50f5a8cf03415dd39d95ab261be6639f50ca511972f8d25a056a16249e18ebde

Analysis

max time kernel
150s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2023, 15:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

setup_stardew_valley_1.5.6.1988831614_(53038).exe
Size

587.2MB
MD5

b99ea7ba69d6c36113ed9fcfa1ff6fd6
SHA1

eebbf65822f2bff52b921fa16e599e391a8bfb93
SHA256

50f5a8cf03415dd39d95ab261be6639f50ca511972f8d25a056a16249e18ebde
SHA512

1ea042a17c2fd9afe318ceb4d4b6f29a42a96a0a3cff4de2f61228df59b4d4c40a402faafa38d5875453d1506c8b9dc72b2219ea4193c39a5199c6711cef8d37
SSDEEP

12582912:ZrZro437kTCA73Kkso8EX9RtU8zXcHSwgkMLdscY/HUKw:ZD3oTZqItRtZ8dhMLdscL

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	setup_stardew_valley_1.5.6.1988831614_(53038).tmp

Executes dropped EXE 2 IoCs

pid	Process
2508	setup_stardew_valley_1.5.6.1988831614_(53038).tmp
4944	DXSETUP.exe

Loads dropped DLL 10 IoCs

pid	Process
2508	setup_stardew_valley_1.5.6.1988831614_(53038).tmp
2508	setup_stardew_valley_1.5.6.1988831614_(53038).tmp
2508	setup_stardew_valley_1.5.6.1988831614_(53038).tmp
2508	setup_stardew_valley_1.5.6.1988831614_(53038).tmp
2508	setup_stardew_valley_1.5.6.1988831614_(53038).tmp
2508	setup_stardew_valley_1.5.6.1988831614_(53038).tmp
4944	DXSETUP.exe
4944	DXSETUP.exe
4944	DXSETUP.exe
4944	DXSETUP.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\SET291A.tmp	DXSETUP.exe
File created	C:\Windows\SysWOW64\SET291A.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\d3dx9_33.dll	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\SET29C5.tmp	DXSETUP.exe
File created	C:\Windows\SysWOW64\SET29C5.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\xinput1_3.dll	DXSETUP.exe

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\APR2007_d3dx9_33_x86.cab	msiexec.exe
File created	C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\DSETUP.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\Feb2010_xact_x86.cab	msiexec.exe
File created	C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\APR2007_xinput_x86.cab	msiexec.exe
File created	C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\Mar2009_d3dx9_41_x86.cab	msiexec.exe
File created	C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\dsetup32.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\Feb2010_XAudio_x86.cab	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\XNA\Framework\v4.0\EULA.en-US.txt	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\XNA\Framework\Shared\xnavisualizer.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\dxupdate.cab	msiexec.exe
File created	C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\Feb2010_X3DAudio_x86.cab	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\XNA\Framework\v4.0\XnaNative.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\XNA\Framework\Shared\XnaVisualizerPS.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\DXSETUP.exe	msiexec.exe

Drops file in Windows directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\{D69C8EDE-BBC5-436B-8E0E-C5A6D311CF4F}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\assembly\tmp\VEOJO88W\Microsoft.Xna.Framework.Game.dll	msiexec.exe
File created	C:\Windows\assembly\tmp\ATPFNE7C\Microsoft.Xna.Framework.GamerServices.dll	msiexec.exe
File created	C:\Windows\assembly\tmp\BM0W7WEJ\Microsoft.Xna.Framework.Net.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\EDE8C96D5CBBB634E8E05C6A3D11FCF4\4.0.30901	msiexec.exe
File created	C:\Windows\Installer\{D69C8EDE-BBC5-436B-8E0E-C5A6D311CF4F}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\e58d6a4.msi	msiexec.exe
File created	C:\Windows\assembly\GACLock.dat	msiexec.exe
File created	C:\Windows\Installer\e58d6a7.msi	msiexec.exe
File opened for modification	C:\Windows\Logs\DirectX.log	DXSETUP.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\assembly\tmp\NREFUEGI\Microsoft.Xna.Framework.Avatar.dll	msiexec.exe
File created	C:\Windows\assembly\tmp\FOQMWNCR\Microsoft.Xna.Framework.dll	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\EDE8C96D5CBBB634E8E05C6A3D11FCF4\4.0.30901\F_CENTRAL_msvcp100_x86.DF495DFD_79F6_34DF_BB1E_E58DB5BDCF2C	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\EDE8C96D5CBBB634E8E05C6A3D11FCF4\4.0.30901\F_CENTRAL_msvcr100_x86.DF495DFD_79F6_34DF_BB1E_E58DB5BDCF2C	msiexec.exe
File opened for modification	C:\Windows\Installer\e58d6a4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDC13.tmp	msiexec.exe
File created	C:\Windows\assembly\tmp\PATFJNBB\Microsoft.Xna.Framework.Storage.dll	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D69C8EDE-BBC5-436B-8E0E-C5A6D311CF4F}	msiexec.exe
File created	C:\Windows\assembly\tmp\33FKWZ5D\Microsoft.Xna.Framework.Input.Touch.dll	msiexec.exe
File created	C:\Windows\assembly\tmp\EF2O2VUA\Microsoft.Xna.Framework.Video.dll	msiexec.exe
File created	C:\Windows\assembly\tmp\GR7KVCM9\Microsoft.Xna.Framework.Graphics.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\EDE8C96D5CBBB634E8E05C6A3D11FCF4	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\EDE8C96D5CBBB634E8E05C6A3D11FCF4\4.0.30901\F_CENTRAL_msvcr100_x86.DF495DFD_79F6_34DF_BB1E_E58DB5BDCF2C	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\assembly\tmp\LA1NU84S\Microsoft.Xna.Framework.Xact.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\EDE8C96D5CBBB634E8E05C6A3D11FCF4\4.0.30901\F_CENTRAL_msvcp100_x86.DF495DFD_79F6_34DF_BB1E_E58DB5BDCF2C	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000009865abc95f2d4b980000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800009865abc90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff0000000007000100006809009865abc9000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000009865abc900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000009865abc900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DXSETUP.exe

