDF10.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE626.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEC41.tmp	msiexec.exe
File created	C:\Windows\Installer\{6BED8C3A-B64E-494B-82CB-5DB62EC34A5A}\ARP.exe	msiexec.exe
File created	C:\Windows\Installer\e58dcce.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\{6BED8C3A-B64E-494B-82CB-5DB62EC34A5A}\ARP.exe	msiexec.exe
File created	C:\Windows\Installer\e58dcd0.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MTInstaller.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000f94cc820840d1c590000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000f94cc8200000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900f94cc820000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1af94cc820000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1df94cc820000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\.mtff	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|MadgeTech\|MadgeTech 4\|MTControls.dll\MTControls,version="1.1.0.0",culture="neutral",publicKeyToken="89B00405592683D2",processorArchitecture="MSIL" = 48002900500063004a006d005200460057003f0031002a0027005d0063006a006300620024004500440065006600610075006c00740046006500610074007500720065003e0031003d004c00780055007b00380024003500710061002b005f002a0046002d0037003f006800380000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|MadgeTech\|MadgeTech 4\|DeviceComm.dll\DeviceComm,version="1.3.0.1",culture="neutral",publicKeyToken="89B00405592683D2",processorArchitecture="MSIL" = 48002900500063004a006d005200460057003f0031002a0027005d0063006a006300620024004500440065006600610075006c00740046006500610074007500720065003e002e00270041005600240071005d005a006a0055006d007d007a004f0029003d002500290065005e0000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|MadgeTech\|MadgeTech 4\|ActiproSoftware.Shared.Wpf.dll\ActiproSoftware.Shared.Wpf,version="25.1.0.0",culture="neutral",publicKeyToken="36FF2196AB5654B9",processorArchitecture="MSI = 48002900500063004a006d005200460057003f0031002a0027005d0063006a006300620024004500440065006600610075006c00740046006500610074007500720065003e0051002d002b0067004b007300410036005b007500250078007e0028005b007d00730037002700620000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|MadgeTech\|MadgeTech 4\|ActiproSoftware.Docking.Wpf.dll	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|MadgeTech\|MadgeTech 4\|MvvmFoundation.Wpf.dll	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A3C8DEB6E46BB49428BCD56BE23CA4A5\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|MadgeTech\|MadgeTech 4\|MTCommon.dll\MTCommon,version="1.1.0.0",culture="neutral",publicKeyToken="89B00405592683D2",processorArchitecture="MSIL" = 48002900500063004a006d005200460057003f0031002a0027005d0063006a006300620024004500440065006600610075006c00740046006500610074007500720065003e006500300067003d0071003d004000380028004a0046004e002500340074004c007a0034007e00780000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|MadgeTech\|MadgeTech 4\|ActiproSoftware.Editors.Wpf.dll\ActiproSoftware.Editors.Wpf,version="25.1.0.0",culture="neutral",publicKeyToken="36FF2196AB5654B9",processorArchitecture="M = 48002900500063004a006d005200460057003f0031002a0027005d0063006a006300620024004500440065006600610075006c00740046006500610074007500720065003e006a003500610057005d00470047006c0047004c0033003f00240032003f00250034004b004100680000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|MadgeTech\|MadgeTech 4\|Microsoft.WindowsAPICodePack.dll	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|MadgeTech\|MadgeTech 4\|System.Data.SQLite.Linq.dll	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Data Logger Report File	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|MadgeTech\|MadgeTech 4\|Auth.dll\Auth,version="1.2.11.0",culture="neutral",publicKeyToken="89B00405592683D2",processorArchitecture="MSIL" = 48002900500063004a006d005200460057003f0031002a0027005d0063006a006300620024004500440065006600610075006c00740046006500610074007500720065003e004d00540027005e0074005f005600750040006200640067002400710046002700560063007700350000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Data Logger Report File\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mtff\ = "Data Logger Report File"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|MadgeTech\|MadgeTech 4\|CircularDependencyTool.dll	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\A3C8DEB6E46BB49428BCD56BE23CA4A5	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A3C8DEB6E46BB49428BCD56BE23CA4A5\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|MadgeTech\|MadgeTech 4\|GongSolutions.Wpf.DragDrop.dll	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|MadgeTech\|MadgeTech 4\|Microsoft.WindowsAPICodePack.dll\Microsoft.WindowsAPICodePack,version="1.1.8.0",culture="neutral",publicKeyToken="8985BEAAB7EA3F04",processorArchitecture=" = 48002900500063004a006d005200460057003f0031002a0027005d0063006a006300620024004500440065006600610075006c00740046006500610074007500720065003e0070005800250052006000660057004e0050006400650038005d0067006a006a006e0070005000410000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A3C8DEB6E46BB49428BCD56BE23CA4A5\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Data Logger Report File\ = "Data Logger Report File"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|MadgeTech\|MadgeTech 4\|ActiproSoftware.Shared.Wpf.dll	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\A3C8DEB6E46BB49428BCD56BE23CA4A5\DefaultFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|MadgeTech\|MadgeTech 4\|MTControls.dll	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|MadgeTech\|MadgeTech 4\|DeviceComm.dll	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|MadgeTech\|MadgeTech 4\|MT.exe\MT,version="4.3.1.1",culture="neutral",publicKeyToken="89B00405592683D2",processorArchitecture="MSIL" = 48002900500063004a006d005200460057003f0031002a0027005d0063006a006300620024004500440065006600610075006c00740046006500610074007500720065003e002b00710065004f0042004700570065006f0040007a0044002a005b00760035006f004c006b00780000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|MadgeTech\|MadgeTech 4\|MvvmFoundation.Wpf.dll\MvvmFoundation.Wpf,version="1.0.0.0",culture="neutral",publicKeyToken="822CDFCC3211A4B2",processorArchitecture="MSIL" = 48002900500063004a006d005200460057003f0031002a0027005d0063006a006300620024004500440065006600610075006c00740046006500610074007500720065003e0029006f00650046006b0074005e0063002800370034005b00750038005d007e00560043004000730000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\CBFB85E6ED0DBCA4C857991505318953\A3C8DEB6E46BB49428BCD56BE23CA4A5	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Data Logger Report File\shell\open\command\ = "\"C:\\Program Files (x86)\\MadgeTech\\MadgeTech 4\\MT.exe\" \"%1\""	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|MadgeTech\|MadgeTech 4\|DynamicDataDisplay.dll\DynamicDataDisplay,version="0.3.3.24",culture="neutral",publicKeyToken="5B7D744A7263923F",processorArchitecture="MSIL" = 48002900500063004a006d005200460057003f0031002a0027005d0063006a006300620024004500440065006600610075006c00740046006500610074007500720065003e00390076004d003600320031003200540021004f00270041006e002900480037004c002e002600660000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|MadgeTech\|MadgeTech 4\|MT.exe	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|MadgeTech\|MadgeTech 4\|ActiproSoftware.Editors.Wpf.dll	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|MadgeTech\|MadgeTech 4\|PresentationFramework.Aero.dll	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Data Logger Report File\DefaultIcon\ = "\"C:\\Program Files (x86)\\MadgeTech\\MadgeTech 4\\MT.exe\""	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|MadgeTech\|MadgeTech 4\|ActiproSoftware.Docking.Wpf.dll\ActiproSoftware.Docking.Wpf,version="25.1.0.0",culture="neutral",publicKeyToken="36FF2196AB5654B9",processorArchitecture="M = 48002900500063004a006d005200460057003f0031002a0027005d0063006a006300620024004500440065006600610075006c00740046006500610074007500720065003e0032002a005400610043005e00370049006d00290032004c0066005e0051003600750049005100770000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|MadgeTech\|MadgeTech 4\|System.Data.SQLite.dll\System.Data.SQLite,version="1.0.110.0",culture="neutral",publicKeyToken="DB937BC2D44FF139",processorArchitecture="MSIL" = 48002900500063004a006d005200460057003f0031002a0027005d0063006a006300620024004500440065006600610075006c00740046006500610074007500720065003e006b00340041003400670076003300510040006a00340078004c007b006a004a00610077005f005f0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A3C8DEB6E46BB49428BCD56BE23CA4A5\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|MadgeTech\|MadgeTech 