Analysis

  • max time kernel
    120s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    15/11/2023, 00:13

General

  • Target

    KerbalSpaceProgram Turkce Yama Kurulumu.exe

  • Size

    67.1MB

  • MD5

    93530a9714f6b721ba45fbf82fb36c4e

  • SHA1

    7fa1dc079004c8acd6d3a2c53ac9fba4dbfb11d5

  • SHA256

    4f1c64f9a718df8014428ebfa1222183700c91b1c7f3a431f66bbcbb357a8574

  • SHA512

    011e81762215bea51bb6b4295d3a8a36bde93c8cc845bab66b3ce7e475eadc19d0de164b0289e0e5c17454cb4a7bb0884a07aa4252d1322679be36a11ef2f234

  • SSDEEP

    1572864:eGlqhpZDckekSjofjyjsUSnSTt2mjN6LIFTtAmriZn0:ZlqzpakSjobmsUQC0mjN6Qbs0

Score
10/10

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 20 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • AutoIT Executable 20 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 22 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 46 IoCs
  • Modifies registry class 24 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\KerbalSpaceProgram Turkce Yama Kurulumu.exe
    "C:\Users\Admin\AppData\Local\Temp\KerbalSpaceProgram Turkce Yama Kurulumu.exe"
    1⤵
    • Loads dropped DLL
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2516
    • C:\Users\Admin\AppData\Local\Temp\KerbalSpaceProgram Turkce Yama Kurulumu.exe
      "C:\Users\Admin\AppData\Local\Temp\KerbalSpaceProgram Turkce Yama Kurulumu.exe" /i C:\Users\Admin\AppData\Local\Temp\{61C2C8B7-51C7-423E-A9EE-F57CA8F5BF75}\deneme.back.msi AI_EUIMSI=1 APPDIR="C:\Program Files (x86)\KSPCeviri\Kerbal Space Program Türkçe Yama" SECONDSEQUENCE="1" CLIENTPROCESSID="2516" CHAINERUIPROCESSID="2516Chainer" ACTION="INSTALL" EXECUTEACTION="INSTALL" CLIENTUILEVEL="0" ADDLOCAL="MainFeature" PRIMARYFOLDER="APPDIR" ROOTDRIVE="C:\" TRANSFORMS=":1033" AI_FOUND_PREREQS=".NET Framework 4.5" AI_SETUPEXEPATH="C:\Users\Admin\AppData\Local\Temp\KerbalSpaceProgram Turkce Yama Kurulumu.exe" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1699747812 " AI_SETUPEXEPATH_ORIGINAL="C:\Users\Admin\AppData\Local\Temp\KerbalSpaceProgram Turkce Yama Kurulumu.exe" TARGETDIR="C:\" AI_INSTALL="1"
      2⤵
      • Enumerates connected drives
      PID:2952
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\EXE4489.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2580
      • C:\Windows\SysWOW64\attrib.exe
        C:\Windows\System32\attrib.exe -r "C:\Users\Admin\AppData\Local\Temp\AIE840E.tmp"
        3⤵
        • Views/modifies file attributes
        PID:1968
      • C:\Windows\SysWOW64\attrib.exe
        C:\Windows\System32\attrib.exe -r "C:\Users\Admin\AppData\Local\Temp\EXE4489.bat"
        3⤵
        • Views/modifies file attributes
        PID:548
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" del "C:\Users\Admin\AppData\Local\Temp\EXE4489.bat" "
        3⤵
          PID:268
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" cls"
          3⤵
            PID:752
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Modifies Windows Defender Real-time Protection settings
        • Loads dropped DLL
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2720
        • C:\Windows\syswow64\MsiExec.exe
          C:\Windows\syswow64\MsiExec.exe -Embedding 995357B18EA7C186C931A5B6FC32DCBA C
          2⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2244
          • C:\Program Files (x86)\KSPCeviri\Kerbal Space Program Türkçe Yama\Launcher.exe
            "C:\Program Files (x86)\KSPCeviri\Kerbal Space Program Türkçe Yama\Launcher.exe"
            3⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1096
            • C:\Windows\system32\cmd.exe
              cmd.exe /c sc start trustedinstaller
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:1256
              • C:\Windows\system32\sc.exe
                sc start trustedinstaller
                5⤵
                • Launches sc.exe
                PID:2848
            • C:\Windows\rft64.exe
              C:\Windows\rft64.exe trustedinstaller.exe 1 powershell.exe
              4⤵
              • Executes dropped EXE
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious behavior: EnumeratesProcesses
              PID:2396
        • C:\Windows\syswow64\MsiExec.exe
          C:\Windows\syswow64\MsiExec.exe -Embedding 1CDBE6182E5F0E0324AD8171965669FA
          2⤵
          • Loads dropped DLL
          PID:1080
        • C:\Windows\syswow64\MsiExec.exe
          C:\Windows\syswow64\MsiExec.exe -Embedding B9D0F42227E144AA90BEBB4703DE29F1 M Global\MSI0000
          2⤵
          • Loads dropped DLL
          PID:2228
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
          PID:1720
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000004D0" "0000000000000594"
          1⤵
          • Drops file in Windows directory
          • Modifies data under HKEY_USERS
          PID:2000
        • C:\Program Files (x86)\KSPCeviri\Kerbal Space Program Türkçe Yama\Launcher.exe
          "C:\Program Files (x86)\KSPCeviri\Kerbal Space Program Türkçe Yama\Launcher.exe"
          1⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2920
          • C:\Windows\system32\cmd.exe
            cmd.exe /c sc start trustedinstaller
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2984
            • C:\Windows\system32\sc.exe
              sc start trustedinstaller
              3⤵
              • Launches sc.exe
              PID:820
          • C:\Windows\rft64.exe
            C:\Windows\rft64.exe trustedinstaller.exe 1 powershell.exe
            2⤵
            • Executes dropped EXE
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious behavior: EnumeratesProcesses
            PID:1628

