078eea9448311d3464d601ec81d7b488e3acf80ed7e1460995c78e76dc92b7d8

Analysis

max time kernel
75s
max time network
72s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28/12/2022, 19:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MSIAfterburnerSetup465Beta2.exe
Size

53.2MB
MD5

9de643091af41afb051a4ea65bcbccf7
SHA1

b61bd244650d67d55448092710e23c79e9fc7b4c
SHA256

078eea9448311d3464d601ec81d7b488e3acf80ed7e1460995c78e76dc92b7d8
SHA512

b92c65802a50c45d3a27fea41530c4ea14c5034f9d6f6d9b609f907abbf72752b31b580a81659a169ff0221dba4f7322fda364c7b0cfd599c59d5c98fc55586b
SSDEEP

1572864:H6JqsOEc92Rl/Gt76mPSwGt76FP8X8i7kpOMPc:H6cpfpt7aRt7CZAMPc

Score

8^/10

discovery

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
2256	vcredist_x86.exe
968	install.exe
2752	vcredist_x64.exe
2852	install.exe
4496	MSIAfterburner.exe
3228	MSIAfterburner.exe

Loads dropped DLL 24 IoCs

pid	Process
3384	MSIAfterburnerSetup465Beta2.exe
3384	MSIAfterburnerSetup465Beta2.exe
3384	MSIAfterburnerSetup465Beta2.exe
3384	MSIAfterburnerSetup465Beta2.exe
968	install.exe
2852	install.exe
4496	MSIAfterburner.exe
4496	MSIAfterburner.exe
4496	MSIAfterburner.exe
4496	MSIAfterburner.exe
4496	MSIAfterburner.exe
4496	MSIAfterburner.exe
4496	MSIAfterburner.exe
4496	MSIAfterburner.exe
4496	MSIAfterburner.exe
3228	MSIAfterburner.exe
3228	MSIAfterburner.exe
3228	MSIAfterburner.exe
3228	MSIAfterburner.exe
3228	MSIAfterburner.exe
3228	MSIAfterburner.exe
3228	MSIAfterburner.exe
3228	MSIAfterburner.exe
3228	MSIAfterburner.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\MSI Afterburner\Localization\FR\Help\Properties\Profiles\2D_PROFILE_COMBO	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Localization\FR\Translation\MSIAfterburner.exe\StringTable	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Localization\ITA\Help\Properties\Benchmark\RECREATE_BENCHMARK	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Localization\KOR\Help\Properties\Monitoring\SHOW_IN_LCD	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Localization\RUS\Help\Properties\Video capture\VIDEO_CAPTURE_FRAMERATE	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Localization\RUS\Translation\Localization\DUT\Description	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Bundle\OCScanner\scanner.dll	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Localization\FR\Help\BUTTON_DEFAULTS	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Localization\SPA\Help\Properties\General\START_WITH_WINDOWS	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Localization\UKR\Help\BUTTON_LINK	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Localization\JP\Help\Properties\Profiles\PROFILE5_HOTKEY	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Localization\TC\Translation\Localization\PTBR\Description	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Help\Properties\Monitoring\ENABLE_LOG	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Localization\ITA\Help\Properties\Profiles\PROFILE5_HOTKEY	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Localization\SPA\Translation\Localization\SPA\Description	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Localization\UKR\Help\Properties\Monitoring\GRAPH_COLUMNS	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\SDK\Samples\Plugins\Monitoring\PerfCounter\PerfCounterGlobals.h	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Localization\PTBR\Help\Properties\Video capture\AUDIO_SOURCE	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Localization\SPA\Translation\Localization\KOR\Description	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Localization\GER\Help\Properties\Video capture\VIDEO_CAPTURE_QUALITY	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Localization\ID\Help\Properties\Monitoring\BROWSE_LOG_PATH	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Localization\JP\Help\TEXT_AUX_VOLTAGE	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Localization\FR\Translation\Localization\POL\Description	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Localization\GER\Help\Properties\Video capture\MJPG_DECODER	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Localization\PTBR\Help\Properties\Benchmark\BROWSE_BENCHMARK	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Localization\RUS\Help\Properties\Monitoring\LayoutEditor\SIZE	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Localization\TR\Help\Properties\Profiles\PROFILE4_HOTKEY	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\SDK\Samples\Plugins\Monitoring\PerfCounter\PerfCounterObjects.cpp	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Localization\CHN\Help\SLIDER_FAN_SPEED	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Localization\KOR\Translation\Graphics\LCD\Fonts	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Skins\Steampunked.usf	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\MSIAfterburner.dat	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Localization\TC\Translation\Localization\CHN\Description	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Localization\POL\Help\BUTTON_PROFILE5	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Localization\RUS\Help\BUTTON_PROFILE6	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Localization\UKR\Help\Properties\Monitoring\ENABLE_DATA_FILTERING	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Help\Properties\Monitoring\TRAY_ICON_TYPE	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Localization\ITA\Translation\Skins\MSIGaming.usf\header	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Localization\DUT\Help\TEXT_DRIVER	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Localization\RUS\Help\Properties\Monitoring\MIN_LIMIT	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Localization\KOR\Help\TEXT_CORE_VOLTAGE	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Localization\TC\Help\Properties\On-Screen Display\OSD_ON_HOTKEY	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\SDK\Samples\Plugins\Monitoring\PerfCounter\MultiString.cpp	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Localization\DUT\Help\TEXT_MEMORY_VOLTAGE	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Localization\ITA\Help\Properties\Video capture\VIDEO_CAPTURE_GAMMA_CORRECTION	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Localization\GER\Translation\Localization\CHN\Description	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Localization\ITA\Help\Properties\Profiles\PROFILE_CONTENTS_HARDWARE_SETTINGS	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Localization\RUS\Help\Properties\Video capture\STEREO_MODE	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Localization\SPA\Translation\Localization\PTBR\Description	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Localization\TR\Help\BUTTON_STARTUP	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\SDK\Samples\Plugins\Monitoring\GPU\res\GPU.rc2	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Localization\DUT\Help\Properties\General\START_MINIMIZED	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Localization\FR\Help\TEXT_SHADER_CLK	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Localization\PTBR\Help\Properties\General\UPDATE_CHECKING_ALLOW_BETAS	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Help\Properties\General\DRV_RESET	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Help\Properties\General\UNLOCK_VOLTAGE_CONTROL	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Localization\TR\Help\TEXT_SHADER_CLK	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Localization\UKR\Help\BUTTON_PROFILE6	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Localization\GER\Help\SLIDER_SHADER_CLK	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Localization\POL\Help\SLIDER_FAN_SPEED	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Localization\POL\Help\Properties\Screen capture\SCREEN_CAPTURE_QUALITY	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Localization\RUS\Help\TEXT_CORE_VOLTAGE	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Localization\RUS\Help\Properties\User interface\SHOW_HINTS	MSIAfterburnerSetup465Beta2.exe
File created	C:\Program Files (x86)\MSI Afterburner\Localization\SPA\Help\BUTTON_CLOSE	MSIAfterburnerSetup465Beta2.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA60.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1CDF.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20	msiexec.exe