4\|WCFInterop.dll\WCFInterop,version="1.1.0.1",culture="neutral",publicKeyToken="89B00405592683D2",processorArchitecture="MSIL" = 48002900500063004a006d005200460057003f0031002a0027005d0063006a006300620024004500440065006600610075006c00740046006500610074007500720065003e00680040004b005e002c0021003500250071003f00760043002700330043006400260040003600670000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|MadgeTech\|MadgeTech 4\|ActiproSoftware.Wizard.Wpf.dll\ActiproSoftware.Wizard.Wpf,version="25.1.0.0",culture="neutral",publicKeyToken="36FF2196AB5654B9",processorArchitecture="MSI = 48002900500063004a006d005200460057003f0031002a0027005d0063006a006300620024004500440065006600610075006c00740046006500610074007500720065003e00590056004f0036002b005600250050005400550029005d004b007b002c0066005b002d002500650000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A3C8DEB6E46BB49428BCD56BE23CA4A5\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A3C8DEB6E46BB49428BCD56BE23CA4A5\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A3C8DEB6E46BB49428BCD56BE23CA4A5\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|MadgeTech\|MadgeTech 4\|ActiproSoftware.Ribbon.Wpf.dll	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Data Logger Report File\shell\open\ = "&Open"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A3C8DEB6E46BB49428BCD56BE23CA4A5	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A3C8DEB6E46BB49428BCD56BE23CA4A5\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A3C8DEB6E46BB49428BCD56BE23CA4A5\ProductIcon = "C:\\Windows\\Installer\\{6BED8C3A-B64E-494B-82CB-5DB62EC34A5A}\\ARP.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|MadgeTech\|MadgeTech 4\|DynamicDataDisplay.dll	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|MadgeTech\|MadgeTech 4\|ActiproSoftware.DataGrid.Contrib.Wpf.dll\ActiproSoftware.DataGrid.Contrib.Wpf,version="25.1.0.0",culture="neutral",publicKeyToken="36FF2196AB5654B9",proces = 48002900500063004a006d005200460057003f0031002a0027005d0063006a006300620024004500440065006600610075006c00740046006500610074007500720065003e0071007b005000450051007d0043005900470041006b004b003d004200610068002500390044002c0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|MadgeTech\|MadgeTech 4\|System.Data.SQLite.dll	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A3C8DEB6E46BB49428BCD56BE23CA4A5\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A3C8DEB6E46BB49428BCD56BE23CA4A5\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Data Logger Report File\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Data Logger Report File\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Data Logger Report File\DefaultIcon	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|MadgeTech\|MadgeTech 4\|System.Data.SQLite.Linq.dll\System.Data.SQLite.Linq,version="1.0.110.0",culture="neutral",publicKeyToken="DB937BC2D44FF139",processorArchitecture="MSIL" = 48002900500063004a006d005200460057003f0031002a0027005d0063006a006300620024004500440065006600610075006c00740046006500610074007500720065003e00590064003700600063003000410077007500430031005a0037002e00420077007900410027007a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Data Logger Report File	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|MadgeTech\|MadgeTech 4\|WCFInterop.dll	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|MadgeTech\|MadgeTech 4\|GongSolutions.Wpf.DragDrop.dll\GongSolutions.Wpf.DragDrop,version="0.1.3.0",culture="neutral",publicKeyToken="3D7F30B638381860",processorArchitecture="MSIL = 48002900500063004a006d005200460057003f0031002a0027005d0063006a006300620024004500440065006600610075006c00740046006500610074007500720065003e0049004e00740034005f00400032004000770033007d00760031002d0068005100260026006900370000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|MadgeTech\|MadgeTech 4\|CircularDependencyTool.dll\CircularDependencyTool,version="1.0.0.0",culture="neutral",publicKeyToken="89B00405592683D2",processorArchitecture="MSIL" = 48002900500063004a006d005200460057003f0031002a0027005d0063006a006300620024004500440065006600610075006c00740046006500610074007500720065003e003600250032002e0067003d007400370038005700590048003600320021002c00350071007600720000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|MadgeTech\|MadgeTech 4\|PresentationFramework.Aero.dll\PresentationFramework.Aero,version="4.0.0.0",culture="neutral",publicKeyToken="31BF3856AD364E35" = 48002900500063004a006d005200460057003f0031002a0027005d0063006a006300620024004500440065006600610075006c00740046006500610074007500720065003e0028007b004200500058006f0056006c007e0059004f0068007a0046002d004900300051003700690000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A3C8DEB6E46BB49428BCD56BE23CA4A5\PackageCode = "6A98EFD5DE19710408A4825B484FE015"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4060	msiexec.exe
4060	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1132	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1132	msiexec.exe
Token: SeSecurityPrivilege	4060	msiexec.exe
Token: SeCreateTokenPrivilege	1132	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1132	msiexec.exe
Token: SeLockMemoryPrivilege	1132	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1132	msiexec.exe
Token: SeMachineAccountPrivilege	1132	msiexec.exe
Token: SeTcbPrivilege	1132	msiexec.exe
Token: SeSecurityPrivilege	1132	msiexec.exe
Token: SeTakeOwnershipPrivilege	1132	msiexec.exe
Token: SeLoadDriverPrivilege	1132	msiexec.exe
Token: SeSystemProfilePrivilege	1132	msiexec.exe
Token: SeSystemtimePrivilege	1132	msiexec.exe
Token: SeProfSingleProcessPrivilege	1132	msiexec.exe
Token: SeIncBasePriorityPrivilege	1132	msiexec.exe
Token: SeCreatePagefilePrivilege	1132	msiexec.exe
Token: SeCreatePermanentPrivilege	1132	msiexec.exe
Token: SeBackupPrivilege	1132	msiexec.exe
Token: SeRestorePrivilege	1132	msiexec.exe
Token: SeShutdownPrivilege	1132	msiexec.exe
Token: SeDebugPrivilege	1132	msiexec.exe
Token: SeAuditPrivilege	1132	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1132	msiexec.exe
Token: SeChangeNotifyPrivilege	1132	msiexec.exe
Token: SeRemoteShutdownPrivilege	1132	msiexec.exe
Token: SeUndockPrivilege	1132	msiexec.exe
Token: SeSyncAgentPrivilege	1132	msiexec.exe
Token: SeEnableDelegationPrivilege	1132	msiexec.exe
Token: SeManageVolumePrivilege	1132	msiexec.exe
Token: SeImpersonatePrivilege	1132	msiexec.exe
Token: SeCreateGlobalPrivilege	1132	msiexec.exe
Token: SeCreateTokenPrivilege	1132	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1132	msiexec.exe
Token: SeLockMemoryPrivilege	1132	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1132	msiexec.exe
Token: SeMachineAccountPrivilege	1132	msiexec.exe
Token: SeTcbPrivilege	1132	msiexec.exe
Token: SeSecurityPrivilege	1132	msiexec.exe
Token: SeTakeOwnershipPrivilege	1132	msiexec.exe
Token: SeLoadDriverPrivilege	1132	msiexec.exe
Token: SeSystemProfilePrivilege	1132	msiexec.exe
Token: SeSystemtimePrivilege	1132	msiexec.exe
Token: SeProfSingleProcessPrivilege	1132	msiexec.exe
Token: SeIncBasePriorityPrivilege	1132	msiexec.exe
Token: SeCreatePagefilePrivilege	1132	msiexec.exe
Token: SeCreatePermanentPrivilege	1132	msiexec.exe
Token: SeBackupPrivilege	1132	msiexec.exe
Token: SeRestorePrivilege	1132	msiexec.exe
Token: SeShutdownPrivilege	1132	msiexec.exe
Token: SeDebugPrivilege	1132	msiexec.exe
Token: SeAuditPrivilege	1132	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1132	msiexec.exe
Token: SeChangeNotifyPrivilege	1132	msiexec.exe
Token: SeRemoteShutdownPrivilege	1132	msiexec.exe
Token: SeUndockPrivilege	1132	msiexec.exe
Token: SeSyncAgentPrivilege	1132	msiexec.exe
Token: SeEnableDelegationPrivilege	1132	msiexec.exe
Token: SeManageVolumePrivilege	1132	msiexec.exe
Token: SeImpersonatePrivilege	1132	msiexec.exe
Token: SeCreateGlobalPrivilege	1132	msiexec.exe
Token: SeCreateTokenPrivilege	1132	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1132	msiexec.exe
Token: SeLockMemoryPrivilege	1132	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1132	msiexec.exe
1132	msiexec.exe
2556	MT.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 1132	4704	MTInstaller.exe	85
PID 4060 wrote to memory of 2940	4060	msiexec.exe	92
PID 4060 wrote to memory of 564	4060	msiexec.exe	102
PID 4060 wrote to memory of 3884	4060	msiexec.exe	104
PID 4060 wrote to memory of 1120	4060	msiexec.exe	105
PID 2940 wrote to memory of 2556	2940	MsiExec.exe	107
PID 2940 wrote to memory of 1552	2940	MsiExec.exe	108