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Config.Msi\f7700be.rbs

          Filesize

          11KB

          MD5

          3e56fa485f631fb044d773c4ae7a16ff

          SHA1

          58ae4afebac1a456cb8cbc1169e7290ffe5a1b1a

          SHA256

          343ac5b5b6f15f03af7a372ef8840a83965e63af77103bb4bdbb235b813673b9

          SHA512

          3c18cc09f98c1e3c52117b0929e81114d143a0d7475a93eeb24a36d9c9ab57db76dc9989e45d2811fd36ed381bb6a2a6e0572f955fd54a385e9e89cec43e33ba

        • C:\Program Files (x86)\KSPCeviri\Kerbal Space Program Türkçe Yama\Launcher.exe

          Filesize

          15.4MB

          MD5

          cf29f092eb7d654a73236a8becbc36f6

          SHA1

          e3cc40bfd4ec178a0285a9f8cd652f88c89eefcf

          SHA256

          44ea5818829a2a9c69274cfdcde623466f0734dd907dd2e2273256c48d27e761

          SHA512

          da36e9ff4b0c0db12c4747c6108aa46ad5c3ae49ac1dc6021824562bf6391dc77fd815e42a315b908a677507e9eece9c03bc09027e733d12457b56e5741a1ac8

        • C:\Program Files (x86)\KSPCeviri\Kerbal Space Program Türkçe Yama\Launcher.exe

          Filesize

          15.4MB

          MD5

          cf29f092eb7d654a73236a8becbc36f6

          SHA1

          e3cc40bfd4ec178a0285a9f8cd652f88c89eefcf

          SHA256

          44ea5818829a2a9c69274cfdcde623466f0734dd907dd2e2273256c48d27e761

          SHA512

          da36e9ff4b0c0db12c4747c6108aa46ad5c3ae49ac1dc6021824562bf6391dc77fd815e42a315b908a677507e9eece9c03bc09027e733d12457b56e5741a1ac8

        • C:\Program Files (x86)\KSPCeviri\Kerbal Space Program Türkçe Yama\Launcher.exe

          Filesize

          15.4MB

          MD5

          cf29f092eb7d654a73236a8becbc36f6

          SHA1

          e3cc40bfd4ec178a0285a9f8cd652f88c89eefcf

          SHA256

          44ea5818829a2a9c69274cfdcde623466f0734dd907dd2e2273256c48d27e761

          SHA512

          da36e9ff4b0c0db12c4747c6108aa46ad5c3ae49ac1dc6021824562bf6391dc77fd815e42a315b908a677507e9eece9c03bc09027e733d12457b56e5741a1ac8

        • C:\Program Files (x86)\KSPCeviri\Kerbal Space Program Türkçe Yama\config_data.dll

          Filesize

          21B

          MD5

          e3e38da1bfb9bc09b3516819cb856b5c

          SHA1

          05c16bc56e0ded751e2e65507068fd8884709785

          SHA256

          145eeff89e9231058eec20405e9e17eac807fbac11fbff1158b5d92bdfe5d656

          SHA512

          ac7255e30acae4c659f8d9f55f543aeb6b0e78dee17118b3d353ee58630e5c69b65c99f681b25bb48100c667ff33f96f317d9ee854086c2e7e9c83b6e6c504bf

        • C:\Users\Admin\AppData\Local\Temp\AIE840E.tmp

          Filesize

          1.5MB

          MD5

          f12a2f4402a956ae5e63f75cddab0c56

          SHA1

          91a6d37b8b97e05488267acdda33782bee99a6b7

          SHA256

          932211ce9a58697ec93e2ba050546e733ad78674c07c78dd23b0ec33a1ded7f4

          SHA512

          e4d3c8c75c49cc63b02375becc8c645c9e1b2619a7d9877a0be127cef7ee2cad022f9463be5126cf900125dc1e1ceef738b9ac087e81213a3cca6f9288728056

        • C:\Users\Admin\AppData\Local\Temp\AIE840E.tmp

          Filesize

          1.5MB

          MD5

          f12a2f4402a956ae5e63f75cddab0c56

          SHA1

          91a6d37b8b97e05488267acdda33782bee99a6b7

          SHA256

          932211ce9a58697ec93e2ba050546e733ad78674c07c78dd23b0ec33a1ded7f4

          SHA512

          e4d3c8c75c49cc63b02375becc8c645c9e1b2619a7d9877a0be127cef7ee2cad022f9463be5126cf900125dc1e1ceef738b9ac087e81213a3cca6f9288728056

