53a9896638ccbb2c48820247e6da3a31f49c53e7b4a97d7f2bc6ba5a2c0176a1

Analysis

max time kernel
86s
max time network
88s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
14-02-2024 10:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

app_x64.exe
Size

27.2MB
MD5

e9e17473448e9c4a9be3bf229d6d2fee
SHA1

4336945a1380589cbc67764191a112d31d588d71
SHA256

53a9896638ccbb2c48820247e6da3a31f49c53e7b4a97d7f2bc6ba5a2c0176a1
SHA512

2faafb9bca5f2c00e4406987ea58a2d466896382835fb50b845b21b68db17d8a9537c8de3485693a5f3991cf4ead0ada2b249d65613eb071a9c9acfc738634c4
SSDEEP

393216:9AK/4px/+bFjRd9cxnmkv6n+UzaQ6jBKN3nWy4H+kJIELDJiICAruD5xdAhK5Sak:D//bFNdK3inTaDUNXijThVhkXtkc5KR

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 9 IoCs

pid	Process
3528	MsiExec.exe
3528	MsiExec.exe
3528	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\L:	app_x64.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	app_x64.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	app_x64.exe
File opened (read-only)	\??\Z:	app_x64.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	app_x64.exe
File opened (read-only)	\??\S:	app_x64.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\E:	app_x64.exe
File opened (read-only)	\??\G:	app_x64.exe
File opened (read-only)	\??\I:	app_x64.exe
File opened (read-only)	\??\K:	app_x64.exe
File opened (read-only)	\??\M:	app_x64.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	app_x64.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\V:	app_x64.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\X:	app_x64.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	app_x64.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	app_x64.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	app_x64.exe
File opened (read-only)	\??\O:	app_x64.exe
File opened (read-only)	\??\U:	app_x64.exe
File opened (read-only)	\??\W:	app_x64.exe
File opened (read-only)	\??\Y:	app_x64.exe
File opened (read-only)	\??\Q:	app_x64.exe
File opened (read-only)	\??\T:	app_x64.exe
File opened (read-only)	\??\Y:	msiexec.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFEA068B6288882623.TMP	msiexec.exe
File created	C:\Windows\Installer\e57594b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI59F8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5A09.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{8BA62DA6-2BCE-4D35-9DF5-ECB25909BABC}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF26659D50E7BCBB48.TMP	msiexec.exe
File created	C:\Windows\Installer\e57594f.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFAE7B513DEF8A5467.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI598A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5A19.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5A3B.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6EDE7CB9839F39DD.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e57594b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5A2A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI622B.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1155165157-2721788668-771323609-1000_Classes\MIME\Database\Content Type\jeia	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1155165157-2721788668-771323609-1000_Classes\MIME\Database\Content Type\jeia\Extension = ".ext"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1155165157-2721788668-771323609-1000_Classes\public ut.App tu\shell\ = "open"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1155165157-2721788668-771323609-1000_Classes\public ut.App tu\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\public ut\\App tu\\i_view64.exe\" \"%1\""	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1155165157-2721788668-771323609-1000_Classes\public ut.App tu\shell\open\command\command = 29002b002800740054004f004f0037006e0040005b003d0027005300620057004b006d00600065003e002b0044003700650070004b003700280071004000630065002e0060005500630059002600610042002000220025003100220000000000	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1155165157-2721788668-771323609-1000_Classes\.ext\public ut.App tu	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1155165157-2721788668-771323609-1000_Classes\.ext\Content Type = "jeia"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1155165157-2721788668-771323609-1000_Classes\public ut.App tu\shell\open	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1155165157-2721788668-771323609-1000_Classes\.ext\public ut.App tu\ShellNew	