4f1c64f9a718df8014428ebfa1222183700c91b1c7f3a431f66bbcbb357a8574

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
15/11/2023, 00:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

KerbalSpaceProgram Turkce Yama Kurulumu.exe
Size

67.1MB
MD5

93530a9714f6b721ba45fbf82fb36c4e
SHA1

7fa1dc079004c8acd6d3a2c53ac9fba4dbfb11d5
SHA256

4f1c64f9a718df8014428ebfa1222183700c91b1c7f3a431f66bbcbb357a8574
SHA512

011e81762215bea51bb6b4295d3a8a36bde93c8cc845bab66b3ce7e475eadc19d0de164b0289e0e5c17454cb4a7bb0884a07aa4252d1322679be36a11ef2f234
SSDEEP

1572864:eGlqhpZDckekSjofjyjsUSnSTt2mjN6LIFTtAmriZn0:ZlqzpakSjobmsUQC0mjN6Qbs0

Score

10^/10

evasion trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Launcher.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	Launcher.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	Launcher.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableAntiSpyware = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Launcher.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	Launcher.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	Launcher.exe

Executes dropped EXE 4 IoCs

pid	Process
1096	Launcher.exe
2396	rft64.exe
2920	Launcher.exe
1628	rft64.exe

Loads dropped DLL 20 IoCs

pid	Process
2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
2244	MsiExec.exe
2244	MsiExec.exe
2244	MsiExec.exe
2244	MsiExec.exe
2244	MsiExec.exe
2244	MsiExec.exe
2244	MsiExec.exe
1080	MsiExec.exe
1080	MsiExec.exe
1080	MsiExec.exe
1080	MsiExec.exe
1080	MsiExec.exe
2720	msiexec.exe
2228	MsiExec.exe
2228	MsiExec.exe
1240	Process not Found
1240	Process not Found
2244	MsiExec.exe
2244	MsiExec.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	KerbalSpaceProgram Turkce Yama Kurulumu.exe
File opened (read-only)	\??\E:	KerbalSpaceProgram Turkce Yama Kurulumu.exe
File opened (read-only)	\??\H:	KerbalSpaceProgram Turkce Yama Kurulumu.exe
File opened (read-only)	\??\V:	KerbalSpaceProgram Turkce Yama Kurulumu.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	KerbalSpaceProgram Turkce Yama Kurulumu.exe
File opened (read-only)	\??\T:	KerbalSpaceProgram Turkce Yama Kurulumu.exe
File opened (read-only)	\??\K:	KerbalSpaceProgram Turkce Yama Kurulumu.exe
File opened (read-only)	\??\V:	KerbalSpaceProgram Turkce Yama Kurulumu.exe
File opened (read-only)	\??\X:	KerbalSpaceProgram Turkce Yama Kurulumu.exe
File opened (read-only)	\??\X:	KerbalSpaceProgram Turkce Yama Kurulumu.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	KerbalSpaceProgram Turkce Yama Kurulumu.exe
File opened (read-only)	\??\H:	KerbalSpaceProgram Turkce Yama Kurulumu.exe
File opened (read-only)	\??\U:	KerbalSpaceProgram Turkce Yama Kurulumu.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Q:	KerbalSpaceProgram Turkce Yama Kurulumu.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	KerbalSpaceProgram Turkce Yama Kurulumu.exe
File opened (read-only)	\??\Y:	KerbalSpaceProgram Turkce Yama Kurulumu.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\U:	KerbalSpaceProgram Turkce Yama Kurulumu.exe
File opened (read-only)	\??\M:	KerbalSpaceProgram Turkce Yama Kurulumu.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	KerbalSpaceProgram Turkce Yama Kurulumu.exe
File opened (read-only)	\??\N:	KerbalSpaceProgram Turkce Yama Kurulumu.exe
File opened (read-only)	\??\W:	KerbalSpaceProgram Turkce Yama Kurulumu.exe
File opened (read-only)	\??\K:	KerbalSpaceProgram Turkce Yama Kurulumu.exe
File opened (read-only)	\??\S:	KerbalSpaceProgram Turkce Yama Kurulumu.exe
File opened (read-only)	\??\Z:	KerbalSpaceProgram Turkce Yama Kurulumu.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Z:	KerbalSpaceProgram Turkce Yama Kurulumu.exe
File opened (read-only)	\??\J:	KerbalSpaceProgram Turkce Yama Kurulumu.exe
File opened (read-only)	\??\P:	KerbalSpaceProgram Turkce Yama Kurulumu.exe
File opened (read-only)	\??\A:	KerbalSpaceProgram Turkce Yama Kurulumu.exe
File opened (read-only)	\??\G:	KerbalSpaceProgram Turkce Yama Kurulumu.exe
File opened (read-only)	\??\I:	KerbalSpaceProgram Turkce Yama Kurulumu.exe
File opened (read-only)	\??\P:	KerbalSpaceProgram Turkce Yama Kurulumu.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\G:	KerbalSpaceProgram Turkce Yama Kurulumu.exe
File opened (read-only)	\??\R:	KerbalSpaceProgram Turkce Yama Kurulumu.exe
File opened (read-only)	\??\L:	KerbalSpaceProgram Turkce Yama Kurulumu.exe
File opened (read-only)	\??\T:	KerbalSpaceProgram Turkce Yama Kurulumu.exe
File opened (read-only)	\??\S:	KerbalSpaceProgram Turkce Yama Kurulumu.exe
File opened (read-only)	\??\Y:	KerbalSpaceProgram Turkce Yama Kurulumu.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\L:	KerbalSpaceProgram Turkce Yama Kurulumu.exe
File opened (read-only)	\??\R:	KerbalSpaceProgram Turkce Yama Kurulumu.exe
File opened (read-only)	\??\O:	KerbalSpaceProgram Turkce Yama Kurulumu.exe
File opened (read-only)	\??\W:	KerbalSpaceProgram Turkce Yama Kurulumu.exe
File opened (read-only)	\??\M:	KerbalSpaceProgram Turkce Yama Kurulumu.exe
File opened (read-only)	\??\Q:	KerbalSpaceProgram Turkce Yama Kurulumu.exe
File opened (read-only)	\??\J:	KerbalSpaceProgram Turkce Yama Kurulumu.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe

AutoIT Executable 20 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/1096-164-0x000000013F180000-0x000000014104F000-memory.dmp	autoit_exe
behavioral1/memory/1096-163-0x000000013F180000-0x000000014104F000-memory.dmp	autoit_exe
behavioral1/memory/1096-165-0x000000013F180000-0x000000014104F000-memory.dmp	autoit_exe
behavioral1/memory/1096-166-0x000000013F180000-0x000000014104F000-memory.dmp	autoit_exe
behavioral1/memory/1096-174-0x000000013F180000-0x000000014104F000-memory.dmp	autoit_exe
behavioral1/memory/2396-179-0x000000013FE30000-0x0000000141807000-memory.dmp	autoit_exe
behavioral1/memory/2396-180-0x000000013FE30000-0x0000000141807000-memory.dmp	autoit_exe
behavioral1/memory/2396-181-0x000000013FE30000-0x0000000141807000-memory.dmp	autoit_exe
behavioral1/memory/2396-182-0x000000013FE30000-0x0000000141807000-memory.dmp	autoit_exe
behavioral1/memory/2396-183-0x000000013FE30000-0x0000000141807000-memory.dmp	autoit_exe
behavioral1/memory/2920-229-0x000000013F790000-0x000000014165F000-memory.dmp	autoit_exe
behavioral1/memory/2920-230-0x000000013F790000-0x000000014165F000-memory.dmp	autoit_exe
behavioral1/memory/2920-231-0x000000013F790000-0x000000014165F000-memory.dmp	autoit_exe
behavioral1/memory/2920-232-0x000000013F790000-0x000000014165F000-memory.dmp	autoit_exe
behavioral1/memory/2920-237-0x000000013F790000-0x000000014165F000-memory.dmp	autoit_exe
behavioral1/memory/1628-240-0x000000013FB70000-0x0000000141547000-memory.dmp	autoit_exe
behavioral1/memory/1628-243-0x000000013FB70000-0x0000000141547000-memory.dmp	autoit_exe
behavioral1/memory/1628-244-0x000000013FB70000-0x0000000141547000-memory.dmp	autoit_exe
behavioral1/memory/1628-245-0x000000013FB70000-0x0000000141547000-memory.dmp	autoit_exe
behavioral1/memory/1628-246-0x000000013FB70000-0x0000000141547000-memory.dmp	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

pid	Process
1096	Launcher.exe
1096	Launcher.exe
2396	rft64.exe
2396	rft64.exe
2920	Launcher.exe
2920	Launcher.exe
1628	rft64.exe
1628	rft64.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\KSPCeviri\Kerbal Space Program Türkçe Yama\config_data.dll	msiexec.exe
File created	C:\Program Files (x86)\KSPCeviri\Kerbal Space Program Türkçe Yama\Launcher.exe	msiexec.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File created	C:\Windows\Installer\f7700bc.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI291.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3BA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID5C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{3F9B5A3D-F4FB-4312-8194-E70CF3C54089}\Launcher.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\f7700bd.ipi	msiexec.exe
File created	C:\Windows\rft64.exe	Launcher.exe
File created	C:\Windows\rft64.exe	Launcher.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI1A6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF23.tmp	msiexec.exe
File created	C:\Windows\DotNetZip.dll	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIEA5.tmp	msiexec.exe
File created	C:\Windows\Installer\{3F9B5A3D-F4FB-4312-8194-E70CF3C54089}\Launcher.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\f7700bc.msi	msiexec.exe
File created	C:\Windows\Installer\f7700bd.ipi	msiexec.exe
File created	C:\Windows\Task.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI13E5.tmp	msiexec.exe
File created	C:\Windows\Installer\f7700bf.msi	msiexec.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2848	sc.exe
820	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 46 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\777E3BC32C3A6BE48B424BDFC7E84E59	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3A5B9F3BF4F213418497EC03F5C0498\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D3A5B9F3BF4F213418497EC03F5C0498	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D3A5B9F3BF4F213418497EC03F5C0498\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3A5B9F3BF4F213418497EC03F5C0498\PackageCode = "2507A6272C50F66428136EFAA88D0578"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3A5B9F3BF4F213418497EC03F5C0498\Language = "1055"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3A5B9F3BF4F213418497EC03F5C0498\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3A5B9F3BF4F213418497EC03F5C0498\Transforms = ":1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3A5B9F3BF4F213418497EC03F5C0498\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3A5B9F3BF4F213418497EC03F5C0498\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3A5B9F3BF4F213418497EC03F5C0498\Version = "16777216"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3A5B9F3BF4F213418497EC03F5C0498\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3A5B9F3BF4F213418497EC03F5C0498\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3A5B9F3BF4F213418497EC03F5C0498\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3A5B9F3BF4F213418497EC03F5C0498\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\{61C2C8B7-51C7-423E-A9EE-F57CA8F5BF75}\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3A5B9F3BF4F213418497EC03F5C0498\SourceList\PackageName = "deneme.back.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3A5B9F3BF4F213418497EC03F5C0498\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\{61C2C8B7-51C7-423E-A9EE-F57CA8F5BF75}\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3A5B9F3BF4F213418497EC03F5C0498\SourceList\Media\1 = "Disk1;Disk1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3A5B9F3BF4F213418497EC03F5C0498	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3A5B9F3BF4F213418497EC03F5C0498\ProductName = "Kerbal Space Program Türkçe Yama"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3A5B9F3BF4F213418497EC03F5C0498\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3A5B9F3BF4F213418497EC03F5C0498\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\777E3BC32C3A6BE48B424BDFC7E84E59\D3A5B9F3BF4F213418497EC03F5C0498	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3A5B9F3BF4F213418497EC03F5C0498\Clients = 3a0000000000	msiexec.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2720	msiexec.exe
2720	msiexec.exe
1096	Launcher.exe
1096	Launcher.exe
1096	Launcher.exe
1096	Launcher.exe
2396	rft64.exe
2920	Launcher.exe
2920	Launcher.exe
2920	Launcher.exe
2920	Launcher.exe
1628	rft64.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	2720	msiexec.exe
Token: SeTakeOwnershipPrivilege	2720	msiexec.exe
Token: SeSecurityPrivilege	2720	msiexec.exe
Token: SeCreateTokenPrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeAssignPrimaryTokenPrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeLockMemoryPrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeIncreaseQuotaPrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeMachineAccountPrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeTcbPrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeSecurityPrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeTakeOwnershipPrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeLoadDriverPrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeSystemProfilePrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeSystemtimePrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeProfSingleProcessPrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeIncBasePriorityPrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeCreatePagefilePrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeCreatePermanentPrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeBackupPrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeRestorePrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeShutdownPrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeDebugPrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeAuditPrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeSystemEnvironmentPrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeChangeNotifyPrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeRemoteShutdownPrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeUndockPrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeSyncAgentPrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeEnableDelegationPrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeManageVolumePrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeImpersonatePrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeCreateGlobalPrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeCreateTokenPrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeAssignPrimaryTokenPrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeLockMemoryPrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeIncreaseQuotaPrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeMachineAccountPrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeTcbPrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeSecurityPrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeTakeOwnershipPrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeLoadDriverPrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeSystemProfilePrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeSystemtimePrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeProfSingleProcessPrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeIncBasePriorityPrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeCreatePagefilePrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeCreatePermanentPrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeBackupPrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeRestorePrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeShutdownPrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeDebugPrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeAuditPrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeSystemEnvironmentPrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeChangeNotifyPrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeRemoteShutdownPrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeUndockPrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeSyncAgentPrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeEnableDelegationPrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeManageVolumePrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeImpersonatePrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeCreateGlobalPrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeCreateTokenPrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeAssignPrimaryTokenPrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
Token: SeLockMemoryPrivilege	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe
2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 2244	2720	msiexec.exe	29
PID 2720 wrote to memory of 2244	2720	msiexec.exe	29
PID 2720 wrote to memory of 2244	2720	msiexec.exe	29
PID 2720 wrote to memory of 2244	2720	msiexec.exe	29
PID 2720 wrote to memory of 2244	2720	msiexec.exe	29
PID 2720 wrote to memory of 2244	2720	msiexec.exe	29
PID 2720 wrote to memory of 2244	2720	msiexec.exe	29
PID 2516 wrote to memory of 2952	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe	30
PID 2516 wrote to memory of 2952	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe	30
PID 2516 wrote to memory of 2952	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe	30
PID 2516 wrote to memory of 2952	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe	30
PID 2516 wrote to memory of 2952	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe	30
PID 2516 wrote to memory of 2952	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe	30
PID 2516 wrote to memory of 2952	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe	30
PID 2720 wrote to memory of 1080	2720	msiexec.exe	36
PID 2720 wrote to memory of 1080	2720	msiexec.exe	36
PID 2720 wrote to memory of 1080	2720	msiexec.exe	36
PID 2720 wrote to memory of 1080	2720	msiexec.exe	36
PID 2720 wrote to memory of 1080	2720	msiexec.exe	36
PID 2720 wrote to memory of 1080	2720	msiexec.exe	36
PID 2720 wrote to memory of 1080	2720	msiexec.exe	36
PID 2720 wrote to memory of 2228	2720	msiexec.exe	37
PID 2720 wrote to memory of 2228	2720	msiexec.exe	37
PID 2720 wrote to memory of 2228	2720	msiexec.exe	37
PID 2720 wrote to memory of 2228	2720	msiexec.exe	37
PID 2720 wrote to memory of 2228	2720	msiexec.exe	37
PID 2720 wrote to memory of 2228	2720	msiexec.exe	37
PID 2720 wrote to memory of 2228	2720	msiexec.exe	37
PID 2244 wrote to memory of 1096	2244	MsiExec.exe	39
PID 2244 wrote to memory of 1096	2244	MsiExec.exe	39
PID 2244 wrote to memory of 1096	2244	MsiExec.exe	39
PID 2244 wrote to memory of 1096	2244	MsiExec.exe	39
PID 1096 wrote to memory of 1256	1096	Launcher.exe	40
PID 1096 wrote to memory of 1256	1096	Launcher.exe	40
PID 1096 wrote to memory of 1256	1096	Launcher.exe	40
PID 1256 wrote to memory of 2848	1256	cmd.exe	43
PID 1256 wrote to memory of 2848	1256	cmd.exe	43
PID 1256 wrote to memory of 2848	1256	cmd.exe	43
PID 2516 wrote to memory of 2580	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe	44
PID 2516 wrote to memory of 2580	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe	44
PID 2516 wrote to memory of 2580	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe	44
PID 2516 wrote to memory of 2580	2516	KerbalSpaceProgram Turkce Yama Kurulumu.exe	44
PID 2580 wrote to memory of 1968	2580	cmd.exe	46
PID 2580 wrote to memory of 1968	2580	cmd.exe	46
PID 2580 wrote to memory of 1968	2580	cmd.exe	46
PID 2580 wrote to memory of 1968	2580	cmd.exe	46
PID 2580 wrote to memory of 548	2580	cmd.exe	47
PID 2580 wrote to memory of 548	2580	cmd.exe	47
PID 2580 wrote to memory of 548	2580	cmd.exe	47
PID 2580 wrote to memory of 548	2580	cmd.exe	47
PID 2580 wrote to memory of 268	2580	cmd.exe	48
PID 2580 wrote to memory of 268	2580	cmd.exe	48
PID 2580 wrote to memory of 268	2580	cmd.exe	48
PID 2580 wrote to memory of 268	2580	cmd.exe	48
PID 2580 wrote to memory of 752	2580	cmd.exe	49
PID 2580 wrote to memory of 752	2580	cmd.exe	49
PID 2580 wrote to memory of 752	2580	cmd.exe	49
PID 2580 wrote to memory of 752	2580	cmd.exe	49
PID 2920 wrote to memory of 2984	2920	Launcher.exe	52
PID 2920 wrote to memory of 2984	2920	Launcher.exe	52
PID 2920 wrote to memory of 2984	2920	Launcher.exe	52
PID 2984 wrote to memory of 820	2984	cmd.exe	54
PID 2984 wrote to memory of 820	2984	cmd.exe	54
PID 2984 wrote to memory of 820	2984	cmd.exe	54