        • C:\Users\Admin\AppData\Local\Temp\AIE840E.tmp

          Filesize

          1.6MB

          MD5

          14640dd8ca6827ed133bcad2f5a90fe1

          SHA1

          6afe60863553585e6275bda065d593f76a1c0588

          SHA256

          2cb27c951543c0a3a66bd1f5c0fbdf01fac36e4958c00ad013bb27ab97219ce9

          SHA512

          8638771b35c561e830df5c3a913d6cfefd8dd90a99ee7ff3f9a1d073d4f808ae1b95728024048438dada7fe3e0baa0ff225603cb75b880939a7a7bfa48eb514f

        • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2516\banner

          Filesize

          2KB

          MD5

          ce1143e3563de4e200ba7f4953b3807b

          SHA1

          d3d4522a4bdcb68672047eb7b830cde532ef34a6

          SHA256

          a5eefaca044b04460a1ced5fec2229545edf85f01e1d6673e6e14d06b3108c2d

          SHA512

          c2fd5457d1a0b67f62d6f6d789d906702fe943e11c6e05a9fe77c2d633c347229f90444dcc78104311f90cd9f868b867940c84f28952a92a7b3fd98e6fd9b166

        • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2516\dialog

          Filesize

          11KB

          MD5

          553df955cb4b2e7be5cef99cb8ec9254

          SHA1

          370c2f61e886e53d8faf9537040daaafed330137

          SHA256

          f1fcb09df932aef09b24eea796286ceaedcbceccd4d8f4536345163c4d3d9ff7

          SHA512

          d31d4fc9080c794901b9fa3d3aec998a1b274f4c11c02362b30d2fbaf013b877198b08bb6d96fda68c7e9e329740090609a7d65249bc7e6209ace24fcfe3c34b

        • C:\Users\Admin\AppData\Local\Temp\EXE4489.bat

          Filesize

          369B

          MD5

          8797303c17b8f9ff007cc9e86fb91ec7

          SHA1

          a53351ddc969216a7be1bc0ee766d83e782e7c7d

          SHA256

          9cb94756cad7e7acc99184d9a36fdcc003fe5d9de0887f279061ecfb62ac589d

          SHA512

          6ff37adae9429721b811ce089de8d3e87f1b8be426369099c3b4ea633d79bb5085db1da9ec7b631c0d2f73b9cbc4cdbb7a572ba1e13f9500b9eb6fcaf447177c

        • C:\Users\Admin\AppData\Local\Temp\EXE4489.bat

          Filesize

          369B

          MD5

          8797303c17b8f9ff007cc9e86fb91ec7

          SHA1

          a53351ddc969216a7be1bc0ee766d83e782e7c7d

          SHA256

          9cb94756cad7e7acc99184d9a36fdcc003fe5d9de0887f279061ecfb62ac589d

          SHA512

          6ff37adae9429721b811ce089de8d3e87f1b8be426369099c3b4ea633d79bb5085db1da9ec7b631c0d2f73b9cbc4cdbb7a572ba1e13f9500b9eb6fcaf447177c

        • C:\Users\Admin\AppData\Local\Temp\MSI1F3C.tmp

          Filesize

          386KB

          MD5

          72b1c6699ddc2baab105d32761285df2

          SHA1

          fc85e9fb190f205e6752624a5231515c4ee4e155

          SHA256

          bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97

          SHA512

          cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170

        • C:\Users\Admin\AppData\Local\Temp\MSI1F7B.tmp

          Filesize

          386KB

          MD5

          72b1c6699ddc2baab105d32761285df2

          SHA1

          fc85e9fb190f205e6752624a5231515c4ee4e155

          SHA256

          bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97

          SHA512

          cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170

        • C:\Users\Admin\AppData\Local\Temp\MSI87E6.tmp

          Filesize

          386KB

          MD5

          72b1c6699ddc2baab105d32761285df2

          SHA1

          fc85e9fb190f205e6752624a5231515c4ee4e155

          SHA256

          bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97

          SHA512

          cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170

        • C:\Users\Admin\AppData\Local\Temp\MSI89EA.tmp

          Filesize

          544KB

          MD5

          40117f705bff008c3d96a73162dad044

          SHA1

          2735813836f36b5de83a745c47628053a0f61f66

          SHA256

          32211c43bcfee2ea3ae54899af178d1fc0c2b1111b2a9e3cc3fd125e1ab7daad

          SHA512

          eace1d55d479c4cf5692ec1dc98a6738e94874901bebe14a0a0a93eefd00fc4bd55a701e4629a1f7c47f72ac91fe3b698d590a8463119998852e05d6682f91a4