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\MTInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\MTInstaller.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\MadgeTech 4.msi"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1132

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 02623AEA4453DC2E34359463CA53F3E9 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2940
- - C:\Program Files (x86)\MadgeTech\MadgeTech 4\MT.exe
    "C:\Program Files (x86)\MadgeTech\MadgeTech 4\MT.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of FindShellTrayWindow
    PID:2556
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\MadgeTech\MadgeTech 4\Documentation\MadgeTech_ReleaseNotes.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1552
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:564
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C256020F4DBA8166E36FAAD60A29C631
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3884
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D2D3C0FDAD00531846AAA76D0EEFAC98 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1120

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58dccf.rbs

Path C:\Config.Msi\e58dccf.rbs
Size 33KB
SHA256 3e6e0fe515ce19b592bf1e3b1d1184636132c33a1a09fba10bad827ce2d91fd5
MD5 b0fb3100251685d69e63e4756229ec59
SHA1 b617487ba718c35bd0319c7ec429125339bafd94
SHA512 6a3f9735484980d3214625aff9bad2d579000c7e2bc0a6b36a1ad8c640f7a067843ad1b18baf5ebc79866069a10152d81cfc0129db8854012d230cf762fa56b8
SSDEEP 384:a6Dntw7zb3YHvbNpwUNpwS6KiA6poD2Egdb69OnZFU9P3GbagFW:a67K7zMjNiUNibXTI
TLSH
T17AF232027946D5D4FD4AEAF0ABD15F0437354AE5E298C2BB22CF460F9950BD42AFC392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ActiproSoftware.DataGrid.Contrib.Wpf.dll

Path C:\Program Files (x86)\MadgeTech\MadgeTech 4\ActiproSoftware.DataGrid.Contrib.Wpf.dll
Size 99KB
SHA256 bb1b0cc3d6e0e355256e038c375cfb1653b62c5e6e1118190d500c9707b37224
MD5 ea093d41bf5756c9eaa61645d45f92bc
SHA1 42a070f6002878e5a609e4d1865099a3f31d3e97
SHA512 6c169a3fe8ae53971a867bf838f1ffb73317af3139719233e38faa3e313a6b06d662243d79b26952b0d2a3a557ff2438816ad7700c3edee83105c3ef95639826
SSDEEP 1536:tAfyuwKZr/J/JwhphGE5c3yg/yqlSR9GfIiv:tLvKZrheLGE517hM
TLSH
T1D3A37D06F3678321C6494E7290E785241B7AEB8375B3C7463CC816AD4E937C68B1A7DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ActiproSoftware.Docking.Wpf.dll

Path C:\Program Files (x86)\MadgeTech\MadgeTech 4\ActiproSoftware.Docking.Wpf.dll
Size 814KB
SHA256 4719da01cf3cec2c90cb66b3fa79f75a3d9e86b3c4ef17413ae004a2a31b7a35
MD5 1fa6407d44dd523a4dbf3f685b040f88
SHA1 4e1f18afc3259ea1dd17da999f78c707ab53cdc8
SHA512 0e4f6532f0a0b9e068ff5869a54800dc75b8f1c99c0ca4af0415aa57541f9cf0c2f218f5f62cbc6f79aa118b3d5e2dcd8e5e1217b42fe8f8d3e747b91fdd1312
SSDEEP 24576:mjuh3WJY7jw66mdEOhcJYHCkoYfb64AVG67nnC9:m6n6PkoYfb64tqnC9
TLSH
T10B054A80B776C627C21F0B37D1E159144BB48143E291EB5B79D52BFA2E873538E092EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ActiproSoftware.Editors.Wpf.dll

Path C:\Program Files (x86)\MadgeTech\MadgeTech 4\ActiproSoftware.Editors.Wpf.dll
Size 921KB
SHA256 3707bc6f21fa8f7dec3a75b3d71060c5633c4307c1bc3e70dee3b4964d11afcd
MD5 9610d291b33eee518f265d8a0d176975
SHA1 d04d3fb3a9795fc888effb0536a9ba014d1603db
SHA512 5cb4a9c2be78456f915d0a6f315f317a361176464f6d1d4ebd97082776ccebe719a61b35cd1cfa3f28a8fb51d3b9dc6f9991ff99845d14920fb85470a9b80565
SSDEEP 12288:ojirLilFyrPpdlX6vkQfjgF9wKA7T7Xhg22nJ:oiBJXyjgEKA7T7Xhg2o
TLSH
T179153A45BAE6CE26E65C4B73C4D1450CCB758113E2D2C72B6EE52BF02D873628D4D2AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ActiproSoftware.Ribbon.Wpf.dll

Path C:\Program Files (x86)\MadgeTech\MadgeTech 4\ActiproSoftware.Ribbon.Wpf.dll
Size 782KB
SHA256 806cb42104ee21a0d50179c9019b36abf1a0d24381f2412880bb03b407d72609
MD5 a38d7ecc41b4aef8dc1d83e27914047a
SHA1 64d39f6ad8bd427673cb766e21061aa87d5e61ce
SHA512 2cced50d79b223a594876ec30fff17de2fdfa619ed16e5f5cd8c5f675edb271409e1775bc2bee3d173926d8f3a3b78676470717f688cf6fbba22c4f0d573b317
SSDEEP 6144:gHMm/oFIm6KNr2EdxV0S1TYHxvqTaVQV/KXRFh5/089yoy1ZltGPmQkAFEpdBSC5:6L8XFTYXVQVirDcyvCAO7
TLSH
T1F3053B413379C963C72E073AA1D656284F364642A1E2CA7B25D63FD9AAC73830F05E5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ActiproSoftware.Shared.Wpf.dll

Path C:\Program Files (x86)\MadgeTech\MadgeTech 4\ActiproSoftware.Shared.Wpf.dll
Size 2.2MB
SHA256 8e25bded96d89cf37c7e669070fc0bfc57a33b7cd1436275bf648a4400ec8902
MD5 b339bbeb9b8906f993f753fa4aedccda
SHA1 5d1bcc21e94c2094b3a157bce7b80c367a3fd00f
SHA512 a300a67e014225936ca517b3e72b67197113b875fe8acd599e64bb9294e7aec7270c79a1cc42dc8232aa0934c2d250f31dd7f27737eed54dc26e6e15df909b2b
SSDEEP 49152:Dnp33k3ibnVoTKVwjCZbivA5nN0XoFUykBVOUHNHmA0YDQYWZ1:Dntk3ibsBhU1
TLSH
T1C7B55C85E6B2CC6AD32E5B77C0D044185B359202E392C75F6B853BBD29D332B8D0967B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ActiproSoftware.Wizard.Wpf.dll

