Analysis

  • max time kernel
    82s
  • max time network
    90s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/02/2024, 10:16

General

  • Target

    app_x64.exe

  • Size

    27.2MB

  • MD5

    e9e17473448e9c4a9be3bf229d6d2fee

  • SHA1

    4336945a1380589cbc67764191a112d31d588d71

  • SHA256

    53a9896638ccbb2c48820247e6da3a31f49c53e7b4a97d7f2bc6ba5a2c0176a1

  • SHA512

    2faafb9bca5f2c00e4406987ea58a2d466896382835fb50b845b21b68db17d8a9537c8de3485693a5f3991cf4ead0ada2b249d65613eb071a9c9acfc738634c4

  • SSDEEP

    393216:9AK/4px/+bFjRd9cxnmkv6n+UzaQ6jBKN3nWy4H+kJIELDJiICAruD5xdAhK5Sak:D//bFNdK3inTaDUNXijThVhkXtkc5KR

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 9 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 14 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\app_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\app_x64.exe"
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:324
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\setup_voa.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\app_x64.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1707665202 " AI_EUIMSI=""
      2⤵
      • Enumerates connected drives
      • Suspicious use of FindShellTrayWindow
      PID:2096
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3280
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding D9F71A5A5034C32E03ECB763F30A2AB5 C
      2⤵
      • Loads dropped DLL
      PID:560
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding C5506C84923EED8BE1C1DD3E6CBC89DD
      2⤵
      • Loads dropped DLL
      PID:5068

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Config.Msi\e57f32d.rbs

          Filesize

          37KB

          MD5

          ff5d21f62f9fb4d4ec07ba3afc92407c

          SHA1

          65ae538cddde076d12a6359253e3bff6abb3937c

          SHA256

          4d278881a0a0bb9eccd02aacf0110e7d5750fa1113af6504fa84aa93d42f4771

          SHA512

          14a4d2eb968b8dbbc7a6d4a4b9e6d840b58f97bb60ae118c25cd79358121a992b7d3b140f4e93297667525783a41ce16266049dba0fc437c182c8ad81f7952a5

        • C:\Users\Admin\AppData\Local\Temp\MSID6F8.tmp

          Filesize

          721KB

          MD5

          5a1f2196056c0a06b79a77ae981c7761

          SHA1

          a880ae54395658f129e24732800e207ecd0b5603

          SHA256

          52f41817669af7ac55b1516894ee705245c3148f2997fa0e6617e9cc6353e41e

          SHA512

          9afc180ebc10c0ee0d7306f4b7085608a4e69321044d474691587bf7e63f945888781a9fc5e69568d351ac690b0335214bd04bdf5c75fd8a3bd1ec4be5d3475a

        • C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Html\copy_files.txt

          Filesize

          412B

          MD5

          b8d29ecde93b8e61a43aaa2ec7eeb7c4

          SHA1

          84c695f3fed53af051279d1eb962d6ed5f3cbe4a

          SHA256

          4660f81a01eff535507087deb0a77110942166a1083d81e6311a9d29484074b8

          SHA512

          2eecc5f8ebd107f61a36f9046dd658e3c575979a4da4c04e3becf1b74627be7eabba622d1b13503529c1edd51dd64dcef12da4c56e5d1026eb88c6dc5eeaf2f5

        • C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Arabic.dll

          Filesize

          180KB

          MD5

          a1fb20834c0ee30da23e74f30f0f6b64

          SHA1

          366728b44236ff95acadd502d870d4e13c1d2cb8

          SHA256

          b3118a87e8378b3a12795356285527ac9c024ee0c614d8c58ef07ae2a70d3c7f

          SHA512

          9de6573297a0b39eb9424023c1c64638e99145b5737f37a93a6863364624df0f3326da9c84889460a0e28110366d3308f6b03c62bae2a59345fff962a8dce7ad

        • C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Bulgarian.dll

          Filesize

          168KB

          MD5

          c873d5c115b8f4e36d9f9dbc94b100fc

          SHA1

          17df72a7b9c0ba6502e1f466726c0bcee0d86e76

          SHA256

          a353b29e7b8d23a61b335f2620957de04ad75a257a897caecfe3b81b80cb3f83

          SHA512

          ab4fd0d1b9b65ff98501c6aea7b0dbfd26ed35e3c909b00c0b9e6fabea2098d1af1da8ea14443556124bedd6714be0cb70635ee1861cc3f986aaf5245977358d