        • C:\Users\Admin\AppData\Local\Temp\MSI8A68.tmp

          Filesize

          386KB

          MD5

          72b1c6699ddc2baab105d32761285df2

          SHA1

          fc85e9fb190f205e6752624a5231515c4ee4e155

          SHA256

          bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97

          SHA512

          cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170

        • C:\Users\Admin\AppData\Local\Temp\MSI8A68.tmp

          Filesize

          386KB

          MD5

          72b1c6699ddc2baab105d32761285df2

          SHA1

          fc85e9fb190f205e6752624a5231515c4ee4e155

          SHA256

          bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97

          SHA512

          cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170

        • C:\Users\Admin\AppData\Local\Temp\MSI8B24.tmp

          Filesize

          386KB

          MD5

          72b1c6699ddc2baab105d32761285df2

          SHA1

          fc85e9fb190f205e6752624a5231515c4ee4e155

          SHA256

          bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97

          SHA512

          cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170

        • C:\Users\Admin\AppData\Local\Temp\MSI8BB1.tmp

          Filesize

          386KB

          MD5

          72b1c6699ddc2baab105d32761285df2

          SHA1

          fc85e9fb190f205e6752624a5231515c4ee4e155

          SHA256

          bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97

          SHA512

          cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170

        • C:\Users\Admin\AppData\Local\Temp\MSI8C8D.tmp

          Filesize

          544KB

          MD5

          40117f705bff008c3d96a73162dad044

          SHA1

          2735813836f36b5de83a745c47628053a0f61f66

          SHA256

          32211c43bcfee2ea3ae54899af178d1fc0c2b1111b2a9e3cc3fd125e1ab7daad

          SHA512

          eace1d55d479c4cf5692ec1dc98a6738e94874901bebe14a0a0a93eefd00fc4bd55a701e4629a1f7c47f72ac91fe3b698d590a8463119998852e05d6682f91a4

        • C:\Users\Admin\AppData\Local\Temp\MSI8D2A.tmp

          Filesize

          386KB

          MD5

          72b1c6699ddc2baab105d32761285df2

          SHA1

          fc85e9fb190f205e6752624a5231515c4ee4e155

          SHA256

          bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97

          SHA512

          cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170

        • C:\Users\Admin\AppData\Local\Temp\{61C2C8B7-51C7-423E-A9EE-F57CA8F5BF75}\deneme.back.msi

          Filesize

          1.5MB

          MD5

          500c824b3862d7caadaf7bf1ab51803a

          SHA1

          dddaf7467c10ae206bd8b213ce2ca8216b3183cb

          SHA256

          4ec1e2a5d24aa742761dd67660907ecb320dbf0db7f5d1b092322c5ee4d5dfb8

          SHA512

          475b0ff7d157bf87ed509c6a3e968530779afb054155fd64c8351e2def021a8a12615e0cbd99cf7b0d2b8490cd8e8d1f9196af15124840da845c6411e4b8a16c

        • C:\Users\Admin\AppData\Local\Temp\{61C2C8B7-51C7-423E-A9EE-F57CA8F5BF75}\deneme.back1.cab

          Filesize

          15.3MB

          MD5

          bc8f50573a55f12b2d364eeea316b445

          SHA1

          2924a75897819f965b9ebf3715f2c74ccb576cfb

          SHA256

          786a97ab6626b952ec69e6b8276b533859dfffd38c2b376ddabfb76b4af4671b

          SHA512

          421e81d74fa9cf142855f3bc6a7414fce7f2d9428b23536719f5a4f1f5d0f5071b2dec1d2ab0f754b54f75ce0629704d442fe661d718f194f518ef725e223221

        • C:\Users\Public\Desktop\KSPTRGiris.lnk

          Filesize

          2KB

          MD5

          b19e6d1c99a9beeb05bbadb33cbda283

          SHA1

          2df42c7b97d25970116b290b65c44d4338e70c76

          SHA256

          a9d1dc719c1e9f957d38b77806b1b23ec491b237556009c75c2a93989231606d

          SHA512

          57a611d4460d4ef65ea65e75e93690cde514115645402138b696e0894947f4a3ac99baf5d2436d1481301eac0e7261edc299b8fe82ab7ec852eafdc63323fe7e

        • C:\Windows\Installer\MSI13E5.tmp

          Filesize

          278KB

          MD5

          5d7495207fbb9e5bfb0037ba83e86214

          SHA1

          2f61780801d657424dd891e9d72463767fd5d5fb

          SHA256

          0503e4d5de79d2fa7a55a25e8b43d8e2bac3759365314d9bf17ed231082a5ae1

          SHA512

          2a7bdd1bac890580ab99b2509e45fc2f0b7fcbe699ffb24d3ecdbfd406a79d6d42409f968c54f70c5eec6bd85793a52aa786d7d5a5e87e5533d84f1f95a7a4e1