Path C:\Program Files (x86)\MadgeTech\MadgeTech 4\ActiproSoftware.Wizard.Wpf.dll
Size 147KB
SHA256 e20ac3ed619ea1321c8761424c2d7a03b409c77104a904729cc41ea33152c632
MD5 c2840e889daa3bddfe19e31f0ee32e86
SHA1 59adb071edbfde7bb952a8ea0d5a1b3edeaf33fb
SHA512 d49662c24c6eadeb336a35c69d3a6ab412834817443c53a3152657353e8f57774b1e62dd7f5bcf03bb6b1be24e02f5c4ba80664e06dffdd35d6e47b9a7d613b0
SSDEEP 3072:Eo/kYHPXLH/hGalDi5Qn+Z5py2Yb2W4Ibtl7:zXLHZWWn+dy2YN
TLSH
T138E34BA4B369C929C64D0E3360D3D62017B4978339B2D7692AC6138D9E833874F577DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Auth.dll

Path C:\Program Files (x86)\MadgeTech\MadgeTech 4\Auth.dll
Size 25KB
SHA256 7725080a621590ab511fb30c9a2d73f49bb4197d35fc02356ea4d563a26208e6
MD5 8e410b13e941c8fd63640f8953bcc854
SHA1 aedcc72b193f8038dce3832857d3074eaf0b8586
SHA512 f5b4007351e14db1f3358daf32dab9d2bdf146b83433419d0f696422062c7d8935c4ef4001deaee6139e09237096d811f076ceb87ae28f770d1001ecdeb9168e
SSDEEP 768:p9nMzJPp40DpBciMZUXHRC+z+Yituz5HtLF06VRUaOTPEpH8ArElqn:p9MzJ+UXHYBzE6WEIn
TLSH
T158C2A62253E8557DFAF70F7B2835A2464673FD18B830E2BDA869115D1AF138285A1F33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CircularDependencyTool.dll

Path C:\Program Files (x86)\MadgeTech\MadgeTech 4\CircularDependencyTool.dll
Size 77KB
SHA256 ddb4685e971320d65ef856069cc5ca270bfe0e715d69dc2c87ca885a254380c9
MD5 63d5219d346d97402c7f17310fe411ee
SHA1 6682106cb446b6b815d1d14587ab8d5a2340ff50
SHA512 71dff1665b9359d24c66fa985afa058d21d7a7d7643a866818b003f2153856495f7362a2bab7e4f26cf44ab245b870a2fda29e9c85faa5d2ddb55674f946c91c
SSDEEP 768:EseL01S8C77IfrAA8o/zrH43C8d8fSn4e3oV7XEvC77IfrAA8o:H1SxiX8o7rY3C8d88r27UsiX8o
TLSH
T140738C6A23A46943ED9A0A74A4A3416043F68E73C9F6DF6537D9706E6C433C34D02A7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DeviceComm.dll

Path C:\Program Files (x86)\MadgeTech\MadgeTech 4\DeviceComm.dll
Size 1.8MB
SHA256 f7d4ed3af94c05d798512cd79101567fa248e1c365afa0d932f2fff19ec460af
MD5 cea3a294a69dc99538dd5d82855cd20f
SHA1 732711588cef1c578330a55539746bc14af302c0
SHA512 809ce3991b83f3acf1de0551ab0613b039e008c79eb63add6fc899681fd2d9f6a9629c416832397614609153e7ca428a2350e7f01d771226ac4ee5b0b2052ba4
SSDEEP 24576:snTroxN/tdERk5J8IQAI45eNT0jNJ/rI62:CTotdERkgIxJ/rI6
TLSH
T14A856D0A6BFD591EF2FB0B71B5750094AFB5B8699D02EA1F901024CD0E62F888E71777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MadgeTech_ReleaseNotes.txt

Path C:\Program Files (x86)\MadgeTech\MadgeTech 4\Documentation\MadgeTech_ReleaseNotes.txt
Size 65KB
SHA256 6d64ed4b122dcb4b476aaaabc678ac4f59196c4f889b46aba09e3ed403a44396
MD5 bf3bbc1637253f3a2b7dc9e360765e6b
SHA1 37a22202adc9028259ada3597eb7fc6860dd6765
SHA512 e6937d4d1b60f08539e483d630bd5ce414be55ce325491a5343e68c0996010eaf1895eb08f932fa969a41e9bc7e3ff216d6a227f2ae9c40e8d4268537f0947f7
SSDEEP 768:0mtGOoZInUQh1tPnVXtiu9k1HCtq5TN20l7e0HxWET3uB8TiH4H3HHs6T:RXoZIn5nWCtI5pHEG+JWT
TLSH
T13B6393523D6EF3F50643D192B9842393EB3AA069579313D424EAD28D24414B9F33EBF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DynamicDataDisplay.dll

Path C:\Program Files (x86)\MadgeTech\MadgeTech 4\DynamicDataDisplay.dll
Size 617KB
SHA256 2dea2dd250c8d115b375ecb2222899d15562b3661e0b1ceacc02c77678a75348
MD5 9dabccdfa1795e33e515fb3ca6a9a11a
SHA1 8d0f2d4d867f878842f50b8d887f50242dea2017
SHA512 b7cc452614555573acb0c8d4e9096334727d35bec69939790bf9ca69dd9f90186616ae40670955a14ce3a6c62472ea803d072f5c766add82aac864499e70b4d7
SSDEEP 12288:xWvsXoFlACbAYyXf9/k/ofqXNQHgf+y8klXfk8zsJ1mLFL:YsIACcY+1/knXRHXfnLFL
TLSH
T176D47D2473A88E2AC0AF1775F02518259374DD17A7A6D71F99C1BABD2CF77A18C013A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EPPlus.dll

Path C:\Program Files (x86)\MadgeTech\MadgeTech 4\EPPlus.dll
Size 1.2MB
SHA256 0889cc0aa254d77c4a6914e298b8a3d9f2aaad5d117df4ba35868ed1595d57fa
MD5 ff7a02aef15776af903f2ef82ab02def
SHA1 adb132cd5d63cb823b563dc98284b8dde76165a1
SHA512 14b32ca2b5e172819fe936061f940575720f75accc134e0984b0119f22079302347a96b29e962b7caf22dca34ffc161557d5dfb6f1123bc7b8201f787c6b59d6
SSDEEP 24576:og5XzQAdmvC96R0KSjPSbENgEEoC6wgDxZpp09+sOZm:ou196R0pwgDxZpp8+Z
TLSH
T19855293937F867AAE0AE6B70EC722C0107F1A50666D5F74E6DB8629E1C5B7408C4079F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FileStore

Path C:\Program Files (x86)\MadgeTech\MadgeTech 4\FileStore
Size 139KB
SHA256 dadca106d00eb48c1289ce35ef780ec290a8096ee8c8871ff42216be1a236d6e
MD5 68c443602b679cb9a23446a7904dfa26
SHA1 b1d8b00644f76483f5d80f5ed20a6a58450a8c08
SHA512 a40008a2101560aee0e0c7c22669682569ea9adfa106a59a9b4db05d07b79713b2c415d362bdbcbe9dab760eda7c991a93dc5170c19ff4c607969ff88cb9454b
SSDEEP 3072:Cgz+PCUP2HPxL5aSdnhuapO75+P4rzYqEFgEGGmB/flzYG:gl2L5aS5YakIPwhEPGGmBn2G
TLSH
T1F6D3120A0FEE6DAEC1A7AC37C7251C21A56369826C4DBD4D2C02373E647591C7E1F3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MT.Cloud.Common.dll

Path C:\Program Files (x86)\MadgeTech\MadgeTech 4\MT.Cloud.Common.dll
Size 158KB
SHA256 6f24eaa7274f3cd26d6c9531c78cf8a6a3e93f672dc70729f6de332fc7fd8207
MD5 fc6a74e3f5976df1afd6cbac87752391
SHA1 71eff6830bf6fbcd724feb8ed87b30f0316c1682
SHA512 66ed1b8c7c5c07fd75829d1e437ee1b5198bb2d5374bd07f923530b5341aae577e4c469ab9e334550e2008854a1a3e928ec5e73e8984fb6f83e343c0bfd3fe47
SSDEEP 3072:sfIn8iP/ZYQH2QESSF/jcQ6chGXMFoisjnwpxveRYiGkoxQsA:ln8a/ZzH2QESSF/jcQ6dAoisLzoxQs
TLSH
T103F3182367E8561AE62DF6F19B90D1784721F129522F8FBB29C4A01B16D7B507A00FF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MT.Cloud.DB.API.dll