        • C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Catalan.dll

          Filesize

          180KB

          MD5

          a07c47be03054207780d8c1c591422ab

          SHA1

          01ca150b3d205cc38a26672827937ca1dc2f46ab

          SHA256

          b6c746db05631ca76c4449a7bc329df7f2b84b724b7d959a2dcaebe233788889

          SHA512

          2bd12c926a9b321563cd07df820a2c613eebd78bd81e3bc9dead8f55b3fb7b30dc3e7fed7c9d7c914dc588eb6e37b96823200159b6ffe27d5e74f74d135d15a3

        • C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Chinese_Simp.dll

          Filesize

          120KB

          MD5

          f9138d395ebcd1c0a32bdc6aaf85619e

          SHA1

          6e661a1edba3fad410ad30601ebc6a7b8193d59c

          SHA256

          257673ac931e86d56e9d9e1de54fa47c116be2ae8102f2494876e43b9b117ad0

          SHA512

          69efdabf7509cdecf0cde77068713367272c5a87ad36794b577bee1de41f5e894ec40e4aac2f8e2041a8de58dcca8bd50dd5be14520efc9a79c31f4a99c833f6

        • C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Chinese_TW.dll

          Filesize

          128KB

          MD5

          1a8e5b62560b2c25910debcaae52ff0d

          SHA1

          e0142e33ecff2c30f964a33ea1ce3bd6f43aff0f

          SHA256

          73d778f666e491690d5f6013e7b3bd3407560ad08323d7c402c2174f67e6d4b1

          SHA512

          bee5e1aca70b8123db4894d9455e637d8b42f29ad42f6bc681610ea98fba4ca0b4655553f68ee5795ad616fce915bc100e2e2663935ed1e98bd62c265755f147

        • C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Czech.dll

          Filesize

          172KB

          MD5

          66184d6ca388193b68b16174455d7f5c

          SHA1

          c97efb638f88496b0375e7d4cfe0c73cac662982

          SHA256

          a67036280aea51d37daecc9ccd401af7424a89f713d0d4cc6893be72bfe5e219

          SHA512

          8cd208494c4930f11ff450199a2402f24a38f82931444be228c57fe1a3d93585662a0b6d2e65656cb36c135e3977aab13f1126eeb7fe6906ddca129b5074f288

        • C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Dansk.dll

          Filesize

          155KB

          MD5

          7223d557f938d74ab97eba9632ef0d99

          SHA1

          3c6ecbd8c6cd1ff392c76ff99e5129cd5467e89c

          SHA256

          49ea62fbf869f8553300120667dedd003c14b5850ddb4b1d989afb10d0bc7da6

          SHA512

          056003c23deedde901a8fc13c921310ad83fe22581a479a206d91ada22561cfbc75754ef7c724686bef36c9b4f3ea63cf80f3a894452a431915e895f47e8e798

        • C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Deutsch.dll

          Filesize

          172KB

          MD5

          608185b4a5f1fac97ac21ad4e9c298bf

          SHA1

          b938d10a675b268babc9e0e3653742e39fee3967

          SHA256

          796002e77975f1c47fd4dc357dc4a4862dd028263d64aee457672be586b9fe9f

          SHA512

          3781351360bb0d80a01de5170d0c0cbc78ffccba65098e66645acab5ca80abc205e720d1ac8254b8f783635a1dd531b41830738b9b40839d2b12ce3f80e279c3

        • C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\English_GB.dll

          Filesize

          168KB

          MD5

          5187d71cc0b48fab25ce065c67acd3e3

          SHA1

          65373cbdd8cbdb41f1a0153bdd6f8711cc89ddb6

          SHA256

          f1b9f26375645cd3a9b8e3b2c5c10ed78a4658975415639cd6883760d66f44a2

          SHA512

          927da1e72f0197553a23111b2a4f1abe00e726317e912401255b06ae763d5ebf1ae2528f7a8665d691488a1c0f8b67b8a9cb4c0ec75cbd1eed0a0a037b8636f3