        • C:\Windows\Installer\MSI1A6.tmp

          Filesize

          386KB

          MD5

          72b1c6699ddc2baab105d32761285df2

          SHA1

          fc85e9fb190f205e6752624a5231515c4ee4e155

          SHA256

          bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97

          SHA512

          cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170

        • C:\Windows\Installer\MSI291.tmp

          Filesize

          544KB

          MD5

          40117f705bff008c3d96a73162dad044

          SHA1

          2735813836f36b5de83a745c47628053a0f61f66

          SHA256

          32211c43bcfee2ea3ae54899af178d1fc0c2b1111b2a9e3cc3fd125e1ab7daad

          SHA512

          eace1d55d479c4cf5692ec1dc98a6738e94874901bebe14a0a0a93eefd00fc4bd55a701e4629a1f7c47f72ac91fe3b698d590a8463119998852e05d6682f91a4

        • C:\Windows\Installer\MSI291.tmp

          Filesize

          544KB

          MD5

          40117f705bff008c3d96a73162dad044

          SHA1

          2735813836f36b5de83a745c47628053a0f61f66

          SHA256

          32211c43bcfee2ea3ae54899af178d1fc0c2b1111b2a9e3cc3fd125e1ab7daad

          SHA512

          eace1d55d479c4cf5692ec1dc98a6738e94874901bebe14a0a0a93eefd00fc4bd55a701e4629a1f7c47f72ac91fe3b698d590a8463119998852e05d6682f91a4

        • C:\Windows\Installer\MSI3BA.tmp

          Filesize

          544KB

          MD5

          40117f705bff008c3d96a73162dad044

          SHA1

          2735813836f36b5de83a745c47628053a0f61f66

          SHA256

          32211c43bcfee2ea3ae54899af178d1fc0c2b1111b2a9e3cc3fd125e1ab7daad

          SHA512

          eace1d55d479c4cf5692ec1dc98a6738e94874901bebe14a0a0a93eefd00fc4bd55a701e4629a1f7c47f72ac91fe3b698d590a8463119998852e05d6682f91a4

        • C:\Windows\Installer\MSIEA5.tmp

          Filesize

          278KB

          MD5

          5d7495207fbb9e5bfb0037ba83e86214

          SHA1

          2f61780801d657424dd891e9d72463767fd5d5fb

          SHA256

          0503e4d5de79d2fa7a55a25e8b43d8e2bac3759365314d9bf17ed231082a5ae1

          SHA512

          2a7bdd1bac890580ab99b2509e45fc2f0b7fcbe699ffb24d3ecdbfd406a79d6d42409f968c54f70c5eec6bd85793a52aa786d7d5a5e87e5533d84f1f95a7a4e1

        • C:\Windows\Installer\MSIF23.tmp

          Filesize

          278KB

          MD5

          5d7495207fbb9e5bfb0037ba83e86214

          SHA1

          2f61780801d657424dd891e9d72463767fd5d5fb

          SHA256

          0503e4d5de79d2fa7a55a25e8b43d8e2bac3759365314d9bf17ed231082a5ae1

          SHA512

          2a7bdd1bac890580ab99b2509e45fc2f0b7fcbe699ffb24d3ecdbfd406a79d6d42409f968c54f70c5eec6bd85793a52aa786d7d5a5e87e5533d84f1f95a7a4e1

        • C:\Windows\Installer\MSIF23.tmp

          Filesize

          278KB

          MD5

          5d7495207fbb9e5bfb0037ba83e86214

          SHA1

          2f61780801d657424dd891e9d72463767fd5d5fb

          SHA256

          0503e4d5de79d2fa7a55a25e8b43d8e2bac3759365314d9bf17ed231082a5ae1

          SHA512

          2a7bdd1bac890580ab99b2509e45fc2f0b7fcbe699ffb24d3ecdbfd406a79d6d42409f968c54f70c5eec6bd85793a52aa786d7d5a5e87e5533d84f1f95a7a4e1

        • C:\Windows\rft64.exe

          Filesize

          10.4MB

          MD5

          27c3445f5d46964e15f8358a9589dbe4

          SHA1

          4d3b42f0d82428791eea8f2a0ebd463d30df70aa

          SHA256

          3d71f4dd329a115945231bc5abf38a0171b2561181e92eb0bf465db4589e45ca

          SHA512

          5b4f67d10fc15a54a3103183b8548353f47599e47e4e60e64b474bdc624c0e29af39215eeeac44e7aea7a2ff7ddbe3d3199a6b950a213b7cd8be03cd88e659ed

        • C:\Windows\rft64.exe

          Filesize

          10.4MB

          MD5

          27c3445f5d46964e15f8358a9589dbe4

          SHA1

          4d3b42f0d82428791eea8f2a0ebd463d30df70aa

          SHA256

          3d71f4dd329a115945231bc5abf38a0171b2561181e92eb0bf465db4589e45ca

          SHA512

          5b4f67d10fc15a54a3103183b8548353f47599e47e4e60e64b474bdc624c0e29af39215eeeac44e7aea7a2ff7ddbe3d3199a6b950a213b7cd8be03cd88e659ed

        • \??\c:\windows\rft64.exe

          Filesize

          10.4MB

          MD5

          27c3445f5d46964e15f8358a9589dbe4

          SHA1

          4d3b42f0d82428791eea8f2a0ebd463d30df70aa

          SHA256

          3d71f4dd329a115945231bc5abf38a0171b2561181e92eb0bf465db4589e45ca

          SHA512

          5b4f67d10fc15a54a3103183b8548353f47599e47e4e60e64b474bdc624c0e29af39215eeeac44e7aea7a2ff7ddbe3d3199a6b950a213b7cd8be03cd88e659ed