Modifies registry class 36 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EDE8C96D5CBBB634E8E05C6A3D11FCF4\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EDE8C96D5CBBB634E8E05C6A3D11FCF4\SourceList\Media	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings	setup_stardew_valley_1.5.6.1988831614_(53038).tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.Xna.Framework.Avatar,fileVersion="4.0.30901.0",version="4.0.0.00000",culture="neutral",publicKeyToken="842CF8BE1DE50553",processorArchitecture="MSIL" = 5f006b0079007b006d00580043007200610039002c0027007b005a005e002700600040006000410058004e0041004600720061006d00650077006f0072006b005200650064006900730074003e006000490066005200610038006c007d006e00400064003100700042005b00330060002c003900350000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\EDE8C96D5CBBB634E8E05C6A3D11FCF4\XNAFrameworkRedist	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EDE8C96D5CBBB634E8E05C6A3D11FCF4	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EDE8C96D5CBBB634E8E05C6A3D11FCF4\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\500BB8FAD5F3D2A4D9EFC01E0702D939\EDE8C96D5CBBB634E8E05C6A3D11FCF4	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.Xna.Framework.Net,fileVersion="4.0.30901.0",version="4.0.0.00000",culture="neutral",publicKeyToken="842CF8BE1DE50553",processorArchitecture="MSIL" = 5f006b0079007b006d00580043007200610039002c0027007b005a005e002700600040006000410058004e0041004600720061006d00650077006f0072006b005200650064006900730074003e00440072005900520072006c002d004a003d0041006b00390052007a005500210029006f005e00380000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.Xna.Framework.Storage,fileVersion="4.0.30901.0",version="4.0.0.00000",culture="neutral",publicKeyToken="842CF8BE1DE50553",processorArchitecture="MSIL" = 5f006b0079007b006d00580043007200610039002c0027007b005a005e002700600040006000410058004e0041004600720061006d00650077006f0072006b005200650064006900730074003e007b0072006100690027004a006300710041003d00550070005d002e0026004d0043007a007100590000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\EDE8C96D5CBBB634E8E05C6A3D11FCF4\DXRedist	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EDE8C96D5CBBB634E8E05C6A3D11FCF4\ProductName = "Microsoft XNA Framework Redistributable 4.0 Refresh"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EDE8C96D5CBBB634E8E05C6A3D11FCF4\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EDE8C96D5CBBB634E8E05C6A3D11FCF4\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.Xna.Framework.Xact,fileVersion="4.0.30901.0",version="4.0.0.00000",culture="neutral",publicKeyToken="842CF8BE1DE50553",processorArchitecture="x86" = 5f006b0079007b006d00580043007200610039002c0027007b005a005e002700600040006000410058004e0041004600720061006d00650077006f0072006b005200650064006900730074003e0058003600520051006200610026006500470040005b002d003200630041007600560064007300740000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\EDE8C96D5CBBB634E8E05C6A3D11FCF4	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EDE8C96D5CBBB634E8E05C6A3D11FCF4\Version = "67139765"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EDE8C96D5CBBB634E8E05C6A3D11FCF4\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EDE8C96D5CBBB634E8E05C6A3D11FCF4\SourceList\Net\1 = "C:\\GOG Games\\Stardew Valley\\__redist\\XNA_40\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EDE8C96D5CBBB634E8E05C6A3D11FCF4\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EDE8C96D5CBBB634E8E05C6A3D11FCF4\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.Xna.Framework.Graphics,fileVersion="4.0.30901.0",version="4.0.0.00000",culture="neutral",publicKeyToken="842CF8BE1DE50553",processorArchitecture="x86" = 5f006b0079007b006d00580043007200610039002c0027007b005a005e002700600040006000410058004e0041004600720061006d00650077006f0072006b005200650064006900730074003e0055006a0064003f003d002e00310076002400390053007e005a00340068007b0055006f007a00690000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EDE8C96D5CBBB634E8E05C6A3D11FCF4\PackageCode = "02E5359D2EEEF614C80C345380F8B4D6"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EDE8C96D5CBBB634E8E05C6A3D11FCF4\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EDE8C96D5CBBB634E8E05C6A3D11FCF4\ProductIcon = "C:\\Windows\\Installer\\{D69C8EDE-BBC5-436B-8E0E-C5A6D311CF4F}\\ProductIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\500BB8FAD5F3D2A4D9EFC01E0702D939	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.Xna.Framework.GamerServices,fileVersion="4.0.30901.0",version="4.0.0.00000",culture="neutral",publicKeyToken="842CF8BE1DE50553",processorArchitecture="MSIL" = 5f006b0079007b006d00580043007200610039002c0027007b005a005e002700600040006000410058004e0041004600720061006d00650077006f0072006b005200650064006900730074003e007a00770076007100640077006800410066003d007a0027006500360077004900760034006700560000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.Xna.Framework.Input.Touch,fileVersion="4.0.30901.0",version="4.0.0.00000",culture="neutral",publicKeyToken="842CF8BE1DE50553",processorArchitecture="MSIL" = 5f006b0079007b006d00580043007200610039002c0027007b005a005e002700600040006000410058004e0041004600720061006d00650077006f0072006b005200650064006900730074003e0050006a006300540058005b0053007b00610039003700380070002d005d0061006c0065004900260000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EDE8C96D5CBBB634E8E05C6A3D11FCF4\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EDE8C96D5CBBB634E8E05C6A3D11FCF4\SourceList\PackageName = "xnafx40_redist.msi"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EDE8C96D5CBBB634E8E05C6A3D11FCF4\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.Xna.Framework.Video,fileVersion="4.0.30901.0",version="4.0.0.00000",culture="neutral",publicKeyToken="842CF8BE1DE50553",processorArchitecture="MSIL" = 5f006b0079007b006d00580043007200610039002c0027007b005a005e002700600040006000410058004e0041004600720061006d00650077006f0072006b005200650064006900730074003e00550048004a0055006e0053003d0052005d00380048004d005d00250038005d00400059006900750000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.Xna.Framework.Game,fileVersion="4.0.30901.0",version="4.0.0.00000",culture="neutral",publicKeyToken="842CF8BE1DE50553",processorArchitecture="x86" = 5f006b0079007b006d00580043007200610039002c0027007b005a005e002700600040006000410058004e0041004600720061006d00650077006f0072006b005200650064006900730074003e0048006100380066004c0049004f0071007b003f00380032003100310034002e002400740052006c0000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.Xna.Framework,fileVersion="4.0.30901.0",version="4.0.0.00000",culture="neutral",publicKeyToken="842CF8BE1DE50553",processorArchitecture="x86" = 5f006b0079007b006d00580043007200610039002c0027007b005a005e002700600040006000410058004e0041004600720061006d00650077006f0072006b005200650064006900730074003e0065006a0036002d0051005b002d0065003900400060004a003d006e0079005e005b005d002a00710000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EDE8C96D5CBBB634E8E05C6A3D11FCF4\SourceList\LastUsedSource = "n;1;C:\\GOG Games\\Stardew Valley\\__redist\\XNA_40\\"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2508	setup_stardew_valley_1.5.6.1988831614_(53038).tmp
2508	setup_stardew_valley_1.5.6.1988831614_(53038).tmp
4768	msiexec.exe
4768	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1708	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1708	msiexec.exe
Token: SeSecurityPrivilege	4768	msiexec.exe
Token: SeCreateTokenPrivilege	1708	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1708	msiexec.exe
Token: SeLockMemoryPrivilege	1708	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1708	msiexec.exe
Token: SeMachineAccountPrivilege	1708	msiexec.exe
Token: SeTcbPrivilege	1708	msiexec.exe
Token: SeSecurityPrivilege	1708	msiexec.exe
Token: SeTakeOwnershipPrivilege	1708	msiexec.exe
Token: SeLoadDriverPrivilege	1708	msiexec.exe
Token: SeSystemProfilePrivilege	1708	msiexec.exe
Token: SeSystemtimePrivilege	1708	msiexec.exe
Token: SeProfSingleProcessPrivilege	1708	msiexec.exe
Token: SeIncBasePriorityPrivilege	1708	msiexec.exe
Token: SeCreatePagefilePrivilege	1708	msiexec.exe
Token: SeCreatePermanentPrivilege	1708	msiexec.exe
Token: SeBackupPrivilege	1708	msiexec.exe
Token: SeRestorePrivilege	1708	msiexec.exe
Token: SeShutdownPrivilege	1708	msiexec.exe
Token: SeDebugPrivilege	1708	msiexec.exe
Token: SeAuditPrivilege	1708	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1708	msiexec.exe
Token: SeChangeNotifyPrivilege	1708	msiexec.exe
Token: SeRemoteShutdownPrivilege	1708	msiexec.exe
Token: SeUndockPrivilege	1708	msiexec.exe
Token: SeSyncAgentPrivilege	1708	msiexec.exe
Token: SeEnableDelegationPrivilege	1708	msiexec.exe
Token: SeManageVolumePrivilege	1708	msiexec.exe
Token: SeImpersonatePrivilege	1708	msiexec.exe
Token: SeCreateGlobalPrivilege	1708	msiexec.exe
Token: SeRestorePrivilege	4768	msiexec.exe
Token: SeTakeOwnershipPrivilege	4768	msiexec.exe
Token: SeRestorePrivilege	4768	msiexec.exe
Token: SeTakeOwnershipPrivilege	4768	msiexec.exe
Token: SeRestorePrivilege	4768	msiexec.exe
Token: SeTakeOwnershipPrivilege	4768	msiexec.exe
Token: SeRestorePrivilege	4768	msiexec.exe
Token: SeTakeOwnershipPrivilege	4768	msiexec.exe
Token: SeRestorePrivilege	4768	msiexec.exe
Token: SeTakeOwnershipPrivilege	4768	msiexec.exe
Token: SeRestorePrivilege	4768	msiexec.exe
Token: SeTakeOwnershipPrivilege	4768	msiexec.exe
Token: SeRestorePrivilege	4768	msiexec.exe
Token: SeTakeOwnershipPrivilege	4768	msiexec.exe
Token: SeRestorePrivilege	4768	msiexec.exe
Token: SeTakeOwnershipPrivilege	4768	msiexec.exe
Token: SeRestorePrivilege	4768	msiexec.exe
Token: SeTakeOwnershipPrivilege	4768	msiexec.exe
Token: SeRestorePrivilege	4768	msiexec.exe
Token: SeTakeOwnershipPrivilege	4768	msiexec.exe
Token: SeRestorePrivilege	4768	msiexec.exe
Token: SeTakeOwnershipPrivilege	4768	msiexec.exe
Token: SeRestorePrivilege	4768	msiexec.exe
Token: SeTakeOwnershipPrivilege	4768	msiexec.exe
Token: SeRestorePrivilege	4768	msiexec.exe
Token: SeTakeOwnershipPrivilege	4768	msiexec.exe
Token: SeRestorePrivilege	4768	msiexec.exe
Token: SeTakeOwnershipPrivilege	4768	msiexec.exe
Token: SeRestorePrivilege	4768	msiexec.exe
Token: SeTakeOwnershipPrivilege	4768	msiexec.exe
Token: SeRestorePrivilege	4768	msiexec.exe
Token: SeTakeOwnershipPrivilege	4768	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2508	setup_stardew_valley_1.5.6.1988831614_(53038).tmp

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 2508	1260	setup_stardew_valley_1.5.6.1988831614_(53038).exe	83
PID 1260 wrote to memory of 2508	1260	setup_stardew_valley_1.5.6.1988831614_(53038).exe	83
PID 1260 wrote to memory of 2508	1260	setup_stardew_valley_1.5.6.1988831614_(53038).exe	83
PID 2508 wrote to memory of 1708	2508	setup_stardew_valley_1.5.6.1988831614_(53038).tmp	92
PID 2508 wrote to memory of 1708	2508	setup_stardew_valley_1.5.6.1988831614_(53038).tmp	92
PID 2508 wrote to memory of 1708	2508	setup_stardew_valley_1.5.6.1988831614_(53038).tmp	92
PID 4768 wrote to memory of 4944	4768	msiexec.exe	95
PID 4768 wrote to memory of 4944	4768	msiexec.exe	95
PID 4768 wrote to memory of 4944	4768	msiexec.exe	95

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\setup_stardew_valley_1.5.6.1988831614_(53038).exe
"C:\Users\Admin\AppData\Local\Temp\setup_stardew_valley_1.5.6.1988831614_(53038).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Users\Admin\AppData\Local\Temp\is-55RM4.tmp\setup_stardew_valley_1.5.6.1988831614_(53038).tmp
  "C:\Users\Admin\AppData\Local\Temp\is-55RM4.tmp\setup_stardew_valley_1.5.6.1988831614_(53038).tmp" /SL5="$80064,614801487,192512,C:\Users\Admin\AppData\Local\Temp\setup_stardew_valley_1.5.6.1988831614_(53038).exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2508
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\GOG Games\Stardew Valley\__redist\XNA_40\xnafx40_redist.msi" /qn
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1708
- - C:\GOG Games\Stardew Valley\__redist\MSVC2013\vcredist_x86.exe
    "C:\GOG Games\Stardew Valley\__redist\MSVC2013\vcredist_x86.exe" /install /quiet /norestart
    3⤵
    PID:4376
  - - C:\GOG Games\Stardew Valley\__redist\MSVC2013\vcredist_x86.exe
      "C:\GOG Games\Stardew Valley\__redist\MSVC2013\vcredist_x86.exe" /install /quiet /norestart -burn.unelevated BurnPipe.{9EBCE620-4BAC-456D-9940-A5124993AB07} {2A3F0F86-07B0-4D9C-9152-9FB90C5FD17B} 4376
      4⤵
      PID:3028

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\DXSETUP.exe
  "C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\DXSETUP.exe" /silent
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:4944
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Microsoft Shared\XNA\Framework\Shared\xnavisualizer.dll"
  2⤵
  PID:1012

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:1560

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:3916

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e58d6a6.rbs

Filesize
17KB

MD5
a53e254cdd0549ed409b2e74b07eff9d

SHA1
77fa4fd7b54f3380e449bca44289c99c5b3bf2fa

SHA256
9f598840636c3f90176d1201876b9f4f6ebbb0b08c8ba7d6e58a663a002f61e4

SHA512
dbd5297de58b8d435f29a91a5ae61986a6adb2ac00b4163b42b9db070e57bd8f62fe4f02a16292a27f918398033ee0466418218d9416ecc0353d23e35d6fb8cd

Download Submit
C:\Config.Msi\e58d6a8.rbs

Filesize
612B

MD5
27cfab2cc37854ec2f777b1f998eb896

SHA1
2038c0ba868030eea23033482100d6347b6a22c8

SHA256
47492dc7f32c45aa3542462c074a48793575bf6ec3c7aee96024609982c088b0

SHA512
4be1cada3774716e9311b3ba15d9a202cc42e991411f914f97dd038e93766dc74f04642f4870b90c4392ce2000998a4b32fa98cff0ca309ed1d88c6a585dbf49