        • C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Estonian.dll

          Filesize

          172KB

          MD5

          3968943a81056549e1773f0022176ccc

          SHA1

          558870e01170bb7ebb2d8d6a26f9c705d05c70e5

          SHA256

          bb4303d659a42e6678fc0eb581e52b85cef4a67f06827ba672106cbc5acc26a1

          SHA512

          f4e5cd9c6944b29a79bb97fca9f0577e1d28d7ab92ed91974a2b134adbf8e06bfea4af70ffc8347ff059bd755db974c1c8b18a432e14e082585ad4c46e6026ae

        • C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Finnish.dll

          Filesize

          168KB

          MD5

          1e62f8c0d6d3ce98bef52c1b7ccdb5fe

          SHA1

          677cb3e56c81681e49f10f93b992829638bc2287

          SHA256

          a4bc4c97446c439c990344fc347c09d23ba90de50be7fe8d3e8c4ba80aee0147

          SHA512

          d2cd4da08777b55459ae56683f58ee79109c569292e6977be5ad2b2ae72929bc286bf4db8b546833af651999c056caa9a54e806a81110ed7cb3aa1c06eefd872

        • C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\French.dll

          Filesize

          172KB

          MD5

          dd3253f12f8018353754d809d4e41740

          SHA1

          2a44a38f88d30b1db103a39dda448c7032b5be0a

          SHA256

          1b42aba123c087cbe01c84d0cda4edd8015f12905de4898b9415c8caa1c540c0

          SHA512

          37e90d6d98f8b1bcf0fdc90fef2cc2790a89eb43bb2795f3b5824661fc20ec04334018073705a4604a9b765af3f2b04712ba59815afc468ed8608b583bc6ecca

        • C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\French2.dll

          Filesize

          208KB

          MD5

          c6b9eec67287a2b43f2aa04f8cb7f527

          SHA1

          f6b5d2102409644e636537f2f745072f6f841b74

          SHA256

          8b13cbc023e0adb5ad2d91d804a7079eeec827ce85ef40eea61cba18e755d66b

          SHA512

          011f1c8778c4bc827daf31bf07c174a2f2b4f76a985423d7f2f98dbd85e7b0d57a34ca695a6d8b44f3e062dff4bbd24b114f123ea7dc01ea0d474738e3f819e0

        • C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Hebrew.dll

          Filesize

          172KB

          MD5

          8ebb2093772df6dadbec3f9f2099fd6a

          SHA1

          385b321aba88626c70ccc21670f70d0bb0ea4b9a

          SHA256

          d96a2d05efa754542623d78542d0f79c8b216a54dc20573e306086cfe872470a

          SHA512

          d8973cb035f5694467b9c0c06abc0666d65d292741b7272667166a3514c8545d0e3e6cd53147fd26b36e34e88f54b59b847038a31914f0b290d12b1765e2f5c0

        • C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Hellenic.dll

          Filesize

          167KB

          MD5

          910238c79bf1d613a2e9e27c7b195b31

          SHA1

          ea67844f7d4a74a9e940e5095a5e6c0128c34c07

          SHA256

          aa98863f36ade462bf488913682443ce2b54d4828e0b8040348d626778be6f30

          SHA512

          cbdfb725cf9a09a01103bb926f7bae71b127fcdceafe0c71bf7a2fbb6116eeb1166a4d7326584508eb4de8496a540b6a4b44a300b57d36263e17b5795158acd2

        • C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Hrvatski.dll

          Filesize

          154KB

          MD5

          3c6a12e8d15073a8186d5373629eef43

          SHA1

          53ecf7c8358dab389357e1e8db371d219fac965a

          SHA256

          a253b7b549e9ab37bebd6cb0c1fdadce0f514616e78fc873c08884160b6ca789

          SHA512

          b96a59a9e27f68bad222923afbd6ae1fea37050444636329f70dd7ef531052e12b65f2048cc7e690ee84b31bf40b07024b65db94b4dcc108247f0766f58980fd

