187c3a434094cbfcbb97709acefd59f4c941893675182b36385ef3ea82247395

Resubmissions

17/09/2023, 20:31

230917-zayqbacf31 7

16/09/2023, 21:11

230916-z1rdxsde6t 7

Analysis

max time kernel
154s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
17/09/2023, 20:31

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

Clickteam_Fusion_R291.6.exe
Size

531.1MB
MD5

e93fee341f436c192fd2798e66ab1dfb
SHA1

899d34c7af6635170665076b207dc1bd27304ea5
SHA256

187c3a434094cbfcbb97709acefd59f4c941893675182b36385ef3ea82247395
SHA512

d0ea0583651279aa9d0de15d555a10bc46913f4a7d113b040c23f7d3be79f476f94100f6e9907caaf0b445e0901a70060e60b1376892eb1bfdf981d9c2a431ff
SSDEEP

12582912:bgDd+o/8zlqVfA50LD4Ga3H6t73q/C7ZM2asXRhRoppAjiLoti:bgDb8zkVm0D4GgH6B6/uZTjhuGiGi

Score

7^/10

bootkit discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation	mmf2u.exe

Executes dropped EXE 6 IoCs

pid	Process
3976	Clickteam Fusion Developer 2.5.exe
4824	mmf2u.exe
2076	Clickteam Fusion Developer 2.5.exe
1772	mmf2u.exe
1124	Clickteam Fusion Developer 2.5.exe
2216	mmf2u.exe

Loads dropped DLL 64 IoCs

pid	Process
2980	Clickteam_Fusion_R291.6.exe
2980	Clickteam_Fusion_R291.6.exe
2980	Clickteam_Fusion_R291.6.exe
2980	Clickteam_Fusion_R291.6.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
2076	rundll32.exe
2076	rundll32.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
50	api.ipify.org

Writes to the Master Boot Record (MBR) 1 TTPs 6 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	rundll32.exe
File opened for modification	\??\PhysicalDrive0	mmf2u.exe
File opened for modification	\??\PhysicalDrive0	rundll32.exe
File opened for modification	\??\PhysicalDrive0	mmf2u.exe
File opened for modification	\??\PhysicalDrive0	rundll32.exe
File opened for modification	\??\PhysicalDrive0	mmf2u.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
4824	mmf2u.exe
1772	mmf2u.exe
2216	mmf2u.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Clickteam Fusion Developer 2.5\Skins\Dark\EE_CheckmarksSelected.png	Clickteam_Fusion_R291.6.exe
File opened for modification	C:\Program Files\Clickteam Fusion Developer 2.5\Samples\Human\Yells\Oo 3.wav	Clickteam_Fusion_R291.6.exe
File created	C:\Program Files\Clickteam Fusion Developer 2.5\Data\Runtime\iPhone\AdvDir.ext	Clickteam_Fusion_R291.6.exe
File opened for modification	C:\Program Files\Clickteam Fusion Developer 2.5\Data\Runtime\Wua\js\runtime\actions\ACT_CCASETGLOBALSTRING.js	Clickteam_Fusion_R291.6.exe
File created	C:\Program Files\Clickteam Fusion Developer 2.5\Data\Runtime\Wua\js\runtime\conditions\CND_EXTCOLBACK.js	Clickteam_Fusion_R291.6.exe
File created	C:\Program Files\Clickteam Fusion Developer 2.5\Languages\en-us\Help\AVI.chm	Clickteam_Fusion_R291.6.exe
File opened for modification	C:\Program Files\Clickteam Fusion Developer 2.5\MIDI\Other\gothic.mid	Clickteam_Fusion_R291.6.exe
File created	C:\Program Files\Clickteam Fusion Developer 2.5\Data\Runtime\Wua\js\runtime\conditions\CND_EXTCMPFRAME.js	Clickteam_Fusion_R291.6.exe
File opened for modification	C:\Program Files\Clickteam Fusion Developer 2.5\Lib\Objects\Games\Other\Misc.mfa	Clickteam_Fusion_R291.6.exe
File opened for modification	C:\Program Files\Clickteam Fusion Developer 2.5\Samples\Bells & Horns\BELL01.WAV	Clickteam_Fusion_R291.6.exe
File created	C:\Program Files\Clickteam Fusion Developer 2.5\Samples\Bells & Horns\Alert.wav	Clickteam_Fusion_R291.6.exe
File created	C:\Program Files\Clickteam Fusion Developer 2.5\Samples\Creatures\Horse 1.wav	Clickteam_Fusion_R291.6.exe
File created	C:\Program Files\Clickteam Fusion Developer 2.5\Data\Runtime\Wua\js\runtime\params\PARAM_OBJECT.js	Clickteam_Fusion_R291.6.exe
File opened for modification	C:\Program Files\Clickteam Fusion Developer 2.5\Languages\en-us\Help\Movements\style_default.css	Clickteam_Fusion_R291.6.exe
File opened for modification	C:\Program Files\Clickteam Fusion Developer 2.5\Languages\ja-jp\Help\Box2DGround.chm	Clickteam_Fusion_R291.6.exe
File created	C:\Program Files\Clickteam Fusion Developer 2.5\Lib\Objects\Buttons and pointers\Media - Widgets #3.mfa	Clickteam_Fusion_R291.6.exe
File opened for modification	C:\Program Files\Clickteam Fusion Developer 2.5\Samples\Elements\WIND4.WAV	Clickteam_Fusion_R291.6.exe
File opened for modification	C:\Program Files\Clickteam Fusion Developer 2.5\Data\Runtime\Wua\js\runtime\conditions\CND_ONMOUSEWHEELUP.js	Clickteam_Fusion_R291.6.exe
File opened for modification	C:\Program Files\Clickteam Fusion Developer 2.5\Samples\Music\Jingles\Message.ogg	Clickteam_Fusion_R291.6.exe
File opened for modification	C:\Program Files\Clickteam Fusion Developer 2.5\Samples\Creatures\PIG1.WAV	Clickteam_Fusion_R291.6.exe
File opened for modification	C:\Program Files\Clickteam Fusion Developer 2.5\Data\Runtime\Html5\preloader.png	Clickteam_Fusion_R291.6.exe
File created	C:\Program Files\Clickteam Fusion Developer 2.5\Extensions\Unicode\Box2DParticules.mfx	Clickteam_Fusion_R291.6.exe
File opened for modification	C:\Program Files\Clickteam Fusion Developer 2.5\Samples\Creatures\Bat.wav	Clickteam_Fusion_R291.6.exe
File created	C:\Program Files\Clickteam Fusion Developer 2.5\Languages\ja-jp\Modules\InAppAndroid.txt	Clickteam_Fusion_R291.6.exe
File created	C:\Program Files\Clickteam Fusion Developer 2.5\Lib\Objects\Games\Characters\Games - 3D - Big Eye Top.mfa	Clickteam_Fusion_R291.6.exe
File created	C:\Program Files\Clickteam Fusion Developer 2.5\Samples\Music\Planet Earth\Dinosaur World.ogg	Clickteam_Fusion_R291.6.exe
File created	C:\Program Files\Clickteam Fusion Developer 2.5\Data\Runtime\Flash\Flex\frameworks\air-config.xml	Clickteam_Fusion_R291.6.exe
File created	C:\Program Files\Clickteam Fusion Developer 2.5\Data\Runtime\Java\kcpict.jar	Clickteam_Fusion_R291.6.exe
File created	C:\Program Files\Clickteam Fusion Developer 2.5\Data\Runtime\Wua\js\runtime\expressions\EXP_PLALIVES.js	Clickteam_Fusion_R291.6.exe
File created	C:\Program Files\Clickteam Fusion Developer 2.5\Examples\Games\Solitaire\Solitaire.mfa	Clickteam_Fusion_R291.6.exe
File created	C:\Program Files\Clickteam Fusion Developer 2.5\Extensions\FireflyBI.mfx	Clickteam_Fusion_R291.6.exe
File created	C:\Program Files\Clickteam Fusion Developer 2.5\Samples\Impacts\GLASS09.WAV	Clickteam_Fusion_R291.6.exe
File created	C:\Program Files\Clickteam Fusion Developer 2.5\Samples\Science Fiction\Alien sex.wav	Clickteam_Fusion_R291.6.exe
File opened for modification	C:\Program Files\Clickteam Fusion Developer 2.5\Languages\ja-jp\Help\HiScore.chm	Clickteam_Fusion_R291.6.exe
File opened for modification	C:\Program Files\Clickteam Fusion Developer 2.5\Samples\MISC\HAMMER1.WAV	Clickteam_Fusion_R291.6.exe
File opened for modification	C:\Program Files\Clickteam Fusion Developer 2.5\Examples\Picture\pictures	Clickteam_Fusion_R291.6.exe
File opened for modification	C:\Program Files\Clickteam Fusion Developer 2.5\Data\Runtime\Wua\js\runtime\conditions\CND_TIMEOUT.js	Clickteam_Fusion_R291.6.exe
File created	C:\Program Files\Clickteam Fusion Developer 2.5\MIDI\Other\sunsetbeach.mid	Clickteam_Fusion_R291.6.exe
File created	C:\Program Files\Clickteam Fusion Developer 2.5\Samples\Other\wet_space.ogg	Clickteam_Fusion_R291.6.exe
File opened for modification	C:\Program Files\Clickteam Fusion Developer 2.5\Samples\Science Fiction\PULSE12.WAV	Clickteam_Fusion_R291.6.exe
File opened for modification	C:\Program Files\Clickteam Fusion Developer 2.5\Languages\fr-fr\Modules\RuntimeHTML5.Final.html	Clickteam_Fusion_R291.6.exe
File created	C:\Program Files\Clickteam Fusion Developer 2.5\Lib\Objects\Games\Miscellaneous 2\Athletics.mfa	Clickteam_Fusion_R291.6.exe
File opened for modification	C:\Program Files\Clickteam Fusion Developer 2.5\Skins\Default\EE_Negation.png	Clickteam_Fusion_R291.6.exe
File opened for modification	C:\Program Files\Clickteam Fusion Developer 2.5\Languages\ja-jp\Modules\GameCenterLeaderboard.txt	Clickteam_Fusion_R291.6.exe
File created	C:\Program Files\Clickteam Fusion Developer 2.5\Lib\Objects\Games\Characters\Fighter - Gold.mfa	Clickteam_Fusion_R291.6.exe
File opened for modification	C:\Program Files\Clickteam Fusion Developer 2.5\MIDI\Other\slick.mid	Clickteam_Fusion_R291.6.exe
File created	C:\Program Files\Clickteam Fusion Developer 2.5\Data\Runtime\Android.json	Clickteam_Fusion_R291.6.exe
File opened for modification	C:\Program Files\Clickteam Fusion Developer 2.5\Data\Runtime\Flash\StaticText.zip	Clickteam_Fusion_R291.6.exe
File created	C:\Program Files\Clickteam Fusion Developer 2.5\Data\Runtime\joyfront.png	Clickteam_Fusion_R291.6.exe
File opened for modification	C:\Program Files\Clickteam Fusion Developer 2.5\Data\Runtime\Unicode\clickteam-regpolygon.mvx	Clickteam_Fusion_R291.6.exe
File created	C:\Program Files\Clickteam Fusion Developer 2.5\Help\StringTokenizer.chm	Clickteam_Fusion_R291.6.exe
File created	C:\Program Files\Clickteam Fusion Developer 2.5\Samples\Creatures\INSECT4.WAV	Clickteam_Fusion_R291.6.exe
File created	C:\Program Files\Clickteam Fusion Developer 2.5\Samples\MISC\BLOWTRCH.WAV	Clickteam_Fusion_R291.6.exe
File opened for modification	C:\Program Files\Clickteam Fusion Developer 2.5\Samples\Weapons\GUN03.WAV	Clickteam_Fusion_R291.6.exe
File created	C:\Program Files\Clickteam Fusion Developer 2.5\Data\Runtime\Flash\StaticText.zip	Clickteam_Fusion_R291.6.exe
File opened for modification	C:\Program Files\Clickteam Fusion Developer 2.5\Languages\fr-fr\Help\hwa.chm	Clickteam_Fusion_R291.6.exe
File created	C:\Program Files\Clickteam Fusion Developer 2.5\Samples\Impacts\IMPACT13.WAV	Clickteam_Fusion_R291.6.exe
File opened for modification	C:\Program Files\Clickteam Fusion Developer 2.5\Samples\Creatures\ROAR3.WAV	Clickteam_Fusion_R291.6.exe
File opened for modification	C:\Program Files\Clickteam Fusion Developer 2.5\Samples\MISC\TELTONE6.WAV	Clickteam_Fusion_R291.6.exe
File created	C:\Program Files\Clickteam Fusion Developer 2.5\Samples\Science Fiction\HITSNTH1.WAV	Clickteam_Fusion_R291.6.exe
File opened for modification	C:\Program Files\Clickteam Fusion Developer 2.5\Data\Runtime\Flash\Flex\templates\client-side-detection-with-history	Clickteam_Fusion_R291.6.exe
File opened for modification	C:\Program Files\Clickteam Fusion Developer 2.5\Data\Runtime\Android\apache-ant\etc\maudit-frames.xsl	Clickteam_Fusion_R291.6.exe
File opened for modification	C:\Program Files\Clickteam Fusion Developer 2.5\Data\Runtime\Android\LauncherIcon.png	Clickteam_Fusion_R291.6.exe
File created	C:\Program Files\Clickteam Fusion Developer 2.5\Data\Runtime\Wua\js\runtime\expressions\EXP_ASIN.js	Clickteam_Fusion_R291.6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
2800	1772	WerFault.exe	101
4376	1772	WerFault.exe	101
4268	2216	WerFault.exe	108
3680	2216	WerFault.exe	108