Download Submit
C:\GOG Games\Stardew Valley\Content\Data\Events\Tent.ru-RU.xnb

Filesize
222B

MD5
5f6870d85096c9ef6adf00cbdb47c22e

SHA1
7942b3a783c4c1cf294c325113a18017730d4bf6

SHA256
83bf8b5c96087d0eae165ca3f9d864df1c677f7a69b1e67620eaee8f9bd15861

SHA512
0d10b320fe68559c8fe398b09e776b231dc5797e3dfb5775fa9a328af6f178d28959501b57b5cbc18ef3f1d7e7151d2c5c282f14209bca185ae49c23f0ed3e80

Download Submit
C:\GOG Games\Stardew Valley\__redist\MSVC2013\vcredist_x86.exe

Filesize
6.2MB

MD5
0fc525b6b7b96a87523daa7a0013c69d

SHA1
df7f0a73bfa077e483e51bfb97f5e2eceedfb6a3

SHA256
a22895e55b26202eae166838edbe2ea6aad00d7ea600c11f8a31ede5cbce2048

SHA512
729251371ed208898430040fe48cabd286a5671bd7f472a30e9021b68f73b2d49d85a0879920232426b139520f7e21321ba92646985216bf2f733c64e014a71d

Download Submit
C:\GOG Games\Stardew Valley\__redist\MSVC2013\vcredist_x86.exe

Filesize
6.2MB

MD5
0fc525b6b7b96a87523daa7a0013c69d

SHA1
df7f0a73bfa077e483e51bfb97f5e2eceedfb6a3

SHA256
a22895e55b26202eae166838edbe2ea6aad00d7ea600c11f8a31ede5cbce2048

SHA512
729251371ed208898430040fe48cabd286a5671bd7f472a30e9021b68f73b2d49d85a0879920232426b139520f7e21321ba92646985216bf2f733c64e014a71d

Download Submit
C:\GOG Games\Stardew Valley\__redist\MSVC2013\vcredist_x86.exe

Filesize
6.2MB

MD5
0fc525b6b7b96a87523daa7a0013c69d

SHA1
df7f0a73bfa077e483e51bfb97f5e2eceedfb6a3

SHA256
a22895e55b26202eae166838edbe2ea6aad00d7ea600c11f8a31ede5cbce2048

SHA512
729251371ed208898430040fe48cabd286a5671bd7f472a30e9021b68f73b2d49d85a0879920232426b139520f7e21321ba92646985216bf2f733c64e014a71d

Download Submit
C:\GOG Games\Stardew Valley\__redist\MSVC2013\vcredist_x86.exe

Filesize
6.2MB

MD5
0fc525b6b7b96a87523daa7a0013c69d

SHA1
df7f0a73bfa077e483e51bfb97f5e2eceedfb6a3

SHA256
a22895e55b26202eae166838edbe2ea6aad00d7ea600c11f8a31ede5cbce2048

SHA512
729251371ed208898430040fe48cabd286a5671bd7f472a30e9021b68f73b2d49d85a0879920232426b139520f7e21321ba92646985216bf2f733c64e014a71d

Download Submit
C:\GOG Games\Stardew Valley\__redist\XNA_40\xnafx40_redist.msi

Filesize
6.7MB

MD5
f949909f4cfe27a17e6ca047fb8d4a46

SHA1
7a7b99a71d4aca7bf91b8824d34c9e35096caa97

SHA256
e02a21a2abcd32fe64411704fca9b199844f13f22f9d5b60d4b7c912c7c88e15

SHA512
75fd31f535d9a8a8cf1df35ba1c4a1fa071f9289463a98f549ce1450505efd7934d6bd79ee6ead9650be22614ce653cb371cb0a16fca65f54a01df6f44129310

Download Submit
C:\GOG Games\Stardew Valley\__redist\XNA_40\xnafx40_redist.msi

Filesize
6.7MB

MD5
f949909f4cfe27a17e6ca047fb8d4a46

SHA1
7a7b99a71d4aca7bf91b8824d34c9e35096caa97

SHA256
e02a21a2abcd32fe64411704fca9b199844f13f22f9d5b60d4b7c912c7c88e15

SHA512
75fd31f535d9a8a8cf1df35ba1c4a1fa071f9289463a98f549ce1450505efd7934d6bd79ee6ead9650be22614ce653cb371cb0a16fca65f54a01df6f44129310

Download Submit
C:\PROGRA~2\MICROS~2\XNAGAM~1\v4.0\Redist\DXREDI~1\Apr2007_d3dx9_33_x86.cab

Filesize
1.5MB

MD5
3676d740157493e80e7b8641289c003c

SHA1
8135aeeab67151dd4e2418d4907077f646e72873

SHA256
219441f975c200352a12dc3d8f82811fc7b53ed28d63761327933afbb660f876

SHA512
abfc5ea36a7368a34193c8f3771ae4e36c0d570ae0a20b11892184cd4e384d6abe6542769e3c890293b4e640faecf6392f84f5733017d8d86c65456caa24c6f7

Download Submit
C:\PROGRA~2\MICROS~2\XNAGAM~1\v4.0\Redist\DXREDI~1\Apr2007_xinput_x86.cab

Filesize
55KB

MD5
f83f54f45ac15a32dc17614c4f6882d4

SHA1
fc8542fcd33bb9e669806409f677edec9bfb64fb

SHA256
5ab7bb15394e4ece850da5453413ab1de2ea97d5c93f86482b75073aaa05da9c

SHA512
e4dcccc3a4299d262b94b24ff4b29394bed71e211b80a8a457acc4ab89325500082e6a9b597bc7b1dbc35746d01a9aa038a9c3a401aa42a426fcc3d15f410c9a

Download Submit
C:\PROGRA~2\MICROS~2\XNAGAM~1\v4.0\Redist\DXREDI~1\Feb2010_X3DAudio_x86.cab

Filesize
20KB

MD5
ed093ce20bddc7c42ede4daf772ed5aa

SHA1
21beb0ef8130be1c62b8467dfb67bf3f7548cea1

SHA256
7fbf09682fd15d721ff2c5cb110b5ffcf5982cd2dd8d72b708cf3cd0bc4fa250

SHA512
734e397f4ed2554944e1d1f6f799794c4027792a06e9da25bab58e6e4ff58146058d8b45ff0cb9c861f77989cad029164945f22ffcb459432e1d3a2c7172525c

Download Submit
C:\PROGRA~2\MICROS~2\XNAGAM~1\v4.0\Redist\DXREDI~1\Feb2010_XACT_x86.cab

Filesize
90KB

MD5
5cf3585c99a59319ac10e18cc92f0024

SHA1
c48c25e6b7094eaf337fa986960f9895e5f465ba

SHA256
0ba00c41443639dea9b816fa2608088ccef5dbe850531dff4c1e7993804b0b60

SHA512
26b8213a5105b37912632c8abc1a07381210836e620f8f70d77b3b412a406e2e38df7af037001fe27f2da874e143c59aa7dbff90a9183e7619a8e5af0a23b158

Download Submit
C:\PROGRA~2\MICROS~2\XNAGAM~1\v4.0\Redist\DXREDI~1\Feb2010_XAudio_x86.cab

Filesize
270KB

MD5
5da6e4a80fa53568d2fdde31cbff2979

SHA1
9606fda70427cd9f4eb8e67b625417e2775e6876

SHA256
281bb0e12f617e9ae7fe3301a7d4a08201b377caa0311a886e8cddc2526f734a

SHA512
649fc2578388064267ebe8e55daada29d2e51ae6422b10088b6bfacd229bc0439aafdc4f9af7b3b5e187df179c72b4d85f70839a8c91505d17da06d53a40cf3b

Download Submit
C:\PROGRA~2\MICROS~2\XNAGAM~1\v4.0\Redist\DXREDI~1\Mar2009_d3dx9_41_x86.cab

Filesize
1.5MB

MD5
0fdd6e4e5dfc5d913261355746402214

SHA1
a80c28755c9d3ca163bd377d1bd951a1c111733c

SHA256
5146e15d4c65590704286bfcfbbcc31e98a6832f8a7cc3bfdcb1e7fa5a647bb1

SHA512
9eb85c4507881fc1004c906ee954273bfbea8979d70b2321f197a3cf82121734225103e4239a9bfb591a980b70400a5d19b93482abc108c46614a20476a81f90

Download Submit
C:\PROGRA~2\MICROS~2\XNAGAM~1\v4.0\Redist\DXREDI~1\dxupdate.cab

Filesize
93KB

MD5
c187448c8104d30087f3f25a9d112014

SHA1
b64ac3e44f2f38a3bf8400f11a40a39039fc9caa

SHA256
54d68f154058433865708ee0dbf3ecf2d609ffbd618e84a1056440379494d9fd

SHA512
9148cece409557444eeaf66dee58e2a6043a64d7b76b91e6c4074a5ba0d066cd1ebb2c60d44e1c7a40ca1dc63d72aa7afcc410202901d5afbf2116e3ba8b0f11

Download Submit
C:\Program Files (x86)\Common Files\Microsoft Shared\XNA\Framework\Shared\xnavisualizer.dll

Filesize
46KB

MD5
06569711cc1044c52af68b5c1b2fc29a

SHA1
fa6632b18001e913ea8a26f278b4984d161a5f52

SHA256
df78c3cc61ee8fcec9af8681205d9452dedd8e6f59d913ec6eab5de286ed3580

SHA512
2c3c3add9e85970f7e887b0a2a92b421a57880c0d950bf205737aa3aa57654dce53799bd34abafe2ca60be379fbc37a2b33c2ab4d5577f9bbb08f3705b817d33

Download Submit
C:\Program Files (x86)\Common Files\Microsoft Shared\XNA\Framework\Shared\xnavisualizer.dll

Filesize
46KB

MD5
06569711cc1044c52af68b5c1b2fc29a

SHA1
fa6632b18001e913ea8a26f278b4984d161a5f52

SHA256
df78c3cc61ee8fcec9af8681205d9452dedd8e6f59d913ec6eab5de286ed3580

SHA512
2c3c3add9e85970f7e887b0a2a92b421a57880c0d950bf205737aa3aa57654dce53799bd34abafe2ca60be379fbc37a2b33c2ab4d5577f9bbb08f3705b817d33

Download Submit
C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\DSETUP.dll

Filesize
91KB

MD5
4d48dbe4d3a06c497435014e5c583f34

SHA1
159cbc37080b7ea3ceae8d25125b99f9f4948341

SHA256
9d47b4fa2dcce6a02a51324cfb97f5e153086c2eb8832b211e175cbe5fb850b3

SHA512
b8029bde36e4d6581916c131ec51d74f4a2b03abf5a238c503e1c7b19980d0946606375f0b4c3bd10b9c514e084368c356be8536b282bee887037d7d7f139732

Download Submit
C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\DSETUP32.DLL