        • C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\IP_Catalan.lng

          Filesize

          8KB

          MD5

          84d7c0bef837a42ce12587a5ac8ab92b

          SHA1

          4d0e009bdd15e03b1f0c2bf1574a1d9c1fcad887

          SHA256

          8953265cba28c89e5e5c438edc43a6654b8b4efaecf70a350d6c13866e016e29

          SHA512

          2b42f74abf8423559b6d3834a71dc7c6ea09e6ce2436f89fa34f02e5894f1db958eb23f3aa5a15329081d7ec06e77fbca26f42a5fecf8a8571d63ac306e7f636

        • C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Italian.dll

          Filesize

          184KB

          MD5

          84d8d3b8ab287da992e603e232f6d6da

          SHA1

          799b6b5d88332501c2ea0c11331b70bd11ab1bc5

          SHA256

          77a8d1151b35e905c6509f23c7783298eff332de1961e946efce1a6725dfc311

          SHA512

          a4b36991152cde60e0d3928314f18b4a313278d4d411ee6461a121b2b69dfd61fa031bd10bf2a39cbe263d80109a226d0bd6f54b2e12e8cb6dc8accc84ef3385

        • C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Italian2.dll

          Filesize

          188KB

          MD5

          94c8eb4fb9f72ac3f6cf6382cef9a58e

          SHA1

          a1dd97e3c7b8597661f91b7cb03e387f4e3165fb

          SHA256

          4670e94541a3f4c746841d668ad43e78cc5ef6f76499e4054bf08062892a9ec3

          SHA512

          209aa80ca952eb02c56197cc7599271480d65702b989a905d3cfc451b9c6eaa93475cef932b1ea9ede5a7bf5cde5675bf540581aab239d4673f84a1f137c0b90

        • C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Japanese.dll

          Filesize

          125KB

          MD5

          3b151b87cc2645769d09347f19e1836d

          SHA1

          3adedb76262be074e2115433563ba7af080a95c7

          SHA256

          d686ffeab62046e5c1d00dde9bd641878c960ef4f5979cc3b87addd4cac56be8

          SHA512

          e82710c068955e089034ee65513adbc3c1103fe6f7f6d05f3c91d6d2e64d3d270b0d9deda497155fea5db36c95fffe414bf1fa00d43950f103ed82ae4a89653b

        • C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Japanese_YuGothic.dll

          Filesize

          125KB

          MD5

          ea1e9792dcdbed397a6e2d2c9a663c78

          SHA1

          e56f499ef53ddb92f26bb2bfd51c31334f518136

          SHA256

          1d6adc5fe7c1da7102e18f0e353ba5788008c24fa5f4abb2e5907ebf21596844

          SHA512

          6bf0834fee96ed46c3fb9ad58b212cf06b972bd4c94775ebd42213d622d75736e9d72233d6a92462a111c01cebac9532eaaeaace57e86fb1b9c96ee14b95da18

        • C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Korean.dll

          Filesize

          136KB

          MD5

          4373c4223e784a8084324e63edb77518

          SHA1

          5390ae04c4f2804c8118451390366a5471b91914

          SHA256

          b9ddc53298937ec125e254a20ecddea912c679c6c51150ef0366dcdfb7035f76

          SHA512

          21168f691c019251f6b2797250801350026ee8a0d77dce0c0854b2f9a4a00809347668b95cd7d2dda2d86241124197ce8673d0c315d4b3a853754f7264ba12e8

        • C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Latvian.dll

          Filesize

          180KB

          MD5

          ce8a3cedbb59feecaf2c5a9856b93ec3

          SHA1

          f2c004b14bbee7dbf979dd5128142577546ffcfa

          SHA256

          c7b9e1b354c2b56bd7669821869e06d15f89f3192995fd2a53bbda4c43b22ff9

          SHA512

          8d0c97248fd13d9a2de72cf728a4e83f6d3d27c316fb873ebcd795cdc498cc7bf651724bc509daea0c74851c736b1c52cde47cb400c7571bdd8c684e7eb11565