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "229"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MMF2.Document\shell\print\command\ = "C:\\PROGRA~1\\CLICKT~1.5\\mmf2u.exe /p \"%1\""	mmf2u.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MMF2.Document\shell\printto\command\ = "C:\\PROGRA~1\\CLICKT~1.5\\mmf2u.exe /pt \"%1\" \"%2\" \"%3\" \"%4\""	mmf2u.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MMF2.Document\shell	mmf2u.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MMF2.Document\DefaultIcon\ = "C:\\PROGRA~1\\CLICKT~1.5\\mmf2u.exe,1"	mmf2u.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mfa\ShellNew	mmf2u.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MMF2.Document\shell\printto\command	mmf2u.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MMF2.Document\DefaultIcon\ = "C:\\PROGRA~1\\CLICKT~1.5\\mmf2u.exe,1"	mmf2u.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MMF2.Document\shell\print\command\ = "C:\\PROGRA~1\\CLICKT~1.5\\mmf2u.exe /p \"%1\""	mmf2u.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mfa	mmf2u.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MMF2.Document\shell\print\command	mmf2u.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mfw\ = "MMF2.Document"	mmf2u.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MMF2.Document\ = "MMF2 Document"	mmf2u.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MMF2.Document\shell\print\command	mmf2u.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mfa\ShellNew	mmf2u.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mfw	mmf2u.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MMF2.Document	mmf2u.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mfw	mmf2u.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MMF2.Document\shell\print\command	mmf2u.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MMF2.Document\shell\printto\command	mmf2u.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MMF2.Document\shell\print	mmf2u.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MMF2.Document\shell\printto\command	mmf2u.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MMF2.Document\shell\open	mmf2u.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MMF2.Document\shell\print	mmf2u.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MMF2.Document\shell\print\command\ = "C:\\PROGRA~1\\CLICKT~1.5\\mmf2u.exe /p \"%1\""	mmf2u.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MMF2.Document\ = "MMF2 Document"	mmf2u.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MMF2.Document\DefaultIcon	mmf2u.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mfa	mmf2u.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MMF2.Document	mmf2u.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mfw\ = "MMF2.Document"	mmf2u.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MMF2.Document\shell\print\command	mmf2u.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MMF2.Document\shell\printto	mmf2u.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MMF2.Document\shell\open\command\ = "C:\\PROGRA~1\\CLICKT~1.5\\mmf2u.exe \"%1\""	mmf2u.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MMF2.Document\shell\printto	mmf2u.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mfa\ShellNew	mmf2u.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MMF2.Document\shell\open\command	mmf2u.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MMF2.Document	mmf2u.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MMF2.Document\DefaultIcon	mmf2u.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MMF2.Document\shell\printto\command	mmf2u.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MMF2.Document\shell\print\command	mmf2u.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MMF2.Document\DefaultIcon	mmf2u.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MMF2.Document\shell\printto\command\ = "C:\\PROGRA~1\\CLICKT~1.5\\mmf2u.exe /pt \"%1\" \"%2\" \"%3\" \"%4\""	mmf2u.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MMF2.Document\shell\printto	mmf2u.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mfw\ = "MMF2.Document"	mmf2u.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MMF2.Document\shell\print	mmf2u.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MMF2.Document\shell\open\command\ = "C:\\PROGRA~1\\CLICKT~1.5\\mmf2u.exe \"%1\""	mmf2u.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mfa\ = "MMF2.Document"	mmf2u.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mfa\ShellNew	mmf2u.exe
Key created	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings	mmf2u.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mfa	mmf2u.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MMF2.Document\shell	mmf2u.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mfa\ShellNew\NullFile	mmf2u.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MMF2.Document\DefaultIcon\ = "C:\\PROGRA~1\\CLICKT~1.5\\mmf2u.exe,1"	mmf2u.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MMF2.Document\shell\print	mmf2u.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MMF2.Document\shell\printto\command	mmf2u.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mfa\ = "MMF2.Document"	mmf2u.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MMF2.Document\shell\printto\command	mmf2u.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MMF2.Document\shell\printto	mmf2u.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mfa\ShellNew	mmf2u.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MMF2.Document\shell\printto	mmf2u.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MMF2.Document\shell	mmf2u.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MMF2.Document\shell\open\command\ = "C:\\PROGRA~1\\CLICKT~1.5\\mmf2u.exe \"%1\""	mmf2u.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mfa\ShellNew	mmf2u.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MMF2.Document\shell\printto\command\ = "C:\\PROGRA~1\\CLICKT~1.5\\mmf2u.exe /pt \"%1\" \"%2\" \"%3\" \"%4\""	mmf2u.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mfa\ShellNew\NullFile	mmf2u.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
1772	mmf2u.exe
1772	mmf2u.exe
1772	mmf2u.exe
1772	mmf2u.exe
1772	mmf2u.exe
1772	mmf2u.exe
1772	mmf2u.exe
1772	mmf2u.exe
1772	mmf2u.exe
1772	mmf2u.exe
1772	mmf2u.exe
1812	rundll32.exe
1812	rundll32.exe
1812	rundll32.exe
1812	rundll32.exe
1812	rundll32.exe
1812	rundll32.exe
1812	rundll32.exe
1812	rundll32.exe
1812	rundll32.exe
1772	mmf2u.exe
1772	mmf2u.exe
1772	mmf2u.exe
1772	mmf2u.exe
1772	mmf2u.exe
1772	mmf2u.exe
1772	mmf2u.exe
1772	mmf2u.exe
1772	mmf2u.exe
1772	mmf2u.exe
2216	mmf2u.exe
2216	mmf2u.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
2980	Clickteam_Fusion_R291.6.exe
4824	mmf2u.exe
1772	mmf2u.exe
2216	mmf2u.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2980	Clickteam_Fusion_R291.6.exe
Token: 33	1596	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1596	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4824	mmf2u.exe
1772	mmf2u.exe
2216	mmf2u.exe

Suspicious use of SetWindowsHookEx 21 IoCs

pid	Process
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
4824	mmf2u.exe
2020	hh.exe
2020	hh.exe
1772	mmf2u.exe
1772	mmf2u.exe
1772	mmf2u.exe
1772	mmf2u.exe
1772	mmf2u.exe
1772	mmf2u.exe
2216	mmf2u.exe
2216	mmf2u.exe
2216	mmf2u.exe
2216	mmf2u.exe
2216	mmf2u.exe
2216	mmf2u.exe
4888	LogonUI.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 3976 wrote to memory of 4824	3976	Clickteam Fusion Developer 2.5.exe	94
PID 3976 wrote to memory of 4824	3976	Clickteam Fusion Developer 2.5.exe	94
PID 3976 wrote to memory of 4824	3976	Clickteam Fusion Developer 2.5.exe	94
PID 4824 wrote to memory of 2076	4824	mmf2u.exe	96
PID 4824 wrote to memory of 2076	4824	mmf2u.exe	96
PID 4824 wrote to memory of 2076	4824	mmf2u.exe	96
PID 4824 wrote to memory of 2020	4824	mmf2u.exe	97
PID 4824 wrote to memory of 2020	4824	mmf2u.exe	97
PID 2076 wrote to memory of 1772	2076	Clickteam Fusion Developer 2.5.exe	101
PID 2076 wrote to memory of 1772	2076	Clickteam Fusion Developer 2.5.exe	101
PID 2076 wrote to memory of 1772	2076	Clickteam Fusion Developer 2.5.exe	101
PID 1772 wrote to memory of 1812	1772	mmf2u.exe	102
PID 1772 wrote to memory of 1812	1772	mmf2u.exe	102
PID 1772 wrote to memory of 1812	1772	mmf2u.exe	102
PID 1124 wrote to memory of 2216	1124	Clickteam Fusion Developer 2.5.exe	108
PID 1124 wrote to memory of 2216	1124	Clickteam Fusion Developer 2.5.exe	108
PID 1124 wrote to memory of 2216	1124	Clickteam Fusion Developer 2.5.exe	108
PID 2216 wrote to memory of 4016	2216	mmf2u.exe	109
PID 2216 wrote to memory of 4016	2216	mmf2u.exe	109
PID 2216 wrote to memory of 4016	2216	mmf2u.exe	109

C:\Users\Admin\AppData\Local\Temp\Clickteam_Fusion_R291.6.exe
"C:\Users\Admin\AppData\Local\Temp\Clickteam_Fusion_R291.6.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2980

C:\Program Files\Clickteam Fusion Developer 2.5\Clickteam Fusion Developer 2.5.exe
"C:\Program Files\Clickteam Fusion Developer 2.5\Clickteam Fusion Developer 2.5.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976
- C:\Program Files\Clickteam Fusion Developer 2.5\mmf2u.exe
  "C:\Program Files\Clickteam Fusion Developer 2.5\mmf2u.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Program Files\Clickteam Fusion Developer 2.5\SmartSteamEmu\SmartSteamEmu.dll",InitSSE
    3⤵
    - Loads dropped DLL
    - Writes to the Master Boot Record (MBR)
    - Suspicious behavior: EnumeratesProcesses
    PID:2076
- - C:\Windows\hh.exe
    "C:\Windows\hh.exe" C:\Program Files\Clickteam Fusion Developer 2.5\Languages\en-US\Help\ChocoBreak.chm
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2020