Filesize
1.6MB

MD5
7c7cc9feb1026678c48bbabe84ea57c2

SHA1
4fe9c466fc65cf07af0e1440743b1822ab65849b

SHA256
a5c6df12f9fe2edab2a22fe7abf3cb17eac110a6fd469f2570ba04afc88ad767

SHA512
d9cca6dfd5966d45342b87afb6091bc8ad3beff039f9bc9c523f8118dc6723337c279cd652c19624250ed3934d8f4a2b15670652867c0114b7e785bbab4212e0

Download Submit
C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\DXSETUP.exe

Filesize
512KB

MD5
11dd6e8ab9759d1ac91ffe0d0e4949cb

SHA1
2a86774d0c87050d5c7aa9738cc3975303a40d0e

SHA256
16953a202265db5655b3dd972b855619728da76545a2f94bcbb6c43262f48d5b

SHA512
06828f51b3866f7c2b29861707bf8552b742e366783115b3062f08a9c0005c96507ecf1fff92ad41dc0318ad715176c39c84ff0424372b080bf7c031e4f307de

Download Submit
C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\DXSETUP.exe

Filesize
512KB

MD5
11dd6e8ab9759d1ac91ffe0d0e4949cb

SHA1
2a86774d0c87050d5c7aa9738cc3975303a40d0e

SHA256
16953a202265db5655b3dd972b855619728da76545a2f94bcbb6c43262f48d5b

SHA512
06828f51b3866f7c2b29861707bf8552b742e366783115b3062f08a9c0005c96507ecf1fff92ad41dc0318ad715176c39c84ff0424372b080bf7c031e4f307de

Download Submit
C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\dsetup.dll

Filesize
91KB

MD5
4d48dbe4d3a06c497435014e5c583f34

SHA1
159cbc37080b7ea3ceae8d25125b99f9f4948341

SHA256
9d47b4fa2dcce6a02a51324cfb97f5e153086c2eb8832b211e175cbe5fb850b3

SHA512
b8029bde36e4d6581916c131ec51d74f4a2b03abf5a238c503e1c7b19980d0946606375f0b4c3bd10b9c514e084368c356be8536b282bee887037d7d7f139732

Download Submit
C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\dsetup32.dll

Filesize
1.6MB

MD5
7c7cc9feb1026678c48bbabe84ea57c2

SHA1
4fe9c466fc65cf07af0e1440743b1822ab65849b

SHA256
a5c6df12f9fe2edab2a22fe7abf3cb17eac110a6fd469f2570ba04afc88ad767

SHA512
d9cca6dfd5966d45342b87afb6091bc8ad3beff039f9bc9c523f8118dc6723337c279cd652c19624250ed3934d8f4a2b15670652867c0114b7e785bbab4212e0

Download Submit
C:\ProgramData\GOG.com\supportInstaller\uninstall.dll

Filesize
691KB

MD5
7db706c324cc9b6fda497d081eed6e26

SHA1
ca97392e573af0cf61bfa3301801a85f2beea44c

SHA256
cc685dbcf798549ad1a51c1dde45462e2a451ec59f48ee91219182a3871cd5b0

SHA512
8edf1494d57d5e708faaff4170f21f435658be897a6fe0acf243ced0701a7fd574b3c973c5bc5e8d92815e966c98977e69ac1e3083ab00c11b072115527ffa19

Download Submit
C:\Users\Admin\AppData\Local\Temp\DX2551.tmp\FEB2010_X3DAudio_x86.inf

Filesize
1KB

MD5
e84adf38d499ae39090ad60fd76d76e3

SHA1
6af4d58bc04aac2723e8b97649f1b35fb1aca84c

SHA256
d4da3e530982812d1e2a31570b80af541fac1b13c72997d2aad7ea3bfeaf4a4a

SHA512
6714992e7aee7bd0798fbec68f92c97ee502127580e21e1b6693ed6737312b44dbc9fd9ef579fe552590e9e5a4904df94e4116334265a34699a04aa76ab87c24

Download Submit
C:\Users\Admin\AppData\Local\Temp\DX2551.tmp\FEB2010_XACT_x86.inf

Filesize
1KB

MD5
82c10b720e33be099f69e4010d44ecd2

SHA1
e95a2eb23db3fd610d71089500aad523f93c9469

SHA256
e850fdb84bcac0f667927e53fee943efd3f43be6c6a0ae1e17f3fff83ddb2635

SHA512
853261c439b26cdc8991ac289b9f9925976452ed613481b0cf09e75444882805ffa15633eba441d8e1a04641f5f6378b68e2270a6a48d3911d7f9c2c0b1235bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\DX2551.tmp\FEB2010_XAudio_x86.inf

Filesize
1KB

MD5
e6e942a2cfbb587bfcc4203b5bb34fd4

SHA1
2e0172ea1936911a98e11a6e98990703e24172c0

SHA256
74c827ef94881099761e04397ef8f162fd0ccaf4876a5503c4b53a5216d2acca

SHA512
3d70d76e6f459819a1703c5019a2e10fe518ee6e8eb5d3313fe57d3d1b6313b52c4904398a26841c78a9ecf9d715e1201e834ab3df47265e070ec94417a78e4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\DX2551.tmp\Mar2009_d3dx9_41_x86.inf

Filesize
1KB

MD5
b37a5ff044eb65521a290c79ba1a3e00

SHA1
ed505464894bd3e52654834487f3821ae117edfe

SHA256
bd29711cc2ecd924990167ffa95f48842e24aeed3acef1023717040240b4bbb6

SHA512
eae4408cfa7f9c39b101489688cc570a184b8a57f3d20d3b0452a581fb80c4f485dc2f512a39669a92a5bde81fbf474e1585f566ff482e87610780c23126c21e

Download Submit
C:\Users\Admin\AppData\Local\Temp\DX2551.tmp\X3DAudio1_7.dll

Filesize
21KB

MD5
c811e70c8804cfff719038250a43b464

SHA1
ec48da45888ccea388da1425d5322f5ee9285282

SHA256
288c701bdedf1d45c63dd0b7d424a752f8819f90feb5088c582f76bc98970ba3

SHA512
09f2f4d412485ef69aceacc90637c90fad25874f534433811c5ed88225285559db1d981a3ab7bc3a20336e96fb43b4801b4b48a3668c64c21436ee3ea3c32f45

Download Submit
C:\Users\Admin\AppData\Local\Temp\DX2551.tmp\XAPOFX1_4.dll

Filesize
72KB

MD5
e4ce2af32f501a7f7dddd908704a0ee6

SHA1
9dc2976efb15b6fba08bebdeb98929b6961063a5

SHA256
0aee44b12913a95840ee6431d90518b0d72c54a27392e21ee6995e2151554a06

SHA512
ec14a58414d595a36c6b575cdae690f11481cd3f0b35fd2f4c6a6d162a6272882cfe03da865e09a34972775790529f51c80b69056a2fcb909f25b549ed2f7f01

Download Submit
C:\Users\Admin\AppData\Local\Temp\DX2551.tmp\XAudio2_6.dll

Filesize
515KB

MD5
4976243bd70fae3d1d24e49739ab2710

SHA1
6ef27b10bcf4e697fe77c3e964b326be11e4444f

SHA256
61b57170f7c6365714396072d22cb98746718c0f44c9f0d5c62fdb1b218639c7

SHA512
af2d6aaad44bed880a1a2ee947618b142c76a5eca42d4608196b74df9108a9649059d8207e84a58b76ad43aefe9b66ffcc519f8126667177011cf4199f163e83

Download Submit
C:\Users\Admin\AppData\Local\Temp\DX2551.tmp\apr2007_d3dx9_33_x86.inf

Filesize
1KB

MD5
044cae9c30c88bda73727243f5e5206d

SHA1
de744e349cf4ea458b10657d510966d21ad08d67

SHA256
349a09a2791d697bffffc61410a536cdcf258f0d7c86dda44a297e8aec4bdf00

SHA512
18e501142004afbcd28b41bdd3a9b19e2eebc047d7858ee11a9135f19759cfd8c643ff074a51e937bbcab7162888fd95effc146be21fe63dfc300ef03ed44056

Download Submit
C:\Users\Admin\AppData\Local\Temp\DX2551.tmp\apr2007_xinput_x86.inf

Filesize
1KB

MD5
e188f534500688cec2e894d3533997b4

SHA1
f073f8515b94cb23b703ab5cdb3a5cfcc10b3333

SHA256
1c798cb80e9e46ce03356ea7316e1eff5d3a88ccdd7cbfbfcdce73cded23b4e5

SHA512
332ccb25c5ed92ae48c5805a330534d985d6b41f9220af0844d407b2019396fcefea7076b409439f5ab8a9ca6819b65c07ada7bd3aa1222429966dc5a440d4f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\DX2551.tmp\d3dx9_33.dll

Filesize
3.3MB

MD5
cdb1cd22baff21f48606b3c1a18b000b

SHA1
9315b5db975a34dbebdb4dcae652ba1db01c482c

SHA256
c6b7b2ad7742dde5dd8d1a35fdc1c185e586e551ad9c74d3fb21759cd8ca4da8

SHA512
c5fb24de8f1ee6fc1ed6e74580b5d22599ea4eb6c3589645fff0b15dc8dca051c4917e60fbc00ca86542dd63a8f5e40da92ea77e24826c0c6bdba9b58c36d4db

Download Submit
C:\Users\Admin\AppData\Local\Temp\DX2551.tmp\d3dx9_41.dll

Filesize
4.0MB

MD5
3fa06cf5079b84155d18b05c08f7131b

SHA1
fafe52876151a08f39dbb6b4aa137dd85558ba5f

SHA256
6ac4df203af419d3f3b7d9a99e14a3490ea3ad307c474bfe36baea642b1421f6

SHA512
24d29c3ffb6532da860fef4dd93e61f7532cea3af94928495a3af0231e7dff6db5cad25713451a2e722c076462b94818cd6969a1c7d8905585b0f64e12174d1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\DX2551.tmp\dxupdate.dll

Filesize
169KB

MD5
c4842e139fca422e265c91c44a1341d6

SHA1
299a5ab4644fe7302b515aa10ef0f1715046275c

SHA256
b1f954cd75dc3c9d5bc57f1a4c28720ee3639aa8a4306f3da7b27d3c361ff8f5

SHA512
e85a35164e0feafa73a676dacf67d275b8e8aa5be40d861743662a7d1ac8135625c2d59a73e5c77fe1e3e8bd8523d9c823c89137aa4cb1b32d392cd9a1b59989