        • C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Lithuanian.dll

          Filesize

          175KB

          MD5

          6e9f60da89d53282933ac045331624d3

          SHA1

          89c8b2c1f2f7f649bd28e35995d30d94f81615bb

          SHA256

          a2ee6e8b93a46954d491c1204ed65bddd212ba1e706a3d9efcb07da74df72e35

          SHA512

          aa90816abb9209c6511179e6d0c0788a435ba99d9f084d8242fefedd90ba428262a8d0c534f0a89599420a351201fd4cfa964d634b6f1c366e2e22fa961252ac

        • C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Magyar.dll

          Filesize

          163KB

          MD5

          3636e18d0092f73197dabd7c57e3685d

          SHA1

          9a16bdbe60f46ccbaaaed1d46b7d531d0b4503d1

          SHA256

          81e6ce3dd500995afe9e335e69bd40d4fd8d962f06dccff0b1b88f5e004db633

          SHA512

          b4345b0e5cd30b0ba50b269505540a3ec4083b5a054de8c48f5f7a165cc0877f81986df0a1ad46d6106ebd8aa5c2701384ba8bd38a534b064ea63b583e57d539

        • C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Nederlands.dll

          Filesize

          165KB

          MD5

          e334d2045ae0ca8a7bea8abaa6520f86

          SHA1

          7b08b57504e1bb14501475090f2a85970e207aa5

          SHA256

          dd0a72137830d020cd4a2e7c8fb07bc9ac72cda201325e95dc41daffe3fe1ab2

          SHA512

          b6e29d1ef5fdfd6c52061e9192e096f790c846a8137b8039edf26f35f023754cae91883b7ee024265fd2c797b004363d252da5624e6671b5848cdd03ae9668da

        • C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Norsk.dll

          Filesize

          180KB

          MD5

          d662cf66f0068e6ac2d8979cdf1c3260

          SHA1

          95284be7cde04684e207d07d9e694e4309419b3e

          SHA256

          42d6004368be5cb0bb77538fc224394ab55fecd3b762c4dca0a0ad424d5693d6

          SHA512

          9ae9f43cc9f460f28fb674ad7cd6e66c713e98283c93158ea5a00ae29ea10a55d55c7d22ec72b18fa5ec4ea0ee56fb80d779a227f47d81de2e4ab53f4f3738a7

        • C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Polski.dll

          Filesize

          180KB

          MD5

          ebb224f33fd82bfb473e022ee76012cb

          SHA1

          f79cd9a6ba8b38bd62b5f6250943f5ad51336cde

          SHA256

          ea8e06ddacec03d9ffea24682fe1a2c22664b16879b25bb78684521020a69b9d

          SHA512

          e73401fec5b1684c7fdb3657430e3cd1d1873ea0c8b71f8cb88b9d52efdcb178cbeda11a9c7f7ac18906c3091e4aad09393e5b14e3cbebe70a345c7b6d65daca

        • C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Portuguese.dll

          Filesize

          176KB

          MD5

          303c950079d2a0ff7ae89fc149014ddf

          SHA1

          c49b8b607fefc132d26d11d940a921b186f54938

          SHA256

          502590dfc90074e4f313a5bbb264396d735aae228cb2470a878e450f220a9065

          SHA512

          662d0ea7e197a19f7b0af78f56aab82e63937d6b8dc6eda87bd4de56c1cede32360fe7ac097a764da2d769f0cca912522ac0e777b9eb24492c18021cbcbfdcc8

        • C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Portuguese_br.dll

          Filesize

          188KB

          MD5

          059358c1fbccc4a65b0f4af4290fff31

          SHA1

          4c763188d5e0022ddde0c40b2779f99c6ae10f48

          SHA256

          9e16ee5800d23a2225435a39f6f4c3ae94256fb3d469cac2c4906a96cd8c8cd4

          SHA512

          4b256a807f4e8d23f1a63c4490586542a2c880c9fa0a7248b6117b429a866930cef388f384b0154465f8347abebd5918e9ab712962be5f0cf0ba42e85cf5f7a8

        • C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Romanian.dll

          Filesize

          175KB

          MD5

          0d70103f46c78339c37e9a144aff1aaa

          SHA1

          c1cf65e3d00a26614bf4d43647a6f0eb6297e0a7

          SHA256

          b3a1790ea017c5e68a28260cf17b1e48590c6b47c686eac65e9d24d885663467

          SHA512

          f0b0a47c1a4b7f48d7816e8452f41366909502d98b4e4354f68a87b9a4e5c5e10da463fbf282df36c9d0825666d2074eee0a303a6ce6474bcdc7ea638451515e