Modifies registry class 57 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6E815EB96CCE9A53884E7857C57002F0\FT_VC_Redist_MFCLOC_x86 = "VC_Redist_12222_x86_enu"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RivaTuner.HardwareMonitoringLog\Shell	MSIAfterburner.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6E815EB96CCE9A53884E7857C57002F0\Servicing_Key	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6E815EB96CCE9A53884E7857C57002F0\FT_VC_Redist_CRT_x86 = "VC_Redist_12222_x86_enu"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RivaTuner.HardwareMonitoringLog\DefaultIcon\ = "C:\\Program Files (x86)\\MSI Afterburner\\MSIAfterburner.exe,0"	MSIAfterburner.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.MFCLOC,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32-policy" = 5300530073002b005a0066007a00250039003500390027006e006a004d0066002c00350072002700460054005f00560043005f005200650064006900730074005f004d00460043004c004f0043005f007800380036003e0042005b00240070007200510032006f004d003800720048007b00720067003d00320065006e002e0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\FT_VC_Redist_MFCLOC_x64 = "VC_Redist_12222_amd64_enu"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\67D6ECF5CD5FBA732B8B22BAC8DE1B4D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0\SourceList\Net\2 = "c:\\9907764eefac44fe9d3f\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.MFC,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64",type="win32-policy" = 3600540043006c0046002e005f007400740035006200290038002100600024004b005a0046006d00460054005f00560043005f005200650064006900730074005f004d00460043005f007800360034003e005e002a00320070005a00740060003f0050003500620061005700370038003400280076006c006b0000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.CRT,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64",type="win32" = 3600540043006c0046002e005f007400740035006200290038002100600024004b005a0046006d00460054005f00560043005f005200650064006900730074005f004300520054005f007800360034003e0028002e006f0034002e0054004c005e00690033005a00760060007d00610026003f0049002900260000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.OpenMP,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64",type="win32-policy" = 3600540043006c0046002e005f007400740035006200290038002100600024004b005a0046006d00460054005f00560043005f005200650064006900730074005f004f00700065006e004d0050005f007800360034003e007900700040005500210076003f005400490037006c007a004c00450075005a003d005a003100730000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.ATL,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32-policy" = 5300530073002b005a0066007a00250039003500390027006e006a004d0066002c00350072002700460054005f00560043005f005200650064006900730074005f00410054004c005f007800380036003e004e002e004b004300300068004d0064007b00340060006d002b00380039004f002e002e003100540000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.MFC,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64",type="win32" = 3600540043006c0046002e005f007400740035006200290038002100600024004b005a0046006d00460054005f00560043005f005200650064006900730074005f004d00460043005f007800360034003e00360057002e002700490055007a0028005000330071003f0064004c0051004e00440029002500290000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\VC_Redist_12222_amd64_enu	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RivaTuner.HardwareMonitoringLog\ = "RivaTuner hardware monitoring log file"	MSIAfterburner.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.OpenMP,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32" = 5300530073002b005a0066007a00250039003500390027006e006a004d0066002c00350072002700460054005f00560043005f005200650064006900730074005f004f00700065006e004d0050005f007800380036003e0032005f0072002700710025004a006a004a0034007600780044002800660049004c0067005a00780000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.MFCLOC,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32" = 5300530073002b005a0066007a00250039003500390027006e006a004d0066002c00350072002700460054005f00560043005f005200650064006900730074005f004d00460043004c004f0043005f007800380036003e0027002a005b0069005b00320062006e004100340070006b0046005d006b004b0057007e005800300000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\FT_VC_Redist_MFC_x64 = "VC_Redist_12222_amd64_enu"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.ATL,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64",type="win32" = 3600540043006c0046002e005f007400740035006200290038002100600024004b005a0046006d00460054005f00560043005f005200650064006900730074005f00410054004c005f007800360034003e0049005b00280055004d0049005b007600260036006a006d005f004f0071005400570060004100370000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.CRT,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64",type="win32-policy" = 3600540043006c0046002e005f007400740035006200290038002100600024004b005a0046006d00460054005f00560043005f005200650064006900730074005f004300520054005f007800360034003e002c007d0050004e002c00320065006e007a003300270070005b00550021006c004900720021006e0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.hml	MSIAfterburner.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.CRT,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32" = 5300530073002b005a0066007a00250039003500390027006e006a004d0066002c00350072002700460054005f00560043005f005200650064006900730074005f004300520054005f007800380036003e004b00520050005200400047006b006e005d0033003d002b004c00380047003600210061002e00490000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.CRT,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32-policy" = 5300530073002b005a0066007a00250039003500390027006e006a004d0066002c00350072002700460054005f00560043005f005200650064006900730074005f004300520054005f007800380036003e006f006f0063007b006200340036003f004500380042006a005f0079005d005d007e004f006f002c0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0\SourceList\LastUsedSource = "n;2;c:\\9907764eefac44fe9d3f\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RivaTuner.HardwareMonitoringLog\Shell\open	MSIAfterburner.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\FT_VC_Redist_CRT_x64 = "VC_Redist_12222_amd64_enu"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.hml\ = "RivaTuner.HardwareMonitoringLog"	MSIAfterburner.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6E815EB96CCE9A53884E7857C57002F0\FT_VC_Redist_MFC_x86 = "VC_Redist_12222_x86_enu"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\FT_VC_Redist_ATL_x64 = "VC_Redist_12222_amd64_enu"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\VC_RED_enu_amd64_net_SETUP	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\FT_VC_Redist_OpenMP_x64 = "VC_Redist_12222_amd64_enu"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.MFC,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32" = 5300530073002b005a0066007a00250039003500390027006e006a004d0066002c00350072002700460054005f00560043005f005200650064006900730074005f004d00460043005f007800380036003e00660074005a003f002800770035002b002e0034002c007e007b0044004700380037002b007800260000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.OpenMP,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64",type="win32" = 3600540043006c0046002e005f007400740035006200290038002100600024004b005a0046006d00460054005f00560043005f005200650064006900730074005f004f00700065006e004d0050005f007800360034003e0061005b0046005f0031006a0048006a005d003300680065005f004f005400590026006b003f00400000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RivaTuner.HardwareMonitoringLog	MSIAfterburner.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.MFC,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32-policy" = 5300530073002b005a0066007a00250039003500390027006e006a004d0066002c00350072002700460054005f00560043005f005200650064006900730074005f004d00460043005f007800380036003e005500410049003f00470048002e007b005d0037006a005a003f0034005d0041006e0062002400420000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\SourceList\LastUsedSource = "n;2;c:\\4fddc1cb775fc33478e5a9280e54bd42\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RivaTuner.HardwareMonitoringLog\Shell\open\command\ = "C:\\Program Files (x86)\\MSI Afterburner\\MSIAfterburner.exe \"%1\""	MSIAfterburner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RivaTuner.HardwareMonitoringLog\Shell\open\command	MSIAfterburner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6E815EB96CCE9A53884E7857C57002F0\VC_Redist_12222_x86_enu	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\Servicing_Key	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\SourceList\Net\2 = "c:\\4fddc1cb775fc33478e5a9280e54bd42\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6E815EB96CCE9A53884E7857C57002F0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6E815EB96CCE9A53884E7857C57002F0\VC_RED_enu_x86_net_SETUP	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6E815EB96CCE9A53884E7857C57002F0\FT_VC_Redist_ATL_x86 = "VC_Redist_12222_x86_enu"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6E815EB96CCE9A53884E7857C57002F0\FT_VC_Redist_OpenMP_x86 = "VC_Redist_12222_x86_enu"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.ATL,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64",type="win32-policy" = 3600540043006c0046002e005f007400740035006200290038002100600024004b005a0046006d00460054005f00560043005f005200650064006900730074005f00410054004c005f007800360034003e006a0068004f00670050007e006b003600580037002e00580036005000780024002e0028005f00530000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.MFCLOC,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64",type="win32" = 3600540043006c0046002e005f007400740035006200290038002100600024004b005a0046006d00460054005f00560043005f005200650064006900730074005f004d00460043004c004f0043005f007800360034003e0077006e002e005a006000290063004000760034003d004b002c0044004f00360056007e0028006e0000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.MFCLOC,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64",type="win32-policy" = 3600540043006c0046002e005f007400740035006200290038002100600024004b005a0046006d00460054005f00560043005f005200650064006900730074005f004d00460043004c004f0043005f007800360034003e004d0059006800540068002a003300600053003300260021006b00460048006f00490055007600570000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RivaTuner.HardwareMonitoringLog\DefaultIcon	MSIAfterburner.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.ATL,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32" = 5300530073002b005a0066007a00250039003500390027006e006a004d0066002c00350072002700460054005f00560043005f005200650064006900730074005f00410054004c005f007800380036003e00550029004600250024002a0025005a00370038002c005d007b002d007400430064004f003700310000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.OpenMP,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32-policy" = 5300530073002b005a0066007a00250039003500390027006e006a004d0066002c00350072002700460054005f00560043005f005200650064006900730074005f004f00700065006e004d0050005f007800380036003e00690060003700480050004400240062002400350035007e004a007b00730074007e0029006200780000000000	msiexec.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4844	msiexec.exe
4844	msiexec.exe
4844	msiexec.exe
4844	msiexec.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	968	install.exe
Token: SeIncreaseQuotaPrivilege	968	install.exe
Token: SeSecurityPrivilege	4844	msiexec.exe
Token: SeCreateTokenPrivilege	968	install.exe
Token: SeAssignPrimaryTokenPrivilege	968	install.exe
Token: SeLockMemoryPrivilege	968	install.exe
Token: SeIncreaseQuotaPrivilege	968	install.exe
Token: SeMachineAccountPrivilege	968	install.exe
Token: SeTcbPrivilege	968	install.exe
Token: SeSecurityPrivilege	968	install.exe
Token: SeTakeOwnershipPrivilege	968	install.exe
Token: SeLoadDriverPrivilege	968	install.exe
Token: SeSystemProfilePrivilege	968	install.exe
Token: SeSystemtimePrivilege	968	install.exe
Token: SeProfSingleProcessPrivilege	968	install.exe
Token: SeIncBasePriorityPrivilege	968	install.exe
Token: SeCreatePagefilePrivilege	968	install.exe
Token: SeCreatePermanentPrivilege	968	install.exe
Token: SeBackupPrivilege	968	install.exe
Token: SeRestorePrivilege	968	install.exe
Token: SeShutdownPrivilege	968	install.exe
Token: SeDebugPrivilege	968	install.exe
Token: SeAuditPrivilege	968	install.exe
Token: SeSystemEnvironmentPrivilege	968	install.exe
Token: SeChangeNotifyPrivilege	968	install.exe
Token: SeRemoteShutdownPrivilege	968	install.exe
Token: SeUndockPrivilege	968	install.exe
Token: SeSyncAgentPrivilege	968	install.exe
Token: SeEnableDelegationPrivilege	968	install.exe
Token: SeManageVolumePrivilege	968	install.exe
Token: SeImpersonatePrivilege	968	install.exe
Token: SeCreateGlobalPrivilege	968	install.exe
Token: SeRestorePrivilege	4844	msiexec.exe
Token: SeTakeOwnershipPrivilege	4844	msiexec.exe
Token: SeRestorePrivilege	4844	msiexec.exe
Token: SeTakeOwnershipPrivilege	4844	msiexec.exe
Token: SeRestorePrivilege	4844	msiexec.exe
Token: SeTakeOwnershipPrivilege	4844	msiexec.exe
Token: SeRestorePrivilege	4844	msiexec.exe
Token: SeTakeOwnershipPrivilege	4844	msiexec.exe
Token: SeRestorePrivilege	4844	msiexec.exe
Token: SeTakeOwnershipPrivilege	4844	msiexec.exe
Token: SeRestorePrivilege	4844	msiexec.exe
Token: SeTakeOwnershipPrivilege	4844	msiexec.exe
Token: SeRestorePrivilege	4844	msiexec.exe
Token: SeTakeOwnershipPrivilege	4844	msiexec.exe
Token: SeRestorePrivilege	4844	msiexec.exe
Token: SeTakeOwnershipPrivilege	4844	msiexec.exe
Token: SeRestorePrivilege	4844	msiexec.exe
Token: SeTakeOwnershipPrivilege	4844	msiexec.exe
Token: SeRestorePrivilege	4844	msiexec.exe
Token: SeTakeOwnershipPrivilege	4844	msiexec.exe
Token: SeRestorePrivilege	4844	msiexec.exe
Token: SeTakeOwnershipPrivilege	4844	msiexec.exe
Token: SeRestorePrivilege	4844	msiexec.exe
Token: SeTakeOwnershipPrivilege	4844	msiexec.exe
Token: SeRestorePrivilege	4844	msiexec.exe
Token: SeTakeOwnershipPrivilege	4844	msiexec.exe
Token: SeRestorePrivilege	4844	msiexec.exe
Token: SeTakeOwnershipPrivilege	4844	msiexec.exe
Token: SeRestorePrivilege	4844	msiexec.exe
Token: SeTakeOwnershipPrivilege	4844	msiexec.exe
Token: SeRestorePrivilege	4844	msiexec.exe
Token: SeTakeOwnershipPrivilege	4844	msiexec.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4496	MSIAfterburner.exe
3228	MSIAfterburner.exe
3228	MSIAfterburner.exe
3228	MSIAfterburner.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3384 wrote to memory of 2256	3384	MSIAfterburnerSetup465Beta2.exe	88
PID 3384 wrote to memory of 2256	3384	MSIAfterburnerSetup465Beta2.exe	88
PID 3384 wrote to memory of 2256	3384	MSIAfterburnerSetup465Beta2.exe	88
PID 2256 wrote to memory of 968	2256	vcredist_x86.exe	90
PID 2256 wrote to memory of 968	2256	vcredist_x86.exe	90
PID 2256 wrote to memory of 968	2256	vcredist_x86.exe	90
PID 3384 wrote to memory of 2752	3384	MSIAfterburnerSetup465Beta2.exe	93
PID 3384 wrote to memory of 2752	3384	MSIAfterburnerSetup465Beta2.exe	93
PID 3384 wrote to memory of 2752	3384	MSIAfterburnerSetup465Beta2.exe	93
PID 2752 wrote to memory of 2852	2752	vcredist_x64.exe	94
PID 2752 wrote to memory of 2852	2752	vcredist_x64.exe	94
PID 3384 wrote to memory of 4496	3384	MSIAfterburnerSetup465Beta2.exe	95
PID 3384 wrote to memory of 4496	3384	MSIAfterburnerSetup465Beta2.exe	95
PID 3384 wrote to memory of 4496	3384	MSIAfterburnerSetup465Beta2.exe	95
PID 3384 wrote to memory of 3228	3384	MSIAfterburnerSetup465Beta2.exe	96
PID 3384 wrote to memory of 3228	3384	MSIAfterburnerSetup465Beta2.exe	96
PID 3384 wrote to memory of 3228	3384	MSIAfterburnerSetup465Beta2.exe	96