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x33c 0x4e4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1596

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\76d6227ad0114a5bac3012c747d8129e /t 2476 /p 2020
1⤵
PID:4016

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\d5df3338a46d44f5aec4555f6dfbcaa4 /t 4236 /p 4824
1⤵
PID:3600

C:\Program Files\Clickteam Fusion Developer 2.5\Clickteam Fusion Developer 2.5.exe
"C:\Program Files\Clickteam Fusion Developer 2.5\Clickteam Fusion Developer 2.5.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Program Files\Clickteam Fusion Developer 2.5\mmf2u.exe
  "C:\Program Files\Clickteam Fusion Developer 2.5\mmf2u.exe"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1772
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Program Files\Clickteam Fusion Developer 2.5\SmartSteamEmu\SmartSteamEmu.dll",InitSSE
    3⤵
    - Writes to the Master Boot Record (MBR)
    - Suspicious behavior: EnumeratesProcesses
    PID:1812
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1772 -s 2524
    3⤵
    - Program crash
    PID:2800
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1772 -s 3248
    3⤵
    - Program crash
    PID:4376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 1772 -ip 1772
1⤵
PID:3148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1772 -ip 1772
1⤵
PID:1436

C:\Program Files\Clickteam Fusion Developer 2.5\Clickteam Fusion Developer 2.5.exe
"C:\Program Files\Clickteam Fusion Developer 2.5\Clickteam Fusion Developer 2.5.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Program Files\Clickteam Fusion Developer 2.5\mmf2u.exe
  "C:\Program Files\Clickteam Fusion Developer 2.5\mmf2u.exe"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Program Files\Clickteam Fusion Developer 2.5\SmartSteamEmu\SmartSteamEmu.dll",InitSSE
    3⤵
    - Writes to the Master Boot Record (MBR)
    PID:4016
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 3700
    3⤵
    - Program crash
    PID:4268
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 3680
    3⤵
    - Program crash
    PID:3680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2216 -ip 2216
1⤵
PID:3880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2216 -ip 2216
1⤵
PID:1496

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39b2055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Clickteam Fusion Developer 2.5\Clickteam Fusion Developer 2.5.exe

Filesize
227KB

MD5
0e7fde098d64a93e60191d25e06bf642

SHA1
8d0973ef176d03f68d33c4d9e6595ba8c988ff1f

SHA256
44e6e2035db0ab9c4e811e7418c72f01f50e675dbdffd8114e29f965ec62eb38

SHA512
b3a63341882abc284bd8d2718608d7c60b565227e672450497f83f4c72890547b49f3730382a87c94cb2faf172397d79d1108a74068b3e1b5465736dcea98006

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Clickteam Fusion Developer 2.5.exe

Filesize
227KB

MD5
0e7fde098d64a93e60191d25e06bf642

SHA1
8d0973ef176d03f68d33c4d9e6595ba8c988ff1f

SHA256
44e6e2035db0ab9c4e811e7418c72f01f50e675dbdffd8114e29f965ec62eb38

SHA512
b3a63341882abc284bd8d2718608d7c60b565227e672450497f83f4c72890547b49f3730382a87c94cb2faf172397d79d1108a74068b3e1b5465736dcea98006

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Data\RunTime\Unicode\mmfs2.dll

Filesize
460KB

MD5
4758d460ecbb307ed90d59643046f00b

SHA1
2bd87c39f97b73b9db6d205bb10ae37eb82f2372

SHA256
3293a93c6d8a2ce529538fbdd2a81dc623fc40464efdb5348c8e039788ad1b22

SHA512
970a44102539ed3116c125bfcf9075e3acb8f710a338ff8ba881bbebf5111d236b3c27bf325a77d83d295aba8e836439fb6fd54a899e3ef075e1e45b6e2a1fdb

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Data\Runtime\Flash\Flex\bin\copylocale.exe

Filesize
104KB

MD5
20a3dd454acdd5099cc4c59eb255138b

SHA1
0129f364864eeba73331e7b105ee4e1db9c31579

SHA256
3c076fd7994662b071fea7af281ddc136acca5c14af4d03ecd07c98ebfeb9af8

SHA512
07eeb68a8b2661603ec8339647c3d2414616dfbbfc8b1de20112f8b702bfbff8d276776bbd7f7a7ddd71d7267f5360cc6c25bdc38543118a16aaf1597ef48e37

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Data\Runtime\Flash\Flex\templates\express-installation-with-history\AC_OETags.js

Filesize
8KB

MD5
c59b6ec0b4911bf16ae3538c2fdfecd9

SHA1
8321df2d8890ee28fc7fc378403243e29a9c7f70

SHA256
3b7fd24359a196eeb0d32c7145ce160b73130be8c3bdd7e9e9691ee7da9983b7

SHA512
f8efaad1200e87d0b035bbb9fcbdefc7572e06c18e512f9ebc4b5d74e2cd3603b2d227b20299adf75537250586d9f42f172d2103cd8c6e294cff99b1ae7e60ef

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Data\Runtime\Flash\Flex\templates\express-installation\playerProductInstall.swf

Filesize
657B

MD5
be332eb9be4b3dcfdcd757bbc6e495e5

SHA1
02b34f62c2c130752118d8b7a33453a2a2972e41

SHA256
05a1649c572994fa677cd1cff908d6e9354c5b66e322cef3f452092d73f0fc78

SHA512
2a311c2bb88158f0af5fb3818f22f7f5606f09fddd205de3f42626fb3f5069245d31184a32f5a01d85d3ced1a94a72a7ba08ce74d9a058c0ef00b3a46a25457d

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Data\Runtime\Flash\Flex\templates\no-player-detection-with-history\history\history.css

Filesize
365B

MD5
d259eb8de60231b44394917f36c4af65

SHA1
292549d9cc51b2995aafd7d3a95ed7d8739d8e5d

SHA256
d7da3ca179656df2310b9be8cfb92e530a724fccc7d97054e043645834c64abb

SHA512
e651a3596225bee0d1fdb6d113f31241a8b2ed088a8bfe96f20bdde6ea27b2ce213261ba2b077f0bf4372b3b158c83f0065f1f5cd4323e1a508ff66af87f2c63

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Data\Runtime\Flash\Flex\templates\no-player-detection-with-history\history\history.js

Filesize
23KB

MD5
30b14386a765df478134afc86f475c33

SHA1
bb1670726bd4a4dfa8a64d49c089a38820c8e21a

SHA256
21615d6a199185512ad428e9df44cf813c9bab2b0625758a8730da769c846660

SHA512
91d703fce1927627176de2390119775c8ae1b451c5fddae18af3c2bfc97fef7c95241d24b34035601099d475693b309293042bc518dd733304489a05c6fcf638

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Data\Runtime\Flash\Flex\templates\no-player-detection-with-history\history\historyFrame.html

Filesize
798B

MD5
d2256e510a3112d15fcf08a07fdde8b5

SHA1
79a3f67c84705938d18d4f6add9e9dcfcd419a24

SHA256
f2a429019aaa0813d72ed61bd1666af2ce8737d360b012ae97c7aab9853d904e

SHA512
c62880e411e07f361884f90f2061f364d8ee71204e8790a7a9a7cc5c9773613f926b5abd325305204722b5134b3dc0c796940a98c54e0759e94474ae747f4bd1

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Data\Runtime\Unicode\mmfs2.dll

Filesize
460KB

MD5
4758d460ecbb307ed90d59643046f00b

SHA1
2bd87c39f97b73b9db6d205bb10ae37eb82f2372

SHA256
3293a93c6d8a2ce529538fbdd2a81dc623fc40464efdb5348c8e039788ad1b22

SHA512
970a44102539ed3116c125bfcf9075e3acb8f710a338ff8ba881bbebf5111d236b3c27bf325a77d83d295aba8e836439fb6fd54a899e3ef075e1e45b6e2a1fdb

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Data\Runtime\Xna\Xbox\AdvDir.zip

Filesize
2KB

MD5
8eeba571808518c9ebccd2e17ce0ab99

SHA1
48ef84f13196fcfce06d477177c35b9543ea7f8f

SHA256
e51050a4c12f2bb503aa13188a308f8c9e356ebec5c6ca0a90743d6fad702ef4

SHA512
d6fc0100fb0f9f9bea4d50c953a3867c615176a0b5fb0b4fb61d12fdfc354e6a5c0bfb4ef9621ce8da52864fdc3abb5f18e4befe855e51378dc7acc83663e394

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Data\Runtime\iPhone\AdvDir.ext

Filesize
17B

MD5
c89eb6fad4cc25a8bbcb19af8fc243a4

SHA1
eef33f3fb14d22d964250e9cda897c58c40afb41

SHA256
6b6c15a2917c0c3b2fe6ae09ac55ba5ccd446138325b8f9864fc8373f775c3fa

SHA512
3cd75cc6566946d995406bf13c79379747803aa000f96f0b04af5844c26f1eb1381b7dc66cfd1e69c247978cbcd24c44909f2637be7779fe98c718d156b983c8

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Filters\Images\aviflt.ift

Filesize
24KB

MD5
c793619e902345e6ffeae952cbba76ec

SHA1
6e2b49dfb8edcf88407914d90cdd8f7feef56100

SHA256
30bd50d461b308c5692932b84683fca7017f38902823f73f4fb5c5a543885a91

SHA512
6b37cd1930450f4be9a77c8f525710143b12a03d65d781ac382c285a284f8d727f5490506001482b020397be2e1f8f30974b9308882dfc1269302c32470c81ce

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Filters\Images\aviflt.ift

Filesize
24KB

MD5
c793619e902345e6ffeae952cbba76ec

SHA1
6e2b49dfb8edcf88407914d90cdd8f7feef56100

SHA256
30bd50d461b308c5692932b84683fca7017f38902823f73f4fb5c5a543885a91

SHA512
6b37cd1930450f4be9a77c8f525710143b12a03d65d781ac382c285a284f8d727f5490506001482b020397be2e1f8f30974b9308882dfc1269302c32470c81ce

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Filters\Images\bmpflt.ift

Filesize
24KB

MD5
3c7bbedd1de15e2cd0c09acd2bf4617d

SHA1
714cb1b1094910e82b96aba525470caa1b5cb5cd

SHA256
7eba12f554588de8b46a3f7cf65b68b06884a5a1c092ab7eed4725dd10d8db2d

SHA512
d6a91ad501411e82edf2ae945d0506ab59198f1855968c7e8a1b929c972d9627c1c62a3b98922e37b8b1450db7bc56e7f2b9100af894d3619e86041df5d88d57

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Filters\Images\bmpflt.ift

Filesize
24KB

MD5
3c7bbedd1de15e2cd0c09acd2bf4617d

SHA1
714cb1b1094910e82b96aba525470caa1b5cb5cd

SHA256
7eba12f554588de8b46a3f7cf65b68b06884a5a1c092ab7eed4725dd10d8db2d

SHA512
d6a91ad501411e82edf2ae945d0506ab59198f1855968c7e8a1b929c972d9627c1c62a3b98922e37b8b1450db7bc56e7f2b9100af894d3619e86041df5d88d57