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1155165157-2721788668-771323609-1000_Classes\.ext	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1155165157-2721788668-771323609-1000_Classes\public ut.App tu\shell\open\ = "&Open"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1155165157-2721788668-771323609-1000_Classes\public ut.App tu	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1155165157-2721788668-771323609-1000_Classes\public ut.App tu\shell	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1155165157-2721788668-771323609-1000_Classes\.ext\ = "public ut.App tu"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1155165157-2721788668-771323609-1000_Classes\public ut.App tu\shell\open\command	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
800	msiexec.exe
800	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	800	msiexec.exe
Token: SeCreateTokenPrivilege	5008	app_x64.exe
Token: SeAssignPrimaryTokenPrivilege	5008	app_x64.exe
Token: SeLockMemoryPrivilege	5008	app_x64.exe
Token: SeIncreaseQuotaPrivilege	5008	app_x64.exe
Token: SeMachineAccountPrivilege	5008	app_x64.exe
Token: SeTcbPrivilege	5008	app_x64.exe
Token: SeSecurityPrivilege	5008	app_x64.exe
Token: SeTakeOwnershipPrivilege	5008	app_x64.exe
Token: SeLoadDriverPrivilege	5008	app_x64.exe
Token: SeSystemProfilePrivilege	5008	app_x64.exe
Token: SeSystemtimePrivilege	5008	app_x64.exe
Token: SeProfSingleProcessPrivilege	5008	app_x64.exe
Token: SeIncBasePriorityPrivilege	5008	app_x64.exe
Token: SeCreatePagefilePrivilege	5008	app_x64.exe
Token: SeCreatePermanentPrivilege	5008	app_x64.exe
Token: SeBackupPrivilege	5008	app_x64.exe
Token: SeRestorePrivilege	5008	app_x64.exe
Token: SeShutdownPrivilege	5008	app_x64.exe
Token: SeDebugPrivilege	5008	app_x64.exe
Token: SeAuditPrivilege	5008	app_x64.exe
Token: SeSystemEnvironmentPrivilege	5008	app_x64.exe
Token: SeChangeNotifyPrivilege	5008	app_x64.exe
Token: SeRemoteShutdownPrivilege	5008	app_x64.exe
Token: SeUndockPrivilege	5008	app_x64.exe
Token: SeSyncAgentPrivilege	5008	app_x64.exe
Token: SeEnableDelegationPrivilege	5008	app_x64.exe
Token: SeManageVolumePrivilege	5008	app_x64.exe
Token: SeImpersonatePrivilege	5008	app_x64.exe
Token: SeCreateGlobalPrivilege	5008	app_x64.exe
Token: SeCreateTokenPrivilege	5008	app_x64.exe
Token: SeAssignPrimaryTokenPrivilege	5008	app_x64.exe
Token: SeLockMemoryPrivilege	5008	app_x64.exe
Token: SeIncreaseQuotaPrivilege	5008	app_x64.exe
Token: SeMachineAccountPrivilege	5008	app_x64.exe
Token: SeTcbPrivilege	5008	app_x64.exe
Token: SeSecurityPrivilege	5008	app_x64.exe
Token: SeTakeOwnershipPrivilege	5008	app_x64.exe
Token: SeLoadDriverPrivilege	5008	app_x64.exe
Token: SeSystemProfilePrivilege	5008	app_x64.exe
Token: SeSystemtimePrivilege	5008	app_x64.exe
Token: SeProfSingleProcessPrivilege	5008	app_x64.exe
Token: SeIncBasePriorityPrivilege	5008	app_x64.exe
Token: SeCreatePagefilePrivilege	5008	app_x64.exe
Token: SeCreatePermanentPrivilege	5008	app_x64.exe
Token: SeBackupPrivilege	5008	app_x64.exe
Token: SeRestorePrivilege	5008	app_x64.exe
Token: SeShutdownPrivilege	5008	app_x64.exe
Token: SeDebugPrivilege	5008	app_x64.exe
Token: SeAuditPrivilege	5008	app_x64.exe
Token: SeSystemEnvironmentPrivilege	5008	app_x64.exe
Token: SeChangeNotifyPrivilege	5008	app_x64.exe
Token: SeRemoteShutdownPrivilege	5008	app_x64.exe
Token: SeUndockPrivilege	5008	app_x64.exe
Token: SeSyncAgentPrivilege	5008	app_x64.exe
Token: SeEnableDelegationPrivilege	5008	app_x64.exe
Token: SeManageVolumePrivilege	5008	app_x64.exe
Token: SeImpersonatePrivilege	5008	app_x64.exe
Token: SeCreateGlobalPrivilege	5008	app_x64.exe
Token: SeCreateTokenPrivilege	5008	app_x64.exe
Token: SeAssignPrimaryTokenPrivilege	5008	app_x64.exe
Token: SeLockMemoryPrivilege	5008	app_x64.exe
Token: SeIncreaseQuotaPrivilege	5008	app_x64.exe
Token: SeMachineAccountPrivilege	5008	app_x64.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5008	app_x64.exe
912	msiexec.exe
912	msiexec.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 3528	800	msiexec.exe	79
PID 800 wrote to memory of 3528	800	msiexec.exe	79
PID 800 wrote to memory of 3528	800	msiexec.exe	79
PID 5008 wrote to memory of 912	5008	app_x64.exe	80
PID 5008 wrote to memory of 912	5008	app_x64.exe	80
PID 5008 wrote to memory of 912	5008	app_x64.exe	80
PID 800 wrote to memory of 2832	800	msiexec.exe	81
PID 800 wrote to memory of 2832	800	msiexec.exe	81
PID 800 wrote to memory of 2832	800	msiexec.exe	81