C:\Users\Admin\AppData\Local\Temp\MSIAfterburnerSetup465Beta2.exe
"C:\Users\Admin\AppData\Local\Temp\MSIAfterburnerSetup465Beta2.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3384
- C:\Program Files (x86)\MSI Afterburner\Redist\vcredist_x86.exe
  "C:\Program Files (x86)\MSI Afterburner\Redist\vcredist_x86.exe" /Q
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2256
- - \??\c:\9907764eefac44fe9d3f\install.exe
    c:\9907764eefac44fe9d3f\.\install.exe /Q
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:968
- C:\Program Files (x86)\MSI Afterburner\Redist\vcredist_x64.exe
  "C:\Program Files (x86)\MSI Afterburner\Redist\vcredist_x64.exe" /Q
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2752
- - \??\c:\4fddc1cb775fc33478e5a9280e54bd42\install.exe
    c:\4fddc1cb775fc33478e5a9280e54bd42\.\install.exe /Q
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2852
- C:\Program Files (x86)\MSI Afterburner\MSIAfterburner.exe
  "C:\Program Files (x86)\MSI Afterburner\MSIAfterburner.exe" /LANG
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:4496
- C:\Program Files (x86)\MSI Afterburner\MSIAfterburner.exe
  "C:\Program Files (x86)\MSI Afterburner\MSIAfterburner.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:3228