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
548	attrib.exe
1968	attrib.exe

C:\Users\Admin\AppData\Local\Temp\KerbalSpaceProgram Turkce Yama Kurulumu.exe
"C:\Users\Admin\AppData\Local\Temp\KerbalSpaceProgram Turkce Yama Kurulumu.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Users\Admin\AppData\Local\Temp\KerbalSpaceProgram Turkce Yama Kurulumu.exe
  "C:\Users\Admin\AppData\Local\Temp\KerbalSpaceProgram Turkce Yama Kurulumu.exe" /i C:\Users\Admin\AppData\Local\Temp\{61C2C8B7-51C7-423E-A9EE-F57CA8F5BF75}\deneme.back.msi AI_EUIMSI=1 APPDIR="C:\Program Files (x86)\KSPCeviri\Kerbal Space Program Türkçe Yama" SECONDSEQUENCE="1" CLIENTPROCESSID="2516" CHAINERUIPROCESSID="2516Chainer" ACTION="INSTALL" EXECUTEACTION="INSTALL" CLIENTUILEVEL="0" ADDLOCAL="MainFeature" PRIMARYFOLDER="APPDIR" ROOTDRIVE="C:\" TRANSFORMS=":1033" AI_FOUND_PREREQS=".NET Framework 4.5" AI_SETUPEXEPATH="C:\Users\Admin\AppData\Local\Temp\KerbalSpaceProgram Turkce Yama Kurulumu.exe" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1699747812 " AI_SETUPEXEPATH_ORIGINAL="C:\Users\Admin\AppData\Local\Temp\KerbalSpaceProgram Turkce Yama Kurulumu.exe" TARGETDIR="C:\" AI_INSTALL="1"
  2⤵
  - Enumerates connected drives
  PID:2952
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\EXE4489.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Windows\SysWOW64\attrib.exe
    C:\Windows\System32\attrib.exe -r "C:\Users\Admin\AppData\Local\Temp\AIE840E.tmp"
    3⤵
    - Views/modifies file attributes
    PID:1968
- - C:\Windows\SysWOW64\attrib.exe
    C:\Windows\System32\attrib.exe -r "C:\Users\Admin\AppData\Local\Temp\EXE4489.bat"
    3⤵
    - Views/modifies file attributes
    PID:548
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" del "C:\Users\Admin\AppData\Local\Temp\EXE4489.bat" "
    3⤵
    PID:268
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" cls"
    3⤵
    PID:752