C:\Users\Admin\AppData\Local\Temp\app_x64.exe
"C:\Users\Admin\AppData\Local\Temp\app_x64.exe"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\setup_voa.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\app_x64.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1707665214 " AI_EUIMSI=""
  2⤵
  - Enumerates connected drives
  - Suspicious use of FindShellTrayWindow
  PID:912

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:800
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 58D4A83AB8EC5F80084994C0D2405888 C
  2⤵
  - Loads dropped DLL
  PID:3528
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 83C81313E6DB661A345AA5D5AC415A00
  2⤵
  - Loads dropped DLL
  PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57594e.rbs

Filesize
37KB

MD5
1b817ef651fb54704a551b0fac12ae92

SHA1
dfed0de4b76525baf49c037973018b236a31b963

SHA256
3e974f4b6ca2a2814012aabe50adb9064398ab0b0238063df258de16971f2b4b

SHA512
97811a484bdf8078bbea773d33d5fad911e7d499035a120026100ae79fd596c1ad4c7eadc0c7dd9c04f5689bd0b27ad7315132ebd28ddcb2700306a4c2057e2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI57C6.tmp

Filesize
721KB

MD5
5a1f2196056c0a06b79a77ae981c7761

SHA1
a880ae54395658f129e24732800e207ecd0b5603

SHA256
52f41817669af7ac55b1516894ee705245c3148f2997fa0e6617e9cc6353e41e

SHA512
9afc180ebc10c0ee0d7306f4b7085608a4e69321044d474691587bf7e63f945888781a9fc5e69568d351ac690b0335214bd04bdf5c75fd8a3bd1ec4be5d3475a

Download Submit
C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Html\copy_files.txt

Filesize
412B

MD5
b8d29ecde93b8e61a43aaa2ec7eeb7c4

SHA1
84c695f3fed53af051279d1eb962d6ed5f3cbe4a

SHA256
4660f81a01eff535507087deb0a77110942166a1083d81e6311a9d29484074b8

SHA512
2eecc5f8ebd107f61a36f9046dd658e3c575979a4da4c04e3becf1b74627be7eabba622d1b13503529c1edd51dd64dcef12da4c56e5d1026eb88c6dc5eeaf2f5

Download Submit
C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Arabic.dll

Filesize
180KB

MD5
a1fb20834c0ee30da23e74f30f0f6b64

SHA1
366728b44236ff95acadd502d870d4e13c1d2cb8

SHA256
b3118a87e8378b3a12795356285527ac9c024ee0c614d8c58ef07ae2a70d3c7f

SHA512
9de6573297a0b39eb9424023c1c64638e99145b5737f37a93a6863364624df0f3326da9c84889460a0e28110366d3308f6b03c62bae2a59345fff962a8dce7ad

Download Submit
C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Bulgarian.dll

Filesize
168KB

MD5
c873d5c115b8f4e36d9f9dbc94b100fc

SHA1
17df72a7b9c0ba6502e1f466726c0bcee0d86e76

SHA256
a353b29e7b8d23a61b335f2620957de04ad75a257a897caecfe3b81b80cb3f83

SHA512
ab4fd0d1b9b65ff98501c6aea7b0dbfd26ed35e3c909b00c0b9e6fabea2098d1af1da8ea14443556124bedd6714be0cb70635ee1861cc3f986aaf5245977358d

Download Submit
C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Catalan.dll

Filesize
180KB

MD5
a07c47be03054207780d8c1c591422ab

SHA1
01ca150b3d205cc38a26672827937ca1dc2f46ab

SHA256
b6c746db05631ca76c4449a7bc329df7f2b84b724b7d959a2dcaebe233788889

SHA512
2bd12c926a9b321563cd07df820a2c613eebd78bd81e3bc9dead8f55b3fb7b30dc3e7fed7c9d7c914dc588eb6e37b96823200159b6ffe27d5e74f74d135d15a3

Download Submit
C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Chinese_Simp.dll

Filesize
120KB

MD5
f9138d395ebcd1c0a32bdc6aaf85619e

SHA1
6e661a1edba3fad410ad30601ebc6a7b8193d59c

SHA256
257673ac931e86d56e9d9e1de54fa47c116be2ae8102f2494876e43b9b117ad0

SHA512
69efdabf7509cdecf0cde77068713367272c5a87ad36794b577bee1de41f5e894ec40e4aac2f8e2041a8de58dcca8bd50dd5be14520efc9a79c31f4a99c833f6

Download Submit
C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Chinese_TW.dll