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Filters\Images\bmpflt.ift

Filesize
24KB

MD5
3c7bbedd1de15e2cd0c09acd2bf4617d

SHA1
714cb1b1094910e82b96aba525470caa1b5cb5cd

SHA256
7eba12f554588de8b46a3f7cf65b68b06884a5a1c092ab7eed4725dd10d8db2d

SHA512
d6a91ad501411e82edf2ae945d0506ab59198f1855968c7e8a1b929c972d9627c1c62a3b98922e37b8b1450db7bc56e7f2b9100af894d3619e86041df5d88d57

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Filters\Images\fliflt.ift

Filesize
28KB

MD5
aedf2a0f1e448c227cfe5295e21443da

SHA1
f8f809ab5eee9f35c08b90b5638dd201f01eb855

SHA256
c19c21866f90df64d822458247fe7476d078d5333982ac9cd3cd8ebb3ca83257

SHA512
98112e2d735669c38192573a5d661865388eae962bbc607a3069d7a592ee64faa50189729a2ec6312777d380c13a868dd5f406cfe2962551ef92d41be3462595

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Filters\Images\fliflt.ift

Filesize
28KB

MD5
aedf2a0f1e448c227cfe5295e21443da

SHA1
f8f809ab5eee9f35c08b90b5638dd201f01eb855

SHA256
c19c21866f90df64d822458247fe7476d078d5333982ac9cd3cd8ebb3ca83257

SHA512
98112e2d735669c38192573a5d661865388eae962bbc607a3069d7a592ee64faa50189729a2ec6312777d380c13a868dd5f406cfe2962551ef92d41be3462595

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Filters\Images\fliflt.ift

Filesize
28KB

MD5
aedf2a0f1e448c227cfe5295e21443da

SHA1
f8f809ab5eee9f35c08b90b5638dd201f01eb855

SHA256
c19c21866f90df64d822458247fe7476d078d5333982ac9cd3cd8ebb3ca83257

SHA512
98112e2d735669c38192573a5d661865388eae962bbc607a3069d7a592ee64faa50189729a2ec6312777d380c13a868dd5f406cfe2962551ef92d41be3462595

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Filters\Images\gifflt.ift

Filesize
28KB

MD5
d2bc2e97a0bf414b81d2344b638cec9f

SHA1
c6a75237217f219c0da74c2760b2ecc0d8390e8c

SHA256
08239a4f12043aab7afe3ba786f0c32c6d181350e2bd56bc1cfe99e2c4f5a967

SHA512
5d2f000dd11bff989a31f9e378d7b23ae10833f1e77d3c08fa4a386960b649d4f230ab27249c2a32d3bf0224150d2dda0fc680d20bdfa25e64383dea18868aff

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Filters\Images\gifflt.ift

Filesize
28KB

MD5
d2bc2e97a0bf414b81d2344b638cec9f

SHA1
c6a75237217f219c0da74c2760b2ecc0d8390e8c

SHA256
08239a4f12043aab7afe3ba786f0c32c6d181350e2bd56bc1cfe99e2c4f5a967

SHA512
5d2f000dd11bff989a31f9e378d7b23ae10833f1e77d3c08fa4a386960b649d4f230ab27249c2a32d3bf0224150d2dda0fc680d20bdfa25e64383dea18868aff

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Filters\Images\gifflt.ift

Filesize
28KB

MD5
d2bc2e97a0bf414b81d2344b638cec9f

SHA1
c6a75237217f219c0da74c2760b2ecc0d8390e8c

SHA256
08239a4f12043aab7afe3ba786f0c32c6d181350e2bd56bc1cfe99e2c4f5a967

SHA512
5d2f000dd11bff989a31f9e378d7b23ae10833f1e77d3c08fa4a386960b649d4f230ab27249c2a32d3bf0224150d2dda0fc680d20bdfa25e64383dea18868aff

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Filters\Images\jpgflt.ift

Filesize
96KB

MD5
04cd791dbb7093995f8c74599e0eacfd

SHA1
dda08614b569e86bf61a31654231f5cf6a0fb22e

SHA256
a4a0ea3663b02f2953fbf6a1a89b9ec3039d36c081ee97ecbf22988af9212109

SHA512
bb79f9e79fea31d7388fee4969f339db00f1da7b03584da5b0bf54451cbb0369bdda9d5ff4ab2a3f943b354eb5f64af3693766b742f1de30d58e6d7ead59d37a

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Filters\Images\jpgflt.ift

Filesize
96KB

MD5
04cd791dbb7093995f8c74599e0eacfd

SHA1
dda08614b569e86bf61a31654231f5cf6a0fb22e

SHA256
a4a0ea3663b02f2953fbf6a1a89b9ec3039d36c081ee97ecbf22988af9212109

SHA512
bb79f9e79fea31d7388fee4969f339db00f1da7b03584da5b0bf54451cbb0369bdda9d5ff4ab2a3f943b354eb5f64af3693766b742f1de30d58e6d7ead59d37a

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Filters\Images\jpgflt.ift

Filesize
96KB

MD5
04cd791dbb7093995f8c74599e0eacfd

SHA1
dda08614b569e86bf61a31654231f5cf6a0fb22e

SHA256
a4a0ea3663b02f2953fbf6a1a89b9ec3039d36c081ee97ecbf22988af9212109

SHA512
bb79f9e79fea31d7388fee4969f339db00f1da7b03584da5b0bf54451cbb0369bdda9d5ff4ab2a3f943b354eb5f64af3693766b742f1de30d58e6d7ead59d37a

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Filters\Images\pcxflt.ift

Filesize
24KB

MD5
c23f1f940003f7854e35badee0f77a61

SHA1
0e2914ea8f424d6ba3dcfe666a81d4f6d6d45417

SHA256
c92ad0389965a2d23cbdd3cb7c5bbb696f026ff34848e55722cef1fab7b05795

SHA512
ac63f9d3c541285434903b02b5874ada9ba5c4b5f4c2ec64d2e7efaf8ee3ad1e4097732ae6a99d611b7fe14fa33aa4628953848fd3d180bb14f1e89bc716b398

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Filters\Images\pcxflt.ift

Filesize
24KB

MD5
c23f1f940003f7854e35badee0f77a61

SHA1
0e2914ea8f424d6ba3dcfe666a81d4f6d6d45417

SHA256
c92ad0389965a2d23cbdd3cb7c5bbb696f026ff34848e55722cef1fab7b05795

SHA512
ac63f9d3c541285434903b02b5874ada9ba5c4b5f4c2ec64d2e7efaf8ee3ad1e4097732ae6a99d611b7fe14fa33aa4628953848fd3d180bb14f1e89bc716b398

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Filters\Images\pcxflt.ift

Filesize
24KB

MD5
c23f1f940003f7854e35badee0f77a61

SHA1
0e2914ea8f424d6ba3dcfe666a81d4f6d6d45417

SHA256
c92ad0389965a2d23cbdd3cb7c5bbb696f026ff34848e55722cef1fab7b05795

SHA512
ac63f9d3c541285434903b02b5874ada9ba5c4b5f4c2ec64d2e7efaf8ee3ad1e4097732ae6a99d611b7fe14fa33aa4628953848fd3d180bb14f1e89bc716b398

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Filters\Images\pngflt.ift

Filesize
288KB

MD5
b8c313b40ccb2218507ea9fce09f35ff

SHA1
768344d10604331d442a8886e161e3a837425d0f

SHA256
abc8cbba8cba5afccef042b6ac9b9d77d2d96d79feb7661afda15cdc037a6883

SHA512
d77b420ecbf615c4a283f0fa8bbb0bd8fed547588486a4b246cbc60238fe7c00804ac9958f36dea20ba4c66909c47270d5f4bfd3ea35febd9bce4a4f372c6465

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Filters\Images\pngflt.ift

Filesize
288KB

MD5
b8c313b40ccb2218507ea9fce09f35ff

SHA1
768344d10604331d442a8886e161e3a837425d0f

SHA256
abc8cbba8cba5afccef042b6ac9b9d77d2d96d79feb7661afda15cdc037a6883

SHA512
d77b420ecbf615c4a283f0fa8bbb0bd8fed547588486a4b246cbc60238fe7c00804ac9958f36dea20ba4c66909c47270d5f4bfd3ea35febd9bce4a4f372c6465

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Filters\Images\tgaflt.ift

Filesize
24KB

MD5
1cd183ea8b2fd5dfd12506e8b5b1fa09

SHA1
65ac6fa86b87e1847dd46fa0c98ac46751c00c14

SHA256
762cf4671dedd1dfff92b79eb69e572f69182bc3a491cb6762c4ecd88a0e3a85

SHA512
0cfe97241eb002b0e0f512413bc1584d2b5f58394bc8aa18eb4dd4136bc6ad4b464793367faee8ecddf7ab1554861700c7a2b8b446e656176523f046e02d077a

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Filters\Images\tgaflt.ift

Filesize
24KB

MD5
1cd183ea8b2fd5dfd12506e8b5b1fa09

SHA1
65ac6fa86b87e1847dd46fa0c98ac46751c00c14

SHA256
762cf4671dedd1dfff92b79eb69e572f69182bc3a491cb6762c4ecd88a0e3a85

SHA512
0cfe97241eb002b0e0f512413bc1584d2b5f58394bc8aa18eb4dd4136bc6ad4b464793367faee8ecddf7ab1554861700c7a2b8b446e656176523f046e02d077a

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Filters\Images\tgaflt.ift

Filesize
24KB

MD5
1cd183ea8b2fd5dfd12506e8b5b1fa09

SHA1
65ac6fa86b87e1847dd46fa0c98ac46751c00c14

SHA256
762cf4671dedd1dfff92b79eb69e572f69182bc3a491cb6762c4ecd88a0e3a85

SHA512
0cfe97241eb002b0e0f512413bc1584d2b5f58394bc8aa18eb4dd4136bc6ad4b464793367faee8ecddf7ab1554861700c7a2b8b446e656176523f046e02d077a

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Filters\Sounds\aiffflt.sft

Filesize
6KB

MD5
a9d967ec972eb6e073068ac2da0075bf

SHA1
dc0e6751c7abcb58258d0c7c4fffc382768a0fe6

SHA256
5c00a02a5c0084a6681d34e97f8dacb80742c7e1ea1682a9d7efc9723e970dee

SHA512
71eb106fe9f71c2f7fb0cce5bed0b67e8092f47311516bd18fac73ddab7e6bc93f40398043cc0aef6385cd8256c6c53f36ba0a38ec46d75e0befb14365ee9aa8

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Filters\Sounds\aiffflt.sft

Filesize
6KB

MD5
a9d967ec972eb6e073068ac2da0075bf

SHA1
dc0e6751c7abcb58258d0c7c4fffc382768a0fe6

SHA256
5c00a02a5c0084a6681d34e97f8dacb80742c7e1ea1682a9d7efc9723e970dee

SHA512
71eb106fe9f71c2f7fb0cce5bed0b67e8092f47311516bd18fac73ddab7e6bc93f40398043cc0aef6385cd8256c6c53f36ba0a38ec46d75e0befb14365ee9aa8