Download Submit
C:\Users\Admin\AppData\Local\Temp\DX2551.tmp\dxupdate.dll

Filesize
169KB

MD5
c4842e139fca422e265c91c44a1341d6

SHA1
299a5ab4644fe7302b515aa10ef0f1715046275c

SHA256
b1f954cd75dc3c9d5bc57f1a4c28720ee3639aa8a4306f3da7b27d3c361ff8f5

SHA512
e85a35164e0feafa73a676dacf67d275b8e8aa5be40d861743662a7d1ac8135625c2d59a73e5c77fe1e3e8bd8523d9c823c89137aa4cb1b32d392cd9a1b59989

Download Submit
C:\Users\Admin\AppData\Local\Temp\DX2551.tmp\dxupdate.dll

Filesize
169KB

MD5
c4842e139fca422e265c91c44a1341d6

SHA1
299a5ab4644fe7302b515aa10ef0f1715046275c

SHA256
b1f954cd75dc3c9d5bc57f1a4c28720ee3639aa8a4306f3da7b27d3c361ff8f5

SHA512
e85a35164e0feafa73a676dacf67d275b8e8aa5be40d861743662a7d1ac8135625c2d59a73e5c77fe1e3e8bd8523d9c823c89137aa4cb1b32d392cd9a1b59989

Download Submit
C:\Users\Admin\AppData\Local\Temp\DX2551.tmp\dxupdate.inf

Filesize
12KB

MD5
8c281fcb5546d1ed3cdaf6e3f7303139

SHA1
de342a17f2df0386f6584e2f55ae43c558ceb6c4

SHA256
7530c6e18dbb522c5f4fbf6714962c185ea318f9eab7aeb833b0cc07cd2fe656

SHA512
344ea0a375c8851fcf413f441a1cac3013b3748d1630a4d677da72e98f41823bf9427d896de7e1fe35bf868279538cf3b8322aa6ef20025bff48a6bb7f8c42d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\DX2551.tmp\xactengine3_6.dll

Filesize
233KB

MD5
f81c4678a55ffee585ac75825faf5582

SHA1
8fb2e6cf2a022eaed2ff5e3e225b3ca1e453d1cc

SHA256
8a7e7c5ac2e6230f0249d46751522e7ecf85e7490cf7491ab73bf2e7e59e4c0f

SHA512
8c8071bc2640d5c0fcf140ad68d4788cbb0706d17313c3cb74e25624a748b282acbf77eda678cf0d5fecf2ec3d583508c6f4eaf5c84073909b616f59b4f4e5fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\DX2551.tmp\xinput1_3.dll

Filesize
79KB

MD5
77f595dee5ffacea72b135b1fce1312e

SHA1
d2a710b332de3ef7a576e0aed27b0ae66892b7e9

SHA256
8d540d484ea41e374fd0107d55d253f87ded4ce780d515d8fd59bbe8c98970a7

SHA512
a8683050d7758c248052c11ac6a46c9a0b3b3773902cca478c1961b6d9d2d57c75a8c925ba5af4499989c0f44b34eaf57abafafa26506c31e5e4769fb3439746

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-55RM4.tmp\setup_stardew_valley_1.5.6.1988831614_(53038).tmp

Filesize
1.3MB

MD5
cf4a3ced53955ac3932662bd81b0e58c

SHA1
f0291fcb73309d569efa2bfe033fcf9d31c247da

SHA256
1c7b28c5dde2ff26adc204a198316569c810cf7db63d6fa8ef5cafc3eaf53ab3

SHA512
95d5637d1a3aa76867731bad7cddc0a793bf636288fd1dc0967bd82cb550cabd1cb71dde8b386d14846431e3edc701944d22d860773d2e30b7afae40dae5428c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-55RM4.tmp\setup_stardew_valley_1.5.6.1988831614_(53038).tmp

Filesize
1.3MB

MD5
cf4a3ced53955ac3932662bd81b0e58c

SHA1
f0291fcb73309d569efa2bfe033fcf9d31c247da

SHA256
1c7b28c5dde2ff26adc204a198316569c810cf7db63d6fa8ef5cafc3eaf53ab3

SHA512
95d5637d1a3aa76867731bad7cddc0a793bf636288fd1dc0967bd82cb550cabd1cb71dde8b386d14846431e3edc701944d22d860773d2e30b7afae40dae5428c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C2RDM.tmp\07\ee\07ee3c58a88ff60128f72a09c2b9a92b

Filesize
125KB

MD5
07ee3c58a88ff60128f72a09c2b9a92b

SHA1
5efc2c27455e614137a522a0023fcab9b127851c

SHA256
ddb5d92d0d80c43d2338c692ad4f93bb9fb3c355ee0ae6b528ed984e0f767023

SHA512
41d53b6208e15a9ecc893f1edafaf086560ca68a666e16889903a089bc1d6addae4b1673090ab995c6e3e94a224ca2a8eac5f8a75e8c45f443e9b6a7111cce2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C2RDM.tmp\0c\69\0c693af8894e585f26180879d7562be1

Filesize
12KB

MD5
0c693af8894e585f26180879d7562be1

SHA1
81b97f6c9198d207ef7fd4b729834fa248affbd8

SHA256
65677868fcedd3c77d94df1a8fe7f698716dcfac8fcedd981ecdb7a30d200c48

SHA512
2564b1431384ddca3458a1379d13688909cb8b2b79bbb474ca873e87f731ae8aa5e36948c7df8f906e52bff6824f5e8b8228e301850ecf30f48fc456b2a34bec

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C2RDM.tmp\1207666123_english.jpg

Filesize
227KB

MD5
6ae605edb3e45dd0df89c6ae10764372

SHA1
61d91eabc15e8acf7c4b2805603dcab8a1288a13

SHA256
57c4b9c2d2c18a5a170af3caf47d0b64e2396bfd8f7ea82ce351f260918841d3

SHA512
1754ab7dd582b0cc4f6a02c5cbd5760623b0d8a8406a14261375d3257a0ca6508684b1d08903e50150e511ceef1a1920b9998c48ab6088e2f8f62258dbb18e32

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C2RDM.tmp\13\c1\13c18b1b5aa78a623860d30b14d13b4e

Filesize
140KB

MD5
13c18b1b5aa78a623860d30b14d13b4e

SHA1
da56b7ef30047450389dffebab82c043009c17b0

SHA256
a9602c6bdb24da3ec0f52ba978ec53122ffab8a409249a6546fb2a69430d5bc0

SHA512
d55206ef455e6394c053b62515c9afd396baac23e1a03cf70b4f1b91dc91a2865a6d31e6bed1eee751c830073578986071d12eb2fb1d2c8fca757f9da7e8b4e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C2RDM.tmp\1432297044_english.jpg

Filesize
228KB

MD5
8b0e59c0cb10b4c21fdd81f7df6b7cb5

SHA1
03c19fe23cae568212c6098909750ec4bedf054a

SHA256
136ef9aaaed43071446aa3f57b95567d7ab0ac728f1a03b1c23d4b0ecf0d52dd

SHA512
366185be5f75caaa1d7196682f4f8f2d383151c05f49d5fc9dacb97115efb4e6c09aa0c2fccfb99a21f26d15418da1ec3598b2211fd84d43ca7ac4b8e27983a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C2RDM.tmp\1434460532_english.jpg

Filesize
143KB

MD5
867262a5ef052a7e9449fc0ca80981b7

SHA1
79de93cdab8d86b9ff0e0bed592eacf24306ed44

SHA256
c5e80e836e4bacd18fa3914cb93b5adb9311563b3a613c154fa91a410d605312

SHA512
868c6eda3285535d8ac49276dbb5e01ae02c7f08ba61be48b70ea746c53b271a2bf51363a2c2ce1c87d84f2317168c2d2fd4202e3c6ab7729ec4361a0c1da6bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C2RDM.tmp\15\75\157521a6054e016f999cd493aff40e72

Filesize
47KB

MD5
157521a6054e016f999cd493aff40e72

SHA1
a376d3dfa9710ede55a3f57675f71e7bf1048729

SHA256
5d120849b1da68ef22f61ecf4fbfa9878950ab02f3450c9f803b28d6f0bf1a25

SHA512
e301528ae2ace5d47ebd928b1f7e70efcc51b685ab04c327364b18232da5cef22b06868b4c5bc9c7bf37c93dc9aef7bb68956237a75b95f06a7c89569d8b7afa

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C2RDM.tmp\1a\67\1a67d7e539243ef21ea0f772c42c5c3a

Filesize
8KB

MD5
1a67d7e539243ef21ea0f772c42c5c3a

SHA1
9483a544d1aee6fa92126c4f1c281a37b1cc78c9

SHA256
8f13e3c9d365e725854961a497f703cee7f7803e9a84c9c9226c6a173086b644

SHA512
489447742d7b528d9db68a6e2b7e687306ec2410db5aa6b166d9b1a10a88e5de7831c98d2f21a466e1401fb19c864fbe232b3a08e4a9601860fb5603e5d23bc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C2RDM.tmp\2c\a4\2ca4d87a5bd6f086297e5f7fa5fb5201

Filesize
113KB

MD5
2ca4d87a5bd6f086297e5f7fa5fb5201

SHA1
7366c9a9b8d0f67d9e1258c01995931206a6ab1e

SHA256
3821780df6b71cd26b82294d5366ca622c54bb9c53a7ffc4d42aa4542252fd4c

SHA512
e4056bf556f57b3b0e164830e11954c271f04cad5749cbd53a569211e1f27b235b1f22f028f722a4f9fefad1a84fff072d342e35b1882809cbf36d40c2a72222

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C2RDM.tmp\2e\10\2e10c77706b6cde5c7d426166aaaadf6

Filesize
32KB

MD5
2e10c77706b6cde5c7d426166aaaadf6

SHA1
1946cefd3513c112851cf5245fb49a11a9d2c6b5

SHA256
ecb9c8908a4d74b4af718d3e8d6b2433c9af9271518b7caa9e14832a1559d1e8

SHA512
18068dc5393bbafe0015d6a3e05a53283ea1f780d8152c85eb11e4df160264891484f82fbc09f853503c7939d78e988fef3c1eba5f7a3c70c943ec8831e8154e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C2RDM.tmp\5a\1e\5a1e81fb23345ac3ecf0bed419397740

Filesize
9KB

MD5
5a1e81fb23345ac3ecf0bed419397740

SHA1
871fb84d6b614ebe471ad29bbc36aa08a5fab87e

SHA256
f4b742736c64cf59d254a176aeee9d3c83177dea0de0a8892047730026a226c6

SHA512
8fae1553222da303f5be951b0d5d5578d0b3a0476f768898ed451214dff95064c271ca94d1c43dfb9326d82c0316e7827c569fbe4abbfb01e14771e9eb7356fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C2RDM.tmp\69\26\69269e7d76e5f68b89f99aae3d39f283