        • C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Russian.dll

          Filesize

          176KB

          MD5

          53c2b5f6e1741e51c50b8ada8812b496

          SHA1

          30ade056bfdf31ad751fe46e2dc4a74040285397

          SHA256

          57c904c63d0a0694e420b372b221d59ad94cceb51a5ccc9f679ede029b0e0d89

          SHA512

          1c11631690cc1e9a2f7e90f1804540519c7abe4daf1c8c86b963731c68e6703dece0d9808a762059e59a034419dcf0f2d43167792e3a12edca5f560ac703b279

        • C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Slovak.dll

          Filesize

          163KB

          MD5

          8a984d5d98aacee0ed5fe13ce581a190

          SHA1

          5757872714f9c57345305d0285c1efc1a934945e

          SHA256

          55be572803ec60686cc4392287b81575ef19dca7e47cc3b44f7f60e6d1403299

          SHA512

          801b64c86c76897946fc9639fd7ab59f35aa6e304cb1ff0030eeb3592ad56d34aafcc186b42191bd00443b49cca43f7f58491db91c89136fc6e32002bf73f065

        • C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Slovenscina.dll

          Filesize

          184KB

          MD5

          19c7ff40eae81193badc4e6a3aea5997

          SHA1

          6486fed7053fa2d192ffb8752202cd93b608ad92

          SHA256

          a572ab321510b4e1dc8f774b5cdea4e89acd8e71416a4e583942af8183694bde

          SHA512

          41e7949475632b04152f2e232e9246d9cfe993d90c1610b753fb8c271366a149d178a28f76fd373e56bcaf32411bf19a42373ce346725cb9190754b76523b6d4

        • C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Spanish.dll

          Filesize

          188KB

          MD5

          92c5a34cd354ffabbd99ab6a6b9c8751

          SHA1

          e1eccedc577e36ae92757e31dbc064b8344022e1

          SHA256

          fe51640237dfe1bf950f27508083780a610a3b427fc1c50bbaeafcccdd08e3a7

          SHA512

          f10d8e849f3dd7e0777e9ba0348e6fa9c07a545d21560596b0e3ec60b8a78d33056c7c938dbe29eb020f282371dcf295545f7e6368d270ebabf1d3e425c651d9

        • C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Swedish.dll

          Filesize

          168KB

          MD5

          06932290b3280cec676daf363b78e43a

          SHA1

          7c4e08bb8a981676a9bb5c07ffa4d9de590b2c2a

          SHA256

          1063a30f2a049884dd60995a9c602f14986fd7ed99d29106f9a9ca48f0e498bb

          SHA512

          50bc61b27ab87be4a031b96460070b02c8607821a3672155ae0367057a925fb4e4d2e8000be4c5686a6c783ad363e83990682d7ea76e8728ad5dcf293d37d5af

        • C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Turkish.dll

          Filesize

          176KB

          MD5

          3b3b7a1b5765dfcff9df827ae8abfe01

          SHA1

          6ef9bad7abc8218a5ba669fdc2b14483410254bf

          SHA256

          e1adb0272614a498bdbcba1095c6cd92c5d5a225e858e50c1bda1d87701480e7

          SHA512

          af04c67469c88b33287a01f787997fec189a29c848870fba1cd86fd0d23b067ff502c4516c3347c3a1900475416f2c1e56834002d00e1884e946433dd0663d95

        • C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Ukrainian.dll

          Filesize

          180KB

          MD5

          db16afc69aae8afb5048f5fa332d90bb

          SHA1

          3fb6fe1ec38d6dc42755158c11f3675a795f0330

          SHA256

          70ef05a85f3dc02c5a2a6efa8a12b96b956f7f94211695d25d3ffc91a10ff777

          SHA512

          17c5ebe5dcc6c225d6dcf14fa59386f1ad5b563ee55639cf61aa9bd5f4b0b5e19abce170712479b35f1115a0bd75b2c7a7de1a75594687f739cc6972ffbe2ccf