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4844

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\4fddc1cb775fc33478e5a9280e54bd42\install.exe

Filesize
834KB

MD5
f0995d5ebde916fa146f51d324cf410c

SHA1
6a03e96a663051683b82601b5c7be72d72ecdb1c

SHA256
f0110ab02e8a531e3e7d196c03f907c659e6262c75861dc0c8d05f6a3ccbdd6b

SHA512
8a2ca604c06077a1c5a7ac9782ff6815a4ea1b152502707120cf5a8edddcda7c8d1a71e16c80305a3fa098acb6ecf158c770e6d0a9cb2e57a9d875fb935664b8

Download Submit
C:\4fddc1cb775fc33478e5a9280e54bd42\install.res.1033.dll

Filesize
84KB

MD5
e8ed5b7797472df6f5e1dae87c123e5e

SHA1
71e203899c3faf5e9eb5543bfd0eb748b78da566

SHA256
6ad479dd35201c74092068cccd6d12fd84a45d2c04e927b39901a9126f9e06dd

SHA512
dfdd6bba404753f6afbc804551550bdc771eccc034c01f4c5149beb6d98424cf7b86fc63aac361a1840df9bc8365c726baab672055534620db70ca2c0e2e1b3e

Download Submit
C:\9907764eefac44fe9d3f\install.exe

Filesize
547KB

MD5
4138c31964fbcb3b7418e086933324c3

SHA1
97cc6f58fb064ab6c4a2f02fb665fef77d30532f

SHA256
b72056fc3df6f46069294c243fe5006879bf4a9d8eef388369a590ca41745f29

SHA512
40cf2f35c3a944fca93d58d66465f0308197f5485381ff07d3065e0f59e94fc3834313068e4e5e5da395413ff2d3d1c3ff6fa050f2256e118972bf21a5643557

Download Submit
C:\9907764eefac44fe9d3f\install.res.1033.dll

Filesize
85KB

MD5
ff6003014eefc9c30abe20e3e1f5fbe8

SHA1
4a5bd05f94545f01efc10232385b8fecad300678

SHA256
a522c5ea3250cdd538a9ce7b4a06dfd5123e7eb05eef67509f2b975a8e1d3067

SHA512
3adc5c705bab7fa7b50517a5eb3301491f5150b56e1088ed436590458e963da204cd1875af75db89742403476a56a94c3f425c05327767bdb4bbee4859667ac2

Download Submit
C:\Program Files (x86)\MSI Afterburner\Redist\vcredist_x64.exe

Filesize
5.0MB

MD5
e2ada570911edaaae7d1b3c979345fce

SHA1
a7c83077b8a28d409e36316d2d7321fa0ccdb7e8

SHA256
b811f2c047a3e828517c234bd4aa4883e1ec591d88fad21289ae68a6915a6665

SHA512
b890d83d36f3681a690828d8926139b4f13f8d2fcd258581542cf2fb7dce5d7e7e477731c9545a54a476ed5c2aaac44ce12d2c3d9b99c2c1c04a5ab4ee20c4b8

Download Submit
C:\Program Files (x86)\MSI Afterburner\Redist\vcredist_x64.exe

Filesize
5.0MB

MD5
e2ada570911edaaae7d1b3c979345fce

SHA1
a7c83077b8a28d409e36316d2d7321fa0ccdb7e8

SHA256
b811f2c047a3e828517c234bd4aa4883e1ec591d88fad21289ae68a6915a6665

SHA512
b890d83d36f3681a690828d8926139b4f13f8d2fcd258581542cf2fb7dce5d7e7e477731c9545a54a476ed5c2aaac44ce12d2c3d9b99c2c1c04a5ab4ee20c4b8

Download Submit
C:\Program Files (x86)\MSI Afterburner\Redist\vcredist_x86.exe

Filesize
4.3MB

MD5
35da2bf2befd998980a495b6f4f55e60

SHA1
470640aa4bb7db8e69196b5edb0010933569e98d

SHA256
6b3e4c51c6c0e5f68c8a72b497445af3dbf976394cbb62aa23569065c28deeb6

SHA512
bf630667c87b8f10ef85b61f2f379d7ce24124618b999babfec8e2df424eb494b8f1bf0977580810dff5124d4dbdec9539ff53e0dc14625c076fa34dfe44e3f2

Download Submit
C:\Program Files (x86)\MSI Afterburner\Redist\vcredist_x86.exe

Filesize
4.3MB

MD5
35da2bf2befd998980a495b6f4f55e60

SHA1
470640aa4bb7db8e69196b5edb0010933569e98d

SHA256
6b3e4c51c6c0e5f68c8a72b497445af3dbf976394cbb62aa23569065c28deeb6

SHA512
bf630667c87b8f10ef85b61f2f379d7ce24124618b999babfec8e2df424eb494b8f1bf0977580810dff5124d4dbdec9539ff53e0dc14625c076fa34dfe44e3f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI1FEE.txt

Filesize
1KB

MD5
a109f324980be407d7475460901d33d9

SHA1
a15356bfaeed2e122f4f8c9d747a8174d861d98f

SHA256
f9d0e31ba30f0ff69fe31ee6f4ae2b4987a9db1cd4153a5886b5e39e47066fb3

SHA512
08b3c98d118f1d4a52a9d20828d0389940b705d5af37a5ea7539137ea173eb9612b8445551936d96476556b8cf07f75f0800719d39e310fb059a79dd9cb21b51

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI1FFE.txt

Filesize
1KB

MD5
8b80851e5010fe4a507abc4ae6d873bf

SHA1
e911cfb8d066150f9fae908f826bc5bd4c541ceb

SHA256
8f951c2a39932e032523325fddf33b18d1879e19a7bfe075b03465fee40a3f20

SHA512
ecfa0a255d67bb02b90aa93763fc3be4ddf4c6af44723bee2d560b5866ebd9b40862c2914e39bb52656fd8c4d583ab6394aee401222c3cb01d22b10ea67e3678

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc73BF.tmp\LangDLL.dll

Filesize
5KB

MD5
08de81a4584f5201086f57a7a93ed83b

SHA1
266a6ecc8fb7dca115e6915cd75e2595816841a8

SHA256
4883cd4231744be2dca4433ef62824b7957a3c16be54f8526270402d9413ebe6

SHA512
b72e7cea5ce1f4dc64e65a1f683a3ef9e3fa2dc45cf421f569eb461f1fdcc0caf4ff62a872e62b400579f567c6ff9fc3c2e6e020cdca89d96015502c803a09b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc73BF.tmp\StartMenu.dll

Filesize
7KB

MD5
6581c243481c0ba91ec1bd9fd93f1c30

SHA1
b00b7fe38b0dbf5576239a8f62f01df7fb993e5d

SHA256
72fa1a91185fda8b68a49b9ebb8d5ddf00f899f590d1e657a58c229f9bd0a700

SHA512
c882c15e1222929369753addb023fe028dd95345c0b29a5a8c0ba00cbdee45f3a7aacafd9d4cdc5fe86e3676ba958abf841801d73361c4630e7f48ab63725055

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc73BF.tmp\System.dll

Filesize
12KB

MD5
6e55a6e7c3fdbd244042eb15cb1ec739

SHA1
070ea80e2192abc42f358d47b276990b5fa285a9

SHA256
acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506

SHA512
2d504b74da38edc967e3859733a2a9cacd885db82f0ca69bfb66872e882707314c54238344d45945dc98bae85772aceef71a741787922d640627d3c8ae8f1c35