Path C:\Program Files (x86)\MadgeTech\MadgeTech 4\MT.Cloud.DB.API.dll
Size 42KB
SHA256 ce76526d741ad7d2570d072cf86fa3684c5daeeac55bf5ac3c4b098e28c76276
MD5 7938bbe4416229298668cb68af25b466
SHA1 88114f7c57097286783d91ac4fff83c1a9602833
SHA512 408ac12cb48a4bcb6d87a7ac3b463f5e64ff857eb090ce2fcfece69bb33a7b97a5e43a96cc509e56b90de8a65909f0e14c05aa6ba46524132309aa49c60b2819
SSDEEP 768:iom1iK5LO7jpos9NzeAonMKUjH1f/EN62b4VMnRWQ4cz1Dx5Yr:Xm1iK5y7jRiuOHb8Q4M1Dx5Yr
TLSH
T1AC133A065BFA8F67DEAD0675E43242040BB4F645A213DB890EE4F0AE6D937DC51322DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MT.exe

Path C:\Program Files (x86)\MadgeTech\MadgeTech 4\MT.exe
Size 9.8MB
SHA256 f741fc197d695132125e16db41412026e3082750527ee66357cfbfae6ad551de
MD5 2b40d036330dd3eac9a93e5381fdb12a
SHA1 0fe9f2d7fa43ddc5cf48a2df739737ef8085bb76
SHA512 6f3e860a96ae9764f4fb003e50bb534a8a21b943a4384813a393567219006db038d3e03acc9f2cc5f040c711317f993d2040cb8deef14ec47a1ca37fb9f6cbc0
SSDEEP 98304:P7ClF7Jc/cvsF+0ADXWpJ0zPvrKd+LLQWu+hYoDRnH7o:P7ClF7mckdYXWpizXrS+HHRRnH
TLSH
T128A67B4277FE2559F6F70BB9BD3444949E7ABD2A2E41C24E311C542E1BB2B808D22737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MT.exe.config

Path C:\Program Files (x86)\MadgeTech\MadgeTech 4\MT.exe.config
Size 11KB
SHA256 b3f105a17cfa9c28b851beb66cdfc5a48f1c0cfe44aca7f1a4ec2df363ecdbc4
MD5 9a48e3c913e8c816cfb2670f2acef8a7
SHA1 65117c7d1df093585aa0fa8b4dd29d47d0a3c5e6
SHA512 404ae144ced697938823cc8fbf43e00302fe9e6b86865d5b15583f527f0e517a2da26a43a2b49a524f64fcb023c90ff079b300b93e21ab5d7b1531e8676724c1
SSDEEP 96:TrDpIqe71p7zXgymRuvX4vXjAv97Av9Av9swv7wMv7dfAvzvtfvp5m5AGIivKCWS:Trthe737zXgymklYmmBrry5i4TkQrWg
TLSH
T17442151CB1C1EF9A05736631E63152D1EDA006231166B0F0B8EE3167AF71CDA5AB37B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MT.exe.config

Path C:\Program Files (x86)\MadgeTech\MadgeTech 4\MT.exe.config
Size 11KB
SHA256 8cac5f47d1adc8caaeedcc502540fc76db90434c57565d2b648ec52c758df374
MD5 f89a8001df0c09276037f978cad17762
SHA1 d57131cef60342a6879e4b7a66b802d24358c4ed
SHA512 51650257be48b0ae04207e82bc15a4190b6c8b1f27e2e45745f017d10709382d59974539deb198df2cf1d895adde5c2dc5c2ae994bcb267c6910f224b43ad2ba
SSDEEP 96:urDpIGe71p7/B2ymtuvX4vXjAv97Av9Av9swv74MvhdfAvzvtfvp5m5AGIivKuWW:urt3e737/B2ymIJem8HrPy5O4tkQrEW
TLSH
T14242051CB1C1EF9906776631E73152D1EDA006231166B0F0B8EE3167AF71CDA4AB37A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MTCommon.dll

Path C:\Program Files (x86)\MadgeTech\MadgeTech 4\MTCommon.dll
Size 27KB
SHA256 5a60d53efce7da7402756e3c64fdb0894da8c45c4cdd9f25e65a3054d36a3f3d
MD5 a0d1971a582fe0fd1442c3f238ede2bd
SHA1 da5a0eaf1e5b97aace60955ff2cdcb72a9fa0f61
SHA512 89e7c5c909c7ec6a2a229995686755b8a52d105ddbcf950f2f59bc0856bbac322149f0a52bbeadf3e76ff9a56da15c05c68aa402ea42b791c85438c5781515a7
SSDEEP 384:2gtBTVjF1+IEpysNB+rB9yrsaOGqvCQkbOQVXEJarj6aZbGYZQYq5Nat32HApZPt:27Qry4tCDbO08arjsytSklKbRHUUy1
TLSH
T13FC21819F3888333CEFFC9B468E111109370E346A927DB5628CC50B86A6775C2E5F6E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MTControls.dll

Path C:\Program Files (x86)\MadgeTech\MadgeTech 4\MTControls.dll
Size 216KB
SHA256 1197131ea0938d4f07a6c0232d3a33eec37e6af1aeccb545008270556ae7b668
MD5 9c5dbc5be909a26fe2bfa508d883919c
SHA1 33e964611d4f6435a64769ff7b6b73992d05a552
SHA512 a14297cdc1c9c30114b31bb4b574e7d9473fb624d9ac3cc88f158c05989344e2f54857fdd5414a507e86fedb709a4024bd9c098fe1bfbbc2ab55c8b7da46c57f
SSDEEP 3072:Pl5DyOpXugmUBgL8jjYI91vv5XzTbYmvkq949hS8BWWYhq4M0XnGlTgxvBO8p/oZ:P7zel8jEI9nTwq9AgQlUxvwP
TLSH
T159244A6023F84E2DE6BF5B7578B050508276FA27EE26CB4E548424AC1CB6743CE52B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Exchange.WebServices.Data.dll

Path C:\Program Files (x86)\MadgeTech\MadgeTech 4\Microsoft.Exchange.WebServices.Data.dll
Size 1.2MB
SHA256 769490ace1b1c9f9b50e80cf1ee22f21c5da1b339ba2e56eecbc7ba10d8e4115
MD5 8bbb291b954b3382363648f948ed32d6
SHA1 e2af6491024f76d049368d27c88c7b8bc2df3ec4
SHA512 547506f880856f424f315a5767b2826252617e068325c4b03e18bb8df0c74cbbd90303a7fc2649173233facca1c0eab4d2afb63a4bd801af1183767b5e587eb4
SSDEEP 12288:QPgT2xAli2dgqmpuDfqHdUghLGLsBI+QS/Vo8kLkxL3KHUYz9s6y4NDlWgrpyLU3:QP3jifqHdUg5GLsOClk+L3EimN5WggL
TLSH
T15C450709BBF40A0AE6FE8F7D9476800092B4F9066F43D32E1759A66D1CB7B50CD513AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.WindowsAPICodePack.dll

Path C:\Program Files (x86)\MadgeTech\MadgeTech 4\Microsoft.WindowsAPICodePack.dll
Size 101KB
SHA256 5287fe62b499f25edf310f76f4ee0d085021fefe37592457eaf50b46bbb5b7f2
MD5 21405c186504307a0b049baddd9bf77f
SHA1 eb6d872f06e4b153e60485be033501c817e6d05f
SHA512 ad0ee700fb8cd1e9b6530927199d27960768fe2d52097687e085f0af974cfc93bd7af32e58b352c9c24f58667cb3ee8a2173c3f55f82c6db10dec6bfdbdefc5b
SSDEEP 3072:9RXs/4UqafyrH6edpwTS/lqgrliZlp/ir:9Rc4Uqaf9SpwB
TLSH
T140A38E60B3B85A29DAFF0B78F4361150CB76F8562B17EB5E9A4874CD05E27C046A2373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\Program Files (x86)\MadgeTech\MadgeTech 4\Newtonsoft.Json.dll
Size 695KB
SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
MD5 195ffb7167db3219b217c4fd439eedd6
SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
TLSH
T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PsychroLib.dll