        • \??\c:\windows\rft64.exe

          Filesize

          10.4MB

          MD5

          27c3445f5d46964e15f8358a9589dbe4

          SHA1

          4d3b42f0d82428791eea8f2a0ebd463d30df70aa

          SHA256

          3d71f4dd329a115945231bc5abf38a0171b2561181e92eb0bf465db4589e45ca

          SHA512

          5b4f67d10fc15a54a3103183b8548353f47599e47e4e60e64b474bdc624c0e29af39215eeeac44e7aea7a2ff7ddbe3d3199a6b950a213b7cd8be03cd88e659ed

        • \Program Files (x86)\KSPCeviri\Kerbal Space Program Türkçe Yama\Launcher.exe

          Filesize

          15.4MB

          MD5

          cf29f092eb7d654a73236a8becbc36f6

          SHA1

          e3cc40bfd4ec178a0285a9f8cd652f88c89eefcf

          SHA256

          44ea5818829a2a9c69274cfdcde623466f0734dd907dd2e2273256c48d27e761

          SHA512

          da36e9ff4b0c0db12c4747c6108aa46ad5c3ae49ac1dc6021824562bf6391dc77fd815e42a315b908a677507e9eece9c03bc09027e733d12457b56e5741a1ac8

        • \Program Files (x86)\KSPCeviri\Kerbal Space Program Türkçe Yama\Launcher.exe

          Filesize

          15.4MB

          MD5

          cf29f092eb7d654a73236a8becbc36f6

          SHA1

          e3cc40bfd4ec178a0285a9f8cd652f88c89eefcf

          SHA256

          44ea5818829a2a9c69274cfdcde623466f0734dd907dd2e2273256c48d27e761

          SHA512

          da36e9ff4b0c0db12c4747c6108aa46ad5c3ae49ac1dc6021824562bf6391dc77fd815e42a315b908a677507e9eece9c03bc09027e733d12457b56e5741a1ac8

        • \Program Files (x86)\KSPCeviri\Kerbal Space Program Türkçe Yama\Launcher.exe

          Filesize

          15.4MB

          MD5

          cf29f092eb7d654a73236a8becbc36f6

          SHA1

          e3cc40bfd4ec178a0285a9f8cd652f88c89eefcf

          SHA256

          44ea5818829a2a9c69274cfdcde623466f0734dd907dd2e2273256c48d27e761

          SHA512

          da36e9ff4b0c0db12c4747c6108aa46ad5c3ae49ac1dc6021824562bf6391dc77fd815e42a315b908a677507e9eece9c03bc09027e733d12457b56e5741a1ac8

        • \Program Files (x86)\KSPCeviri\Kerbal Space Program Türkçe Yama\Launcher.exe

          Filesize

          15.4MB

          MD5

          cf29f092eb7d654a73236a8becbc36f6

          SHA1

          e3cc40bfd4ec178a0285a9f8cd652f88c89eefcf

          SHA256

          44ea5818829a2a9c69274cfdcde623466f0734dd907dd2e2273256c48d27e761

          SHA512

          da36e9ff4b0c0db12c4747c6108aa46ad5c3ae49ac1dc6021824562bf6391dc77fd815e42a315b908a677507e9eece9c03bc09027e733d12457b56e5741a1ac8

        • \Users\Admin\AppData\Local\Temp\MSI1F3C.tmp

          Filesize

          386KB

          MD5

          72b1c6699ddc2baab105d32761285df2

          SHA1

          fc85e9fb190f205e6752624a5231515c4ee4e155

          SHA256

          bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97

          SHA512

          cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170

        • \Users\Admin\AppData\Local\Temp\MSI1F7B.tmp

          Filesize

          386KB

          MD5

          72b1c6699ddc2baab105d32761285df2

          SHA1

          fc85e9fb190f205e6752624a5231515c4ee4e155

          SHA256

          bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97

          SHA512

          cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170

        • \Users\Admin\AppData\Local\Temp\MSI87E6.tmp

          Filesize

          386KB

          MD5

          72b1c6699ddc2baab105d32761285df2

          SHA1

          fc85e9fb190f205e6752624a5231515c4ee4e155

          SHA256

          bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97

          SHA512

          cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170

        • \Users\Admin\AppData\Local\Temp\MSI89EA.tmp

          Filesize

          544KB

          MD5

          40117f705bff008c3d96a73162dad044

          SHA1

          2735813836f36b5de83a745c47628053a0f61f66

          SHA256

          32211c43bcfee2ea3ae54899af178d1fc0c2b1111b2a9e3cc3fd125e1ab7daad

          SHA512

          eace1d55d479c4cf5692ec1dc98a6738e94874901bebe14a0a0a93eefd00fc4bd55a701e4629a1f7c47f72ac91fe3b698d590a8463119998852e05d6682f91a4