        • C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Uzbek.dll

          Filesize

          180KB

          MD5

          91617b7c9f4b2a1dd66475ea0a4155e9

          SHA1

          caf8dbb4cfae00bb1e7913bef8ea3e34e9f0a7be

          SHA256

          5135c251c5241846ad4329d09de03808cd5589a6ac70573ebfb04474428b700a

          SHA512

          17a84e5362897833fa0ecd0bc2f80cbacd1ff5267d3042d8d329ab58bb276e532a106b4e938f9760abc048df0004c2b49acc6b00130e9053ad29f0d488b6b21e

        • C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Plugins\AltaLux.dll

          Filesize

          335KB

          MD5

          569d0802c93e1e46c842b6fdc0b6b167

          SHA1

          bae1c9ae077bf831d095b8c4d2a870f197863db5

          SHA256

          c95592c8f7f588eba4b55b909109d6ad4f7a303feffe746591a0fbfb5a1c52be

          SHA512

          d6c7a54e17d9fe4164504845ac72e3b8f7935b4574c6896483e02adf65de35ec630a9811fc0d7d5d539cbdf115a73de27fe4c8d8911b4f7137626ee008135acf

        • C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Plugins\Avif.dll

          Filesize

          1.9MB

          MD5

          1be2bcedea9a2a44901a83e596928ab7

          SHA1

          362889f8ee55fd2ea5318c6027555f96a7dc81c4

          SHA256

          c50eddc8730e8074d2dc2ed9adcde056149e6a68005f43c94f31461693c3165b

          SHA512

          65a424a229bd1f25967137f97f88a09e5a12333f5242e6998929ab13fa38cb4211b490b361dc0bc52b7149af95f0291acba76129a818c9ecf84a6b9086ff442a

        • C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Plugins\Awd.dll

          Filesize

          2.9MB

          MD5

          13209653ff66bf24b718bce8c590a4c6

          SHA1

          2a8b1261d7a97685271ef57cbb1225c675a790d6

          SHA256

          75a4bb820ab7b8feee37fe1497b4e4070bc14e23c9555c49ce35adc4933f6a7a

          SHA512

          5ca43b090a260d8cebdba4850c809282eb162b52f3bde02a0b9709bad019a364ee4c65517f2386321699c5116ea54a075e9b97ea7370937438b073b30510e8d0

        • C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Plugins\B3d.dll

          Filesize

          122KB

          MD5

          0a86bf5841c171425c0cddc22c24be77

          SHA1

          39d0e58207b0efc096ec65a501356bfc9980fc28

          SHA256

          f1930070543b84825f7228cc515c5387ba87ca3c4dbe469df3f24c6fe24a3157

          SHA512

          2d6443b7aad7403dbbe2e8d73b924777fb2f8506c3a07a4d3637e9f8a615a31d4949b82634f136dce6aec9e9ce1b1f0f5f8bbf71ce4d3a87c7a9b3b4098a49a8

        • C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Plugins\BabaCAD4Image.dll

          Filesize

          557KB

          MD5

          d76acd09b8ed974d97c29d821b8c62ea

          SHA1

          44cce0b91de16da0f2470fd86cea9bc6d9826cd7

          SHA256

          2bef1cdb1fec65a6e87dcc46c0d2ed7d2cbebb4c9717abf61886a76831d3a2ea

          SHA512

          717842cf3227384cb84cbf2bed0e8b2959b8f3542da6c6d3009d466241a467a9526670413cb2cb0a61f726b89174ea1d0499d81d4e533542737836290d65799f

        • C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\setup_voa.msi

          Filesize

          2.7MB

          MD5

          a1795951040f43bac4ed87b366d87755

          SHA1

          b8c4a77ed308924e090913aa1f83e85ebd885a54

          SHA256

          1b1563d4ac73a37df8b8fbb5547dbb4ccd62941f8e5448bab79789b109dc8aef

          SHA512

          a9ebfacbb822817a5d43ef4eee4a3f3c806796977a5600d89a9682b9aefdabd7b0959546e5c144ce836380455f5fdf9cf4768ee11f4928bbf0df12bf9bec5f5b

        • C:\Windows\Installer\MSIFC34.tmp

          Filesize

          666KB

          MD5

          029aa011e8eeb0b9cf2b098dc618e22f

          SHA1

          144c3b54740ac786c7eb972a3bb4f8fc605afff6

          SHA256

          0db0d46e74d727a4d367052c29953664b699faf75d71eaaf884831cfa09e8a0f

          SHA512

          2e34db1c114e8272c8979cabc598121cd0e19edbfd329301ee3c9cedff409799edacb962526bb3bd72dc822c98852919187b0c375dc43ca9e68491076fae74b5

        • C:\Windows\Installer\MSIFEB6.tmp

          Filesize

          355KB

          MD5

          6fffcc81f6d77441ee40bd43dcbffea9

          SHA1

          2bfa4ae49d5ae11d7f8fe393a5d2805476fbaa79

          SHA256

          c46fe9399560208736571ee242e67e0d25521e6d6566739c79b9ad9702961877

          SHA512

          1de75a82c6299df1106f0a33d27824768d9816cd05040e0cc2a7d90996d72a2f8385da58647fc129b840afc4b8755df1ff1fb806e31cf6a71354c9a61f5b140f

        • C:\Windows\Installer\MSIFEB6.tmp

          Filesize

          398KB

          MD5

          e9ebda21bc01ce71fc8540b9b6b5d978

          SHA1

          0a6b21f76c3e3c15509f3978971bb74ea02aee4e

          SHA256

          8ca167f69fe5c5f0f17436b3d36a1194e383882af9858cb54be15684626c927a

          SHA512

          ca9072ebec7d2c2f4f4c65964c1dd3a10de31d7cf477ef74d2176f1fbd4517c7bd5e475235c12cf60e0d98f8217f8be877473d2efe1fef29b0396bed9e8bd05d

        • C:\Windows\Installer\MSIFEE6.tmp

          Filesize

          183KB

          MD5

          0fd2cda57c5f67230c84749e72fd754f

          SHA1

          e29341f73b809d7e487ce7d0601e5e57a6c19730

          SHA256

          1b96bc3dd67dc564cda934457e3371e458127c56c551ae2f6d8d1f29fc194032

          SHA512

          d48ce0f2d102ada061bcebc8a1a8c728db74f3ee45ea17b898abc54958bd34820083b57d90aed5ed963599e96ae28db0ff47c1a7208accbf1e7af0b3178c9a85

        • C:\Windows\Installer\MSIFEE6.tmp

          Filesize

          135KB

          MD5

          e5206e2a5aade0a59041b8d8cad4d67b

          SHA1

          d92c38b6897160742e95b4369cca9b61f896e081

          SHA256

          eabe06af3799f71647b3173f36559c4f2f56d587b7cd8be9c9d5ba352e63aaa0

          SHA512

          c4cf58affeea578cec196b3d239d49714d5a6ac5fc8409e4c8b396fca971d84f4ec24447e6833ca00bbad788f0e1ca7bb6eba8b3bb0bb650385816739edc34d0

        • C:\Windows\Installer\MSIFFB2.tmp

          Filesize

          255KB

          MD5

          c79c7fa55abd0db41ed3a896d75098ea

          SHA1

          9dcab048140951f407fe3d6f84375ac23edee8e0

          SHA256

          7d7486945fe02518132e3797b68f7270eba813877a8448f80f6eb752bae6fef7

          SHA512

          0eb262d06b059578544ca568c5f4ad38fdccbca9dcd66eb92dd55c9f0dac68ba7a9ee9de6b669b08de6a01f84072101e9062c872df3541541e9e127e1981e3a5

        • C:\Windows\Installer\MSIFFB2.tmp

          Filesize

          104KB

          MD5

          a16c5e410e91d380f91b155f2c3baa2e

          SHA1

          22075f2c0b8f2c8abc8c4d455a596146961ab61c

          SHA256

          9a446fcc5ca6d2a016ad1e37885ac5dcaf0ca39d5693fd29637c3897a1553677

          SHA512

          f1e82e5d10034d402f7bae6e0defb6ecab97a111a4b36efa144d9e4132c2720d10f4eb280f5079d16251b4bb391c9096211910b88a35d8d0b08bb3ebe528a597