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Modifies Windows Defender Real-time Protection settings
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 995357B18EA7C186C931A5B6FC32DCBA C
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\Program Files (x86)\KSPCeviri\Kerbal Space Program Türkçe Yama\Launcher.exe
    "C:\Program Files (x86)\KSPCeviri\Kerbal Space Program Türkçe Yama\Launcher.exe"
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1096
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc start trustedinstaller
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1256
    - - C:\Windows\system32\sc.exe
        
        sc start trustedinstaller
        5⤵
        Launches sc.exe
        
        PID:2848
  - - C:\Windows\rft64.exe
      C:\Windows\rft64.exe trustedinstaller.exe 1 powershell.exe
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      PID:2396
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1CDBE6182E5F0E0324AD8171965669FA
  2⤵
  - Loads dropped DLL
  PID:1080
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B9D0F42227E144AA90BEBB4703DE29F1 M Global\MSI0000
  2⤵
  - Loads dropped DLL
  PID:2228

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1720

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000004D0" "0000000000000594"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2000

C:\Program Files (x86)\KSPCeviri\Kerbal Space Program Türkçe Yama\Launcher.exe
"C:\Program Files (x86)\KSPCeviri\Kerbal Space Program Türkçe Yama\Launcher.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc start trustedinstaller
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Windows\system32\sc.exe
    sc start trustedinstaller
    3⤵
    - Launches sc.exe
    PID:820
- C:\Windows\rft64.exe
  C:\Windows\rft64.exe trustedinstaller.exe 1 powershell.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:1628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f7700be.rbs

Filesize
11KB

MD5
3e56fa485f631fb044d773c4ae7a16ff

SHA1
58ae4afebac1a456cb8cbc1169e7290ffe5a1b1a

SHA256
343ac5b5b6f15f03af7a372ef8840a83965e63af77103bb4bdbb235b813673b9

SHA512
3c18cc09f98c1e3c52117b0929e81114d143a0d7475a93eeb24a36d9c9ab57db76dc9989e45d2811fd36ed381bb6a2a6e0572f955fd54a385e9e89cec43e33ba

Download Submit
C:\Program Files (x86)\KSPCeviri\Kerbal Space Program Türkçe Yama\Launcher.exe

Filesize
15.4MB

MD5
cf29f092eb7d654a73236a8becbc36f6

SHA1
e3cc40bfd4ec178a0285a9f8cd652f88c89eefcf

SHA256
44ea5818829a2a9c69274cfdcde623466f0734dd907dd2e2273256c48d27e761

SHA512
da36e9ff4b0c0db12c4747c6108aa46ad5c3ae49ac1dc6021824562bf6391dc77fd815e42a315b908a677507e9eece9c03bc09027e733d12457b56e5741a1ac8

Download Submit
C:\Program Files (x86)\KSPCeviri\Kerbal Space Program Türkçe Yama\Launcher.exe

Filesize
15.4MB

MD5
cf29f092eb7d654a73236a8becbc36f6

SHA1
e3cc40bfd4ec178a0285a9f8cd652f88c89eefcf

SHA256
44ea5818829a2a9c69274cfdcde623466f0734dd907dd2e2273256c48d27e761

SHA512
da36e9ff4b0c0db12c4747c6108aa46ad5c3ae49ac1dc6021824562bf6391dc77fd815e42a315b908a677507e9eece9c03bc09027e733d12457b56e5741a1ac8

Download Submit
C:\Program Files (x86)\KSPCeviri\Kerbal Space Program Türkçe Yama\Launcher.exe

Filesize
15.4MB

MD5
cf29f092eb7d654a73236a8becbc36f6

SHA1
e3cc40bfd4ec178a0285a9f8cd652f88c89eefcf

SHA256
44ea5818829a2a9c69274cfdcde623466f0734dd907dd2e2273256c48d27e761

SHA512
da36e9ff4b0c0db12c4747c6108aa46ad5c3ae49ac1dc6021824562bf6391dc77fd815e42a315b908a677507e9eece9c03bc09027e733d12457b56e5741a1ac8

Download Submit
C:\Program Files (x86)\KSPCeviri\Kerbal Space Program Türkçe Yama\config_data.dll

Filesize
21B

MD5
e3e38da1bfb9bc09b3516819cb856b5c

SHA1
05c16bc56e0ded751e2e65507068fd8884709785

SHA256
145eeff89e9231058eec20405e9e17eac807fbac11fbff1158b5d92bdfe5d656

SHA512
ac7255e30acae4c659f8d9f55f543aeb6b0e78dee17118b3d353ee58630e5c69b65c99f681b25bb48100c667ff33f96f317d9ee854086c2e7e9c83b6e6c504bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\AIE840E.tmp

Filesize
1.5MB

MD5
f12a2f4402a956ae5e63f75cddab0c56

SHA1
91a6d37b8b97e05488267acdda33782bee99a6b7

SHA256
932211ce9a58697ec93e2ba050546e733ad78674c07c78dd23b0ec33a1ded7f4

SHA512
e4d3c8c75c49cc63b02375becc8c645c9e1b2619a7d9877a0be127cef7ee2cad022f9463be5126cf900125dc1e1ceef738b9ac087e81213a3cca6f9288728056

Download Submit
C:\Users\Admin\AppData\Local\Temp\AIE840E.tmp

Filesize
1.5MB

MD5
f12a2f4402a956ae5e63f75cddab0c56

SHA1
91a6d37b8b97e05488267acdda33782bee99a6b7

SHA256
932211ce9a58697ec93e2ba050546e733ad78674c07c78dd23b0ec33a1ded7f4

SHA512
e4d3c8c75c49cc63b02375becc8c645c9e1b2619a7d9877a0be127cef7ee2cad022f9463be5126cf900125dc1e1ceef738b9ac087e81213a3cca6f9288728056

Download Submit
C:\Users\Admin\AppData\Local\Temp\AIE840E.tmp

Filesize
1.6MB

MD5
14640dd8ca6827ed133bcad2f5a90fe1

SHA1
6afe60863553585e6275bda065d593f76a1c0588

SHA256
2cb27c951543c0a3a66bd1f5c0fbdf01fac36e4958c00ad013bb27ab97219ce9

SHA512
8638771b35c561e830df5c3a913d6cfefd8dd90a99ee7ff3f9a1d073d4f808ae1b95728024048438dada7fe3e0baa0ff225603cb75b880939a7a7bfa48eb514f