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc73BF.tmp\nsDialogs.dll

Filesize
9KB

MD5
ca5bb0ee2b698869c41c087c9854487c

SHA1
4a8abbb2544f1a9555e57a142a147dfeb40c4ca4

SHA256
c719697d5ced17d97bbc48662327339ccec7e03f6552aa1d5c248f6fa5f16324

SHA512
363a80843d7601ba119bc981c4346188f490b388e3ed390a0667aaf5138b885eec6c69d4e7f60f93b069d6550277f4c926bd0f37bc893928111dc62494124770

Download Submit
\??\c:\4fddc1cb775fc33478e5a9280e54bd42\eula.1028.txt

Filesize
3KB

MD5
f187c4924020065b61ec9ef8eb482415

SHA1
280fc99fb90f10a41461a8ee33dbfba5f02d059d

SHA256
cfa4f2c6c2a8f86896c5a6f9a16e81932734136c3dfde6b4ed44735e9c8115c2

SHA512
1d5a8e80fb6805577258f87c4efd7c26a9ac1c69f7dea1553d6f26bcc462d2d9c01d4b94077f70110a33b39648c9aa3bb685e10534f19ba832d475e9ee6aa743

Download Submit
\??\c:\4fddc1cb775fc33478e5a9280e54bd42\eula.1031.txt

Filesize
15KB

MD5
3168ed3b48c1dc8d373c2abc036574cf

SHA1
7ffbcfb6cd9b262a0e9a55853d76055693f60c60

SHA256
3e4d78fcc11eecb23af12a4eaa316114bb36d39561f6062a3921c08a43261321

SHA512
9465640705c382bb736e468a2ffb303ecfb2637c55ddca759d1fb190279b98103def64a8c599deaa1439e58c41d7b2c2809332c2a5f18945e9ee3d6c046a5197

Download Submit
\??\c:\4fddc1cb775fc33478e5a9280e54bd42\eula.1033.txt

Filesize
9KB

MD5
162fc8231b1bd62f1d24024bb70140d5

SHA1
7fa4601390f1a69b4824ee1334bee772c2941a24

SHA256
c68a0fd93e8c64139a42af4fcd4670c6faea3a5d5d1e9dd35b197f7d5268d92b

SHA512
a707b5ef0e914ba61e815be5224831441922ed8d933f7a2ffe8aecf41f5a1790a1e45981f19d86aa5eab5ea73d03b0c8e2ab6b9f398ab0154d1c828da6f6beda

Download Submit
\??\c:\4fddc1cb775fc33478e5a9280e54bd42\eula.1036.txt

Filesize
11KB

MD5
c360851dfdf51b6ddc9cfcc62c584898

SHA1
f8fbe6b98039d01700dc49eb454bb1c1d8cc4aa6

SHA256
3456ebc9c6decef8b27b10d97f7f6d30a73b5da0024e1b8a0657e3b9a1cc93d9

SHA512
a340a7d98b4b6f925a803805224e733433e76230a36c4ab17e28f9d5951b81280d776153414701b29bb05b496b726932683e35fb603587d7ff5b716a88fece8d

Download Submit
\??\c:\4fddc1cb775fc33478e5a9280e54bd42\eula.1040.txt

Filesize
13KB

MD5
04b833156f39fcc4cee4ae7a0e7224a1

SHA1
2ffa9577a21962532c26819f9f1e8cd71ab396bd

SHA256
ebafaeb37464ed00e579dab5b573908e026cd0e3444079f398aada13fa9a6f66

SHA512
8d3f6a900ebd63a3af74ab41ac54d3041de5fe47331a5e0d442d1707f72a8f557d93d2f527bbb857fb1c67dd8332961fd69acc87de81ba4f2006c37b575f9608

Download Submit
\??\c:\4fddc1cb775fc33478e5a9280e54bd42\eula.1041.txt

Filesize
5KB

MD5
031fab3fb14a85334e7e49d62a5179fe

SHA1
12370185ef938a791609602245372e3e70db31be

SHA256
467773ddffdb3f31027595313b70d1ea934c828b124d1063a4aa4dbe90f15961

SHA512
7424a52bbb18a006816ee544d47f660e086557d13bb587d765631307da96aba56d8b9cd3d4e7d50c2a791815273910cef95ebe928bc03dd9c540b97ac7a86447

Download Submit
\??\c:\4fddc1cb775fc33478e5a9280e54bd42\eula.1042.txt

Filesize
5KB

MD5
6fcd6b5ef928a75655d6be51555288c7

SHA1
eafdcc178343780b83f1280dad9d517aaedab9e4

SHA256
3d45f022996cd6d9ebb659a202fbfd099795f9a39ed4e6bbd62ac6f6ed5f8c7b

SHA512
635ba44d8d8ecfbdb83a88688126f68c9c607e452e67d19247dfe7c307c341dad9b1d2dc3eae56311c4b3e9617ab1ee2bd2a908570df632af6de1e1fa08bf905

Download Submit
\??\c:\4fddc1cb775fc33478e5a9280e54bd42\eula.1049.txt

Filesize
13KB

MD5
bc3a8865b60ec692293679e3e400fd58

SHA1
2b43b69e6158f307fb60c47a70a606cd7e295341

SHA256
f82bca639841fa7387ae9bbf9eca33295fab20fade57496e458152068c06f8a3

SHA512
0d9820416802623e7cd5539d75871447f665481b81758c08f392f412bc0fd2ef12008be0960c108d1c1ce6f26422f1b16161705104d7a582df6a1006b0d1b610

Download Submit
\??\c:\4fddc1cb775fc33478e5a9280e54bd42\eula.3082.txt

Filesize
12KB

MD5
c2d1221cd1c783b5d58b150f2d51aebf

SHA1
3bc9b6419a5f9dcf9064ae9ef3a76c699e750a60

SHA256
c79ff7b9e67aed57f939343a3d5fd4fb01aa7412530693464571148b893b7132

SHA512
c4ec596814b408e3c0aaf98864e2769c6175dba020f3014dd79f0190d81812020c932afca449e6b8b35233f36f2ab2efad0dc8d0d68dccdb40f6715fb1d050b4

Download Submit
\??\c:\4fddc1cb775fc33478e5a9280e54bd42\globdata.ini

Filesize
1KB

MD5
0a6b586fabd072bd7382b5e24194eac7

SHA1
60e3c7215c1a40fbfb3016d52c2de44592f8ca95

SHA256
7912e3fcf2698cf4f8625e563cd8215c6668739cae18bd6f27af2d25bec5c951

SHA512
b96b0448e9f0e94a7867b6bb103979e9ef2c0e074bcb85988d450d63de6edcf21dc83bb154aafb7de524af3c3734f0bb1ba649db0408612479322e1aa85be9f4

Download Submit
\??\c:\4fddc1cb775fc33478e5a9280e54bd42\install.exe

Filesize
834KB

MD5
f0995d5ebde916fa146f51d324cf410c

SHA1
6a03e96a663051683b82601b5c7be72d72ecdb1c

SHA256
f0110ab02e8a531e3e7d196c03f907c659e6262c75861dc0c8d05f6a3ccbdd6b

SHA512
8a2ca604c06077a1c5a7ac9782ff6815a4ea1b152502707120cf5a8edddcda7c8d1a71e16c80305a3fa098acb6ecf158c770e6d0a9cb2e57a9d875fb935664b8

Download Submit
\??\c:\4fddc1cb775fc33478e5a9280e54bd42\install.ini

Filesize
841B

MD5
f8f6c0e030cb622f065fe47d61da91d7

SHA1
cf6fa99747de8f35c6aea52df234c9c57583baa3

SHA256
c16727881c47a40077dc5a1f1ea71cbb28e3f4e156c0ae7074c6d7f5ecece21d

SHA512
b70c6d67dac5e6a0dbd17e3bcf570a95914482abad20d0304c02da22231070b4bc887720dbae972bc5066457e1273b68fde0805f1c1791e9466a5ca343485cde

Download Submit
\??\c:\4fddc1cb775fc33478e5a9280e54bd42\install.res.1028.dll

Filesize
70KB

MD5
d75cebdd99c3c2562ae2cbbb6a8b62e0

SHA1
0dcc32820df90db71429e6e91f962d94584313c4

SHA256
3b603f4847c32f21b4dfc949052ebadb0b191f6caac373e4936e47b27b96cd7a

SHA512
aad9ce212700b0135f230f4f8b48c2abf2516502b01c2a428f8e4177df1dbbd77e904892202fd257a9c8f97039c1caedb6f72103089ce2402a7868465729f58f

Download Submit
\??\c:\4fddc1cb775fc33478e5a9280e54bd42\install.res.1031.dll

Filesize
89KB

MD5
f937d452e3f75ea9c9983b5674793275

SHA1
2d6e30b23ccec84f0754cfc4c90ae909768f14bd

SHA256
a2b2334a1dcfd2eefdda5a1c357ca0a256c55c92a94f84204f8e2d6ca4e0bd82

SHA512
65a0753be4dc25be41eebcf3d55dfdae1dc8d69132d8c02bd0d5cea2c8e963e3bfdc562b6182f8ddadb72801bfb5d911314a292a47269e9c51ec2d7bb34abbfc

Download Submit
\??\c:\4fddc1cb775fc33478e5a9280e54bd42\install.res.1033.dll

Filesize
84KB

MD5
e8ed5b7797472df6f5e1dae87c123e5e

SHA1
71e203899c3faf5e9eb5543bfd0eb748b78da566

SHA256
6ad479dd35201c74092068cccd6d12fd84a45d2c04e927b39901a9126f9e06dd

SHA512
dfdd6bba404753f6afbc804551550bdc771eccc034c01f4c5149beb6d98424cf7b86fc63aac361a1840df9bc8365c726baab672055534620db70ca2c0e2e1b3e

Download Submit
\??\c:\4fddc1cb775fc33478e5a9280e54bd42\install.res.1036.dll

Filesize
90KB

MD5
b129551419e06befddaa3c38354ffc2a

SHA1
9896b9d778911e6f8bf5896160a5ce322b1e7b62

SHA256
87700397b469cb0ea59ae6534370218c42c9b9fba636741612a5300dd72ff530

SHA512
15de906c4a70b47bbcc0bcd5ab9dab9eabd746207b40957c00cba4fe328a310672d04868672a9e70986befe00f393e4b21420ea2cbccd1c18e1fa97a3d74b9b5

Download Submit
\??\c:\4fddc1cb775fc33478e5a9280e54bd42\install.res.1040.dll

Filesize
88KB

MD5
21b98229cf651ae83f213b6bf55f9660

SHA1
3a1a5e800194bf0889a2fb73f9f08f815d036556

SHA256
128b2be768e20129142af7f319cf7a761ead35ff311623d128a7b372033b9122

SHA512
0a1b8ca0469e322b9fdc0dbe4de8bb45ced13ff97ef156d3c84787cfbcb6264ccb46ef26fd135bfb848425aa77e3430a91b8753c8e1af1778880eddc3ff0b0fc

Download Submit
\??\c:\4fddc1cb775fc33478e5a9280e54bd42\install.res.1041.dll

Filesize
75KB

MD5
7cec13259a3b49959bef5856c3985458

SHA1
42f7a813a9175a4ea7e64800affc3a2043f1c201

SHA256
58a7d64dd55d6057e19c039abb1508920f6a33940f4612ac55a90fb74dfca28a

SHA512
13b272a062173f76a5c8b4c193abe67cb1c066e8a7f030177f4b26043c8f3824ba6da9c2cd9bb779330fc72c535d893f668fa186bf395864f1fcc021ae3f9dc8

Download Submit
\??\c:\4fddc1cb775fc33478e5a9280e54bd42\install.res.1042.dll

Filesize
73KB

MD5
37723237b2d38c4a4c996a91fd2da0a5

SHA1
b6f267299e309d0a39b359c19296598e4c23f93c

SHA256
05e79bf81fe87ba3db89950cea02ae78e3b7b1c2d6575f19df47c4f5d7888566

SHA512
9c4ac383f60829a56c1e2fc77b92db0325658b048271269eea7bf5a552a21222757852776b79b17b190d2961c0306ee2f9d8ad3a51aa58d1daca842ea6975d8c

Download Submit
\??\c:\4fddc1cb775fc33478e5a9280e54bd42\install.res.1049.dll

Filesize
86KB

MD5
9536e2675dde8f2d6ea8c8e26b232f23

SHA1
4efa83f14458e3514a3ac3b1cdc2ae388bc78430

SHA256
386f3b2c5b6316963f353cf2bb3dba69ff6e82e2166c010a87813dd54637a49c

SHA512
e31ea9444263833ceedcc9f036cff5eab88f710716b7ddf2d25c98aa088454258c3f34fc664b39da084b2650aade89ff1369e240d1935697bb6949af828a5542

Download Submit
\??\c:\4fddc1cb775fc33478e5a9280e54bd42\install.res.2052.dll

Filesize
69KB

MD5
d442fdaee21df6d1f8d3f5b37fce69a3

SHA1
978b32638c9a88f47b55ca6b52f510ed7babc1d6

SHA256
8eb88b40484b34fc712fae8a31a5e35042712ae57c9dddefd1e5746d949d5a03

SHA512
bbe32be6853400a9afb649a536b0a16524b06fdd6d8e5455ec387e3eced02172a9f5494b431deb90feb16ce73e67d3c11b56b43148c2936ed39e35077eb0bd15

Download Submit
\??\c:\4fddc1cb775fc33478e5a9280e54bd42\install.res.3082.dll

Filesize
89KB

MD5
cc0e0618dcd3275de406316091806f77

SHA1
1ee7e9c4515ff276e2e91777b61e10d7fd74b6b3

SHA256
847bb5d0992fdbcfb90e00ba66fbe8992926d5d5b9b03f3cf1888ee8af600cf8

SHA512
140684e5e7541e40384441917f3d727f4385b5b4552821ed2e766b7abe4660c9c94084a0a1da1aa95afac83ca1b465b1363640eaef0e905a402aad88f09f8072

Download Submit
\??\c:\4fddc1cb775fc33478e5a9280e54bd42\vc_red.msi

Filesize
230KB

MD5
4aa5bbddbf6b2d1cf509c566312f1203

SHA1
0557e25cf4c2aa1bcb170707cd282ae864d93d17

SHA256
017e62a7a046acf00f5565e60f8eed4c5f409913e7ddc2f431d4236bbfdabab8

SHA512
e32fad32aefb70592eec56c55eaf65d6a6ed33939a6cabe7ff0ec33f91c4687001a41575ccfcac448c4739b2af4e309c2ec9e526104fb292d04aa8746dfad8f9

Download Submit
\??\c:\9907764eefac44fe9d3f\VC_RED.cab

Filesize
3.7MB

MD5
0ee84ab717bc400c5e96c8d9d329fbb0

SHA1
be4ba7bbb068c7256b70f4fd7634eaeb2ad04d0a

SHA256
461d575bc1a07f64c14f1da885d2f310bd282cbbedcd0a5cf8ffa7057411805d

SHA512
4a6b0619f471a51df09fb6c1eff4ed166cdb7ef57f79ffdf709fa952a7c2a176c338084689c8ace1a94024a24579e9ee0ab6d411c25a1b42b0f517c57749d1a2