Filesize
145KB

MD5
69269e7d76e5f68b89f99aae3d39f283

SHA1
e7fe5bcfc75225c5db05ff686a8ddb84a807571c

SHA256
6ab3193006d7f627aea440e4ae821a6465627beccd4fc385073a3406234f944f

SHA512
844852cefe8f3e0b8a807ca25df0838002c7d285eac80b2e9daa9f6ad8a5d6d8df3e15cf6f7e0a338d981eee54c539145d13e2a0982e5171cb827f184d0aa81a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C2RDM.tmp\6c\c4\6cc4cb17a75e8339cafeffb5916ddfe5

Filesize
125KB

MD5
6cc4cb17a75e8339cafeffb5916ddfe5

SHA1
81668f7f8f355f307973d998e734d97054351eeb

SHA256
3aab25e3fa66f644bc1ec12eebd5ecbcb61b004f9d51e231e3ab877df8374c2a

SHA512
5e37f24ae5ba56294c4500afc06c738551d1f6ff74baf4819f02ab9a0f35f665ff8bf2a6bc6d7293c922d6f858bedfbfb35cb2b1a9bde45320bfb3d58b2a75a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C2RDM.tmp\72\84\7284a1d645e81fad3d8728ec07a62095

Filesize
32KB

MD5
7284a1d645e81fad3d8728ec07a62095

SHA1
32048bdfadcd15e34607dd614334459618d2e852

SHA256
448d264f2c48f577d7faf4d34f759580dbb999c1a358831001c548f246b61553

SHA512
acc44048c3b79f83c57beb606c09eeeab4f71d088bcd523659f55e3292fc46e105c0c0f650f0ddda525ec72e26dcbf3b60b6f94d54017916493b527370cd724d

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C2RDM.tmp\7b\eb\7beba26141365f94e727bbf5b9a8057a

Filesize
228B

MD5
7beba26141365f94e727bbf5b9a8057a

SHA1
ca2ebc66e46341d4f5bdfb80345ea5b2418bf74c

SHA256
35629bebdcc8d5539ea81069d0588999258c77b57306ef9c5e14df3346f13d58

SHA512
5d981b47d063151953429d5dac755283871f26a2476af9b2f0e8b0f4a50d0c97d8a387971f51a9173afef2fd9a509008b138ce7446871bf5154bdbd69230a861

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C2RDM.tmp\88\2a\882a5e036b6d3f18f36c740ba5593ff3

Filesize
140KB

MD5
882a5e036b6d3f18f36c740ba5593ff3

SHA1
9a0d96f75050f474b313a798f9a6c098245de40d

SHA256
6893818d07bd228562c4573b8cb9ee038f6d423822bb039d6991fb1e0267ee6c

SHA512
1ed2f0e63f16c2d2b57c80094d897f992fcf43e190b706970971a8cdb7dd2c79396564da16b18f7c612b0a25c6ffbb9d65b7ae77a97effef7f767455736bfabf

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C2RDM.tmp\9a\23\9a23973011fce679030531fe48fb997d

Filesize
145KB

MD5
9a23973011fce679030531fe48fb997d

SHA1
dab856059b4d6331dac8f9d4d963fd1b858da3e5

SHA256
ba7f3c888fd52ef3757bdc8a0d4a257a27106bae48c6205b212736b4bacbe98d

SHA512
2953a45748dff69e63a5d41bdc1e34ffbd67d79a807f8ec457bd1b0660b638f2151585456ba2cc2d3299abb063f9c67d4dd1ef7eebcbaf9a9c1ac6efbfa1e8e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C2RDM.tmp\BigOK.png

Filesize
3KB

MD5
5b43a5d975a53f4fc1da67ce9f7784c1

SHA1
8543fa1e471030049942252b23cb22e0880c3af5

SHA256
59d8bb3e87a89ef523c0495addce38d69560af42aaa82f56dd41b12e6612c13a

SHA512
5dd5c4e9859a555a4a32da76f5231b44f7556274c6501da530b2cdd570bcb4675f710bee708322a40ed3ef9280c0d652b4e7ef0e9eaf128c08534f59291917f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C2RDM.tmp\EULAAccepted.png

Filesize
2KB

MD5
461dfeb75927bdb39f9db5348612a611

SHA1
b7893b1fff6801e37ee7337d876962a09184941e

SHA256
0de278f5ca6d8570d9bda592268a14a28b87d3631fea2d25721947397aaab79c

SHA512
68528cf45c81c2c024a672f42c2cd6d4f72c015b443f103ca21deb8ee2bec4f4027490e7f33b5338a87537b5bf7f255f2828aed149f622155ec89cc81687651b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C2RDM.tmp\EULAShow.png

Filesize
1KB

MD5
c596bc9111edc702bbbb29b70984254f

SHA1
d4712c7b91ff4f8994e7907d31357c42eb47c738

SHA256
6112851daea2aaa7174e8cfac4a0f61c968bc090342503804c476eff47cc2462

SHA512
db50d0a39ec644873a03d64552fff1776cc94f016e8dfc8918e65aee94f7529a6de4637567b5e65c4ea988f3775785c4b52c2d96fe8dbc52b1e21ff59c737c2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C2RDM.tmp\b9\62\b96281ffceac9abe6dedf831b5213b76

Filesize
148KB

MD5
b96281ffceac9abe6dedf831b5213b76

SHA1
eb5d872b242968bb22b8bb4f751c0c88ad809ced

SHA256
a5848c1c3288d8aaf9f354d1dc8a0a1e39831258f8f10c47b8817f0bca06f64d

SHA512
a70e1712fc5b309323f4a86ea8f28388fc45a0c34258dd46facacf0837e95e99f039f84f8cfa3934418189efc0cc8e4dd97877e875152570099811ccabff1858

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C2RDM.tmp\background.jpg

Filesize
312KB

MD5
ee3d61b82617433152adc1cc54cffb42

SHA1
c8645b8686b7bacf6774790810b6925a86dae933

SHA256
fb70b740da03f942d9e25ef63cd6e6bd7dca7dc76a1467b2434842fbc9f60f90

SHA512
991cfd57aa468edd5e56c8e65733f0cbb0dd66b898fd7db2b970ed14af474570912f3e9d732df32954f1a68b6a3b14e47eaccef511bf7cee2ac8da40c18ec50b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C2RDM.tmp\botva2.dll

Filesize
35KB

MD5
0177746573eed407f8dca8a9e441aa49

SHA1
6b462adf78059d26cbc56b3311e3b97fcb8d05f7

SHA256
a4b61626a1626fdabec794e4f323484aa0644baa1c905a5dcf785dc34564f008

SHA512
d4ac96da2d72e121d1d63d64e78bcea155d62af828324b81889a3cd3928ceeb12f7a22e87e264e34498d100b57cdd3735d2ab2316e1a3bf7fa099ddb75c5071a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C2RDM.tmp\botva2.dll

Filesize
35KB

MD5
0177746573eed407f8dca8a9e441aa49

SHA1
6b462adf78059d26cbc56b3311e3b97fcb8d05f7

SHA256
a4b61626a1626fdabec794e4f323484aa0644baa1c905a5dcf785dc34564f008

SHA512
d4ac96da2d72e121d1d63d64e78bcea155d62af828324b81889a3cd3928ceeb12f7a22e87e264e34498d100b57cdd3735d2ab2316e1a3bf7fa099ddb75c5071a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C2RDM.tmp\btn_md5.png

Filesize
8KB

MD5
3befe9739354ee24a0b1ea8df05ce274

SHA1
ab0bda986a8c46aa19f57b75a2b7b22445a3c625

SHA256
b0193ab375f604fa4a25cabdea8f713babde1c07ab562ffc5679352c8e01db47

SHA512
ac016a59e0bfc9b22c376ae5d498c5660893a983d932b2bd502dabe032883c69e79ea8d93c2db49f95415c3cdb068e9f7d1d85527a4f9e68e065a989852d09dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C2RDM.tmp\crcdll.dll

Filesize
69KB

MD5
1d51fac9e2384eeb674199cfd5281d7d

SHA1
861dfdc121357d605d0cc3793266713788109eb2

SHA256
23e90ce5a1f2d634a7bf5d5d0522fafeea6df9e536e16f5ce91035d5197128ec

SHA512
921b00adfe43b883200960e8d0958d4e6b97f6d5cfc096ee277766a3e44cc7805a20877a4edf8bd4d9102bb71a20ac218a9a512f4f76bd751d3ef14f4e0a6eda

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C2RDM.tmp\e3\f7\e3f74ac9babf2aa1cd0a8a949e187904

Filesize
148KB

MD5
e3f74ac9babf2aa1cd0a8a949e187904

SHA1
d6e8d20c55cc8d702135c5fb8ee2275375681eab

SHA256
b552481cb45cc2c0b6ca9d1345eb779de9edae1823ec819cac65bdc5c212ca91

SHA512
bda39108a86cde700d1edd30890c5aecb76bf4223292b02e521ebc248a1b8f0cee9089493df30caba220d1acb69662f71d1225090f6f97aa020709f78ebe6c39

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C2RDM.tmp\e8\81\e88137b0a29cd061169deee9980d88b4

Filesize
12KB

MD5
e88137b0a29cd061169deee9980d88b4

SHA1
22163e7903442b8c2ac33a6e3bd786e36fef2fdd

SHA256
47a84e29dd513a44bb198cade8dbf3a190630ae715ec4ab0ddc95eeb2e0dc167

SHA512
9a076df5756d52203fcde17933534251baa372374ee422b9ef141d97187c9b0931cad786f9fa0c20e80284f856adbabe28cf5f89af4036b407f11cf3d7898ac9

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C2RDM.tmp\e9\e1\e9e1fd7fdfb0efecb34dee072c55dda9

Filesize
140KB

MD5
e9e1fd7fdfb0efecb34dee072c55dda9

SHA1
b87b81f8a087f43fee3ad5065ccc53e05fd9b587

SHA256
d41dd2069fb0af9b19618f6bd314f93e278ab1c93e4efa27b77c1b7e9d51b65b

SHA512
4e728b30b1db4a3e40f41cd3e65b4ac09e1189e584d7616ff6af9d092954a3179702488e8266ae55786d1412862637705c9e73a58ea6eeac208c79bc20ba06ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C2RDM.tmp\eb\50\eb50acc710d54102829962f68dc622e6

Filesize
95KB

MD5
eb50acc710d54102829962f68dc622e6

SHA1
b6341bb39a718eda79c5b7e8984278b4fcc60ebb

SHA256
94a3c976e1ba60a26ba3d4f816c7e153ad5ad829f00630c2f85248be1903a874

SHA512
4c276725980e269df50dd0ea25d0883cb34c72a45069a1708df28feb94bf17058ae1adb0ce61c9ec40dc17520cb1b5388882df7fc130c6e0c61b32b89e34ebbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C2RDM.tmp\error.png