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Filters\Sounds\aiffflt.sft

Filesize
6KB

MD5
a9d967ec972eb6e073068ac2da0075bf

SHA1
dc0e6751c7abcb58258d0c7c4fffc382768a0fe6

SHA256
5c00a02a5c0084a6681d34e97f8dacb80742c7e1ea1682a9d7efc9723e970dee

SHA512
71eb106fe9f71c2f7fb0cce5bed0b67e8092f47311516bd18fac73ddab7e6bc93f40398043cc0aef6385cd8256c6c53f36ba0a38ec46d75e0befb14365ee9aa8

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Filters\Sounds\modflt.sft

Filesize
139KB

MD5
6e5eb546f1d4c9b14bb7caba03511bb7

SHA1
fe8ada3a3abe687c8ef8cd2e0216d73827041241

SHA256
e1744d0a36f01213f79a3db6e062f2d5ced5d78e7a4cd5770ec63669ffef2779

SHA512
ca6e57d7974247179f3974260d2b401ea78a9af0e80c616d67252392dd8fe3cfaff4a3a93019ab0c501111f985da588365e5d5aee2977ce48596edaa807366bb

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Filters\Sounds\modflt.sft

Filesize
139KB

MD5
6e5eb546f1d4c9b14bb7caba03511bb7

SHA1
fe8ada3a3abe687c8ef8cd2e0216d73827041241

SHA256
e1744d0a36f01213f79a3db6e062f2d5ced5d78e7a4cd5770ec63669ffef2779

SHA512
ca6e57d7974247179f3974260d2b401ea78a9af0e80c616d67252392dd8fe3cfaff4a3a93019ab0c501111f985da588365e5d5aee2977ce48596edaa807366bb

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Filters\Sounds\modflt.sft

Filesize
139KB

MD5
6e5eb546f1d4c9b14bb7caba03511bb7

SHA1
fe8ada3a3abe687c8ef8cd2e0216d73827041241

SHA256
e1744d0a36f01213f79a3db6e062f2d5ced5d78e7a4cd5770ec63669ffef2779

SHA512
ca6e57d7974247179f3974260d2b401ea78a9af0e80c616d67252392dd8fe3cfaff4a3a93019ab0c501111f985da588365e5d5aee2977ce48596edaa807366bb

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Filters\Sounds\mp3flt.sft

Filesize
24KB

MD5
f0ebc8596156d8ebf6201a10f9864305

SHA1
0efd689d027d2d592369c3585cdd9a0b879e6562

SHA256
fcca0e08e8a64081d71f3ad7455cb5bea48e73f158f0773e856fa100914fe192

SHA512
7752fb5d3d114791c7940088b98c03252d6fb151ad11774a8fd8b4fdf2d289c66b5d54a56feddda2e2e4de125f7f6b75c1197eae276add1774e3290becd8bcf7

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Filters\Sounds\mp3flt.sft

Filesize
24KB

MD5
f0ebc8596156d8ebf6201a10f9864305

SHA1
0efd689d027d2d592369c3585cdd9a0b879e6562

SHA256
fcca0e08e8a64081d71f3ad7455cb5bea48e73f158f0773e856fa100914fe192

SHA512
7752fb5d3d114791c7940088b98c03252d6fb151ad11774a8fd8b4fdf2d289c66b5d54a56feddda2e2e4de125f7f6b75c1197eae276add1774e3290becd8bcf7

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Filters\Sounds\mp3flt.sft

Filesize
24KB

MD5
f0ebc8596156d8ebf6201a10f9864305

SHA1
0efd689d027d2d592369c3585cdd9a0b879e6562

SHA256
fcca0e08e8a64081d71f3ad7455cb5bea48e73f158f0773e856fa100914fe192

SHA512
7752fb5d3d114791c7940088b98c03252d6fb151ad11774a8fd8b4fdf2d289c66b5d54a56feddda2e2e4de125f7f6b75c1197eae276add1774e3290becd8bcf7

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Filters\Sounds\oggflt.sft

Filesize
130KB

MD5
3c63ea4611008fbcf86435559e9dffab

SHA1
fdc9c6302fcc427530b2dbff63aad1b6d204125a

SHA256
9efb0b4cff5bb033cf1e04bdeabc581db7d787399c5238f4fb40a1e820aac6b8

SHA512
938c6ebbd0a7248f32bc83d2548791b35764417a74728b8b861d2bd539c182ced6f5168a604679e20c150dc6741fd6868768e7d1ffce224667546d3ea80787d3

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Filters\Sounds\oggflt.sft

Filesize
130KB

MD5
3c63ea4611008fbcf86435559e9dffab

SHA1
fdc9c6302fcc427530b2dbff63aad1b6d204125a

SHA256
9efb0b4cff5bb033cf1e04bdeabc581db7d787399c5238f4fb40a1e820aac6b8

SHA512
938c6ebbd0a7248f32bc83d2548791b35764417a74728b8b861d2bd539c182ced6f5168a604679e20c150dc6741fd6868768e7d1ffce224667546d3ea80787d3

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Filters\Sounds\oggflt.sft

Filesize
130KB

MD5
3c63ea4611008fbcf86435559e9dffab

SHA1
fdc9c6302fcc427530b2dbff63aad1b6d204125a

SHA256
9efb0b4cff5bb033cf1e04bdeabc581db7d787399c5238f4fb40a1e820aac6b8

SHA512
938c6ebbd0a7248f32bc83d2548791b35764417a74728b8b861d2bd539c182ced6f5168a604679e20c150dc6741fd6868768e7d1ffce224667546d3ea80787d3

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Filters\Sounds\waveflt.sft

Filesize
8KB

MD5
5230a9c12b9829c9fd333cd8b0620011

SHA1
0becf7512f498c18af3b9943a4b2556a769cc8eb

SHA256
98134d326a09569bd5933ffcb026009575509a1bfc20384ef8eebb762aabcd38

SHA512
1a6a5a72fed0458152ca830941b3d07e448bb588fc61a24c97561833b882e23a529a0a78036732cca95013170a46cc5444a4d642bf05a4fa5a474d51d40789d5

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Languages\ja-jp\Help\Movements\images\InAndOut.gif

Filesize
1KB

MD5
2f3c5f8ed019b7cae7fdfbf8d5a67148

SHA1
8523dcd2a957f86c748d04e36efd3fdb7dc8a0d2

SHA256
f0896b65175054d69cf0b86fa426b67b1197a4ad8e22ab7b38af7c3ed98821fa

SHA512
a8a81660e42b689b509e419213354a6b22a26955c8fb7423cdba74326c7b7af5bbc1cc3d1944243c965e5bc50f33d881e365475d4439f0ec0c07a477ec046610

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Languages\ja-jp\Help\Movements\images\extension-clickteam-icon.png

Filesize
1KB

MD5
e279bc4b2b50021aae0cf580bcf23d73

SHA1
5606979106c7c55d7eb62f393735a663adcd83eb

SHA256
490e3dc6b2497bab016a6155dafbf57dd07a33c2bf34b583a4134501eb45f61c

SHA512
2f46d012410cf5917ef3d0259cd7eff13c096cb51bac9ec55102090d505773f466eb654e515508da3323aecc141b520c4905b1430a19da2d157d4ad39612a4fd

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Languages\ja-jp\Help\Movements\style_default.css

Filesize
1KB

MD5
2539837a30ae66caba95d3fc8f6a30c5

SHA1
befcbcdafefdecbc944822b708c0e4e91173484a

SHA256
374ebcdd21951428d8c3b515aadef464a4fe42775b39a98f92d71227ba55883c

SHA512
737ba7fbc1ffc7a926d57098d478c139f8838f17a8d7fa4417696d0e3933c8a036fd060d93ec9546dee7b7a734f3de733f0e792e7a1d67c57a1fce32e4801473

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Languages\ja-jp\Html\limits\images\backlogo.png

Filesize
74KB

MD5
88357a4773a9153af93e1b6a74a27143

SHA1
e29a7a34a4bae04276441fdec5d9da91650d0970

SHA256
81b976b268db69307d080f17352bdd28efd0a43378249769900a2058af5f0174

SHA512
088abd8512b116a5841586a7955aaed79ad6587f706381f2ac18118390cb7424b1f74287b95a79cdea083b3d37fb653a457371e4c4e045b17eaa5f4f0a2be858

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Languages\ja-jp\Html\limits\style.css

Filesize
2KB

MD5
a81d29ef02bc8f8764fd6e30630166c3

SHA1
1bbd3a0b8e5423d9c3f8cc2a8e116f9541e4ddec

SHA256
8d4184f9ef5a998ff313cb3d34023948820060869800582b4d5d923e2c079127

SHA512
4707898f89ca8c7a3335017d13f469ff0217ec423478c51589deeef945078658278cb47e90d012bfb33dd4d4a6991aab7c7ce77a446ffad484c96259bc35dfc4

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Skins\Dark\STB_Foreground.png

Filesize
1KB

MD5
3ef177ff1a29ef9f24702e128c4c0995

SHA1
3e8f1c350c50258c52644356720053bd6eb870aa

SHA256
5fcdd04b72cfd9179ed885726cff05b09c9927ff1ddb6275bf0a9b23f5b3a515

SHA512
6d040f0a48ae28b32c63a33d22cb5a4600a17574ef5c8943336ae3a98c71eb20a3b2139681c9279dd847a8f33cb71a50d89441708a654589f151ae44b3e40413

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Skins\Girly\EE_Inactivated.png

Filesize
14KB

MD5
284e421cb3f85b1c7f297c88484ad159

SHA1
3bf3b2c8d3a7746e521e01dbe15afb00457d7708

SHA256
bf0b9d42124275182053469fb65dc4ed95f5b65371be1c4c134ecb0d3a5c8173

SHA512
a6b2948f98bb3c6c1628c768ac5561faf154436b33a77b282f12369ce289f7b0183494844fcbe20a7100d26387fa35c3ce52077b60a924b9e5dbbebe27a911f6

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Skins\Girly\EE_Remark.png

Filesize
14KB

MD5
d054eb4fbc666a64c038c5173110dcd5

SHA1
d42c1a27f499f51ec0d0ec9c7b61345c04b13bba

SHA256
db218e37c7cfc95fc6d8f126ee7676b2780494cf6561c28701e751d8ed0c852e

SHA512
1480e17ba7b416d5790c833927847e7bd163d51131532e3c14eab437c8000bf515848fdb7bcfc1b888c168c2c4086c5118f679d802ff07371001ea9000bf06f4

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Skins\Girly\STB_FadeIn.png

Filesize
14KB

MD5
eb41ab19e5438fbaab207cca9fc80d9b

SHA1
6014fe672022510723458136bebe6a8d179bd3db

SHA256
760ac176652caed784ceec483549d2c3e4b653f38d4ed57e079cf6163492b2b1

SHA512
211485a08fc00e1b2775aa077c62b8f3da8fbf82991f4cb5f7ae85c775f69b94e61f38cb49f8a99f1e1efb34e1454884480ac871773632c3b5e4facb291356a3

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Skins\Girly\STB_FadeInSelected.png

Filesize
15KB

MD5
4ecf2dd1bc28f6f634b31b816daf49db

SHA1
9b71f52d35aa79c3228cc2573501c01559990569

SHA256
f56a199fdf81113bb91d2f126c462995ec22253bfb64722b3e8751382ece6bed

SHA512
999ddee36822fb192b29c7f496fff1a848d86a2fc8ab5c878b2be539f8491835041bbc19e563be6b46c56fade903a1f828bcec6e8622620cb116828abf42bbf5