Download Submit
\??\c:\9907764eefac44fe9d3f\eula.1028.txt

Filesize
3KB

MD5
f187c4924020065b61ec9ef8eb482415

SHA1
280fc99fb90f10a41461a8ee33dbfba5f02d059d

SHA256
cfa4f2c6c2a8f86896c5a6f9a16e81932734136c3dfde6b4ed44735e9c8115c2

SHA512
1d5a8e80fb6805577258f87c4efd7c26a9ac1c69f7dea1553d6f26bcc462d2d9c01d4b94077f70110a33b39648c9aa3bb685e10534f19ba832d475e9ee6aa743

Download Submit
\??\c:\9907764eefac44fe9d3f\eula.1031.txt

Filesize
15KB

MD5
3168ed3b48c1dc8d373c2abc036574cf

SHA1
7ffbcfb6cd9b262a0e9a55853d76055693f60c60

SHA256
3e4d78fcc11eecb23af12a4eaa316114bb36d39561f6062a3921c08a43261321

SHA512
9465640705c382bb736e468a2ffb303ecfb2637c55ddca759d1fb190279b98103def64a8c599deaa1439e58c41d7b2c2809332c2a5f18945e9ee3d6c046a5197

Download Submit
\??\c:\9907764eefac44fe9d3f\eula.1033.txt

Filesize
9KB

MD5
162fc8231b1bd62f1d24024bb70140d5

SHA1
7fa4601390f1a69b4824ee1334bee772c2941a24

SHA256
c68a0fd93e8c64139a42af4fcd4670c6faea3a5d5d1e9dd35b197f7d5268d92b

SHA512
a707b5ef0e914ba61e815be5224831441922ed8d933f7a2ffe8aecf41f5a1790a1e45981f19d86aa5eab5ea73d03b0c8e2ab6b9f398ab0154d1c828da6f6beda

Download Submit
\??\c:\9907764eefac44fe9d3f\eula.1036.txt

Filesize
11KB

MD5
c360851dfdf51b6ddc9cfcc62c584898

SHA1
f8fbe6b98039d01700dc49eb454bb1c1d8cc4aa6

SHA256
3456ebc9c6decef8b27b10d97f7f6d30a73b5da0024e1b8a0657e3b9a1cc93d9

SHA512
a340a7d98b4b6f925a803805224e733433e76230a36c4ab17e28f9d5951b81280d776153414701b29bb05b496b726932683e35fb603587d7ff5b716a88fece8d

Download Submit
\??\c:\9907764eefac44fe9d3f\eula.1040.txt

Filesize
13KB

MD5
04b833156f39fcc4cee4ae7a0e7224a1

SHA1
2ffa9577a21962532c26819f9f1e8cd71ab396bd

SHA256
ebafaeb37464ed00e579dab5b573908e026cd0e3444079f398aada13fa9a6f66

SHA512
8d3f6a900ebd63a3af74ab41ac54d3041de5fe47331a5e0d442d1707f72a8f557d93d2f527bbb857fb1c67dd8332961fd69acc87de81ba4f2006c37b575f9608

Download Submit
\??\c:\9907764eefac44fe9d3f\eula.1041.txt

Filesize
5KB

MD5
031fab3fb14a85334e7e49d62a5179fe

SHA1
12370185ef938a791609602245372e3e70db31be

SHA256
467773ddffdb3f31027595313b70d1ea934c828b124d1063a4aa4dbe90f15961

SHA512
7424a52bbb18a006816ee544d47f660e086557d13bb587d765631307da96aba56d8b9cd3d4e7d50c2a791815273910cef95ebe928bc03dd9c540b97ac7a86447

Download Submit
\??\c:\9907764eefac44fe9d3f\eula.1042.txt

Filesize
5KB

MD5
6fcd6b5ef928a75655d6be51555288c7

SHA1
eafdcc178343780b83f1280dad9d517aaedab9e4

SHA256
3d45f022996cd6d9ebb659a202fbfd099795f9a39ed4e6bbd62ac6f6ed5f8c7b

SHA512
635ba44d8d8ecfbdb83a88688126f68c9c607e452e67d19247dfe7c307c341dad9b1d2dc3eae56311c4b3e9617ab1ee2bd2a908570df632af6de1e1fa08bf905

Download Submit
\??\c:\9907764eefac44fe9d3f\eula.1049.txt

Filesize
13KB

MD5
bc3a8865b60ec692293679e3e400fd58

SHA1
2b43b69e6158f307fb60c47a70a606cd7e295341

SHA256
f82bca639841fa7387ae9bbf9eca33295fab20fade57496e458152068c06f8a3

SHA512
0d9820416802623e7cd5539d75871447f665481b81758c08f392f412bc0fd2ef12008be0960c108d1c1ce6f26422f1b16161705104d7a582df6a1006b0d1b610

Download Submit
\??\c:\9907764eefac44fe9d3f\eula.2052.txt

Filesize
3KB

MD5
ec4b365a67e7d7db46f095f1b3dcb046

SHA1
d4506530b132ef4aad51fcbc0315dadc110c9b81

SHA256
744275c515354ece1a997dd510f0b3ea607147bbf2b7d73f8fca61839675ba27

SHA512
5e5d1e196fc6ac194589bc6c6ab24e259aed8cbd856999390495fd5ec4211f212c6898e1b63538bfbb4401a5b4da08f3a2e09bca1cfb2e9c2cee38e63190b2a2

Download Submit
\??\c:\9907764eefac44fe9d3f\eula.3082.txt

Filesize
12KB

MD5
c2d1221cd1c783b5d58b150f2d51aebf

SHA1
3bc9b6419a5f9dcf9064ae9ef3a76c699e750a60

SHA256
c79ff7b9e67aed57f939343a3d5fd4fb01aa7412530693464571148b893b7132

SHA512
c4ec596814b408e3c0aaf98864e2769c6175dba020f3014dd79f0190d81812020c932afca449e6b8b35233f36f2ab2efad0dc8d0d68dccdb40f6715fb1d050b4

Download Submit
\??\c:\9907764eefac44fe9d3f\globdata.ini

Filesize
1KB

MD5
0a6b586fabd072bd7382b5e24194eac7

SHA1
60e3c7215c1a40fbfb3016d52c2de44592f8ca95

SHA256
7912e3fcf2698cf4f8625e563cd8215c6668739cae18bd6f27af2d25bec5c951

SHA512
b96b0448e9f0e94a7867b6bb103979e9ef2c0e074bcb85988d450d63de6edcf21dc83bb154aafb7de524af3c3734f0bb1ba649db0408612479322e1aa85be9f4

Download Submit
\??\c:\9907764eefac44fe9d3f\install.exe

Filesize
547KB

MD5
4138c31964fbcb3b7418e086933324c3

SHA1
97cc6f58fb064ab6c4a2f02fb665fef77d30532f

SHA256
b72056fc3df6f46069294c243fe5006879bf4a9d8eef388369a590ca41745f29

SHA512
40cf2f35c3a944fca93d58d66465f0308197f5485381ff07d3065e0f59e94fc3834313068e4e5e5da395413ff2d3d1c3ff6fa050f2256e118972bf21a5643557

Download Submit
\??\c:\9907764eefac44fe9d3f\install.ini

Filesize
841B

MD5
f8f6c0e030cb622f065fe47d61da91d7

SHA1
cf6fa99747de8f35c6aea52df234c9c57583baa3

SHA256
c16727881c47a40077dc5a1f1ea71cbb28e3f4e156c0ae7074c6d7f5ecece21d

SHA512
b70c6d67dac5e6a0dbd17e3bcf570a95914482abad20d0304c02da22231070b4bc887720dbae972bc5066457e1273b68fde0805f1c1791e9466a5ca343485cde

Download Submit
\??\c:\9907764eefac44fe9d3f\install.res.1028.dll

Filesize
71KB

MD5
8c2c1df03574e935277addc6e151bdbe

SHA1
33f7eae718d6704ea99d7c7803207dbe0d1ea3a0

SHA256
1074252f76e72e59a9da9d7e109c80ab131d53554c49cb3d69a180729bffc18e

SHA512
735c438da7fd3e4e0e4738ac11c87a73ce3cacbaa24b21994ec76868e70fc485469337eb6e067e20bb92210995ffb3c385677fcc986c4c34f24bfde6b91ba0c8

Download Submit
\??\c:\9907764eefac44fe9d3f\install.res.1031.dll

Filesize
90KB

MD5
6f22a8ecc5a917c61f1478ef4ad53949

SHA1
180c370698091e53f203d23eb6c839467deebfb9

SHA256
2c5fa53e6eb07bddc22c7c5203ff7bbe707c4cf8803f144ceb031384b59831aa

SHA512
8513f09da143983d436368c6067a62f1829d5d66776a168026f7562f8337d8e1bc8df2ff9ab421f4cc7d75757a0e9b8a75f3761c9e8aba7d0785d2fcb1b00a93

Download Submit
\??\c:\9907764eefac44fe9d3f\install.res.1033.dll

Filesize
85KB

MD5
ff6003014eefc9c30abe20e3e1f5fbe8

SHA1
4a5bd05f94545f01efc10232385b8fecad300678

SHA256
a522c5ea3250cdd538a9ce7b4a06dfd5123e7eb05eef67509f2b975a8e1d3067

SHA512
3adc5c705bab7fa7b50517a5eb3301491f5150b56e1088ed436590458e963da204cd1875af75db89742403476a56a94c3f425c05327767bdb4bbee4859667ac2

Download Submit
\??\c:\9907764eefac44fe9d3f\install.res.1036.dll

Filesize
91KB

MD5
4d431f94a7d0945f4a7f13b7988632aa

SHA1
61461b14b57382eebb3bf4621b7dadb0cb2475b3

SHA256
cb38381c0afdcb3465f71699addad7534ffd72702907b017708eba463dbc68b6

SHA512
e4197801c20dfce7dc14d5d74aa572de18954dceaaca77a75bf989427c6ff7d5889085e5c325376a993ad290ee43ab25e0f6bea074fed3d5158e0fd4c785aeca

Download Submit
\??\c:\9907764eefac44fe9d3f\install.res.1040.dll

Filesize
89KB

MD5
ef1ccfe8572cdaaefb1940efbbff6d80

SHA1
b1d587c8fdb3ca82c320d08379ca7bd781253e3f

SHA256
709ab0139c643b78c2dace7a35b9801e1a4b4e4c4e176c0d00f1b55a2a71d7a8

SHA512
98538c82d56b6e0e9f0ca7cf47a6ce57e0acd18b2a64b90304a95a3c7270920efb835731272200afa16e45dfd461df94f95da04f39c2436915dc6969a4a0ebce

Download Submit
\??\c:\9907764eefac44fe9d3f\install.res.1041.dll

Filesize
76KB

MD5
6bfb58958d58bf38e9242b2056392b8c

SHA1
f4c4653e061eb903ddae29f0d6a798db6ab5bdf4

SHA256
f74006aaa2a19777fb0c3b81321aabf00d87107dc23ba0d2282092502e5cd332

SHA512
672727552812c7d7b775896096d556851d6990b2d9c24c0e2c728f6c720b47c156d2ec2ce7ef23126fd222178969aff848f06568f695d154d6f7836ecf222d88

Download Submit
\??\c:\9907764eefac44fe9d3f\install.res.1042.dll

Filesize
74KB

MD5
ba91e387d54b94689644ebd23ff264ba

SHA1
267b0af1774b6440cac00fad6524f277fde09457

SHA256
16fed8f279b0240f63dd90925150cd37782e9395af32a2693bdc0533c0809767

SHA512
79e818ffc57880a9881d771c0ea607d64a2cbdad29b28a270138d4d03edb8b026e7536e89396968c8454c56c740d198e67a75cac3e2447ca120b7cffefa4c0bd

Download Submit
\??\c:\9907764eefac44fe9d3f\install.res.1049.dll

Filesize
87KB

MD5
9aac6ce2ad6c7aee5481e46ddb0ad0dd

SHA1
dabd5e299a4595b1341f47313ac26c663d79a7c4

SHA256
3de25f7b3fd91a8d5b7f7dd8eccf44e24b33b66133fc89519d21a426b489374e

SHA512
97e00a50d3e8c8954854cc44f36049d63d8f1860e547a511feccf4214ff0560079b5512053aea4c2a40769d58738934d69c1a45186092ff11af1b907395dd126

Download Submit
\??\c:\9907764eefac44fe9d3f\install.res.2052.dll

Filesize
70KB

MD5
208f1260b7145b19434a8c95ff7c0474

SHA1
6a0a74affdc8f988873841b7073f428056a8aa5d

SHA256
f6d949f493cb9b1ba5ee053acc7363bc9675b9e8b3f25258080092001036e6f4

SHA512
2e9cf1ed7944a6246a2f3febee99d0a36759191664e83aee3c14424b64785a134fe9c50e9e5deaaab1095ae298a2f49aac2037f64a127d250af973a077a7e03a

Download Submit
\??\c:\9907764eefac44fe9d3f\install.res.3082.dll

Filesize
90KB

MD5
dbbe392a7536c76ec60a21e211eb3210

SHA1
e1cead8b1e0fd41e9ed79f4921c5e40c2d739dda

SHA256
8de447ae460de91144ec92381c8315a125b25020ac7601bbb721d56a92d0fd0f

SHA512
f725bc786076947874cc58b9591445064b3f133c75865bb1d661e95f29f1a9556447ee3f385a38f9438561e35e6cfa8208dbc938d3304c415cc25ed85c29f15d

Download Submit
\??\c:\9907764eefac44fe9d3f\vc_red.msi

Filesize
222KB

MD5
7e641e6a0b456271745c20c3bb8a18f9

SHA1
ae6cedcb81dc443611a310140ae4671789dbbf3a

SHA256
34c5e7d7ea270ee67f92d34843d89603d6d3b6d9ef5247b43ae3c59c909d380d

SHA512
f67d6bf69d094edcc93541332f31b326131ff89672edb30fd349def6952ad8bfd07dc2f0ca5967b48a7589eee5b7a14b9a2c1ebe0cba4ae2324f7957090ea903

Download Submit
\??\c:\9907764eefac44fe9d3f\vcredist.bmp

Filesize
5KB

MD5
06fba95313f26e300917c6cea4480890

SHA1
31beee44776f114078fc403e405eaa5936c4bc3b

SHA256
594884a8006e24ad5b1578cd7c75aca21171bb079ebdc4f6518905bcf2237ba1

SHA512
7dca0f1ab5d3fd1ac8755142a7ca4d085bb0c2f12a7272e56159dadfa22da79ec8261815be71b9f5e7c32f6e8121ecb2443060f7db76feaf01eb193200e67dfd

Download Submit
memory/3228-210-0x00000000009C0000-0x0000000000A1E000-memory.dmp

Filesize
376KB

Download
memory/3228-211-0x0000000000980000-0x00000000009BC000-memory.dmp

Filesize
240KB

Download
memory/3228-215-0x0000000000A20000-0x0000000000AC7000-memory.dmp

Filesize
668KB

Download
memory/3228-209-0x00000000005F0000-0x0000000000601000-memory.dmp

Filesize
68KB

Download
memory/4496-200-0x00000000006A0000-0x00000000006B1000-memory.dmp

Filesize
68KB

Download
memory/4496-206-0x0000000000746000-0x0000000000759000-memory.dmp

Filesize
76KB

Download
memory/4496-202-0x00000000006C1000-0x00000000006DD000-memory.dmp

Filesize
112KB

Download
memory/4496-205-0x0000000000B70000-0x0000000000C17000-memory.dmp

Filesize
668KB

Download