        • \Users\Admin\AppData\Local\Temp\MSI8A68.tmp

          Filesize

          386KB

          MD5

          72b1c6699ddc2baab105d32761285df2

          SHA1

          fc85e9fb190f205e6752624a5231515c4ee4e155

          SHA256

          bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97

          SHA512

          cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170

        • \Users\Admin\AppData\Local\Temp\MSI8B24.tmp

          Filesize

          386KB

          MD5

          72b1c6699ddc2baab105d32761285df2

          SHA1

          fc85e9fb190f205e6752624a5231515c4ee4e155

          SHA256

          bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97

          SHA512

          cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170

        • \Users\Admin\AppData\Local\Temp\MSI8BB1.tmp

          Filesize

          386KB

          MD5

          72b1c6699ddc2baab105d32761285df2

          SHA1

          fc85e9fb190f205e6752624a5231515c4ee4e155

          SHA256

          bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97

          SHA512

          cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170

        • \Users\Admin\AppData\Local\Temp\MSI8C8D.tmp

          Filesize

          544KB

          MD5

          40117f705bff008c3d96a73162dad044

          SHA1

          2735813836f36b5de83a745c47628053a0f61f66

          SHA256

          32211c43bcfee2ea3ae54899af178d1fc0c2b1111b2a9e3cc3fd125e1ab7daad

          SHA512

          eace1d55d479c4cf5692ec1dc98a6738e94874901bebe14a0a0a93eefd00fc4bd55a701e4629a1f7c47f72ac91fe3b698d590a8463119998852e05d6682f91a4

        • \Users\Admin\AppData\Local\Temp\MSI8D2A.tmp

          Filesize

          386KB

          MD5

          72b1c6699ddc2baab105d32761285df2

          SHA1

          fc85e9fb190f205e6752624a5231515c4ee4e155

          SHA256

          bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97

          SHA512

          cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170

        • \Users\Admin\AppData\Local\Temp\{61C2C8B7-51C7-423E-A9EE-F57CA8F5BF75}\1033.dll

          Filesize

          162KB

          MD5

          b4f850a62de085524b026549acbe5571

          SHA1

          e81b3c4050e888e5556be64bbf2f53eeb75b2982

          SHA256

          fd1fb22420abf616082c3606d76b2d7b3c500ca73ec2f893ebd7ce5f98499e18

          SHA512

          d5c4f0d5fdddc9c7631a90237f3bb84348e5b9e201824d0c65cf9881f95fee70768f2f4c55b262cba44c20eba3e120105d513d7a838619344fddb763c96486b3

        • \Windows\Installer\MSI13E5.tmp

          Filesize

          278KB

          MD5

          5d7495207fbb9e5bfb0037ba83e86214

          SHA1

          2f61780801d657424dd891e9d72463767fd5d5fb

          SHA256

          0503e4d5de79d2fa7a55a25e8b43d8e2bac3759365314d9bf17ed231082a5ae1

          SHA512

          2a7bdd1bac890580ab99b2509e45fc2f0b7fcbe699ffb24d3ecdbfd406a79d6d42409f968c54f70c5eec6bd85793a52aa786d7d5a5e87e5533d84f1f95a7a4e1

        • \Windows\Installer\MSI1A6.tmp

          Filesize

          386KB

          MD5

          72b1c6699ddc2baab105d32761285df2

          SHA1

          fc85e9fb190f205e6752624a5231515c4ee4e155

          SHA256

          bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97

          SHA512

          cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170

        • \Windows\Installer\MSI291.tmp

          Filesize

          544KB

          MD5

          40117f705bff008c3d96a73162dad044

          SHA1

          2735813836f36b5de83a745c47628053a0f61f66

          SHA256

          32211c43bcfee2ea3ae54899af178d1fc0c2b1111b2a9e3cc3fd125e1ab7daad

          SHA512

          eace1d55d479c4cf5692ec1dc98a6738e94874901bebe14a0a0a93eefd00fc4bd55a701e4629a1f7c47f72ac91fe3b698d590a8463119998852e05d6682f91a4

        • \Windows\Installer\MSI3BA.tmp

          Filesize

          544KB

          MD5

          40117f705bff008c3d96a73162dad044

          SHA1

          2735813836f36b5de83a745c47628053a0f61f66

          SHA256

          32211c43bcfee2ea3ae54899af178d1fc0c2b1111b2a9e3cc3fd125e1ab7daad

          SHA512

          eace1d55d479c4cf5692ec1dc98a6738e94874901bebe14a0a0a93eefd00fc4bd55a701e4629a1f7c47f72ac91fe3b698d590a8463119998852e05d6682f91a4

        • \Windows\Installer\MSIEA5.tmp

          Filesize

          278KB

          MD5

          5d7495207fbb9e5bfb0037ba83e86214

          SHA1

          2f61780801d657424dd891e9d72463767fd5d5fb

          SHA256

          0503e4d5de79d2fa7a55a25e8b43d8e2bac3759365314d9bf17ed231082a5ae1

          SHA512

          2a7bdd1bac890580ab99b2509e45fc2f0b7fcbe699ffb24d3ecdbfd406a79d6d42409f968c54f70c5eec6bd85793a52aa786d7d5a5e87e5533d84f1f95a7a4e1