Filesize
726B

MD5
df10adc25b673e74e19971c17bee5a98

SHA1
ee16fb1cf9491f5e611282f0574b27d76fede412

SHA256
142b16dc6239421691fa6e619d1a61e61176d89fa018a88b46893c29a57aad8b

SHA512
dc3de10e0321966cbbfb2e57b3b41da6f26dff0c7233a47469da58775b5c471e6b5181e4d4ffc81ef8b83dbcad74ccc1aad7678518f99c9185a441d2a23e010f

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C2RDM.tmp\f9\d9\f9d97359637ddc6b7c541efaec0d794c

Filesize
155KB

MD5
f9d97359637ddc6b7c541efaec0d794c

SHA1
dfce1a9dd11863a3d145336709190adffed15ef1

SHA256
423f8719f99ec62a55e339e56ac44bd1ef77c9bb592783fc0cf2b5e7d85d694a

SHA512
d38466d82c8dd467a8169425e1195f6882058a770cc4989c6a63867b8f7d334240b45c526249f8e713b3ac1b258480ffd371ab1ea0a4ff78af21880683c60024

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C2RDM.tmp\innocallback.dll

Filesize
63KB

MD5
1c55ae5ef9980e3b1028447da6105c75

SHA1
f85218e10e6aa23b2f5a3ed512895b437e41b45c

SHA256
6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f

SHA512
1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C2RDM.tmp\ok.png

Filesize
1KB

MD5
103c1368e60806b1b7995a0894eacf87

SHA1
971392527f6e4b655044773132505c901a6b5469

SHA256
0d37d4421a39ca8852eb6760b8e914302bdc6cfcc7b170dc1b6c9bb9be148b7e

SHA512
652177e94438aff102f2ed873b26f0985ebed134763852b49b1ca2698463c1dbeb85152f19c8e18d397229ec5cb2cd1d17c61d454ab7c425a2cab540adc8228a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C2RDM.tmp\progress_center.png

Filesize
1KB

MD5
ad7fc1e37e40da38dd57adc446cc6c0e

SHA1
08033265deb9b45243cfa0065d98ffe13a039e26

SHA256
2b9dae87340e66b67ab1d8247d4a137628e324969f92fe1098f95a7c5bab2f43

SHA512
dd715d74f8e1ed6ab75b7b6530b383ac47040d8baa7728be160f6d230bf485a9cc54f15f7dc85b122ce56e54d63fa4890e510dfc89d9c9344e31f789ebac8756

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C2RDM.tmp\progress_left.png

Filesize
1KB

MD5
290c7612ad7a077028cd3dc78ce99673

SHA1
18995fbe39d05e4a1cafc7cc2e0f6fb745442f77

SHA256
85e39d909a7300fa2043ec42818582867b981401264b14fc5408e477ae0b4668

SHA512
799841f5b8a1056e78a49c823009750e4b93af130a6c4ff9dc6d386c06b88614e53b46a6df62f5a217d5c99da01cf4e2fe8392c73d39e81000045291cf24205a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C2RDM.tmp\progress_right.png

Filesize
1KB

MD5
c25a41f022a74308d944d1e807d72f44

SHA1
83c6bbec3fb373fcc78ce0e737742100994cd6d4

SHA256
396a3351fe409328782ab138282cf9cec061a5a9540a3506700a620db1f54e7d

SHA512
d2f4449195f3e60c826cfabb52a083d829eb9d0509272977d8fdb33bc5214678949cd27d0594684594e0a3eda2351c39cec8d91923cb716ad144ccf2b966c8e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C2RDM.tmp\slideshow.ini

Filesize
403B

MD5
85987637ee80396d218b6e4ebb12881d

SHA1
2aca2381f37b07f2b9a4e004273a12e54fd16165

SHA256
c6e4489aade22aa74bea3dad3cfb169e6e133fa4eeb4db8e2defdc0cb6899bc7

SHA512
7149917a35d504a728f02fe484f888fff385f19f6c5e6f244e9c03b5e1edeedaa2a6a46277dcfa13c3205a1365cb7296c2436b64c08e0cd6e0fb2d75d861fdec

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C2RDM.tmp\track_center.png

Filesize
1KB

MD5
3f2b0c22f8ea28dcbb82b39a16a039aa

SHA1
b3f4dfc2ea86fbdad05877b4c356b7fa8016731d

SHA256
794f9eeca7fd99846968376b76a296c927532cef1271325cbf555caa0d0d5860

SHA512
b4bf65d751717e85418947662d315ae3bcb177f60914832fefeeb95da9eddb75eb5531c62e5a5a70ff03c8a025b5a03e61ffbdecc9f483bea9684454ca9362d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C2RDM.tmp\track_left.png

Filesize
1KB

MD5
55dacb00cbe2825a8540236c5777a205

SHA1
18a52ac6c741b558500fbc1716d46b4fe4471982

SHA256
a8340fb5380c922b60ea40043590dba067dcfed6e22636851691df38156a3aa8

SHA512
2ea444cc1080f20761c8d71d96fcd04ef48254cdc1dc41d1d139f459ea5613fe12f6e4bd026bf33a5c01ff038e72e05dae2f8fba33ff517dd395e1911f10ff10

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C2RDM.tmp\track_right.png

Filesize
1KB

MD5
ddec70b6c49be3e8c3a7d01c2f6ff1c5

SHA1
5383271999f787c36b1dc8f3cc13c8407b195439

SHA256
f54cd6e42f2b2bc5cb8a15f6a28f1499abf094a519ebdf39f4c4e167312c9c16

SHA512
f43f94b194b5a7eafcec9e831f61042859c30e1af2e2447195bdd06b12c90982181161a1c1be5aa5223ff664f88e4891bd71cfffb7ef672d6fe4f614030e0e01

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C2RDM.tmp\uninstall.dll

Filesize
691KB

MD5
7db706c324cc9b6fda497d081eed6e26

SHA1
ca97392e573af0cf61bfa3301801a85f2beea44c

SHA256
cc685dbcf798549ad1a51c1dde45462e2a451ec59f48ee91219182a3871cd5b0

SHA512
8edf1494d57d5e708faaff4170f21f435658be897a6fe0acf243ced0701a7fd574b3c973c5bc5e8d92815e966c98977e69ac1e3083ab00c11b072115527ffa19

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C2RDM.tmp\uninstall.dll

Filesize
691KB

MD5
7db706c324cc9b6fda497d081eed6e26

SHA1
ca97392e573af0cf61bfa3301801a85f2beea44c

SHA256
cc685dbcf798549ad1a51c1dde45462e2a451ec59f48ee91219182a3871cd5b0

SHA512
8edf1494d57d5e708faaff4170f21f435658be897a6fe0acf243ced0701a7fd574b3c973c5bc5e8d92815e966c98977e69ac1e3083ab00c11b072115527ffa19

Download Submit
C:\Users\Admin\AppData\Local\Temp\{f65db027-aff3-4070-886a-0d87064aabb1}\.ba1\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\{f65db027-aff3-4070-886a-0d87064aabb1}\.ba1\wixstdba.dll

Filesize
117KB

MD5
a52e5220efb60813b31a82d101a97dcb

SHA1
56e16e4df0944cb07e73a01301886644f062d79b

SHA256
e7c8e7edd9112137895820e789baaaeca41626b01fb99fede82968ddb66d02cf

SHA512
d6565ba18b5b9795d6bde3ef94d8f7cd77bf8bb69ba3fe7adefb80fc7c5d888cdfdc79238d86a0839846aea4a1e51fc0caed3d62f7054885e8b15fad9f6c654e

Download Submit
C:\Windows\Logs\DirectX.log

Filesize
11KB

MD5
a1adc353cc3bfed08c6b357d879a5b41

SHA1
c05462c2007240c7842b5536a1f802f6c7bf7684

SHA256
9ccf0f5c9380085df5c7e4f310e9ee03921dcfd9550797be7414fc59fa2e1455

SHA512
ad5182606ccb2de5f2a755f109666f8efbefff487da457139810021712368a9cfc78da7ba8412fc4e016d7a2031232b270ebf6d8bda04118ad31bbf5c5b9887f

Download Submit
C:\Windows\Logs\DirectX.log

Filesize
11KB

MD5
a1adc353cc3bfed08c6b357d879a5b41

SHA1
c05462c2007240c7842b5536a1f802f6c7bf7684

SHA256
9ccf0f5c9380085df5c7e4f310e9ee03921dcfd9550797be7414fc59fa2e1455

SHA512
ad5182606ccb2de5f2a755f109666f8efbefff487da457139810021712368a9cfc78da7ba8412fc4e016d7a2031232b270ebf6d8bda04118ad31bbf5c5b9887f

Download Submit
C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Xna.Framework.Game\v4.0_4.0.0.0__842cf8be1de50553\Microsoft.Xna.Framework.Game.dll

Filesize
73KB

MD5
b62521605852f3a775aa13ddae49a752

SHA1
d1c49863ad29a59c341c45a4427c6a72a9e4ea3b

SHA256
b5dffdd8125abef2a4507ba4e1d2f11062143f0a63d48fe4f298b95ad746a1f0

SHA512
12d7e82ad4fa7abcf4836fde54b0a13dd1eddcda4401a271ecf9911a10c7f78f2d2a04edea1a4a1b4dc86bc8b01255e655cb5328695db549269a8c7f4cf3315e

Download Submit
C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Xna.Framework.Graphics\v4.0_4.0.0.0__842cf8be1de50553\Microsoft.Xna.Framework.Graphics.dll

Filesize
417KB

MD5
602e98023ab622414371cd7e60004c36

SHA1
62d8b9bb4591cc037c9a0b0db279bfb9553ef48c

SHA256
560080fc39021c611ca9d076dcebed312faf6d7d1413c2dc523683ea635e9f55

SHA512
a1602f4b9b58c73b25f2156badaefe1ee69c210018b5b3046c8071c795a46ed55e9757bcf96a81b4c95634667ec38d2d8c962a279d62405d8f8f44a85a6ce2f7

Download Submit
C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Xna.Framework.Xact\v4.0_4.0.0.0__842cf8be1de50553\Microsoft.Xna.Framework.Xact.dll

Filesize
74KB

MD5
4ee6297e631512a9b71d8136f0baf9cf

SHA1
190d1dbdcc80bbe8348c2491bb278abcab30ac9e

SHA256
a14d5364dca7cf49fb90639e87ba04d52b59a700dc9198efa5707ce8eae28f0a

SHA512
82dc4146cb3e4ae25e05e911c26b0d3e5bf2acf51721d9474ba2939e0789aa62ad00248bf3c8eaabdedb489d5c4a1ba4209afe352ab88a0ebc162e14220f0d13