Filesize
128KB

MD5
1a8e5b62560b2c25910debcaae52ff0d

SHA1
e0142e33ecff2c30f964a33ea1ce3bd6f43aff0f

SHA256
73d778f666e491690d5f6013e7b3bd3407560ad08323d7c402c2174f67e6d4b1

SHA512
bee5e1aca70b8123db4894d9455e637d8b42f29ad42f6bc681610ea98fba4ca0b4655553f68ee5795ad616fce915bc100e2e2663935ed1e98bd62c265755f147

Download Submit
C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Czech.dll

Filesize
172KB

MD5
66184d6ca388193b68b16174455d7f5c

SHA1
c97efb638f88496b0375e7d4cfe0c73cac662982

SHA256
a67036280aea51d37daecc9ccd401af7424a89f713d0d4cc6893be72bfe5e219

SHA512
8cd208494c4930f11ff450199a2402f24a38f82931444be228c57fe1a3d93585662a0b6d2e65656cb36c135e3977aab13f1126eeb7fe6906ddca129b5074f288

Download Submit
C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Dansk.dll

Filesize
155KB

MD5
7223d557f938d74ab97eba9632ef0d99

SHA1
3c6ecbd8c6cd1ff392c76ff99e5129cd5467e89c

SHA256
49ea62fbf869f8553300120667dedd003c14b5850ddb4b1d989afb10d0bc7da6

SHA512
056003c23deedde901a8fc13c921310ad83fe22581a479a206d91ada22561cfbc75754ef7c724686bef36c9b4f3ea63cf80f3a894452a431915e895f47e8e798

Download Submit
C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Deutsch.dll

Filesize
172KB

MD5
608185b4a5f1fac97ac21ad4e9c298bf

SHA1
b938d10a675b268babc9e0e3653742e39fee3967

SHA256
796002e77975f1c47fd4dc357dc4a4862dd028263d64aee457672be586b9fe9f

SHA512
3781351360bb0d80a01de5170d0c0cbc78ffccba65098e66645acab5ca80abc205e720d1ac8254b8f783635a1dd531b41830738b9b40839d2b12ce3f80e279c3

Download Submit
C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\English_GB.dll

Filesize
168KB

MD5
5187d71cc0b48fab25ce065c67acd3e3

SHA1
65373cbdd8cbdb41f1a0153bdd6f8711cc89ddb6

SHA256
f1b9f26375645cd3a9b8e3b2c5c10ed78a4658975415639cd6883760d66f44a2

SHA512
927da1e72f0197553a23111b2a4f1abe00e726317e912401255b06ae763d5ebf1ae2528f7a8665d691488a1c0f8b67b8a9cb4c0ec75cbd1eed0a0a037b8636f3

Download Submit
C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Estonian.dll

Filesize
172KB

MD5
3968943a81056549e1773f0022176ccc

SHA1
558870e01170bb7ebb2d8d6a26f9c705d05c70e5

SHA256
bb4303d659a42e6678fc0eb581e52b85cef4a67f06827ba672106cbc5acc26a1

SHA512
f4e5cd9c6944b29a79bb97fca9f0577e1d28d7ab92ed91974a2b134adbf8e06bfea4af70ffc8347ff059bd755db974c1c8b18a432e14e082585ad4c46e6026ae

Download Submit
C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Finnish.dll

Filesize
168KB

MD5
1e62f8c0d6d3ce98bef52c1b7ccdb5fe

SHA1
677cb3e56c81681e49f10f93b992829638bc2287

SHA256
a4bc4c97446c439c990344fc347c09d23ba90de50be7fe8d3e8c4ba80aee0147

SHA512
d2cd4da08777b55459ae56683f58ee79109c569292e6977be5ad2b2ae72929bc286bf4db8b546833af651999c056caa9a54e806a81110ed7cb3aa1c06eefd872

Download Submit
C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\French.dll

Filesize
172KB

MD5
dd3253f12f8018353754d809d4e41740

SHA1
2a44a38f88d30b1db103a39dda448c7032b5be0a

SHA256
1b42aba123c087cbe01c84d0cda4edd8015f12905de4898b9415c8caa1c540c0

SHA512
37e90d6d98f8b1bcf0fdc90fef2cc2790a89eb43bb2795f3b5824661fc20ec04334018073705a4604a9b765af3f2b04712ba59815afc468ed8608b583bc6ecca

Download Submit
C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\French2.dll

Filesize
208KB

MD5
c6b9eec67287a2b43f2aa04f8cb7f527

SHA1
f6b5d2102409644e636537f2f745072f6f841b74

SHA256
8b13cbc023e0adb5ad2d91d804a7079eeec827ce85ef40eea61cba18e755d66b

SHA512
011f1c8778c4bc827daf31bf07c174a2f2b4f76a985423d7f2f98dbd85e7b0d57a34ca695a6d8b44f3e062dff4bbd24b114f123ea7dc01ea0d474738e3f819e0