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Skins\Girly\STB_FadeOut.png

Filesize
14KB

MD5
4cbbc24b756c09f91d2a8670779f24f9

SHA1
3375192fd3dd86adec74508f65e824c3df23ec82

SHA256
9c42d34357986fd2d12ffbd80aa6c3843ae3d0970b6cce7b852cdbae3957a0a5

SHA512
a3a48f1d679aa32b3c3169ac4489e555def89156c489c159bacf09cad5febfa8169d98eeb3ba5225f8b34372b2cb2e3ce2de8c1d28d68f879c2fa8b8e8891e4b

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Skins\Girly\STB_FadeOutSelected.png

Filesize
15KB

MD5
47ca972b198463f852e8871a6c48105d

SHA1
3d6850febcda9ef008f84c3b05a105bbe1070efb

SHA256
ed4c71d46e1af9b8de7b8f6710869b520acd2a35cc77cfc3bc50eddd53419677

SHA512
09b177b53ef4a85c566630968e515ce1ecd7f3946ab85695ad6daa6d577a8aefcb840c47bea07c1877890b4d7bb36abdf3e7a59a7218b7b379a6607d03ae0491

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Skins\Girly\STB_Foreground.png

Filesize
59KB

MD5
884df62203582d40271e57397f7c3ec5

SHA1
fc42746bc97d8ef2905a0eb9329f7fc9bcd5940f

SHA256
90db706421adc3c6306aff6803ea39ca9198b7e8d4f240c8a7e40922c833b56b

SHA512
c8b3d647375330ca4a2c6c84a3a99996fc5a218067f225b3245d9b641915a9124c7b438f3b2ed1928cd019e1ffde243442d3ba691041ec2272e0a3b0c1ebebe8

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Skins\Pastel\EE_ActionInfo.png

Filesize
15KB

MD5
c35da9d29fae1e4846fbc2a46722cc1f

SHA1
25aacaba158eb504bbc3f897d34d326a7e00206d

SHA256
fb1dc31cf4a4eac016174519d30930ac3710a54f66df026a674ef0a3f33521d3

SHA512
530d926576ec41657219be91073f3716b3a859b92ccbba35b9346f3b0fe4acb3c06293d39c2c24a62570073a806d315985e097ef72204d28ac58648b44c835cc

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Skins\Pastel\EE_Folder.png

Filesize
17KB

MD5
3e47814cda0ee0541b49cace51cde2bd

SHA1
6903b0f5eff03d811ff6e1838c64d652559ece7f

SHA256
b32351674684c286b755c0449281c5ef7e53d653651d63edacac605bf9d5f038

SHA512
cd2fee563cba01a72606358497dc61db295c4ac623aa5bc11e1c34005bf42e68b5f7afbef6cfc5a4280bc692ada60c729ba80748b7f9c04dc21a2b561ceae5f5

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Skins\Pastel\EE_FolderPrevious.png

Filesize
17KB

MD5
482f6ede510e5bb86ebdf4031f08d59c

SHA1
08c6b9b63516d4941ceaa2d49ecf08095c27b29d

SHA256
4e2410b865c5af54985743c214f165b59a51cd4ca45bc5e48146128cefba6afb

SHA512
6078f63ff570efa4c55e5980096c25fe1e93ba9deb8d82506bbcd625b2fec4bfe26b0e3098ef506f4d89530c8d875ab706a1342f87b1497ffb0313189b44c881

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Skins\Pastel\EE_Hidden.png

Filesize
18KB

MD5
7073a06be554148e855489c830082e3d

SHA1
8ced2b4b72e5e8c4ef362726e7ca1f6672cc468c

SHA256
cba42d05f15e762ed14b2fe547317f24ee7c82c3eb700190cbae70dc3eb8ea77

SHA512
8a9685bebad9b6b2a4807879ff0be904d465390a26ca34e9ac865033b66363d90cf15360ffebc9240d11501444032412160424cc7ae76c67df3d4cc297d68d33

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Skins\Pastel\EE_Import.png

Filesize
17KB

MD5
36f16d3118b8afa97f5984468eb92d12

SHA1
f09fca50f3971a8fe949b3a2f5eb68eee9e46e3f

SHA256
718c3da1e4f3a3c119ba2408c31db0fe28ed1ac6f04f4ea33e8e5b427a6fbb7b

SHA512
9abaa97b754fda49edcda838ec260a6612f33a14a5619d0193ca29cd99a1efe2e9b9c8ca647e7002cd0fb5964f67cc9103f9830144ef87ada8e96df4390eac98

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Skins\Pastel\EE_Negation.png

Filesize
922B

MD5
304ff1467cfb8488276c168fc4366902

SHA1
4c57e8516c535fc08fdb3a7d630e442864bcda37

SHA256
7b09a1c63559066d2f99028b68142226f127a0b67b5adc9c6408257b4c2751b8

SHA512
d554a291a25e17f423280e10507c2078a7c8f5ad82710075e9d7c7800c16503a0186d82185d3194676565186344f5c9fe44e441ed14efaeb8ce416c971f961a0

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Skins\Pastel\EE_ObjectEvents.png

Filesize
14KB

MD5
92e5d06a2bbce3b313aea881fd4cd87a

SHA1
aacea92685854e200ccc245f51db9ecbc688436e

SHA256
ceac7d5a27577af63a8fc26e655a892fb0df5c88461925d59db58b160041488c

SHA512
eb15eed3ee63ceae67bbaa4900a5f4eb653382615cb478ec2d17c0378674dd70f8f1455ade90b7abd50aa8c670e6e587bc281ea150a4dc171d19aa87998000da

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Skins\Pastel\EE_ObjectsEventsSelected.png

Filesize
168B

MD5
6cff9e401c6ea7160a30996870906470

SHA1
7849816bbb0452993568a59d22e5304ccb3a8d8a

SHA256
e311cfa119792ec359a4caac829c8362119dac35a70246760c36630c1b93cf28

SHA512
459280fe56a2ec69daa5b61618659e034e46b80f819d0f2a6439dcc3b1911a514b9c2a043e4d84bfccba713059acbdff0b8471e0e1dd7add31b41080ee2c4afa

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Skins\Pastel\EL_EventButtons.png

Filesize
169B

MD5
ea471882d5efd58c9cab511f4444f06d

SHA1
3b6c903f7f3baeb0201d1aad9e997b46eda23a20

SHA256
566164047a34cbd82cab3c7060396ea5c999cb89d270bb00d61c4a48bc2d9bf0

SHA512
f75893487e23735ed611ca1bc93f58dfe79039034df2335fba254f20121c1aa732505514c481500705125351e72ab3c96944f9113d389ff13c116a28c9f924de

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Skins\Pastel\EL_EventButtonsSelected.png

Filesize
169B

MD5
aa1aaf02db41a3a26dff874f53e816b0

SHA1
cd1b3d497b2893c25794b8d1cc3a26d61f48625c

SHA256
0996d8bd238dc0965c362d3649b45da04ae4b3eaf19eb110eb42dbef49faeb05

SHA512
82c89ddfe8620183ec87103ef24003ac1a09a2ebbaaa6f42fd47231bead5e385d5c7fec03f6b5e6db48b9db9cbd9e599b0863df6b2c9d3cc9169f70c2f3d60ba

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Skins\Pastel\STB_Foreground.png

Filesize
61KB

MD5
4a471a7cbe80a639a7a679c55bf41e33

SHA1
91b4a67b14d760d5e319677ae3246ef308b5dbbc

SHA256
4becef3126ac35bd594379215cdb88c80c1aacaea4f1bf936d8c889e9600a474

SHA512
2415b9ea1fdd62a91b3d8cf1f2261e3b48c0616e8b2b7ca308e9161a6b768ec219a962c796177c4af1b536d273477bfbbe454458d80c28ced040ae2f92fefc51

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Skins\Pastel\STB_FrameSize.png

Filesize
15KB

MD5
d10c11ed8c028851a954bc29c0c474a6

SHA1
f02ec5caecf3f9333f83afad908ecea61021ae20

SHA256
5e463bdf9ae5b5dd7a4fd06fce8506744a206067826e98db365fcc2a9ee1ffe4

SHA512
9c2003875d378575add062dd9390304a379a70e743aa9687425fedb84607b18f010cefecdd9b0132f775519b1c5d9bcd533ea97b1bf4ab637b869d9830b74a3a

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\SmartSteamEmu.ini

Filesize
549B

MD5
ca244af85b2a0699c1602a86ac948658

SHA1
6817c9c8cce39328f1d1389754222b2f97f2a887

SHA256
e41dfe025f44577ebb159ede1711b01969ffe4738e99bee8673174ad3d76770b

SHA512
63f9a453d858e0ada042defa5c15d0ae27b7b298ea25efdf9e9fcc4c57d6132f49feb9e225ce099a4037c2c6198628ecf4eefe2a61ef357e881e07b6cfebb00b

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\SmartSteamEmu\SmartSteamEmu.dll

Filesize
4.8MB

MD5
ce9cad38253b2991281d3c38e5a07735

SHA1
89eb8dbbf362e59469b37429b50728a80f2b31e2

SHA256
6800f3dc1d74beb791e3e6e12ab0d6202c116a6ce21006ba67a723b64837d17d

SHA512
92ae6fa19894e800a15dc3f28e1702badeaa0c18bb1ecb2cb6de75c0fd75da06d44ec49903dcfaa53107b5f871c85047d5965ef90ed1727f5804cb9f84b0496f

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\SmartSteamEmu\SmartSteamEmu.dll

Filesize
4.8MB

MD5
ce9cad38253b2991281d3c38e5a07735

SHA1
89eb8dbbf362e59469b37429b50728a80f2b31e2

SHA256
6800f3dc1d74beb791e3e6e12ab0d6202c116a6ce21006ba67a723b64837d17d

SHA512
92ae6fa19894e800a15dc3f28e1702badeaa0c18bb1ecb2cb6de75c0fd75da06d44ec49903dcfaa53107b5f871c85047d5965ef90ed1727f5804cb9f84b0496f

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\SmartSteamEmu\SmartSteamEmu.dll

Filesize
4.8MB

MD5
ce9cad38253b2991281d3c38e5a07735

SHA1
89eb8dbbf362e59469b37429b50728a80f2b31e2

SHA256
6800f3dc1d74beb791e3e6e12ab0d6202c116a6ce21006ba67a723b64837d17d

SHA512
92ae6fa19894e800a15dc3f28e1702badeaa0c18bb1ecb2cb6de75c0fd75da06d44ec49903dcfaa53107b5f871c85047d5965ef90ed1727f5804cb9f84b0496f

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\SmartSteamEmu\SmartSteamEmu\Plugins\SSEFirewall.dll

Filesize
16KB

MD5
3c16a45dd3b0d6214d5e292982e9ad22

SHA1
12ff60924e97c815e288a301fa705fc00eb832c5

SHA256
56bff3b129a0f05cfb9f125a32aa8d8d1aac4c8668614c5636adc0786955757b

SHA512
43b1719bea0cd24b6a50440f305fd534275f256bfbecb7de2540692a6380b7f6e53e6fe2b0d279dfbc57ad0563b1070098369ec6bf10ecf6382b2efa6c925133

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\SmartSteamEmu\SmartSteamEmu\Plugins\SSEFirewall.dll