Download Submit
C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Xna.Framework\v4.0_4.0.0.0__842cf8be1de50553\Microsoft.Xna.Framework.dll

Filesize
663KB

MD5
d008ca9fc1ba351f60858346202253e0

SHA1
70204dcf4d7bd112ef743634e13dc802d5259fba

SHA256
38e7093f52d7474bbc6256906519781a1210d7da50a1c667b52716fcf49ca130

SHA512
0a240f494dedfb4686d53a32b93ee3e4fe1bbf5ac23fdcb84771b29b9a830f4fbd896f6b0efc46729e0f43d61a14aaefafc85291de09b3fc7048e76aab2a29cd

Download Submit
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Xna.Framework.Avatar\v4.0_4.0.0.0__842cf8be1de50553\Microsoft.Xna.Framework.Avatar.dll

Filesize
26KB

MD5
00030e225535a23984345983dac51afd

SHA1
fd55d0a9c6254dd6935127df69858ea683d5e879

SHA256
b3c70bbe469000b9e11507cc63b88d54a4e0bc5c27afc826d66e0aee51640871

SHA512
448584717a1715c090a048c9b12f00dad01d541a082506739d9c904f4bc1adae9fa882b79b6540fba35f8dbcb8d77b4c5b2a5182d078bb68ec94835124a195bd

Download Submit
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Xna.Framework.GamerServices\v4.0_4.0.0.0__842cf8be1de50553\Microsoft.Xna.Framework.GamerServices.dll

Filesize
72KB

MD5
f12807c733076e04ba470e1b881a4ccc

SHA1
5599cb6e52fa19a92e2fce11a0fdee4d1f14548e

SHA256
7c6effed97aa25a95c5e095d9c261f5581e402180cc073271a367b9eef79c8af

SHA512
9293f7b459cfc6b490e075e602a99eff87c3df1f7da2abf643f7f3df31375510c05b4e419da5b1abdf445925cdf241c4ffb6b2c9fd64bfc49a201371eb20812b

Download Submit
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Xna.Framework.Input.Touch\v4.0_4.0.0.0__842cf8be1de50553\Microsoft.Xna.Framework.Input.Touch.dll

Filesize
22KB

MD5
882f8bbc99849a9f37ba525b98ad3bb6

SHA1
135445970ceeb7cfefa11a655777497c01f687d7

SHA256
b0585224c18022c3661057ae79544644c10f33f1dc529678364f3d6b25151c25

SHA512
e09ea6fd49b31dbd35f4d08baf8eddce8010368f3654eeb89382a2d595a510f629ec55299122eceb75938db962c2c728800f5cd339fe11809aeae98acb5bbadd

Download Submit
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Xna.Framework.Net\v4.0_4.0.0.0__842cf8be1de50553\Microsoft.Xna.Framework.Net.dll

Filesize
53KB

MD5
68b2bd5121022a59f2c8ca9640730841

SHA1
51898cc2f06ea3089f183b310674eb38809dd17b

SHA256
39739dbf5f6ba02e1d0b02ed404f6fe0692497848bc1a6a25be132d47ed9c151

SHA512
666ef6f65d7d3d897df385e335ff9562921f1e716bda645991f2b3758eb3c6a46b725467846c512aada808d95731a19ee0012508b8543ab936982f367c4bda45

Download Submit
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Xna.Framework.Storage\v4.0_4.0.0.0__842cf8be1de50553\Microsoft.Xna.Framework.Storage.dll

Filesize
20KB

MD5
bd76254b3d55aa1a229e908c673ffc76

SHA1
53eca2f33cf0d2784facdba18a374ced9f4cdefa

SHA256
798f678e9ae3d9afc3bed66c30123bc9634fb923b6d200188344b618e608cbb8

SHA512
8cdc5067c987d46bb67dd3c7fc2cf946ad08c26fc603f8d5aaf6a28bd43c214f1b7f590fbcdf29628b95cc4b6eda917cb3e47bc6e15ce6abed2baada72c11b3a

Download Submit
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Xna.Framework.Video\v4.0_4.0.0.0__842cf8be1de50553\Microsoft.Xna.Framework.Video.dll

Filesize
17KB

MD5
5f9563040fc3faadf824a6f8e2567727

SHA1
f7229b60fa4d9ea51ed1b9aa907530f7c89baed1

SHA256
17538b1ca9d48a993e2cd88c96b436df08e7abb4aec5d4758eb21feb580d6e06

SHA512
01e2276de213e0e7b584b61034e1e8e7653534db3a9add52744bad40253117f229564f42741267052165f5b3e772155299522b9cd526fefc6ea6c00524990a68

Download Submit
C:\Windows\SysWOW64\XAudio2_6.dll

Filesize
515KB

MD5
4976243bd70fae3d1d24e49739ab2710

SHA1
6ef27b10bcf4e697fe77c3e964b326be11e4444f

SHA256
61b57170f7c6365714396072d22cb98746718c0f44c9f0d5c62fdb1b218639c7

SHA512
af2d6aaad44bed880a1a2ee947618b142c76a5eca42d4608196b74df9108a9649059d8207e84a58b76ad43aefe9b66ffcc519f8126667177011cf4199f163e83

Download Submit
C:\Windows\SysWOW64\xactengine3_6.dll

Filesize
233KB

MD5
f81c4678a55ffee585ac75825faf5582

SHA1
8fb2e6cf2a022eaed2ff5e3e225b3ca1e453d1cc

SHA256
8a7e7c5ac2e6230f0249d46751522e7ecf85e7490cf7491ab73bf2e7e59e4c0f

SHA512
8c8071bc2640d5c0fcf140ad68d4788cbb0706d17313c3cb74e25624a748b282acbf77eda678cf0d5fecf2ec3d583508c6f4eaf5c84073909b616f59b4f4e5fe

Download Submit
memory/1260-133-0x0000000000350000-0x0000000000389000-memory.dmp

Filesize
228KB

Download
memory/1260-279-0x0000000000350000-0x0000000000389000-memory.dmp

Filesize
228KB

Download
memory/2508-13577-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2508-18331-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2508-363-0x0000000000110000-0x0000000000262000-memory.dmp

Filesize
1.3MB

Download
memory/2508-368-0x00000000033E0000-0x00000000033EE000-memory.dmp

Filesize
56KB

Download
memory/2508-366-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2508-1604-0x0000000000110000-0x0000000000262000-memory.dmp

Filesize
1.3MB

Download
memory/2508-1610-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2508-1622-0x00000000033E0000-0x00000000033EE000-memory.dmp

Filesize
56KB

Download
memory/2508-3764-0x0000000000110000-0x0000000000262000-memory.dmp

Filesize
1.3MB

Download
memory/2508-11452-0x00000000056F0000-0x00000000057A7000-memory.dmp

Filesize
732KB

Download
memory/2508-11451-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2508-284-0x0000000002B20000-0x0000000002B21000-memory.dmp

Filesize
4KB

Download
memory/2508-283-0x00000000033E0000-0x00000000033EE000-memory.dmp

Filesize
56KB

Download
memory/2508-282-0x00000000056F0000-0x00000000057A7000-memory.dmp

Filesize
732KB

Download
memory/2508-281-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2508-280-0x0000000000110000-0x0000000000262000-memory.dmp

Filesize
1.3MB

Download
memory/2508-138-0x0000000002B20000-0x0000000002B21000-memory.dmp

Filesize
4KB

Download
memory/2508-278-0x0000000003370000-0x0000000003371000-memory.dmp

Filesize
4KB

Download
memory/2508-11520-0x0000000000110000-0x0000000000262000-memory.dmp

Filesize
1.3MB

Download
memory/2508-11521-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2508-11523-0x00000000056F0000-0x00000000057A7000-memory.dmp

Filesize
732KB

Download
memory/2508-3768-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2508-3769-0x00000000056F0000-0x00000000057A7000-memory.dmp

Filesize
732KB

Download
memory/2508-5733-0x0000000000110000-0x0000000000262000-memory.dmp

Filesize
1.3MB

Download
memory/2508-18347-0x00000000056F0000-0x00000000057A7000-memory.dmp

Filesize
732KB

Download
memory/2508-367-0x00000000056F0000-0x00000000057A7000-memory.dmp

Filesize
732KB

Download
memory/2508-18325-0x0000000000110000-0x0000000000262000-memory.dmp

Filesize
1.3MB

Download
memory/2508-192-0x00000000033E0000-0x00000000033EE000-memory.dmp

Filesize
56KB

Download
memory/2508-5737-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2508-16018-0x00000000056F0000-0x00000000057A7000-memory.dmp

Filesize
732KB

Download
memory/2508-16007-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2508-15996-0x0000000000110000-0x0000000000262000-memory.dmp

Filesize
1.3MB

Download
memory/2508-13583-0x00000000056F0000-0x00000000057A7000-memory.dmp

Filesize
732KB

Download
memory/2508-11450-0x0000000000110000-0x0000000000262000-memory.dmp

Filesize
1.3MB

Download
memory/2508-13571-0x0000000000110000-0x0000000000262000-memory.dmp

Filesize
1.3MB

Download
memory/2508-5740-0x00000000056F0000-0x00000000057A7000-memory.dmp

Filesize
732KB

Download
memory/2508-7802-0x0000000000110000-0x0000000000262000-memory.dmp

Filesize
1.3MB

Download
memory/2508-7808-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2508-7817-0x00000000056F0000-0x00000000057A7000-memory.dmp

Filesize
732KB

Download
memory/2508-10077-0x0000000000110000-0x0000000000262000-memory.dmp

Filesize
1.3MB

Download
memory/2508-10093-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2508-10104-0x00000000056F0000-0x00000000057A7000-memory.dmp

Filesize
732KB

Download
memory/2508-147-0x00000000056F0000-0x00000000057A7000-memory.dmp

Filesize
732KB

Download
memory/4768-18508-0x00000194E9710000-0x00000194E971C000-memory.dmp

Filesize
48KB

Download
memory/4768-18516-0x00000194E9B70000-0x00000194E9B88000-memory.dmp

Filesize
96KB

Download
memory/4768-18521-0x00000194E9720000-0x00000194E972C000-memory.dmp

Filesize
48KB

Download
memory/4768-18524-0x00000194E9B90000-0x00000194E9BA4000-memory.dmp

Filesize
80KB

Download
memory/4768-18527-0x00000194E9730000-0x00000194E973C000-memory.dmp

Filesize
48KB

Download
memory/4768-18530-0x00000194E9740000-0x00000194E974A000-memory.dmp

Filesize
40KB

Download