Download Submit
C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Hebrew.dll

Filesize
172KB

MD5
8ebb2093772df6dadbec3f9f2099fd6a

SHA1
385b321aba88626c70ccc21670f70d0bb0ea4b9a

SHA256
d96a2d05efa754542623d78542d0f79c8b216a54dc20573e306086cfe872470a

SHA512
d8973cb035f5694467b9c0c06abc0666d65d292741b7272667166a3514c8545d0e3e6cd53147fd26b36e34e88f54b59b847038a31914f0b290d12b1765e2f5c0

Download Submit
C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Hellenic.dll

Filesize
167KB

MD5
910238c79bf1d613a2e9e27c7b195b31

SHA1
ea67844f7d4a74a9e940e5095a5e6c0128c34c07

SHA256
aa98863f36ade462bf488913682443ce2b54d4828e0b8040348d626778be6f30

SHA512
cbdfb725cf9a09a01103bb926f7bae71b127fcdceafe0c71bf7a2fbb6116eeb1166a4d7326584508eb4de8496a540b6a4b44a300b57d36263e17b5795158acd2

Download Submit
C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Hrvatski.dll

Filesize
154KB

MD5
3c6a12e8d15073a8186d5373629eef43

SHA1
53ecf7c8358dab389357e1e8db371d219fac965a

SHA256
a253b7b549e9ab37bebd6cb0c1fdadce0f514616e78fc873c08884160b6ca789

SHA512
b96a59a9e27f68bad222923afbd6ae1fea37050444636329f70dd7ef531052e12b65f2048cc7e690ee84b31bf40b07024b65db94b4dcc108247f0766f58980fd

Download Submit
C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\IP_Catalan.lng

Filesize
8KB

MD5
84d7c0bef837a42ce12587a5ac8ab92b

SHA1
4d0e009bdd15e03b1f0c2bf1574a1d9c1fcad887

SHA256
8953265cba28c89e5e5c438edc43a6654b8b4efaecf70a350d6c13866e016e29

SHA512
2b42f74abf8423559b6d3834a71dc7c6ea09e6ce2436f89fa34f02e5894f1db958eb23f3aa5a15329081d7ec06e77fbca26f42a5fecf8a8571d63ac306e7f636

Download Submit
C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Italian.dll

Filesize
184KB

MD5
84d8d3b8ab287da992e603e232f6d6da

SHA1
799b6b5d88332501c2ea0c11331b70bd11ab1bc5

SHA256
77a8d1151b35e905c6509f23c7783298eff332de1961e946efce1a6725dfc311

SHA512
a4b36991152cde60e0d3928314f18b4a313278d4d411ee6461a121b2b69dfd61fa031bd10bf2a39cbe263d80109a226d0bd6f54b2e12e8cb6dc8accc84ef3385

Download Submit
C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Italian2.dll

Filesize
188KB

MD5
94c8eb4fb9f72ac3f6cf6382cef9a58e

SHA1
a1dd97e3c7b8597661f91b7cb03e387f4e3165fb

SHA256
4670e94541a3f4c746841d668ad43e78cc5ef6f76499e4054bf08062892a9ec3

SHA512
209aa80ca952eb02c56197cc7599271480d65702b989a905d3cfc451b9c6eaa93475cef932b1ea9ede5a7bf5cde5675bf540581aab239d4673f84a1f137c0b90

Download Submit
C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Japanese.dll

Filesize
125KB

MD5
3b151b87cc2645769d09347f19e1836d

SHA1
3adedb76262be074e2115433563ba7af080a95c7

SHA256
d686ffeab62046e5c1d00dde9bd641878c960ef4f5979cc3b87addd4cac56be8

SHA512
e82710c068955e089034ee65513adbc3c1103fe6f7f6d05f3c91d6d2e64d3d270b0d9deda497155fea5db36c95fffe414bf1fa00d43950f103ed82ae4a89653b

Download Submit
C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Japanese_YuGothic.dll

Filesize
125KB

MD5
ea1e9792dcdbed397a6e2d2c9a663c78

SHA1
e56f499ef53ddb92f26bb2bfd51c31334f518136

SHA256
1d6adc5fe7c1da7102e18f0e353ba5788008c24fa5f4abb2e5907ebf21596844

SHA512
6bf0834fee96ed46c3fb9ad58b212cf06b972bd4c94775ebd42213d622d75736e9d72233d6a92462a111c01cebac9532eaaeaace57e86fb1b9c96ee14b95da18