Path C:\Program Files (x86)\MadgeTech\MadgeTech 4\PsychroLib.dll
Size 16KB
SHA256 dccbd7e622824f96c28ec7b068ae76e45650eed3351743ec713d92e74a72beae
MD5 34765d3c9e4ab0b5ae958e685c8551ea
SHA1 1ecc4ac338781c373c96d09ddd0f4d4fe32992c9
SHA512 7cb1efd5ffcfe9d10652777cfc0e3b6f84c9ef121fc32021ea8c2eb635befcd54128a0f41fc842ae40fdeb63608654e8aa7cb48719fbd2e27117665fe45b887a
SSDEEP 192:HsFEdPmsmAFMsMaPrJkn+hqm/Kj83hsXIy1ekI5oyAOKg6+35VB:HsFE1msmMMeOn+hqghQYtWyAOlfVB
TLSH
T10A72DB2D9BE85259EDFF0B38E4B2162403A1B551B613EB9D8E0C10AE2A637F41E51F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Data.SQLite.Linq.dll

Path C:\Program Files (x86)\MadgeTech\MadgeTech 4\System.Data.SQLite.Linq.dll
Size 180KB
SHA256 542a586ccadc0038724196bb6acb9015f86c5d58307abf71c7aea975f45f3f9d
MD5 5cde3f2bfe81b0ba2f70e58b4eb26aa9
SHA1 2938cf0c2455c3fa9e5d347c89e360cb0250edab
SHA512 92ca5df60b1c2fc35cbb489011d08e8ee928caf3d54d789032e18ff4145193cf8893f475d85199b9e47ddedafece401b16bd412ebe863f9ef4ec24cc87c9fc2e
SSDEEP 1536:MBJjiZi/XR43K75s0n2s5hbbIcnDEzIYt/hOYkgcyaoz6KP8cF:SNh7r2G/4zIsF9cdg6KP8cF
TLSH
T135048524B2F19E31C1A6023428B57458ADF082F3737D5188FE9E73EDAF7A8111667B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Data.SQLite.dll

Path C:\Program Files (x86)\MadgeTech\MadgeTech 4\System.Data.SQLite.dll
Size 344KB
SHA256 3d9667e9068bb555f5b9bccbac1875a6eb0e9e00655de369be4a64052293ebcb
MD5 400bcafb59ebb5acbfff009691e1c252
SHA1 ce229571d3af05e890d5782ff0647a11b644c45c
SHA512 765bea7f352d7ad98fa561d5c8b3e20cf52743fc51d7ca9b2415d230dc175af170d7fed4787727059700f9e6ba23579fc39ca6ec10d7260b0ab49e33aa750167
SSDEEP 6144:RhNCViuKEF7WvpNz2feogAb3yBmig2HNXuFUGLT8ApkzObHpzUH7FNFaFeFOFwco:nNCV+EAvpNz2GowDgmetVHpQH7FNFaFI
TLSH
T19D744C9533DC161AE2FF53B4F9B125898B71F412AA9BD31DBCC050EA2D22B00A953777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WCFInterop.dll

Path C:\Program Files (x86)\MadgeTech\MadgeTech 4\WCFInterop.dll
Size 7KB
SHA256 74cd88b1ca2f9c62dfd75757a345bdb1b46073d70af70eae160266f64779cbf0
MD5 856889726bca6b27dfd26210cba6958e
SHA1 df42d6c500746f18ec0c9d8b65ae23e59749e810
SHA512 05e02faa1bc7ad1c0e8f917833cab1028910393612e357cd134ad5bc73cc80cba1d62597f9cacea19a4123cab602190ff08d5cbb428dfa8853274a615e762d91
SSDEEP 192:6oW2dHtmzTluf2ELOY1fiH/R4dDsjMaLeHafw3dBcWwEd7:c3lK2EL91fiH/IDsjMFHafw3dBcWwEd7
TLSH
T132F1D732E3D8A33BDD470772FC6303120A75EA58A457DF2F8A4E900AAC967445AB3761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WPFLocalizeExtension.dll

Path C:\Program Files (x86)\MadgeTech\MadgeTech 4\WPFLocalizeExtension.dll
Size 88KB
SHA256 25a1678b4b55d5b46c5b47aa96debc07fb4be6d0cecad980dd29ace894c25906
MD5 5b91d7a32fe187cdfcf2b4f8bf79ed87
SHA1 a0818e2360779c6dcb45b07fe01a0d5221a081c8
SHA512 5b34099377b9541ed34eb9119390ddd1060dc35cf61a03e449b1ff4a24c116f8c642304db3cab0da0f9c7f96f844ea83dae4f4d60acb1d5b9d348874a929153a
SSDEEP 1536:Qv9b4n3AYYmYRNfnlNnTKTNV1RkhLBy3M1EL/wpnJbMjplyC8ekoQ:Ql5N/aT0ny8U4RGlseg
TLSH
T113934A7863FD8A14C6FF8EB5B8B116150771A54AE923F34E19C495EC19A3B810B223F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XAMLMarkupExtensions.dll

Path C:\Program Files (x86)\MadgeTech\MadgeTech 4\XAMLMarkupExtensions.dll
Size 36KB
SHA256 d069824e127d73dd8d32d337d5be91c1dd0c861fd060d82801c833b3dc03d3a7
MD5 c927d1d740830db3b9d0d7e863522713
SHA1 1c27827bc3695e494888bb8db584f8f7668cf837
SHA512 f3464e9377a9fd49a0f959452aa8f31316474e5fc07650840e6ed9921ac81ddd892d1c9bc786cb1990dfe071fd2f8d95d66e3b3409f3d7c95c0b7f4989a6682c
SSDEEP 768:g0SMxZw/niMQtc3jNhbIYVmFC60feWFcae0VObdvFlG:XSMxeBhbIdFUfXFZAzl
TLSH
T13EF20811A3AC8776C6BE07BDFDB0050447F69AA47537F7840E8CB1999C6378066906BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Xceed.Wpf.Toolkit.dll

Path C:\Program Files (x86)\MadgeTech\MadgeTech 4\Xceed.Wpf.Toolkit.dll
Size 985KB
SHA256 4d23209993912f68f048c2cc71584b33db6e40b671169862384b9906b840f818
MD5 50a6b705b4f09cf098775b08b647032a
SHA1 c5f3247cadb7dbffab368e9948dfe3b903836706
SHA512 2e7c7c64c3d75f2e01a7299ea22d6b69412a1cc9c0db7ba1cd921f43001a4900a17da85a79ccdc9728e4d47aa996865470d8c9b90eed92e065d586d492c86fbd
SSDEEP 24576:TaCfh27F4zQI9KlaWz6fVW/gv3FUbySwdW9b548Xx4bjG6G4:I4zQI9KlaWz6dGgvVnSb5VSbj1G4
TLSH
T145256D502378896EC57F1BB460711418AA35F94EE3F2C72B64881B7D6CDBB528E40BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SLABHIDDevice.dll

Path C:\Program Files (x86)\MadgeTech\MadgeTech 4\x64\SLABHIDDevice.dll
Size 153KB
SHA256 3bd1a7c03193c66a556e878ce7713f51f7452c0f5ad3d03c9e17c0c7e7cb3777
MD5 33041e834115ebaa395843dbf72f3bea
SHA1 09dd96c0295231f13aca96c818f07167372a7ddf
SHA512 f2aa62040c45f25c0510c328dae3f6d0b3ea039411636e02b24a3e49cb4b4eccc2fef185e3994faafd3afccf98868ccfbf862300454f37792f662d392e2b83cc
SSDEEP 3072:r99iA6M6iLkoE382mUdLXD2SsvvYyudWmVyqIC9n982T:r3VPLo825NXyurDT
TLSH
T182E37C1BB7A4107BE5A6CA39C8535906E773B8150B618BDF036483566F237E16F3AF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SLABHIDtoUART.dll