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2516\banner

Filesize
2KB

MD5
ce1143e3563de4e200ba7f4953b3807b

SHA1
d3d4522a4bdcb68672047eb7b830cde532ef34a6

SHA256
a5eefaca044b04460a1ced5fec2229545edf85f01e1d6673e6e14d06b3108c2d

SHA512
c2fd5457d1a0b67f62d6f6d789d906702fe943e11c6e05a9fe77c2d633c347229f90444dcc78104311f90cd9f868b867940c84f28952a92a7b3fd98e6fd9b166

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2516\dialog

Filesize
11KB

MD5
553df955cb4b2e7be5cef99cb8ec9254

SHA1
370c2f61e886e53d8faf9537040daaafed330137

SHA256
f1fcb09df932aef09b24eea796286ceaedcbceccd4d8f4536345163c4d3d9ff7

SHA512
d31d4fc9080c794901b9fa3d3aec998a1b274f4c11c02362b30d2fbaf013b877198b08bb6d96fda68c7e9e329740090609a7d65249bc7e6209ace24fcfe3c34b

Download Submit
C:\Users\Admin\AppData\Local\Temp\EXE4489.bat

Filesize
369B

MD5
8797303c17b8f9ff007cc9e86fb91ec7

SHA1
a53351ddc969216a7be1bc0ee766d83e782e7c7d

SHA256
9cb94756cad7e7acc99184d9a36fdcc003fe5d9de0887f279061ecfb62ac589d

SHA512
6ff37adae9429721b811ce089de8d3e87f1b8be426369099c3b4ea633d79bb5085db1da9ec7b631c0d2f73b9cbc4cdbb7a572ba1e13f9500b9eb6fcaf447177c

Download Submit
C:\Users\Admin\AppData\Local\Temp\EXE4489.bat

Filesize
369B

MD5
8797303c17b8f9ff007cc9e86fb91ec7

SHA1
a53351ddc969216a7be1bc0ee766d83e782e7c7d

SHA256
9cb94756cad7e7acc99184d9a36fdcc003fe5d9de0887f279061ecfb62ac589d

SHA512
6ff37adae9429721b811ce089de8d3e87f1b8be426369099c3b4ea633d79bb5085db1da9ec7b631c0d2f73b9cbc4cdbb7a572ba1e13f9500b9eb6fcaf447177c

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI1F3C.tmp

Filesize
386KB

MD5
72b1c6699ddc2baab105d32761285df2

SHA1
fc85e9fb190f205e6752624a5231515c4ee4e155

SHA256
bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97

SHA512
cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI1F7B.tmp

Filesize
386KB

MD5
72b1c6699ddc2baab105d32761285df2

SHA1
fc85e9fb190f205e6752624a5231515c4ee4e155

SHA256
bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97

SHA512
cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI87E6.tmp

Filesize
386KB

MD5
72b1c6699ddc2baab105d32761285df2

SHA1
fc85e9fb190f205e6752624a5231515c4ee4e155

SHA256
bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97

SHA512
cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI89EA.tmp

Filesize
544KB

MD5
40117f705bff008c3d96a73162dad044

SHA1
2735813836f36b5de83a745c47628053a0f61f66

SHA256
32211c43bcfee2ea3ae54899af178d1fc0c2b1111b2a9e3cc3fd125e1ab7daad

SHA512
eace1d55d479c4cf5692ec1dc98a6738e94874901bebe14a0a0a93eefd00fc4bd55a701e4629a1f7c47f72ac91fe3b698d590a8463119998852e05d6682f91a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI8A68.tmp

Filesize
386KB

MD5
72b1c6699ddc2baab105d32761285df2

SHA1
fc85e9fb190f205e6752624a5231515c4ee4e155

SHA256
bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97

SHA512
cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI8A68.tmp

Filesize
386KB

MD5
72b1c6699ddc2baab105d32761285df2

SHA1
fc85e9fb190f205e6752624a5231515c4ee4e155

SHA256
bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97

SHA512
cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI8B24.tmp

Filesize
386KB

MD5
72b1c6699ddc2baab105d32761285df2

SHA1
fc85e9fb190f205e6752624a5231515c4ee4e155

SHA256
bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97

SHA512
cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI8BB1.tmp

Filesize
386KB

MD5
72b1c6699ddc2baab105d32761285df2

SHA1
fc85e9fb190f205e6752624a5231515c4ee4e155

SHA256
bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97

SHA512
cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI8C8D.tmp

Filesize
544KB

MD5
40117f705bff008c3d96a73162dad044

SHA1
2735813836f36b5de83a745c47628053a0f61f66

SHA256
32211c43bcfee2ea3ae54899af178d1fc0c2b1111b2a9e3cc3fd125e1ab7daad

SHA512
eace1d55d479c4cf5692ec1dc98a6738e94874901bebe14a0a0a93eefd00fc4bd55a701e4629a1f7c47f72ac91fe3b698d590a8463119998852e05d6682f91a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI8D2A.tmp

Filesize
386KB

MD5
72b1c6699ddc2baab105d32761285df2

SHA1
fc85e9fb190f205e6752624a5231515c4ee4e155

SHA256
bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97

SHA512
cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170

Download Submit
C:\Users\Admin\AppData\Local\Temp\{61C2C8B7-51C7-423E-A9EE-F57CA8F5BF75}\deneme.back.msi

Filesize
1.5MB

MD5
500c824b3862d7caadaf7bf1ab51803a

SHA1
dddaf7467c10ae206bd8b213ce2ca8216b3183cb

SHA256
4ec1e2a5d24aa742761dd67660907ecb320dbf0db7f5d1b092322c5ee4d5dfb8

SHA512
475b0ff7d157bf87ed509c6a3e968530779afb054155fd64c8351e2def021a8a12615e0cbd99cf7b0d2b8490cd8e8d1f9196af15124840da845c6411e4b8a16c

Download Submit
C:\Users\Admin\AppData\Local\Temp\{61C2C8B7-51C7-423E-A9EE-F57CA8F5BF75}\deneme.back1.cab

Filesize
15.3MB

MD5
bc8f50573a55f12b2d364eeea316b445

SHA1
2924a75897819f965b9ebf3715f2c74ccb576cfb

SHA256
786a97ab6626b952ec69e6b8276b533859dfffd38c2b376ddabfb76b4af4671b

SHA512
421e81d74fa9cf142855f3bc6a7414fce7f2d9428b23536719f5a4f1f5d0f5071b2dec1d2ab0f754b54f75ce0629704d442fe661d718f194f518ef725e223221

Download Submit
C:\Users\Public\Desktop\KSPTRGiris.lnk

Filesize
2KB

MD5
b19e6d1c99a9beeb05bbadb33cbda283

SHA1
2df42c7b97d25970116b290b65c44d4338e70c76

SHA256
a9d1dc719c1e9f957d38b77806b1b23ec491b237556009c75c2a93989231606d

SHA512
57a611d4460d4ef65ea65e75e93690cde514115645402138b696e0894947f4a3ac99baf5d2436d1481301eac0e7261edc299b8fe82ab7ec852eafdc63323fe7e

Download Submit
C:\Windows\Installer\MSI13E5.tmp

Filesize
278KB

MD5
5d7495207fbb9e5bfb0037ba83e86214

SHA1
2f61780801d657424dd891e9d72463767fd5d5fb

SHA256
0503e4d5de79d2fa7a55a25e8b43d8e2bac3759365314d9bf17ed231082a5ae1

SHA512
2a7bdd1bac890580ab99b2509e45fc2f0b7fcbe699ffb24d3ecdbfd406a79d6d42409f968c54f70c5eec6bd85793a52aa786d7d5a5e87e5533d84f1f95a7a4e1

Download Submit
C:\Windows\Installer\MSI1A6.tmp

Filesize
386KB

MD5
72b1c6699ddc2baab105d32761285df2

SHA1
fc85e9fb190f205e6752624a5231515c4ee4e155

SHA256
bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97

SHA512
cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170

Download Submit
C:\Windows\Installer\MSI291.tmp

Filesize
544KB

MD5
40117f705bff008c3d96a73162dad044

SHA1
2735813836f36b5de83a745c47628053a0f61f66

SHA256
32211c43bcfee2ea3ae54899af178d1fc0c2b1111b2a9e3cc3fd125e1ab7daad

SHA512
eace1d55d479c4cf5692ec1dc98a6738e94874901bebe14a0a0a93eefd00fc4bd55a701e4629a1f7c47f72ac91fe3b698d590a8463119998852e05d6682f91a4

Download Submit
C:\Windows\Installer\MSI291.tmp

Filesize
544KB

MD5
40117f705bff008c3d96a73162dad044

SHA1
2735813836f36b5de83a745c47628053a0f61f66

SHA256
32211c43bcfee2ea3ae54899af178d1fc0c2b1111b2a9e3cc3fd125e1ab7daad

SHA512
eace1d55d479c4cf5692ec1dc98a6738e94874901bebe14a0a0a93eefd00fc4bd55a701e4629a1f7c47f72ac91fe3b698d590a8463119998852e05d6682f91a4

Download Submit
C:\Windows\Installer\MSI3BA.tmp

Filesize
544KB

MD5
40117f705bff008c3d96a73162dad044

SHA1
2735813836f36b5de83a745c47628053a0f61f66

SHA256
32211c43bcfee2ea3ae54899af178d1fc0c2b1111b2a9e3cc3fd125e1ab7daad

SHA512
eace1d55d479c4cf5692ec1dc98a6738e94874901bebe14a0a0a93eefd00fc4bd55a701e4629a1f7c47f72ac91fe3b698d590a8463119998852e05d6682f91a4

Download Submit
C:\Windows\Installer\MSIEA5.tmp

Filesize
278KB

MD5
5d7495207fbb9e5bfb0037ba83e86214

SHA1
2f61780801d657424dd891e9d72463767fd5d5fb

SHA256
0503e4d5de79d2fa7a55a25e8b43d8e2bac3759365314d9bf17ed231082a5ae1

SHA512
2a7bdd1bac890580ab99b2509e45fc2f0b7fcbe699ffb24d3ecdbfd406a79d6d42409f968c54f70c5eec6bd85793a52aa786d7d5a5e87e5533d84f1f95a7a4e1

Download Submit
C:\Windows\Installer\MSIF23.tmp

Filesize
278KB

MD5
5d7495207fbb9e5bfb0037ba83e86214

SHA1
2f61780801d657424dd891e9d72463767fd5d5fb

SHA256
0503e4d5de79d2fa7a55a25e8b43d8e2bac3759365314d9bf17ed231082a5ae1

SHA512
2a7bdd1bac890580ab99b2509e45fc2f0b7fcbe699ffb24d3ecdbfd406a79d6d42409f968c54f70c5eec6bd85793a52aa786d7d5a5e87e5533d84f1f95a7a4e1

Download Submit
C:\Windows\Installer\MSIF23.tmp

Filesize
278KB

MD5
5d7495207fbb9e5bfb0037ba83e86214

SHA1
2f61780801d657424dd891e9d72463767fd5d5fb

SHA256
0503e4d5de79d2fa7a55a25e8b43d8e2bac3759365314d9bf17ed231082a5ae1

SHA512
2a7bdd1bac890580ab99b2509e45fc2f0b7fcbe699ffb24d3ecdbfd406a79d6d42409f968c54f70c5eec6bd85793a52aa786d7d5a5e87e5533d84f1f95a7a4e1

Download Submit
C:\Windows\rft64.exe

Filesize
10.4MB

MD5
27c3445f5d46964e15f8358a9589dbe4

SHA1
4d3b42f0d82428791eea8f2a0ebd463d30df70aa

SHA256
3d71f4dd329a115945231bc5abf38a0171b2561181e92eb0bf465db4589e45ca

SHA512
5b4f67d10fc15a54a3103183b8548353f47599e47e4e60e64b474bdc624c0e29af39215eeeac44e7aea7a2ff7ddbe3d3199a6b950a213b7cd8be03cd88e659ed

Download Submit
C:\Windows\rft64.exe

Filesize
10.4MB

MD5
27c3445f5d46964e15f8358a9589dbe4

SHA1
4d3b42f0d82428791eea8f2a0ebd463d30df70aa

SHA256
3d71f4dd329a115945231bc5abf38a0171b2561181e92eb0bf465db4589e45ca

SHA512
5b4f67d10fc15a54a3103183b8548353f47599e47e4e60e64b474bdc624c0e29af39215eeeac44e7aea7a2ff7ddbe3d3199a6b950a213b7cd8be03cd88e659ed

Download Submit
\??\c:\windows\rft64.exe

Filesize
10.4MB

MD5
27c3445f5d46964e15f8358a9589dbe4

SHA1
4d3b42f0d82428791eea8f2a0ebd463d30df70aa

SHA256
3d71f4dd329a115945231bc5abf38a0171b2561181e92eb0bf465db4589e45ca

SHA512
5b4f67d10fc15a54a3103183b8548353f47599e47e4e60e64b474bdc624c0e29af39215eeeac44e7aea7a2ff7ddbe3d3199a6b950a213b7cd8be03cd88e659ed

Download Submit
\??\c:\windows\rft64.exe

Filesize
10.4MB

MD5
27c3445f5d46964e15f8358a9589dbe4

SHA1
4d3b42f0d82428791eea8f2a0ebd463d30df70aa

SHA256
3d71f4dd329a115945231bc5abf38a0171b2561181e92eb0bf465db4589e45ca

SHA512
5b4f67d10fc15a54a3103183b8548353f47599e47e4e60e64b474bdc624c0e29af39215eeeac44e7aea7a2ff7ddbe3d3199a6b950a213b7cd8be03cd88e659ed