Download Submit
C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Korean.dll

Filesize
136KB

MD5
4373c4223e784a8084324e63edb77518

SHA1
5390ae04c4f2804c8118451390366a5471b91914

SHA256
b9ddc53298937ec125e254a20ecddea912c679c6c51150ef0366dcdfb7035f76

SHA512
21168f691c019251f6b2797250801350026ee8a0d77dce0c0854b2f9a4a00809347668b95cd7d2dda2d86241124197ce8673d0c315d4b3a853754f7264ba12e8

Download Submit
C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Latvian.dll

Filesize
180KB

MD5
ce8a3cedbb59feecaf2c5a9856b93ec3

SHA1
f2c004b14bbee7dbf979dd5128142577546ffcfa

SHA256
c7b9e1b354c2b56bd7669821869e06d15f89f3192995fd2a53bbda4c43b22ff9

SHA512
8d0c97248fd13d9a2de72cf728a4e83f6d3d27c316fb873ebcd795cdc498cc7bf651724bc509daea0c74851c736b1c52cde47cb400c7571bdd8c684e7eb11565

Download Submit
C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Lithuanian.dll

Filesize
175KB

MD5
6e9f60da89d53282933ac045331624d3

SHA1
89c8b2c1f2f7f649bd28e35995d30d94f81615bb

SHA256
a2ee6e8b93a46954d491c1204ed65bddd212ba1e706a3d9efcb07da74df72e35

SHA512
aa90816abb9209c6511179e6d0c0788a435ba99d9f084d8242fefedd90ba428262a8d0c534f0a89599420a351201fd4cfa964d634b6f1c366e2e22fa961252ac

Download Submit
C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Magyar.dll

Filesize
163KB

MD5
3636e18d0092f73197dabd7c57e3685d

SHA1
9a16bdbe60f46ccbaaaed1d46b7d531d0b4503d1

SHA256
81e6ce3dd500995afe9e335e69bd40d4fd8d962f06dccff0b1b88f5e004db633

SHA512
b4345b0e5cd30b0ba50b269505540a3ec4083b5a054de8c48f5f7a165cc0877f81986df0a1ad46d6106ebd8aa5c2701384ba8bd38a534b064ea63b583e57d539

Download Submit
C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Nederlands.dll

Filesize
165KB

MD5
e334d2045ae0ca8a7bea8abaa6520f86

SHA1
7b08b57504e1bb14501475090f2a85970e207aa5

SHA256
dd0a72137830d020cd4a2e7c8fb07bc9ac72cda201325e95dc41daffe3fe1ab2

SHA512
b6e29d1ef5fdfd6c52061e9192e096f790c846a8137b8039edf26f35f023754cae91883b7ee024265fd2c797b004363d252da5624e6671b5848cdd03ae9668da

Download Submit
C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Norsk.dll

Filesize
180KB

MD5
d662cf66f0068e6ac2d8979cdf1c3260

SHA1
95284be7cde04684e207d07d9e694e4309419b3e

SHA256
42d6004368be5cb0bb77538fc224394ab55fecd3b762c4dca0a0ad424d5693d6

SHA512
9ae9f43cc9f460f28fb674ad7cd6e66c713e98283c93158ea5a00ae29ea10a55d55c7d22ec72b18fa5ec4ea0ee56fb80d779a227f47d81de2e4ab53f4f3738a7

Download Submit
C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Polski.dll

Filesize
180KB

MD5
ebb224f33fd82bfb473e022ee76012cb

SHA1
f79cd9a6ba8b38bd62b5f6250943f5ad51336cde

SHA256
ea8e06ddacec03d9ffea24682fe1a2c22664b16879b25bb78684521020a69b9d

SHA512
e73401fec5b1684c7fdb3657430e3cd1d1873ea0c8b71f8cb88b9d52efdcb178cbeda11a9c7f7ac18906c3091e4aad09393e5b14e3cbebe70a345c7b6d65daca

Download Submit
C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Portuguese.dll

Filesize
176KB

MD5
303c950079d2a0ff7ae89fc149014ddf

SHA1
c49b8b607fefc132d26d11d940a921b186f54938

SHA256
502590dfc90074e4f313a5bbb264396d735aae228cb2470a878e450f220a9065

SHA512
662d0ea7e197a19f7b0af78f56aab82e63937d6b8dc6eda87bd4de56c1cede32360fe7ac097a764da2d769f0cca912522ac0e777b9eb24492c18021cbcbfdcc8

Download Submit
C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Portuguese_br.dll

Filesize
188KB

MD5
059358c1fbccc4a65b0f4af4290fff31

SHA1
4c763188d5e0022ddde0c40b2779f99c6ae10f48

SHA256
9e16ee5800d23a2225435a39f6f4c3ae94256fb3d469cac2c4906a96cd8c8cd4

SHA512
4b256a807f4e8d23f1a63c4490586542a2c880c9fa0a7248b6117b429a866930cef388f384b0154465f8347abebd5918e9ab712962be5f0cf0ba42e85cf5f7a8