Path C:\Program Files (x86)\MadgeTech\MadgeTech 4\x64\SLABHIDtoUART.dll
Size 144KB
SHA256 4be07df11b374002dfa7c3d0f1478c2cbc3a9cfbc9799e68dd115ffc585fe8fa
MD5 3fd80b52a80b3cd18b1d4b7897452596
SHA1 205601f76fe8155ec08032be38b9bbc452b57b19
SHA512 f97895529a47e2c624f309cf97683952508f9c9d65f1bab7815e73d29852fb1c04ec10cbfdf0a0c06fecb2439e1214647e94efd3fa9d661bec7204544ca90552
SSDEEP 3072:6l1YiDXYJdLvzDQ743aGxEwUvp8nYZlPAoWjgO9rT9n2Aw:w1YiE/DQ8vERC/o56QZ
TLSH
T195E35C5BB3A450B7E4B6C679C4935E06EBB2B821076297CF07B403562F537E06E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SQLite.Interop.dll

Path C:\Program Files (x86)\MadgeTech\MadgeTech 4\x64\SQLite.Interop.dll
Size 1.5MB
SHA256 d0a2eff3dcdd75d1ea8f716c321e151667673d42f1de3fcc860066365a5ae3be
MD5 51a5238ec08c938224215ea8114561d2
SHA1 40ce6ebb7b1d9226fa24e9ccddd37d336ae89ce1
SHA512 8b49c6848a81c08442a2fa105389b8ed0d957cfa12119a8ccdce50d33b6e92399311a25cac7efb8e0aa63ea2809658b7fa252371130c14caf6d2ed74f31bd550
SSDEEP 24576:REPfb/VhA+pZdG8XoLwoIUC4Lmr7d1jUnIfjodLvTQkQ4uTauit:REPA+1GuoLNIUCqmrrjUnwjoRT
TLSH
T131758D4BB2B401DCD5A7C17C86175A07E7B174051F60ABEB57A087AA2F23FE2167E324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiUSBXp.dll

Path C:\Program Files (x86)\MadgeTech\MadgeTech 4\x64\SiUSBXp.dll
Size 437KB
SHA256 f02387bc8bef2091356a821bc4ecab8c1c68c05c8208d7abd47dbb3164020f57
MD5 2d640a0236be1ed0f40c3f359ccac159
SHA1 56d364a40b50cfe01161501e12559b094fda2704
SHA512 3b53d415aa0c5cd7abb1075d6fae24e63b4457bcad008338f8d06d6b6e0ae29aceb06fe17f97659076cc60ef312bfbac8762c0542775e2df0ff43d092d10508b
SSDEEP 12288:yhaxVQ63PMenXvk+4x7VKHFCwBHQKLsrN6:uaxV1Ptvk+4x7VKHFC+HEN6
TLSH
T128949D06F75059B5D177D23CCA534B56EAB2380A4B21E74F03B983AA1F233616A3F725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elzkc4bu.newcfg

Path C:\Users\Admin\AppData\Local\MadgeTech,_Inc\MT.exe_StrongName_wh2gxgbmz03iggqfy5atbax154u3pad4\4.3.1.1\elzkc4bu.newcfg
Size 952B
SHA256 42300445c007c9da82bc0a73a5f17a3adf310921aa15643dbbae2f1140d1b27d
MD5 5c9262fa7e4bef316016d4971397f1d0
SHA1 e786c52eec68677fbca0073919e1aa52596523e8
SHA512 fb6b3a4f3876cefa0284e671f5b3f773517856252f4a5fa10173a5d68f60afe6e9c669e9ceb8e95853d9a9ba956567c3b26928033a459eabd3a396b2d4018f52
TLSH
T10D115A0CB1C1DF5B0176AA31E63142C0EDA055635276A0F0B8ED21635F70DD90AE33B6
MD5 SHA1 SHA512 TLSH

Submit Download

ios5pr33.newcfg

Path C:\Users\Admin\AppData\Local\MadgeTech,_Inc\MT.exe_StrongName_wh2gxgbmz03iggqfy5atbax154u3pad4\4.3.1.1\ios5pr33.newcfg
Size 822B
SHA256 1712d25ba5766832e16b6a156476a444f66a50e9b7a55a7edf12aaf7908a1ac2
MD5 4d7a6cffbfc3f0b5e4b8a223771b77ac
SHA1 a6cef5e0699aa04db73832e0e96ed353668038dd
SHA512 aff6011d40b386cf40ea85c090f4087311dfa826c6f8c3da0cbb0f34ec08a504ce356fc413410b50c2a6ef34c80d21d4401aa618924325a5e8c31840609b9eaa
TLSH
T1F401690CB1C1DF5B0176AA31E63142C0EDA015635277A1F0B8EE21639F70CD90AE33B6
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\MadgeTech,_Inc\MT.exe_StrongName_wh2gxgbmz03iggqfy5atbax154u3pad4\4.3.1.1\user.config
Size 1KB
SHA256 5b639b42a32ec9026409842c7c5f99b956d99536b6aead286c391526f6577342
MD5 d8588e82c8558ac95dbd53810eed23ed
SHA1 5756272d3d386f2f8a396ccf627690544421060b
SHA512 d02b344d68501bee972c13d5e74fe1ba892104878a590f4b2f6636f64364d33304344fc964ea81294c0dded998f95917eed9ca29799bde8a448965f21e155354
TLSH
T15B219D0CB0C1DF5A0176AA36E73182D0EDB015635266B1F0B8EE21276F70CD94AE33B5
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\MadgeTech,_Inc\MT.exe_StrongName_wh2gxgbmz03iggqfy5atbax154u3pad4\4.3.1.1\user.config
Size 1KB
SHA256 e35a9bf318a4e0eeb69477818ad8365812e7f9c4d843732b436d8458fd615721
MD5 3631a0357a35125fe6824057b89065fe
SHA1 8089b80b7da86d26baca8880b41dd64b82c7b498
SHA512 f6358ad54bc53e13b97822dafc66c9581160edc60b0d4c65583f5cba89044e5ee88bcc822f7c968b8efe2b3b7af5cc54977f11ca90a5393b24767bbb9f2a409f
TLSH
T1BE21790CB1C1DF9A0176AA31E63142D0EDA015635266B1F0B8EE21236F70CD90AE33B6
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\MadgeTech,_Inc\MT.exe_StrongName_wh2gxgbmz03iggqfy5atbax154u3pad4\4.3.1.1\user.config
Size 696B
SHA256 51e8a68823bddae2c28f080d0b5888a561740ac76b1f1f8cd20391ca50040dcd
MD5 ebcf7355425c85fb0f2d6b9c3cb3bf1a
SHA1 a0f8dd3cdaf0c41c7f5f3622b24916ed79fa075f
SHA512 90c0dd84145417a5e9d9e0c515fcf86ad96453a3307c621ff057f89d700440d7419f60d006418819bcfbdc5a44c83e899ea41a4c692bcf4bad513a7723277737
TLSH
T11101670CA1C1DF5B0172AA31E63142C0EEA015635277A1F4B8EE22639F70CD90AE33B6
MD5 SHA1 SHA512 TLSH

Submit Download

MSI83D1.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI83D1.tmp
Size 113KB
SHA256 aecd2d2fe766f6d439acc2bbf1346930ecc535012cf5ad7b3273d2875237b7e7
MD5 4fdd16752561cf585fed1506914d73e0
SHA1 f00023b9ae3c8ce5b7bb92f25011eaebe6f9d424
SHA512 3695e7eb1e35ec959243a91ab5b4454eb59aeef0f2699aa5de8e03de8fbb89f756a89130526da5c08815408cb700284a17936522ad2cad594c3e6e9d18a3f600
SSDEEP 1536:YImZwomOndvrhsgz56GoiFmntw1ebC0fsWk0FlcdOJKJpPpxyNokVbY4:jewOdvregz5L/mxb7FUOsrPpxyN7/
TLSH
T19EB37C1275D0C072E8BE0E3D45748A715F7E7930EF648AEB635812694FB42C0AE39E67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MadgeTech 4.msi

Path C:\Users\Admin\AppData\Local\Temp\MadgeTech 4.msi
Size 24.3MB
SHA256 aad7e6581d1e935c5d359afa50421b967e29309d53c200b10b9ef1d2cea392fe
MD5 30a6b820ba761ce8d09609129c626198
SHA1 e53b7de09cb4267b3f5cdd466f37966520423ab3
SHA512 c94540c6c30803be4b1d03eb3fc8b60a32586b358f5a7748789be7f9c208127f363f6e4fabd2b98d862a92bda797a680e6bbe43c7226440bf055f506383d3ae0
SSDEEP 393216:pL5Qwz9r14dpyDcr8sX/NCzmZLPf7C3I2DPyzFUeeTH4xhCiyN5q9zM:5z5G6DXsVCatf/2DPyGeTxDM
TLSH
T1F74723A96C044399C36143F48F16F5896E3AFC1414F5889472EFF2BB247F998E2774A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIE626.tmp

Path C:\Windows\Installer\MSIE626.tmp
Size 211KB
SHA256 c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
MD5 a3ae5d86ecf38db9427359ea37a5f646
SHA1 eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
SHA512 96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
SSDEEP 3072:/Jz/kyKA1X1dxbOZU32KndB4GLvyui2lhQtEaY4IDflQn0xHuudQ+cxEHSiZxaQ:/t/kE1jOZy2KL4GBiwQtEa4L2sV
TLSH
T1ED249D316094943EE7FA0936997ED671AE3DF2341760C9AEC3848C0E6D644C16BB7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 3b10dd8b90aef10d0723aa86b018c069331f06de1e3531986ba0a134d2ad3393
MD5 1d65949fa7ea214847192a615b794136
SHA1 a4d3820a2fd9c67c8dbf486111df3a212142a619
SHA512 0a3996b6638630e9a436d224451dfadbf1b0c15caee0270af7961add614b8575e31be76b5b3fff63b16d9fade3dc139fa577b6368b3add750a35f1e95528b8d6
SSDEEP 24576:Su8m+1zrdoO/vvTLrWceJG64dl0zEVMiwKmNeTtlU06tuLlBovVFk6XRp:i
TLSH
T13B47E42436F92110E7F79E3CA8F16A234D3A7D5B8C159E8D05411B4E0962FB1E872F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{03f4c182-1ace-4181-a50d-ad26e454e73a}_OnDiskSnapshotProp

Path \??\Volume{20c84cf9-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{03f4c182-1ace-4181-a50d-ad26e454e73a}_OnDiskSnapshotProp
Size 6KB
SHA256 e84a3f977bc2b8567bda82764ffaff3a7fd62d252d1f13aaf2f8f7f5479174b8
MD5 a6b6db8b20ce6a0dc3e9de887ece8190
SHA1 42a1c8b5d8d0ad3c3680cffe8be17f55f01043b1
SHA512 4fdad4fe23d80d248e325eb81bf90d4aa1553da1e5b82e61b58cd002bd86c35a363e425d8201b24eb9c39cd8a4fcd18fc66a595d10dae2110986a7094d062af3
SSDEEP 96:FvG3JUcAVvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:s3Jyb++ZVm
TLSH
T170D1890C5AF54311E2B3AB3129F18557A877B811EF33CB8E0298238E6671910F935F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2556-237-0x0000016677660000-0x0000016677682000-memory.dmp

Download

memory/2556-161-0x00000166776A0000-0x0000016677A7A000-memory.dmp

Download

memory/2556-297-0x0000016678FA0000-0x0000016678FA8000-memory.dmp

Download

memory/2556-172-0x0000016674170000-0x000001667417E000-memory.dmp

Download

memory/2556-239-0x0000016679040000-0x000001667909C000-memory.dmp

Download

memory/2556-174-0x0000016677510000-0x00000166775DE000-memory.dmp

Download

memory/2556-176-0x0000016677A80000-0x0000016677B6A000-memory.dmp

Download

memory/2556-248-0x00000166790A0000-0x000001667911E000-memory.dmp

Download

memory/2556-253-0x0000016678FE0000-0x000001667900E000-memory.dmp

Download

memory/2556-178-0x0000016677B70000-0x0000016677C36000-memory.dmp

Download

memory/2556-251-0x00000166791C0000-0x0000016679260000-memory.dmp

Download

memory/2556-184-0x0000016676390000-0x00000166763AC000-memory.dmp

Download

memory/2556-249-0x0000016679650000-0x0000016679B78000-memory.dmp

Download

memory/2556-254-0x0000016679310000-0x00000166793B8000-memory.dmp

Download

memory/2556-182-0x00000166741C0000-0x00000166741FC000-memory.dmp

Download

memory/2556-180-0x0000016678070000-0x00000166782B2000-memory.dmp

Download

memory/2556-260-0x0000016679120000-0x0000016679148000-memory.dmp

Download

memory/2556-170-0x0000016677C50000-0x0000016677E18000-memory.dmp

Download

memory/2556-258-0x0000016678040000-0x0000016678060000-memory.dmp

Download

memory/2556-167-0x0000016674160000-0x0000016674170000-memory.dmp

Download

memory/2556-256-0x0000016677C40000-0x0000016677C50000-memory.dmp

Download

memory/2556-262-0x0000016679010000-0x0000016679028000-memory.dmp

Download

memory/2556-264-0x0000016678020000-0x0000016678028000-memory.dmp

Download

memory/2556-163-0x0000016674130000-0x000001667414C000-memory.dmp

Download

memory/2556-266-0x00000166794C0000-0x00000166795BC000-memory.dmp

Download

memory/2556-214-0x00000166782C0000-0x0000016678372000-memory.dmp

Download

memory/2556-267-0x0000016679260000-0x00000166792A0000-memory.dmp

Download

memory/2556-269-0x0000016678030000-0x000001667803A000-memory.dmp

Download

memory/2556-160-0x00000166733A0000-0x0000016673D68000-memory.dmp

Download

memory/2556-296-0x0000016679460000-0x0000016679480000-memory.dmp

Download

memory/2556-270-0x00000166792A0000-0x0000016679300000-memory.dmp

Download

memory/2556-295-0x000001667AC70000-0x000001667AD2A000-memory.dmp

Download

memory/2556-276-0x0000016678060000-0x000001667806C000-memory.dmp

Download

memory/2556-293-0x00000166793E0000-0x00000166793EE000-memory.dmp

Download

memory/2556-274-0x0000016679F30000-0x000001667A074000-memory.dmp

Download

memory/2556-272-0x0000016679CB0000-0x0000016679DE0000-memory.dmp

Download

memory/2556-277-0x0000016679DE0000-0x0000016679EEA000-memory.dmp

Download

memory/2556-278-0x0000016679400000-0x000001667943A000-memory.dmp

Download

memory/2556-279-0x0000016679190000-0x00000166791B6000-memory.dmp

Download

memory/2556-281-0x0000016679480000-0x00000166794B4000-memory.dmp

Download

memory/2556-294-0x00000166795C0000-0x00000166795F8000-memory.dmp

Download

memory/2556-291-0x0000016679030000-0x0000016679038000-memory.dmp

Download

memory/2556-292-0x0000016679300000-0x0000016679308000-memory.dmp

Download

memory/4704-4-0x0000000006660000-0x000000000666E000-memory.dmp

Download

memory/4704-5-0x0000000006360000-0x0000000006370000-memory.dmp

Download

memory/4704-8-0x0000000006360000-0x0000000006370000-memory.dmp

Download

memory/4704-9-0x0000000006360000-0x0000000006370000-memory.dmp

Download

memory/4704-0-0x00000000000E0000-0x0000000001948000-memory.dmp

Download

memory/4704-3-0x00000000066A0000-0x00000000066D8000-memory.dmp

Download

memory/4704-2-0x0000000006650000-0x0000000006658000-memory.dmp

Download

memory/4704-1-0x0000000006360000-0x0000000006370000-memory.dmp

Download