Download Submit
\Program Files (x86)\KSPCeviri\Kerbal Space Program Türkçe Yama\Launcher.exe

Filesize
15.4MB

MD5
cf29f092eb7d654a73236a8becbc36f6

SHA1
e3cc40bfd4ec178a0285a9f8cd652f88c89eefcf

SHA256
44ea5818829a2a9c69274cfdcde623466f0734dd907dd2e2273256c48d27e761

SHA512
da36e9ff4b0c0db12c4747c6108aa46ad5c3ae49ac1dc6021824562bf6391dc77fd815e42a315b908a677507e9eece9c03bc09027e733d12457b56e5741a1ac8

Download Submit
\Program Files (x86)\KSPCeviri\Kerbal Space Program Türkçe Yama\Launcher.exe

Filesize
15.4MB

MD5
cf29f092eb7d654a73236a8becbc36f6

SHA1
e3cc40bfd4ec178a0285a9f8cd652f88c89eefcf

SHA256
44ea5818829a2a9c69274cfdcde623466f0734dd907dd2e2273256c48d27e761

SHA512
da36e9ff4b0c0db12c4747c6108aa46ad5c3ae49ac1dc6021824562bf6391dc77fd815e42a315b908a677507e9eece9c03bc09027e733d12457b56e5741a1ac8

Download Submit
\Program Files (x86)\KSPCeviri\Kerbal Space Program Türkçe Yama\Launcher.exe

Filesize
15.4MB

MD5
cf29f092eb7d654a73236a8becbc36f6

SHA1
e3cc40bfd4ec178a0285a9f8cd652f88c89eefcf

SHA256
44ea5818829a2a9c69274cfdcde623466f0734dd907dd2e2273256c48d27e761

SHA512
da36e9ff4b0c0db12c4747c6108aa46ad5c3ae49ac1dc6021824562bf6391dc77fd815e42a315b908a677507e9eece9c03bc09027e733d12457b56e5741a1ac8

Download Submit
\Program Files (x86)\KSPCeviri\Kerbal Space Program Türkçe Yama\Launcher.exe

Filesize
15.4MB

MD5
cf29f092eb7d654a73236a8becbc36f6

SHA1
e3cc40bfd4ec178a0285a9f8cd652f88c89eefcf

SHA256
44ea5818829a2a9c69274cfdcde623466f0734dd907dd2e2273256c48d27e761

SHA512
da36e9ff4b0c0db12c4747c6108aa46ad5c3ae49ac1dc6021824562bf6391dc77fd815e42a315b908a677507e9eece9c03bc09027e733d12457b56e5741a1ac8

Download Submit
\Users\Admin\AppData\Local\Temp\MSI1F3C.tmp

Filesize
386KB

MD5
72b1c6699ddc2baab105d32761285df2

SHA1
fc85e9fb190f205e6752624a5231515c4ee4e155

SHA256
bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97

SHA512
cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170

Download Submit
\Users\Admin\AppData\Local\Temp\MSI1F7B.tmp

Filesize
386KB

MD5
72b1c6699ddc2baab105d32761285df2

SHA1
fc85e9fb190f205e6752624a5231515c4ee4e155

SHA256
bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97

SHA512
cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170

Download Submit
\Users\Admin\AppData\Local\Temp\MSI87E6.tmp

Filesize
386KB

MD5
72b1c6699ddc2baab105d32761285df2

SHA1
fc85e9fb190f205e6752624a5231515c4ee4e155

SHA256
bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97

SHA512
cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170

Download Submit
\Users\Admin\AppData\Local\Temp\MSI89EA.tmp

Filesize
544KB

MD5
40117f705bff008c3d96a73162dad044

SHA1
2735813836f36b5de83a745c47628053a0f61f66

SHA256
32211c43bcfee2ea3ae54899af178d1fc0c2b1111b2a9e3cc3fd125e1ab7daad

SHA512
eace1d55d479c4cf5692ec1dc98a6738e94874901bebe14a0a0a93eefd00fc4bd55a701e4629a1f7c47f72ac91fe3b698d590a8463119998852e05d6682f91a4

Download Submit
\Users\Admin\AppData\Local\Temp\MSI8A68.tmp

Filesize
386KB

MD5
72b1c6699ddc2baab105d32761285df2

SHA1
fc85e9fb190f205e6752624a5231515c4ee4e155

SHA256
bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97

SHA512
cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170

Download Submit
\Users\Admin\AppData\Local\Temp\MSI8B24.tmp

Filesize
386KB

MD5
72b1c6699ddc2baab105d32761285df2

SHA1
fc85e9fb190f205e6752624a5231515c4ee4e155

SHA256
bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97

SHA512
cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170

Download Submit
\Users\Admin\AppData\Local\Temp\MSI8BB1.tmp

Filesize
386KB

MD5
72b1c6699ddc2baab105d32761285df2

SHA1
fc85e9fb190f205e6752624a5231515c4ee4e155

SHA256
bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97

SHA512
cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170

Download Submit
\Users\Admin\AppData\Local\Temp\MSI8C8D.tmp

Filesize
544KB

MD5
40117f705bff008c3d96a73162dad044

SHA1
2735813836f36b5de83a745c47628053a0f61f66

SHA256
32211c43bcfee2ea3ae54899af178d1fc0c2b1111b2a9e3cc3fd125e1ab7daad

SHA512
eace1d55d479c4cf5692ec1dc98a6738e94874901bebe14a0a0a93eefd00fc4bd55a701e4629a1f7c47f72ac91fe3b698d590a8463119998852e05d6682f91a4

Download Submit
\Users\Admin\AppData\Local\Temp\MSI8D2A.tmp

Filesize
386KB

MD5
72b1c6699ddc2baab105d32761285df2

SHA1
fc85e9fb190f205e6752624a5231515c4ee4e155

SHA256
bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97

SHA512
cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170

Download Submit
\Users\Admin\AppData\Local\Temp\{61C2C8B7-51C7-423E-A9EE-F57CA8F5BF75}\1033.dll

Filesize
162KB

MD5
b4f850a62de085524b026549acbe5571

SHA1
e81b3c4050e888e5556be64bbf2f53eeb75b2982

SHA256
fd1fb22420abf616082c3606d76b2d7b3c500ca73ec2f893ebd7ce5f98499e18

SHA512
d5c4f0d5fdddc9c7631a90237f3bb84348e5b9e201824d0c65cf9881f95fee70768f2f4c55b262cba44c20eba3e120105d513d7a838619344fddb763c96486b3

Download Submit
\Windows\Installer\MSI13E5.tmp

Filesize
278KB

MD5
5d7495207fbb9e5bfb0037ba83e86214

SHA1
2f61780801d657424dd891e9d72463767fd5d5fb

SHA256
0503e4d5de79d2fa7a55a25e8b43d8e2bac3759365314d9bf17ed231082a5ae1

SHA512
2a7bdd1bac890580ab99b2509e45fc2f0b7fcbe699ffb24d3ecdbfd406a79d6d42409f968c54f70c5eec6bd85793a52aa786d7d5a5e87e5533d84f1f95a7a4e1

Download Submit
\Windows\Installer\MSI1A6.tmp

Filesize
386KB

MD5
72b1c6699ddc2baab105d32761285df2

SHA1
fc85e9fb190f205e6752624a5231515c4ee4e155

SHA256
bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97

SHA512
cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170

Download Submit
\Windows\Installer\MSI291.tmp

Filesize
544KB

MD5
40117f705bff008c3d96a73162dad044

SHA1
2735813836f36b5de83a745c47628053a0f61f66

SHA256
32211c43bcfee2ea3ae54899af178d1fc0c2b1111b2a9e3cc3fd125e1ab7daad

SHA512
eace1d55d479c4cf5692ec1dc98a6738e94874901bebe14a0a0a93eefd00fc4bd55a701e4629a1f7c47f72ac91fe3b698d590a8463119998852e05d6682f91a4

Download Submit
\Windows\Installer\MSI3BA.tmp

Filesize
544KB

MD5
40117f705bff008c3d96a73162dad044

SHA1
2735813836f36b5de83a745c47628053a0f61f66

SHA256
32211c43bcfee2ea3ae54899af178d1fc0c2b1111b2a9e3cc3fd125e1ab7daad

SHA512
eace1d55d479c4cf5692ec1dc98a6738e94874901bebe14a0a0a93eefd00fc4bd55a701e4629a1f7c47f72ac91fe3b698d590a8463119998852e05d6682f91a4

Download Submit
\Windows\Installer\MSIEA5.tmp

Filesize
278KB

MD5
5d7495207fbb9e5bfb0037ba83e86214

SHA1
2f61780801d657424dd891e9d72463767fd5d5fb

SHA256
0503e4d5de79d2fa7a55a25e8b43d8e2bac3759365314d9bf17ed231082a5ae1

SHA512
2a7bdd1bac890580ab99b2509e45fc2f0b7fcbe699ffb24d3ecdbfd406a79d6d42409f968c54f70c5eec6bd85793a52aa786d7d5a5e87e5533d84f1f95a7a4e1

Download Submit
\Windows\Installer\MSIF23.tmp

Filesize
278KB

MD5
5d7495207fbb9e5bfb0037ba83e86214

SHA1
2f61780801d657424dd891e9d72463767fd5d5fb

SHA256
0503e4d5de79d2fa7a55a25e8b43d8e2bac3759365314d9bf17ed231082a5ae1

SHA512
2a7bdd1bac890580ab99b2509e45fc2f0b7fcbe699ffb24d3ecdbfd406a79d6d42409f968c54f70c5eec6bd85793a52aa786d7d5a5e87e5533d84f1f95a7a4e1

Download Submit
memory/1096-177-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

Filesize
3.8MB

Download
memory/1096-168-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

Filesize
3.8MB

Download
memory/1096-170-0x0000000077BE0000-0x0000000077BF0000-memory.dmp

Filesize
64KB

Download
memory/1096-166-0x000000013F180000-0x000000014104F000-memory.dmp

Filesize
30.8MB

Download
memory/1096-164-0x000000013F180000-0x000000014104F000-memory.dmp

Filesize
30.8MB

Download
memory/1096-174-0x000000013F180000-0x000000014104F000-memory.dmp

Filesize
30.8MB

Download
memory/1096-167-0x000000013F180000-0x000000014104F000-memory.dmp

Filesize
30.8MB

Download
memory/1096-163-0x000000013F180000-0x000000014104F000-memory.dmp

Filesize
30.8MB

Download
memory/1096-165-0x000000013F180000-0x000000014104F000-memory.dmp

Filesize
30.8MB

Download
memory/1628-248-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

Filesize
3.8MB

Download
memory/1628-242-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

Filesize
3.8MB

Download
memory/1628-240-0x000000013FB70000-0x0000000141547000-memory.dmp

Filesize
25.8MB

Download
memory/1628-243-0x000000013FB70000-0x0000000141547000-memory.dmp

Filesize
25.8MB

Download
memory/1628-244-0x000000013FB70000-0x0000000141547000-memory.dmp

Filesize
25.8MB

Download
memory/1628-245-0x000000013FB70000-0x0000000141547000-memory.dmp

Filesize
25.8MB

Download
memory/1628-247-0x0000000077BE0000-0x0000000077BF0000-memory.dmp

Filesize
64KB

Download
memory/1628-246-0x000000013FB70000-0x0000000141547000-memory.dmp

Filesize
25.8MB

Download
memory/1628-241-0x000000013FB70000-0x0000000141547000-memory.dmp

Filesize
25.8MB

Download
memory/2396-179-0x000000013FE30000-0x0000000141807000-memory.dmp

Filesize
25.8MB

Download
memory/2396-176-0x000000013FE30000-0x0000000141807000-memory.dmp

Filesize
25.8MB

Download
memory/2396-178-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

Filesize
3.8MB

Download
memory/2396-183-0x000000013FE30000-0x0000000141807000-memory.dmp

Filesize
25.8MB

Download
memory/2396-196-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

Filesize
3.8MB

Download
memory/2396-180-0x000000013FE30000-0x0000000141807000-memory.dmp

Filesize
25.8MB

Download
memory/2396-184-0x0000000077BE0000-0x0000000077BF0000-memory.dmp

Filesize
64KB

Download
memory/2396-182-0x000000013FE30000-0x0000000141807000-memory.dmp

Filesize
25.8MB

Download
memory/2396-181-0x000000013FE30000-0x0000000141807000-memory.dmp

Filesize
25.8MB

Download
memory/2516-3-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/2516-87-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/2720-128-0x000000013F410000-0x000000013F420000-memory.dmp

Filesize
64KB

Download
memory/2720-216-0x000000013F410000-0x000000013F420000-memory.dmp

Filesize
64KB

Download
memory/2920-238-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

Filesize
3.8MB

Download
memory/2920-237-0x000000013F790000-0x000000014165F000-memory.dmp

Filesize
30.8MB

Download
memory/2920-233-0x0000000077BE0000-0x0000000077BF0000-memory.dmp

Filesize
64KB

Download
memory/2920-232-0x000000013F790000-0x000000014165F000-memory.dmp

Filesize
30.8MB

Download
memory/2920-231-0x000000013F790000-0x000000014165F000-memory.dmp

Filesize
30.8MB

Download
memory/2920-230-0x000000013F790000-0x000000014165F000-memory.dmp

Filesize
30.8MB

Download
memory/2920-229-0x000000013F790000-0x000000014165F000-memory.dmp

Filesize
30.8MB

Download
memory/2920-228-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

Filesize
3.8MB

Download
memory/2920-227-0x000000013F790000-0x000000014165F000-memory.dmp

Filesize
30.8MB

Download