Download Submit
C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Romanian.dll

Filesize
175KB

MD5
0d70103f46c78339c37e9a144aff1aaa

SHA1
c1cf65e3d00a26614bf4d43647a6f0eb6297e0a7

SHA256
b3a1790ea017c5e68a28260cf17b1e48590c6b47c686eac65e9d24d885663467

SHA512
f0b0a47c1a4b7f48d7816e8452f41366909502d98b4e4354f68a87b9a4e5c5e10da463fbf282df36c9d0825666d2074eee0a303a6ce6474bcdc7ea638451515e

Download Submit
C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Russian.dll

Filesize
176KB

MD5
53c2b5f6e1741e51c50b8ada8812b496

SHA1
30ade056bfdf31ad751fe46e2dc4a74040285397

SHA256
57c904c63d0a0694e420b372b221d59ad94cceb51a5ccc9f679ede029b0e0d89

SHA512
1c11631690cc1e9a2f7e90f1804540519c7abe4daf1c8c86b963731c68e6703dece0d9808a762059e59a034419dcf0f2d43167792e3a12edca5f560ac703b279

Download Submit
C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Slovak.dll

Filesize
163KB

MD5
8a984d5d98aacee0ed5fe13ce581a190

SHA1
5757872714f9c57345305d0285c1efc1a934945e

SHA256
55be572803ec60686cc4392287b81575ef19dca7e47cc3b44f7f60e6d1403299

SHA512
801b64c86c76897946fc9639fd7ab59f35aa6e304cb1ff0030eeb3592ad56d34aafcc186b42191bd00443b49cca43f7f58491db91c89136fc6e32002bf73f065

Download Submit
C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Slovenscina.dll

Filesize
184KB

MD5
19c7ff40eae81193badc4e6a3aea5997

SHA1
6486fed7053fa2d192ffb8752202cd93b608ad92

SHA256
a572ab321510b4e1dc8f774b5cdea4e89acd8e71416a4e583942af8183694bde

SHA512
41e7949475632b04152f2e232e9246d9cfe993d90c1610b753fb8c271366a149d178a28f76fd373e56bcaf32411bf19a42373ce346725cb9190754b76523b6d4

Download Submit
C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Spanish.dll

Filesize
188KB

MD5
92c5a34cd354ffabbd99ab6a6b9c8751

SHA1
e1eccedc577e36ae92757e31dbc064b8344022e1

SHA256
fe51640237dfe1bf950f27508083780a610a3b427fc1c50bbaeafcccdd08e3a7

SHA512
f10d8e849f3dd7e0777e9ba0348e6fa9c07a545d21560596b0e3ec60b8a78d33056c7c938dbe29eb020f282371dcf295545f7e6368d270ebabf1d3e425c651d9

Download Submit
C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Swedish.dll

Filesize
168KB

MD5
06932290b3280cec676daf363b78e43a

SHA1
7c4e08bb8a981676a9bb5c07ffa4d9de590b2c2a

SHA256
1063a30f2a049884dd60995a9c602f14986fd7ed99d29106f9a9ca48f0e498bb

SHA512
50bc61b27ab87be4a031b96460070b02c8607821a3672155ae0367057a925fb4e4d2e8000be4c5686a6c783ad363e83990682d7ea76e8728ad5dcf293d37d5af

Download Submit
C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Turkish.dll

Filesize
176KB

MD5
3b3b7a1b5765dfcff9df827ae8abfe01

SHA1
6ef9bad7abc8218a5ba669fdc2b14483410254bf

SHA256
e1adb0272614a498bdbcba1095c6cd92c5d5a225e858e50c1bda1d87701480e7

SHA512
af04c67469c88b33287a01f787997fec189a29c848870fba1cd86fd0d23b067ff502c4516c3347c3a1900475416f2c1e56834002d00e1884e946433dd0663d95

Download Submit
C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Ukrainian.dll

Filesize
180KB

MD5
db16afc69aae8afb5048f5fa332d90bb

SHA1
3fb6fe1ec38d6dc42755158c11f3675a795f0330

SHA256
70ef05a85f3dc02c5a2a6efa8a12b96b956f7f94211695d25d3ffc91a10ff777

SHA512
17c5ebe5dcc6c225d6dcf14fa59386f1ad5b563ee55639cf61aa9bd5f4b0b5e19abce170712479b35f1115a0bd75b2c7a7de1a75594687f739cc6972ffbe2ccf

Download Submit
C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Languages\Uzbek.dll

Filesize
180KB

MD5
91617b7c9f4b2a1dd66475ea0a4155e9

SHA1
caf8dbb4cfae00bb1e7913bef8ea3e34e9f0a7be

SHA256
5135c251c5241846ad4329d09de03808cd5589a6ac70573ebfb04474428b700a

SHA512
17a84e5362897833fa0ecd0bc2f80cbacd1ff5267d3042d8d329ab58bb276e532a106b4e938f9760abc048df0004c2b49acc6b00130e9053ad29f0d488b6b21e

Download Submit
C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Plugins\AltaLux.dll

Filesize
335KB

MD5
569d0802c93e1e46c842b6fdc0b6b167

SHA1
bae1c9ae077bf831d095b8c4d2a870f197863db5

SHA256
c95592c8f7f588eba4b55b909109d6ad4f7a303feffe746591a0fbfb5a1c52be

SHA512
d6c7a54e17d9fe4164504845ac72e3b8f7935b4574c6896483e02adf65de35ec630a9811fc0d7d5d539cbdf115a73de27fe4c8d8911b4f7137626ee008135acf

Download Submit
C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Plugins\Avif.dll

Filesize
1.9MB

MD5
1be2bcedea9a2a44901a83e596928ab7

SHA1
362889f8ee55fd2ea5318c6027555f96a7dc81c4

SHA256
c50eddc8730e8074d2dc2ed9adcde056149e6a68005f43c94f31461693c3165b

SHA512
65a424a229bd1f25967137f97f88a09e5a12333f5242e6998929ab13fa38cb4211b490b361dc0bc52b7149af95f0291acba76129a818c9ecf84a6b9086ff442a

Download Submit
C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Plugins\Awd.dll

Filesize
2.9MB

MD5
13209653ff66bf24b718bce8c590a4c6

SHA1
2a8b1261d7a97685271ef57cbb1225c675a790d6

SHA256
75a4bb820ab7b8feee37fe1497b4e4070bc14e23c9555c49ce35adc4933f6a7a

SHA512
5ca43b090a260d8cebdba4850c809282eb162b52f3bde02a0b9709bad019a364ee4c65517f2386321699c5116ea54a075e9b97ea7370937438b073b30510e8d0

Download Submit
C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Plugins\B3d.dll

Filesize
122KB

MD5
0a86bf5841c171425c0cddc22c24be77

SHA1
39d0e58207b0efc096ec65a501356bfc9980fc28

SHA256
f1930070543b84825f7228cc515c5387ba87ca3c4dbe469df3f24c6fe24a3157

SHA512
2d6443b7aad7403dbbe2e8d73b924777fb2f8506c3a07a4d3637e9f8a615a31d4949b82634f136dce6aec9e9ce1b1f0f5f8bbf71ce4d3a87c7a9b3b4098a49a8

Download Submit
C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\Plugins\BabaCAD4Image.dll

Filesize
557KB

MD5
d76acd09b8ed974d97c29d821b8c62ea

SHA1
44cce0b91de16da0f2470fd86cea9bc6d9826cd7

SHA256
2bef1cdb1fec65a6e87dcc46c0d2ed7d2cbebb4c9717abf61886a76831d3a2ea

SHA512
717842cf3227384cb84cbf2bed0e8b2959b8f3542da6c6d3009d466241a467a9526670413cb2cb0a61f726b89174ea1d0499d81d4e533542737836290d65799f

Download Submit
C:\Users\Admin\AppData\Roaming\public ut\App tu 4.9.2\install\909BABC\setup_voa.msi

Filesize
2.7MB

MD5
a1795951040f43bac4ed87b366d87755

SHA1
b8c4a77ed308924e090913aa1f83e85ebd885a54

SHA256
1b1563d4ac73a37df8b8fbb5547dbb4ccd62941f8e5448bab79789b109dc8aef

SHA512
a9ebfacbb822817a5d43ef4eee4a3f3c806796977a5600d89a9682b9aefdabd7b0959546e5c144ce836380455f5fdf9cf4768ee11f4928bbf0df12bf9bec5f5b

Download Submit
C:\Windows\Installer\MSI5A3B.tmp

Filesize
838KB

MD5
4a3f6a4023abd6bba56534de47d20017

SHA1
02dd888e467143e2e35465d73f39cf3e66afad10

SHA256
a8dfdc283ad8d4dc6f500ddfab564e79dadae075c0d54784b50e1ca548709b30

SHA512
580c7918ef90eb0020901bab645b72bcaf945ceb5bd56c2e7847f229b31a961bc4cd4ca9cb2583db480947ca8a0880b5ae4bd26717217abcacc9754352aaba28

Download Submit