        • \Windows\Installer\MSIF23.tmp

          Filesize

          278KB

          MD5

          5d7495207fbb9e5bfb0037ba83e86214

          SHA1

          2f61780801d657424dd891e9d72463767fd5d5fb

          SHA256

          0503e4d5de79d2fa7a55a25e8b43d8e2bac3759365314d9bf17ed231082a5ae1

          SHA512

          2a7bdd1bac890580ab99b2509e45fc2f0b7fcbe699ffb24d3ecdbfd406a79d6d42409f968c54f70c5eec6bd85793a52aa786d7d5a5e87e5533d84f1f95a7a4e1

        • memory/1096-177-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

          Filesize

          3.8MB

        • memory/1096-168-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

          Filesize

          3.8MB

        • memory/1096-170-0x0000000077BE0000-0x0000000077BF0000-memory.dmp

          Filesize

          64KB

        • memory/1096-166-0x000000013F180000-0x000000014104F000-memory.dmp

          Filesize

          30.8MB

        • memory/1096-164-0x000000013F180000-0x000000014104F000-memory.dmp

          Filesize

          30.8MB

        • memory/1096-174-0x000000013F180000-0x000000014104F000-memory.dmp

          Filesize

          30.8MB

        • memory/1096-167-0x000000013F180000-0x000000014104F000-memory.dmp

          Filesize

          30.8MB

        • memory/1096-163-0x000000013F180000-0x000000014104F000-memory.dmp

          Filesize

          30.8MB

        • memory/1096-165-0x000000013F180000-0x000000014104F000-memory.dmp

          Filesize

          30.8MB

        • memory/1628-248-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

          Filesize

          3.8MB

        • memory/1628-242-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

          Filesize

          3.8MB

        • memory/1628-240-0x000000013FB70000-0x0000000141547000-memory.dmp

          Filesize

          25.8MB

        • memory/1628-243-0x000000013FB70000-0x0000000141547000-memory.dmp

          Filesize

          25.8MB

        • memory/1628-244-0x000000013FB70000-0x0000000141547000-memory.dmp

          Filesize

          25.8MB

        • memory/1628-245-0x000000013FB70000-0x0000000141547000-memory.dmp

          Filesize

          25.8MB

        • memory/1628-247-0x0000000077BE0000-0x0000000077BF0000-memory.dmp

          Filesize

          64KB

        • memory/1628-246-0x000000013FB70000-0x0000000141547000-memory.dmp

          Filesize

          25.8MB

        • memory/1628-241-0x000000013FB70000-0x0000000141547000-memory.dmp

          Filesize

          25.8MB

        • memory/2396-179-0x000000013FE30000-0x0000000141807000-memory.dmp

          Filesize

          25.8MB

        • memory/2396-176-0x000000013FE30000-0x0000000141807000-memory.dmp

          Filesize

          25.8MB

        • memory/2396-178-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

          Filesize

          3.8MB

        • memory/2396-183-0x000000013FE30000-0x0000000141807000-memory.dmp

          Filesize

          25.8MB

        • memory/2396-196-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

          Filesize

          3.8MB

        • memory/2396-180-0x000000013FE30000-0x0000000141807000-memory.dmp

          Filesize

          25.8MB

        • memory/2396-184-0x0000000077BE0000-0x0000000077BF0000-memory.dmp

          Filesize

          64KB

        • memory/2396-182-0x000000013FE30000-0x0000000141807000-memory.dmp

          Filesize

          25.8MB

        • memory/2396-181-0x000000013FE30000-0x0000000141807000-memory.dmp

          Filesize

          25.8MB

        • memory/2516-3-0x0000000000200000-0x0000000000201000-memory.dmp

          Filesize

          4KB

        • memory/2516-87-0x0000000000200000-0x0000000000201000-memory.dmp

          Filesize

          4KB

        • memory/2720-128-0x000000013F410000-0x000000013F420000-memory.dmp

          Filesize

          64KB

        • memory/2720-216-0x000000013F410000-0x000000013F420000-memory.dmp

          Filesize

          64KB

        • memory/2920-238-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

          Filesize

          3.8MB

        • memory/2920-237-0x000000013F790000-0x000000014165F000-memory.dmp

          Filesize

          30.8MB

        • memory/2920-233-0x0000000077BE0000-0x0000000077BF0000-memory.dmp

          Filesize

          64KB

        • memory/2920-232-0x000000013F790000-0x000000014165F000-memory.dmp

          Filesize

          30.8MB

        • memory/2920-231-0x000000013F790000-0x000000014165F000-memory.dmp

          Filesize

          30.8MB

        • memory/2920-230-0x000000013F790000-0x000000014165F000-memory.dmp

          Filesize

          30.8MB

        • memory/2920-229-0x000000013F790000-0x000000014165F000-memory.dmp

          Filesize

          30.8MB

        • memory/2920-228-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

          Filesize

          3.8MB

        • memory/2920-227-0x000000013F790000-0x000000014165F000-memory.dmp

          Filesize

          30.8MB