Filesize
16KB

MD5
3c16a45dd3b0d6214d5e292982e9ad22

SHA1
12ff60924e97c815e288a301fa705fc00eb832c5

SHA256
56bff3b129a0f05cfb9f125a32aa8d8d1aac4c8668614c5636adc0786955757b

SHA512
43b1719bea0cd24b6a50440f305fd534275f256bfbecb7de2540692a6380b7f6e53e6fe2b0d279dfbc57ad0563b1070098369ec6bf10ecf6382b2efa6c925133

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\SmartSteamEmu\SmartSteamEmu\Plugins\SSEFirewall.ini

Filesize
90B

MD5
464c4f1758ba746571bbccf52af9f4d5

SHA1
ea9ed2be71ffd2662a38dfe480b4225f793b2357

SHA256
6518ff35767d28962ab7ac59fab295bf926360ae1c4caaa879a829ef4ec2aeac

SHA512
e41b5036a780e0d42bc627e2e23be368c8aa9c989959e10d92dbfceb2fbc72cfd7ec0f18f18356004c563a3be8d348bce71116e75b3e7a5a11f257eb26036579

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\SmartSteamEmu\SmartSteamEmu\Plugins\SSEFirewall64.dll

Filesize
20KB

MD5
f5753caf0fdf0aaaff4dd542d2eaf441

SHA1
9af901c309fd5e2d1c263597ed13b5ca71826390

SHA256
5ad094eededaee23d57b9248c74116e94032c83053bb2e042e4624bfcd5a0490

SHA512
9efe0ac8d7a4dc5f01d3d32ba3729ee1fd44b8e33892377fd893ea7eacf09d2cf70c215a9a2c913e69e07838fc9c9f4fb31f5a47b67341c302c3b306e9802e1e

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\SmartSteamEmu\SmartSteamEmu\Plugins\SSEOverlay.ini

Filesize
75B

MD5
08fb62438e4bf4377f43d70b633bdea8

SHA1
3578e91301604362e348fe3e420e534bbba2dfb4

SHA256
b6384e58f75cdefb8985ad0c49be97af345157c57294dd400138271503c8793e

SHA512
0cd07b1409f4c01c7e4d537b80e3431ca6f8e5b7806b6e31f88016f06f85c27ecb6cd5e2f7b40b80ebdc7c7ec0d96d34ea2049e6567e084fec8cadd630414188

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\SmartSteamEmu\SmartSteamEmu\Plugins\SSEOverlay.ini

Filesize
75B

MD5
08fb62438e4bf4377f43d70b633bdea8

SHA1
3578e91301604362e348fe3e420e534bbba2dfb4

SHA256
b6384e58f75cdefb8985ad0c49be97af345157c57294dd400138271503c8793e

SHA512
0cd07b1409f4c01c7e4d537b80e3431ca6f8e5b7806b6e31f88016f06f85c27ecb6cd5e2f7b40b80ebdc7c7ec0d96d34ea2049e6567e084fec8cadd630414188

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\SmartSteamEmu\SmartSteamEmu\Plugins\SSEOverlay\Language.ini

Filesize
61KB

MD5
d5eaa5cb50a1b0c57edc63d77d366113

SHA1
727c75914c675e7c6be768c221189422124db5b4

SHA256
5ce6d306662dc28040a9eb577fc85fa4f5b732b83020bc5cc99dccf2814ef8b9

SHA512
0b7b6a1c373fd9ed51ba266d18122455cbc5bd9d843b0a769a717a52e858dcb78671d3acd8ad6b4c78c9a73ff1a5b34033453ade783ec1c059395edc8ca8e704

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\SmartSteamEmu\SmartSteamEmu\Plugins\SSEOverlay\message.wav

Filesize
20KB

MD5
85f38f41d28633a6b08ddd7ce2f64582

SHA1
bf0e27361a9a7f137e7218697af4bd28705ca64a

SHA256
6b5c6c54f08e2f02d4cd6e5bea6a16a4e19ee137c484e3efabcc9462a1b840a4

SHA512
c8b55c431a17624ea72811029329327261cc964f762a170d609fdbf22e30d1df960b21fe09e7fb48d266282686eee5b82444772262103202ea19f6e894cfccfe

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\SmartSteamEmu\SmartSteamEmu\Plugins\SSEOverlay\screenshot.wav

Filesize
17KB

MD5
ba95b09f6c80b6d4fcc218a4009c0ace

SHA1
485f01c9583afbf375083096e42da24bcba873dc

SHA256
bb580215824dd89825f114f4fbe5514f0e9783a1ca7bb7aed2376fadc349b6aa

SHA512
d962895d9d776580d2fbbd157ddec4bf57fe1f8c0c8dd3a9a09a69d88bfd815d75a40e74973b15c485cd2a706706004e88e7a3a426cbfa7783a6fc163b0e57e6

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\SmartSteamEmu\SmartSteamEmu\Plugins\x86\SSEOverlay.dll

Filesize
855KB

MD5
f204ca9b0cbc6bccf9df5549ae16b5cf

SHA1
249772a9ca13510e7db6485c42963b72e7be0484

SHA256
c7267e2e20e02bb0ca868f8dbb0a0a4199a3cfb2c4ecfba7f297b15b81e5b31a

SHA512
55363ce555be3479259ef9ee54f90d7fe65c96f633de020e05f991c76a2a365b47efe50a930f784b2cddec932650b24652505a2e0e4a99aee8121fffb1a327e0

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\SmartSteamEmu\SmartSteamEmu\Plugins\x86\SSEOverlay.dll

Filesize
855KB

MD5
f204ca9b0cbc6bccf9df5549ae16b5cf

SHA1
249772a9ca13510e7db6485c42963b72e7be0484

SHA256
c7267e2e20e02bb0ca868f8dbb0a0a4199a3cfb2c4ecfba7f297b15b81e5b31a

SHA512
55363ce555be3479259ef9ee54f90d7fe65c96f633de020e05f991c76a2a365b47efe50a930f784b2cddec932650b24652505a2e0e4a99aee8121fffb1a327e0

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Tutorials\ChocoBreakHD\explosion001.wav

Filesize
8KB

MD5
701ad3463fb42baf39dcea8131bf8d6b

SHA1
67f7b68efa6af731a39bbafb7c962a6950c319b5

SHA256
a609b4f5888f3e2b4c6765f3d960f3bcd7c952eac5edcbdc87d05700306b792d

SHA512
0a1772604b44f19151bb6994efa8d10c65f0b79877b3e64fb773028cd3fa241d40634fe472229c70fc4054dc2d2a5963120c9b92c9e8c09fa0c75cbedf989ce0

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Tutorials\ChocoBreakHD\explosion002.wav

Filesize
47KB

MD5
cc4b80067b3527f70432376740d34c4b

SHA1
de97c74d8713a7d97b5a0d9075d5819ee8f3fefc

SHA256
42c3224a921ef7bd1735a9e807d1dbe4c2b1a104e0603c779a16084b67107ead

SHA512
ee769e12c9e3dbea3512e9d985987d32d1a8ca7cf15c4efd61ec58ed21a16c97e2a1a11fce241679c35e57fc6aa12c9cfcb9274bc6e9f79e3cdae52efa868b75

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Tutorials\ChocoBreakHD\hithat001.wav

Filesize
11KB

MD5
3469b869a9340a3ba5cb98846ae65b23

SHA1
cca8dca94c3e101c94b73b3a24859f83cd6bd8e6

SHA256
3d6b9ff714b41d7e0d1a740b311f33760e8a708d2d9f51b6ccf4ca6f5e513cd7

SHA512
62e65cac8f837e234dd9f4e8f5df324c6c93d9b555b4691231410ca69543abb93634058abf55af6354f7c387695ecbf184195b86c1aee3bca93219f77c5aa051

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\Tutorials\ChocoBreakHD\jump001.wav

Filesize
17KB

MD5
2d64b91d3575a8b9c5caf9fbabc2c105

SHA1
cc1d2540e0c840854fc428dd0856fbf427ca6a38

SHA256
825f1ca7757be2ec26167539c9e6bd77eedfa5d0a4f92c42a9f93ceee54bb15b

SHA512
a310ae145262a74e1dbcaa51499d124e75c14177930a8eb2b2af1dbadfdce854805d6186ac759e9ac7949a4b711328597209e7b518e46ec2d77fb6659e8d4567

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\liblacewing.dll

Filesize
202KB

MD5
1fb58ae94d360c3983c3fe1d1252d86b

SHA1
146cd3a402192cecd18516423f6b42eb6a65dac2

SHA256
5212b88ba87abafd4bd25a55f06f1872f1a040b8924327c2ec00332b89d95bcb

SHA512
f8c74b5e3b36f8bf0e9ad37714c3d8d66ce18c0b9ef3a3aaa7c56a1925cb2edf85e831f6d9a65bf9248d5738f367ef4def0b6a443afb57c154af8df27b2cd050

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\liblacewing.dll

Filesize
202KB

MD5
1fb58ae94d360c3983c3fe1d1252d86b

SHA1
146cd3a402192cecd18516423f6b42eb6a65dac2

SHA256
5212b88ba87abafd4bd25a55f06f1872f1a040b8924327c2ec00332b89d95bcb

SHA512
f8c74b5e3b36f8bf0e9ad37714c3d8d66ce18c0b9ef3a3aaa7c56a1925cb2edf85e831f6d9a65bf9248d5738f367ef4def0b6a443afb57c154af8df27b2cd050

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\mmf2u.exe

Filesize
10.9MB

MD5
cd4b1375c61913c42d9b81ffc39f769c

SHA1
4e3d9cc32da150caf3a56981adf93ef05b33f011

SHA256
df57073fd323e4e483bbcd504940fcaa0c1c4b28d88a0ade98c62096895797e2

SHA512
66cd71b7379cd62034ff5f5b3b1b6df1efbd00bedc07461f7c920c9c31461cdead0a0959f811096b0f9348ca3aaa09fa24feffa384d54c7b9322bd566217f33f

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\mmf2u.exe

Filesize
10.9MB

MD5
cd4b1375c61913c42d9b81ffc39f769c

SHA1
4e3d9cc32da150caf3a56981adf93ef05b33f011

SHA256
df57073fd323e4e483bbcd504940fcaa0c1c4b28d88a0ade98c62096895797e2

SHA512
66cd71b7379cd62034ff5f5b3b1b6df1efbd00bedc07461f7c920c9c31461cdead0a0959f811096b0f9348ca3aaa09fa24feffa384d54c7b9322bd566217f33f

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\steam_api.dll

Filesize
104KB

MD5
fbda2a9248522896c45f2a4f1476c9f8

SHA1
ec5b58064b2bb4a9be732c4bd5612654d8d3abc6

SHA256
716d8eff89d52b88f033e1a3c5b1fcf926dc33bf60f1490e187688e0c332410b

SHA512
c9ba3e9ba9fc3c0b2a71d1fc5802b7688b2cf61490014956556d940bc3e146f6bc0ed55b3f2b704ec2e627ea2e47530c73a97b7d7d91e893082acc234ec4c583

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\steam_api.dll

Filesize
104KB

MD5
fbda2a9248522896c45f2a4f1476c9f8

SHA1
ec5b58064b2bb4a9be732c4bd5612654d8d3abc6

SHA256
716d8eff89d52b88f033e1a3c5b1fcf926dc33bf60f1490e187688e0c332410b

SHA512
c9ba3e9ba9fc3c0b2a71d1fc5802b7688b2cf61490014956556d940bc3e146f6bc0ed55b3f2b704ec2e627ea2e47530c73a97b7d7d91e893082acc234ec4c583

Download Submit
C:\Program Files\Clickteam Fusion Developer 2.5\steam_api.dll

Filesize
104KB

MD5
fbda2a9248522896c45f2a4f1476c9f8

SHA1
ec5b58064b2bb4a9be732c4bd5612654d8d3abc6

SHA256
716d8eff89d52b88f033e1a3c5b1fcf926dc33bf60f1490e187688e0c332410b

SHA512
c9ba3e9ba9fc3c0b2a71d1fc5802b7688b2cf61490014956556d940bc3e146f6bc0ed55b3f2b704ec2e627ea2e47530c73a97b7d7d91e893082acc234ec4c583

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QHTO49S3\welcomedev[2].htm

Filesize
298B

MD5
ea1cb1b71feb83206c4c96befbd69513

SHA1
8d007d702df9a2a247b9aae45bdd5823bfde529d

SHA256
8c19259330545b5a1e5cc4c41545001a775e8e6eeb2a438bdcd9d577828c9c05

SHA512
a2921cded710f99d75e7e1fcba3608b7a409826256735632370d9691114680e8404b0bb8be904432584d3737c792b37f62afc02b0da0c6bff303e3324ffafb64

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsaC729.tmp\LangDLL.dll

Filesize
5KB

MD5
77ff758c10c66937de6d86c388aa431c

SHA1
14bd5628eaf8a12b55cd38f9560c839cb21ce77a

SHA256
6a033e367714ec0d13fca0589c165bdbf4d1dac459fa7ec7415815223fa3c008

SHA512
319837951be276a179ead69efcd24bd7566061abc7997ea782af50bd4b0d69e5ec1a6e4cdeb2825bafedf87edf03380396b7bcf58682b6a3a824c8dc4b966bda

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsaC729.tmp\System.dll

Filesize
11KB

MD5
b0c77267f13b2f87c084fd86ef51ccfc

SHA1
f7543f9e9b4f04386dfbf33c38cbed1bf205afb3

SHA256
a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77

SHA512
f2b57a2eea00f52a3c7080f4b5f2bb85a7a9b9f16d12da8f8ff673824556c62a0f742b72be0fd82a2612a4b6dbd7e0fdc27065212da703c2f7e28d199696f66e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsaC729.tmp\modern-wizard.bmp

Filesize
150KB

MD5
b6a03d812bc4d26c78622a68edd05441

SHA1
d2e4f8d65624ec1e3614a01068bdfc303c583dde

SHA256
da50231c2945040541c01ca01a1c664336a4ed5e08300734ae0cb05a223b7fc5

SHA512
6567ef203d0f17df1564763db2137c771b4390a997be5cf725baea6b2c636142f7c5ac4f285449525e125d7a1a19e8cfbb1db4e63e6b3e45b5523ca76aac63aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsaC729.tmp\nsDialogs.dll

Filesize
9KB

MD5
eac1c3707970fe7c71b2d760c34763fa

SHA1
f275e659ad7798994361f6ccb1481050aba30ff8

SHA256
062c75ad650548750564ffd7aef8cd553773b5c26cae7f25a5749b13165194e3

SHA512
3415bd555cf47407c0ae62be0dbcba7173d2b33a371bf083ce908fc901811adb888b7787d11eb9d99a1a739cbd9d1c66e565db6cd678bdadaf753fbda14ffd09

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsaC729.tmp\nsis7z.dll

Filesize
403KB

MD5
d3850d9ef1d81d2ee2e0a1583e3292f8

SHA1
36a88c987ac8fff6d97f5eea9af5c7421f0496ae

SHA256
47ee083861b20a03a751593073dfb533a0aa447833bfb190a73732c7efb2a2b2

SHA512
3af395aeb470f4f5f26d2072811be2d15e90597ed40d5f1a6ab53e6b66f8a143785868db0476cbf129751cee2ae070ddad179848830e1215393c826101f9caac

Download Submit
C:\Users\Admin\AppData\Roaming\Clickteam\Fusion Developer 2.5\UserImages.bmp

Filesize
56KB

MD5
5f32e1e56549e6017e8dc3bf8e5388fb

SHA1
8940a0be11af23dea7d5c26ff42b247877f02dd0

SHA256
93101255a635212d4777d5ec7d2028fc31c524a817bcbfd5514efe01bee926f5

SHA512
8bb0a3191fa9570768e8459399a622a4d8c2d401865f9e5922767c4d5a9a8b88f9109c780e02fb6dd82566fa1c9c3d7900798290fd06e0047ff98bac6ed4a764

Download Submit
memory/1772-11413-0x0000000002EF0000-0x0000000002F00000-memory.dmp

Filesize
64KB

Download
memory/1772-11286-0x0000000002EF0000-0x0000000002F00000-memory.dmp

Filesize
64KB

Download
memory/1772-11283-0x00000000772F2000-0x00000000772F3000-memory.dmp

Filesize
4KB

Download
memory/1772-11284-0x0000000002D50000-0x0000000002D60000-memory.dmp

Filesize
64KB

Download
memory/1812-11302-0x00000000003F0000-0x0000000000400000-memory.dmp

Filesize
64KB

Download
memory/1812-11294-0x00000000772F2000-0x00000000772F3000-memory.dmp

Filesize
4KB

Download
memory/2076-11081-0x0000000002B00000-0x0000000002B10000-memory.dmp

Filesize
64KB

Download
memory/2076-11083-0x00000000772F2000-0x00000000772F3000-memory.dmp

Filesize
4KB

Download
memory/2076-11039-0x00000000772F2000-0x00000000772F3000-memory.dmp

Filesize
4KB

Download
memory/2216-11547-0x0000000001640000-0x0000000001650000-memory.dmp

Filesize
64KB

Download
memory/2216-11420-0x0000000001640000-0x0000000001650000-memory.dmp

Filesize
64KB

Download
memory/2216-11418-0x00000000015A0000-0x00000000015B0000-memory.dmp

Filesize
64KB

Download
memory/2216-11417-0x00000000772F2000-0x00000000772F3000-memory.dmp

Filesize
4KB

Download
memory/4016-11435-0x0000000001560000-0x0000000001570000-memory.dmp

Filesize
64KB

Download
memory/4016-11428-0x00000000772F2000-0x00000000772F3000-memory.dmp

Filesize
4KB

Download
memory/4824-11130-0x000000000A000000-0x000000000A02F000-memory.dmp

Filesize
188KB

Download
memory/4824-11136-0x000000000A000000-0x000000000A023000-memory.dmp

Filesize
140KB

Download
memory/4824-11105-0x0000000009E00000-0x0000000009E23000-memory.dmp

Filesize
140KB

Download
memory/4824-11109-0x0000000009E00000-0x0000000009E22000-memory.dmp

Filesize
136KB

Download
memory/4824-11111-0x0000000009E00000-0x0000000009E13000-memory.dmp

Filesize
76KB

Download
memory/4824-11112-0x0000000009E00000-0x0000000009E14000-memory.dmp

Filesize
80KB

Download
memory/4824-11114-0x0000000009E00000-0x0000000009E12000-memory.dmp

Filesize
72KB

Download
memory/4824-11115-0x0000000009E00000-0x0000000009E14000-memory.dmp

Filesize
80KB

Download
memory/4824-11113-0x0000000009E00000-0x0000000009E13000-memory.dmp

Filesize
76KB

Download
memory/4824-11116-0x000000000A000000-0x000000000A025000-memory.dmp

Filesize
148KB

Download
memory/4824-11118-0x000000000A000000-0x000000000A022000-memory.dmp

Filesize
136KB

Download
memory/4824-11119-0x000000000A000000-0x000000000A016000-memory.dmp

Filesize
88KB

Download
memory/4824-11120-0x000000000A000000-0x000000000A028000-memory.dmp

Filesize
160KB

Download
memory/4824-11122-0x000000000A000000-0x000000000A020000-memory.dmp

Filesize
128KB

Download
memory/4824-11124-0x000000000A000000-0x000000000A04D000-memory.dmp

Filesize
308KB

Download
memory/4824-11126-0x000000000A000000-0x000000000A023000-memory.dmp

Filesize
140KB

Download
memory/4824-11123-0x000000000A000000-0x000000000A01A000-memory.dmp

Filesize
104KB

Download
memory/4824-11128-0x000000000A000000-0x000000000A024000-memory.dmp

Filesize
144KB

Download
memory/4824-11057-0x00000000045A0000-0x00000000045B8000-memory.dmp

Filesize
96KB

Download
memory/4824-11134-0x000000000A000000-0x000000000A052000-memory.dmp

Filesize
328KB

Download
memory/4824-11132-0x000000000A000000-0x000000000A022000-memory.dmp

Filesize
136KB

Download
memory/4824-11107-0x0000000009E00000-0x0000000009E1F000-memory.dmp

Filesize
124KB

Download
memory/4824-11137-0x000000000A000000-0x000000000A018000-memory.dmp

Filesize
96KB

Download
memory/4824-11138-0x000000000A000000-0x000000000A055000-memory.dmp

Filesize
340KB

Download
memory/4824-11140-0x000000000A000000-0x000000000A01B000-memory.dmp

Filesize
108KB

Download
memory/4824-11141-0x000000000A000000-0x000000000A017000-memory.dmp

Filesize
92KB

Download
memory/4824-11143-0x000000000A400000-0x000000000A423000-memory.dmp

Filesize
140KB

Download
memory/4824-11144-0x000000000A400000-0x000000000A425000-memory.dmp

Filesize
148KB

Download
memory/4824-11146-0x000000000A400000-0x000000000A455000-memory.dmp

Filesize
340KB

Download
memory/4824-11148-0x000000000A400000-0x000000000A479000-memory.dmp

Filesize
484KB

Download
memory/4824-11253-0x0000000003230000-0x0000000003240000-memory.dmp

Filesize
64KB

Download
memory/4824-11103-0x0000000009E00000-0x0000000009E22000-memory.dmp

Filesize
136KB

Download
memory/4824-11072-0x0000000004B00000-0x0000000004B53000-memory.dmp

Filesize
332KB

Download
memory/4824-11101-0x0000000009E00000-0x0000000009E22000-memory.dmp

Filesize
136KB

Download
memory/4824-11024-0x0000000003230000-0x0000000003240000-memory.dmp

Filesize
64KB

Download
memory/4824-11017-0x0000000003080000-0x0000000003090000-memory.dmp

Filesize
64KB

Download
memory/4824-11014-0x00000000772F2000-0x00000000772F3000-memory.dmp

Filesize
4KB

Download
memory/4824-11099-0x0000000009E00000-0x0000000009E25000-memory.dmp

Filesize
148KB

Download
memory/4824-11097-0x0000000009E00000-0x0000000009E1D000-memory.dmp

Filesize
116KB

Download
memory/4824-11095-0x0000000009E00000-0x0000000009E25000-memory.dmp

Filesize
148KB

Download
memory/4824-11093-0x0000000009E00000-0x0000000009E25000-memory.dmp

Filesize
148KB

Download
memory/4824-11084-0x0000000004DA0000-0x0000000004DD9000-memory.dmp

Filesize
228KB

Download
memory/4824-11009-0x0000000010000000-0x0000000010025000-memory.dmp

Filesize
148KB

Download
memory/4824-11080-0x0000000004AD0000-0x0000000004AF4000-memory.dmp

Filesize
144KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads