Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
84s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
09/07/2024, 13:40
Static task
static1
Behavioral task
behavioral1
Sample
vs_update_win-x64_1.19.0-pre.10.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
vs_update_win-x64_1.19.0-pre.10.exe
Resource
win10v2004-20240704-en
General
-
Target
vs_update_win-x64_1.19.0-pre.10.exe
-
Size
87.5MB
-
MD5
72e397f6cae84f0aa70b2f63c7e774d9
-
SHA1
bcf9b398a16e945027d2b165b5328cc43abc76d4
-
SHA256
1f1701651fec90b7c4961c8a3c685603148aef11863aa27e7a88c5d927473383
-
SHA512
366ee828069aa20bf7e692ad6a588edca9c60555d31d25176377301d720451748a6f555798f2edc349ebe8214c863c01b3301cec6d146cb4df56e5a9c03a2cd3
-
SSDEEP
1572864:y1GcaoA8M/lqHzXbISFM0gYOEKulLozrCd6YIYLwZyibG6sKkvk1fWySz:6moA8GqASCGOXu8JwUyuG6cs1fPSz
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 7 IoCs
pid Process 1668 vs_update_win-x64_1.19.0-pre.10.tmp 1632 netcorecheck_x64.exe 2608 dotnet70desktop_x64.exe 2620 dotnet70desktop_x64.exe 1884 windowsdesktop-runtime-7.0.10-win-x64.exe 2056 Vintagestory.exe 2488 VSCrashReporter.exe -
Loads dropped DLL 64 IoCs
pid Process 1288 vs_update_win-x64_1.19.0-pre.10.exe 1668 vs_update_win-x64_1.19.0-pre.10.tmp 1668 vs_update_win-x64_1.19.0-pre.10.tmp 2896 Process not Found 1668 vs_update_win-x64_1.19.0-pre.10.tmp 2608 dotnet70desktop_x64.exe 2620 dotnet70desktop_x64.exe 2620 dotnet70desktop_x64.exe 1616 MsiExec.exe 1336 MsiExec.exe 1720 msiexec.exe 1720 msiexec.exe 2832 MsiExec.exe 1212 MsiExec.exe 1668 vs_update_win-x64_1.19.0-pre.10.tmp 1668 vs_update_win-x64_1.19.0-pre.10.tmp 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 2056 Vintagestory.exe 2056 Vintagestory.exe 2056 Vintagestory.exe 2056 Vintagestory.exe 2056 Vintagestory.exe 2056 Vintagestory.exe 2056 Vintagestory.exe 2056 Vintagestory.exe 2056 Vintagestory.exe 2056 Vintagestory.exe 2056 Vintagestory.exe 2056 Vintagestory.exe 2056 Vintagestory.exe 2056 Vintagestory.exe 2056 Vintagestory.exe 2056 Vintagestory.exe 2056 Vintagestory.exe 2056 Vintagestory.exe 2056 Vintagestory.exe 2056 Vintagestory.exe 2056 Vintagestory.exe 2056 Vintagestory.exe 2056 Vintagestory.exe 2056 Vintagestory.exe 2056 Vintagestory.exe 2056 Vintagestory.exe 2056 Vintagestory.exe 2056 Vintagestory.exe 2056 Vintagestory.exe 2056 Vintagestory.exe 2056 Vintagestory.exe 2056 Vintagestory.exe 2056 Vintagestory.exe 2056 Vintagestory.exe 2056 Vintagestory.exe 2056 Vintagestory.exe 2056 Vintagestory.exe 2488 VSCrashReporter.exe 2488 VSCrashReporter.exe 2488 VSCrashReporter.exe 2488 VSCrashReporter.exe 2488 VSCrashReporter.exe 2488 VSCrashReporter.exe 2488 VSCrashReporter.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{749f7aca-89a5-4659-92a5-0449fc5fdd78} = "\"C:\\ProgramData\\Package Cache\\{749f7aca-89a5-4659-92a5-0449fc5fdd78}\\windowsdesktop-runtime-7.0.10-win-x64.exe\" /burn.runonce" windowsdesktop-runtime-7.0.10-win-x64.exe -
Blocklisted process makes network request 1 IoCs
flow pid Process 5 1720 msiexec.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\System.Runtime.Intrinsics.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\System.IO.IsolatedStorage.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\PresentationFramework.Classic.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\System.Console.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\System.Globalization.Calendars.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\pt-BR\WindowsBase.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\System.Diagnostics.TextWriterTraceListener.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\cs\System.Xaml.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\System.Drawing.Common.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\fr\ReachFramework.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\System.Reflection.TypeExtensions.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\mscordbi.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\pt-BR\UIAutomationTypes.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\System.IO.Compression.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\de\UIAutomationClientSideProviders.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\de\System.Windows.Controls.Ribbon.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\System.IO.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\System.Security.Cryptography.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\ru\UIAutomationClientSideProviders.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\System.Net.WebProxy.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\System.IO.Packaging.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\pl\System.Windows.Input.Manipulations.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\System.Runtime.Extensions.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\System.Drawing.Design.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\WindowsBase.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\System.Drawing.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\de\PresentationUI.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\System.Net.WebClient.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\System.Security.Principal.Windows.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\System.Linq.Parallel.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\ko\System.Windows.Input.Manipulations.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\fr\System.Xaml.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\System.Runtime.CompilerServices.Unsafe.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\System.Resources.Writer.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\pl\WindowsFormsIntegration.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\es\System.Windows.Forms.Design.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\pt-BR\System.Windows.Forms.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\pl\UIAutomationTypes.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\pt-BR\WindowsFormsIntegration.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\pl\WindowsBase.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\de\UIAutomationTypes.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\ja\ReachFramework.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\zh-Hans\System.Windows.Forms.Primitives.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\System.Reflection.Primitives.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\mscordaccore_amd64_amd64_7.0.1023.36312.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\System.Design.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\System.AppContext.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\System.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\mscordaccore.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\pt-BR\UIAutomationClient.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\Microsoft.VisualBasic.Forms.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\Microsoft.CSharp.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\System.Runtime.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\pl\System.Windows.Forms.Primitives.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\System.Resources.Extensions.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\Microsoft.Win32.Registry.AccessControl.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\PenImc_cor3.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\cs\PresentationCore.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\cs\WindowsFormsIntegration.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\tr\WindowsBase.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\zh-Hans\WindowsFormsIntegration.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\System.Buffers.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\System.IO.FileSystem.AccessControl.dll msiexec.exe -
Drops file in Windows directory 30 IoCs
description ioc Process File opened for modification C:\Windows\Installer\f77404e.ipi msiexec.exe File opened for modification C:\Windows\Installer\f774054.ipi msiexec.exe File created C:\Windows\Installer\f774057.msi msiexec.exe File created C:\Windows\Installer\f774060.ipi msiexec.exe File created C:\Windows\Installer\f77404b.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI4B2E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4EFC.tmp msiexec.exe File opened for modification C:\Windows\Installer\f774051.msi msiexec.exe File created C:\Windows\Installer\f77405c.msi msiexec.exe File opened for modification C:\Windows\Installer\f77405d.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI5A7A.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\f774050.msi msiexec.exe File created C:\Windows\Installer\f77405a.ipi msiexec.exe File opened for modification C:\Windows\Installer\f77404b.msi msiexec.exe File opened for modification C:\Windows\Installer\f77405a.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI47A2.tmp msiexec.exe File created C:\Windows\Installer\f774054.ipi msiexec.exe File created C:\Windows\Installer\f774056.msi msiexec.exe File opened for modification C:\Windows\Installer\f774057.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI5356.tmp msiexec.exe File opened for modification C:\Windows\WindowsUpdate.log windowsdesktop-runtime-7.0.10-win-x64.exe File opened for modification C:\Windows\Installer\MSI436B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4B8F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4FBA.tmp msiexec.exe File created C:\Windows\Installer\f77405d.msi msiexec.exe File created C:\Windows\Installer\f774062.msi msiexec.exe File opened for modification C:\Windows\Installer\f774060.ipi msiexec.exe File created C:\Windows\Installer\f77404e.ipi msiexec.exe File created C:\Windows\Installer\f774051.msi msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2F msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\30 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\31 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2F msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\30 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E msiexec.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90922EA8CDE03D145A2206C27ACD6312\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E6628985E0A3AB4FAF33E5C6D62AEAB msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E6628985E0A3AB4FAF33E5C6D62AEAB\Version = "942406812" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DFFEB4543B820C747AFA9E566B582DFF\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B8F77368E53E47741B6553AE76672B13 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E6628985E0A3AB4FAF33E5C6D62AEAB\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\vintagestorymodinstall\URL Protocol vs_update_win-x64_1.19.0-pre.10.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_7.0_x64\Dependents windowsdesktop-runtime-7.0.10-win-x64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B8F77368E53E47741B6553AE76672B13\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_56.43.64722_x64 windowsdesktop-runtime-7.0.10-win-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_56.43.64722_x64\Dependents\{749f7aca-89a5-4659-92a5-0449fc5fdd78} windowsdesktop-runtime-7.0.10-win-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_56.43.64668_x64\DisplayName = "Microsoft .NET Host FX Resolver - 7.0.10 (x64)" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E6628985E0A3AB4FAF33E5C6D62AEAB\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E6628985E0A3AB4FAF33E5C6D62AEAB\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{898266E3-A0E5-4BA3-AF3F-E3C5D626EABA}v56.43.64668\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B8F77368E53E47741B6553AE76672B13\Version = "942406866" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\vintagestorymodinstall\DefaultIcon vs_update_win-x64_1.19.0-pre.10.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\vintagestorymodinstall\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Vintagestory\\VintageStory.exe\" -i \"%1\"" vs_update_win-x64_1.19.0-pre.10.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_56.43.64668_x64\ = "{898266E3-A0E5-4BA3-AF3F-E3C5D626EABA}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DFFEB4543B820C747AFA9E566B582DFF\Provider msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DFFEB4543B820C747AFA9E566B582DFF\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DFFEB4543B820C747AFA9E566B582DFF\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B8F77368E53E47741B6553AE76672B13\ProductName = "Microsoft Windows Desktop Runtime - 7.0.10 (x64)" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\vintagestorymodinstall\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\Vintagestory\\VintageStory.exe,0" vs_update_win-x64_1.19.0-pre.10.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{749f7aca-89a5-4659-92a5-0449fc5fdd78}\Version = "7.0.10.32717" windowsdesktop-runtime-7.0.10-win-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{749f7aca-89a5-4659-92a5-0449fc5fdd78}\DisplayName = "Microsoft Windows Desktop Runtime - 7.0.10 (x64)" windowsdesktop-runtime-7.0.10-win-x64.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_56.43.64668_x64 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\31F2FEB3A105266457E59188F20AAF2E\90922EA8CDE03D145A2206C27ACD6312 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E6628985E0A3AB4FAF33E5C6D62AEAB\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{749f7aca-89a5-4659-92a5-0449fc5fdd78} windowsdesktop-runtime-7.0.10-win-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1E44345F98C50385399EDA2A638439CA\3E6628985E0A3AB4FAF33E5C6D62AEAB msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_7.0_x64\DisplayName = "Microsoft .NET Host - 7.0.10 (x64)" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DFFEB4543B820C747AFA9E566B582DFF\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DFFEB4543B820C747AFA9E566B582DFF\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{454BEFFD-28B3-47C0-A7AF-E965B685D2FF}v56.43.64668\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\CA86F51EA0751C74D0D1FE10686E83D2 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_56.43.64668_x64 windowsdesktop-runtime-7.0.10-win-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_7.0_x64\Dependents\{749f7aca-89a5-4659-92a5-0449fc5fdd78} windowsdesktop-runtime-7.0.10-win-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B8F77368E53E47741B6553AE76672B13\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\vintagestoryjoin\URL Protocol vs_update_win-x64_1.19.0-pre.10.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E6628985E0A3AB4FAF33E5C6D62AEAB\SourceList\PackageName = "dotnet-hostfxr-7.0.10-win-x64.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_56.43.64668_x64\Dependents windowsdesktop-runtime-7.0.10-win-x64.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\vintagestoryjoin\ = "URL:Custom Protocol" vs_update_win-x64_1.19.0-pre.10.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_56.43.64668_x64\DisplayName = "Microsoft .NET Runtime - 7.0.10 (x64)" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\vintagestoryjoin\shell vs_update_win-x64_1.19.0-pre.10.tmp Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\vintagestorymodinstall\shell\open\command vs_update_win-x64_1.19.0-pre.10.tmp Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90922EA8CDE03D145A2206C27ACD6312\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_56.43.64668_x64\Dependents windowsdesktop-runtime-7.0.10-win-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E6628985E0A3AB4FAF33E5C6D62AEAB\SourceList\Media\1 = ";" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DFFEB4543B820C747AFA9E566B582DFF\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_56.43.64722_x64\ = "{86377F8B-E35E-4774-B156-35EA6776B231}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B8F77368E53E47741B6553AE76672B13\MainFeature msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B8F77368E53E47741B6553AE76672B13\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B8F77368E53E47741B6553AE76672B13\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B8F77368E53E47741B6553AE76672B13\SourceList\PackageName = "windowsdesktop-runtime-7.0.10-win-x64.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\90922EA8CDE03D145A2206C27ACD6312 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90922EA8CDE03D145A2206C27ACD6312\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90922EA8CDE03D145A2206C27ACD6312\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90922EA8CDE03D145A2206C27ACD6312\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1E44345F98C50385399EDA2A638439CA msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_7.0_x64\ = "{454BEFFD-28B3-47C0-A7AF-E965B685D2FF}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90922EA8CDE03D145A2206C27ACD6312\ProductName = "Microsoft .NET Runtime - 7.0.10 (x64)" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90922EA8CDE03D145A2206C27ACD6312\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4E3F426DBD05F2A509C6867B91443826\DFFEB4543B820C747AFA9E566B582DFF msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B8F77368E53E47741B6553AE76672B13\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_56.43.64668_x64 windowsdesktop-runtime-7.0.10-win-x64.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 vs_update_win-x64_1.19.0-pre.10.tmp Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde vs_update_win-x64_1.19.0-pre.10.tmp -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1720 msiexec.exe 1720 msiexec.exe 1720 msiexec.exe 1720 msiexec.exe 1720 msiexec.exe 1720 msiexec.exe 1720 msiexec.exe 1720 msiexec.exe 1668 vs_update_win-x64_1.19.0-pre.10.tmp 1668 vs_update_win-x64_1.19.0-pre.10.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1884 windowsdesktop-runtime-7.0.10-win-x64.exe Token: SeIncreaseQuotaPrivilege 1884 windowsdesktop-runtime-7.0.10-win-x64.exe Token: SeRestorePrivilege 1720 msiexec.exe Token: SeTakeOwnershipPrivilege 1720 msiexec.exe Token: SeSecurityPrivilege 1720 msiexec.exe Token: SeCreateTokenPrivilege 1884 windowsdesktop-runtime-7.0.10-win-x64.exe Token: SeAssignPrimaryTokenPrivilege 1884 windowsdesktop-runtime-7.0.10-win-x64.exe Token: SeLockMemoryPrivilege 1884 windowsdesktop-runtime-7.0.10-win-x64.exe Token: SeIncreaseQuotaPrivilege 1884 windowsdesktop-runtime-7.0.10-win-x64.exe Token: SeMachineAccountPrivilege 1884 windowsdesktop-runtime-7.0.10-win-x64.exe Token: SeTcbPrivilege 1884 windowsdesktop-runtime-7.0.10-win-x64.exe Token: SeSecurityPrivilege 1884 windowsdesktop-runtime-7.0.10-win-x64.exe Token: SeTakeOwnershipPrivilege 1884 windowsdesktop-runtime-7.0.10-win-x64.exe Token: SeLoadDriverPrivilege 1884 windowsdesktop-runtime-7.0.10-win-x64.exe Token: SeSystemProfilePrivilege 1884 windowsdesktop-runtime-7.0.10-win-x64.exe Token: SeSystemtimePrivilege 1884 windowsdesktop-runtime-7.0.10-win-x64.exe Token: SeProfSingleProcessPrivilege 1884 windowsdesktop-runtime-7.0.10-win-x64.exe Token: SeIncBasePriorityPrivilege 1884 windowsdesktop-runtime-7.0.10-win-x64.exe Token: SeCreatePagefilePrivilege 1884 windowsdesktop-runtime-7.0.10-win-x64.exe Token: SeCreatePermanentPrivilege 1884 windowsdesktop-runtime-7.0.10-win-x64.exe Token: SeBackupPrivilege 1884 windowsdesktop-runtime-7.0.10-win-x64.exe Token: SeRestorePrivilege 1884 windowsdesktop-runtime-7.0.10-win-x64.exe Token: SeShutdownPrivilege 1884 windowsdesktop-runtime-7.0.10-win-x64.exe Token: SeDebugPrivilege 1884 windowsdesktop-runtime-7.0.10-win-x64.exe Token: SeAuditPrivilege 1884 windowsdesktop-runtime-7.0.10-win-x64.exe Token: SeSystemEnvironmentPrivilege 1884 windowsdesktop-runtime-7.0.10-win-x64.exe Token: SeChangeNotifyPrivilege 1884 windowsdesktop-runtime-7.0.10-win-x64.exe Token: SeRemoteShutdownPrivilege 1884 windowsdesktop-runtime-7.0.10-win-x64.exe Token: SeUndockPrivilege 1884 windowsdesktop-runtime-7.0.10-win-x64.exe Token: SeSyncAgentPrivilege 1884 windowsdesktop-runtime-7.0.10-win-x64.exe Token: SeEnableDelegationPrivilege 1884 windowsdesktop-runtime-7.0.10-win-x64.exe Token: SeManageVolumePrivilege 1884 windowsdesktop-runtime-7.0.10-win-x64.exe Token: SeImpersonatePrivilege 1884 windowsdesktop-runtime-7.0.10-win-x64.exe Token: SeCreateGlobalPrivilege 1884 windowsdesktop-runtime-7.0.10-win-x64.exe Token: SeRestorePrivilege 1720 msiexec.exe Token: SeTakeOwnershipPrivilege 1720 msiexec.exe Token: SeRestorePrivilege 1720 msiexec.exe Token: SeTakeOwnershipPrivilege 1720 msiexec.exe Token: SeRestorePrivilege 1720 msiexec.exe Token: SeTakeOwnershipPrivilege 1720 msiexec.exe Token: SeRestorePrivilege 1720 msiexec.exe Token: SeTakeOwnershipPrivilege 1720 msiexec.exe Token: SeRestorePrivilege 1720 msiexec.exe Token: SeTakeOwnershipPrivilege 1720 msiexec.exe Token: SeRestorePrivilege 1720 msiexec.exe Token: SeTakeOwnershipPrivilege 1720 msiexec.exe Token: SeRestorePrivilege 1720 msiexec.exe Token: SeTakeOwnershipPrivilege 1720 msiexec.exe Token: SeRestorePrivilege 1720 msiexec.exe Token: SeTakeOwnershipPrivilege 1720 msiexec.exe Token: SeRestorePrivilege 1720 msiexec.exe Token: SeTakeOwnershipPrivilege 1720 msiexec.exe Token: SeRestorePrivilege 1720 msiexec.exe Token: SeTakeOwnershipPrivilege 1720 msiexec.exe Token: SeRestorePrivilege 1720 msiexec.exe Token: SeTakeOwnershipPrivilege 1720 msiexec.exe Token: SeRestorePrivilege 1720 msiexec.exe Token: SeTakeOwnershipPrivilege 1720 msiexec.exe Token: SeRestorePrivilege 1720 msiexec.exe Token: SeTakeOwnershipPrivilege 1720 msiexec.exe Token: SeRestorePrivilege 1720 msiexec.exe Token: SeTakeOwnershipPrivilege 1720 msiexec.exe Token: SeRestorePrivilege 1720 msiexec.exe Token: SeTakeOwnershipPrivilege 1720 msiexec.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1668 vs_update_win-x64_1.19.0-pre.10.tmp 2620 dotnet70desktop_x64.exe 2488 VSCrashReporter.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2056 Vintagestory.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1288 wrote to memory of 1668 1288 vs_update_win-x64_1.19.0-pre.10.exe 28 PID 1288 wrote to memory of 1668 1288 vs_update_win-x64_1.19.0-pre.10.exe 28 PID 1288 wrote to memory of 1668 1288 vs_update_win-x64_1.19.0-pre.10.exe 28 PID 1288 wrote to memory of 1668 1288 vs_update_win-x64_1.19.0-pre.10.exe 28 PID 1288 wrote to memory of 1668 1288 vs_update_win-x64_1.19.0-pre.10.exe 28 PID 1288 wrote to memory of 1668 1288 vs_update_win-x64_1.19.0-pre.10.exe 28 PID 1288 wrote to memory of 1668 1288 vs_update_win-x64_1.19.0-pre.10.exe 28 PID 1668 wrote to memory of 1632 1668 vs_update_win-x64_1.19.0-pre.10.tmp 29 PID 1668 wrote to memory of 1632 1668 vs_update_win-x64_1.19.0-pre.10.tmp 29 PID 1668 wrote to memory of 1632 1668 vs_update_win-x64_1.19.0-pre.10.tmp 29 PID 1668 wrote to memory of 1632 1668 vs_update_win-x64_1.19.0-pre.10.tmp 29 PID 1668 wrote to memory of 2608 1668 vs_update_win-x64_1.19.0-pre.10.tmp 33 PID 1668 wrote to memory of 2608 1668 vs_update_win-x64_1.19.0-pre.10.tmp 33 PID 1668 wrote to memory of 2608 1668 vs_update_win-x64_1.19.0-pre.10.tmp 33 PID 1668 wrote to memory of 2608 1668 vs_update_win-x64_1.19.0-pre.10.tmp 33 PID 1668 wrote to memory of 2608 1668 vs_update_win-x64_1.19.0-pre.10.tmp 33 PID 1668 wrote to memory of 2608 1668 vs_update_win-x64_1.19.0-pre.10.tmp 33 PID 1668 wrote to memory of 2608 1668 vs_update_win-x64_1.19.0-pre.10.tmp 33 PID 2608 wrote to memory of 2620 2608 dotnet70desktop_x64.exe 34 PID 2608 wrote to memory of 2620 2608 dotnet70desktop_x64.exe 34 PID 2608 wrote to memory of 2620 2608 dotnet70desktop_x64.exe 34 PID 2608 wrote to memory of 2620 2608 dotnet70desktop_x64.exe 34 PID 2608 wrote to memory of 2620 2608 dotnet70desktop_x64.exe 34 PID 2608 wrote to memory of 2620 2608 dotnet70desktop_x64.exe 34 PID 2608 wrote to memory of 2620 2608 dotnet70desktop_x64.exe 34 PID 2620 wrote to memory of 1884 2620 dotnet70desktop_x64.exe 35 PID 2620 wrote to memory of 1884 2620 dotnet70desktop_x64.exe 35 PID 2620 wrote to memory of 1884 2620 dotnet70desktop_x64.exe 35 PID 2620 wrote to memory of 1884 2620 dotnet70desktop_x64.exe 35 PID 2620 wrote to memory of 1884 2620 dotnet70desktop_x64.exe 35 PID 2620 wrote to memory of 1884 2620 dotnet70desktop_x64.exe 35 PID 2620 wrote to memory of 1884 2620 dotnet70desktop_x64.exe 35 PID 1720 wrote to memory of 1616 1720 msiexec.exe 37 PID 1720 wrote to memory of 1616 1720 msiexec.exe 37 PID 1720 wrote to memory of 1616 1720 msiexec.exe 37 PID 1720 wrote to memory of 1616 1720 msiexec.exe 37 PID 1720 wrote to memory of 1616 1720 msiexec.exe 37 PID 1720 wrote to memory of 1616 1720 msiexec.exe 37 PID 1720 wrote to memory of 1616 1720 msiexec.exe 37 PID 1720 wrote to memory of 1336 1720 msiexec.exe 38 PID 1720 wrote to memory of 1336 1720 msiexec.exe 38 PID 1720 wrote to memory of 1336 1720 msiexec.exe 38 PID 1720 wrote to memory of 1336 1720 msiexec.exe 38 PID 1720 wrote to memory of 1336 1720 msiexec.exe 38 PID 1720 wrote to memory of 1336 1720 msiexec.exe 38 PID 1720 wrote to memory of 1336 1720 msiexec.exe 38 PID 1720 wrote to memory of 2832 1720 msiexec.exe 39 PID 1720 wrote to memory of 2832 1720 msiexec.exe 39 PID 1720 wrote to memory of 2832 1720 msiexec.exe 39 PID 1720 wrote to memory of 2832 1720 msiexec.exe 39 PID 1720 wrote to memory of 2832 1720 msiexec.exe 39 PID 1720 wrote to memory of 2832 1720 msiexec.exe 39 PID 1720 wrote to memory of 2832 1720 msiexec.exe 39 PID 1720 wrote to memory of 1212 1720 msiexec.exe 40 PID 1720 wrote to memory of 1212 1720 msiexec.exe 40 PID 1720 wrote to memory of 1212 1720 msiexec.exe 40 PID 1720 wrote to memory of 1212 1720 msiexec.exe 40 PID 1720 wrote to memory of 1212 1720 msiexec.exe 40 PID 1720 wrote to memory of 1212 1720 msiexec.exe 40 PID 1720 wrote to memory of 1212 1720 msiexec.exe 40 PID 1668 wrote to memory of 2056 1668 vs_update_win-x64_1.19.0-pre.10.tmp 42 PID 1668 wrote to memory of 2056 1668 vs_update_win-x64_1.19.0-pre.10.tmp 42 PID 1668 wrote to memory of 2056 1668 vs_update_win-x64_1.19.0-pre.10.tmp 42 PID 1668 wrote to memory of 2056 1668 vs_update_win-x64_1.19.0-pre.10.tmp 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\vs_update_win-x64_1.19.0-pre.10.exe"C:\Users\Admin\AppData\Local\Temp\vs_update_win-x64_1.19.0-pre.10.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\is-1GCR3.tmp\vs_update_win-x64_1.19.0-pre.10.tmp"C:\Users\Admin\AppData\Local\Temp\is-1GCR3.tmp\vs_update_win-x64_1.19.0-pre.10.tmp" /SL5="$3012C,90406711,983040,C:\Users\Admin\AppData\Local\Temp\vs_update_win-x64_1.19.0-pre.10.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\is-1JCGP.tmp\netcorecheck_x64.exe"C:\Users\Admin\AppData\Local\Temp\is-1JCGP.tmp\netcorecheck_x64.exe" -n Microsoft.WindowsDesktop.App -v 7.0.03⤵
- Executes dropped EXE
PID:1632
-
-
C:\Users\Admin\AppData\Local\Temp\is-1JCGP.tmp\dotnet70desktop_x64.exe"C:\Users\Admin\AppData\Local\Temp\is-1JCGP.tmp\dotnet70desktop_x64.exe" /norestart3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\Temp\{32A3D913-90E7-4709-BF26-263B6D082AC7}\.cr\dotnet70desktop_x64.exe"C:\Windows\Temp\{32A3D913-90E7-4709-BF26-263B6D082AC7}\.cr\dotnet70desktop_x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-1JCGP.tmp\dotnet70desktop_x64.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188 /norestart4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\Temp\{507CAB87-9515-43E6-B8E7-23AE6C694886}\.be\windowsdesktop-runtime-7.0.10-win-x64.exe"C:\Windows\Temp\{507CAB87-9515-43E6-B8E7-23AE6C694886}\.be\windowsdesktop-runtime-7.0.10-win-x64.exe" -q -burn.elevated BurnPipe.{8217DF94-9498-449F-BFDE-E3EE4193EEAD} {43343B94-A41F-432B-AA7C-FFE4A71B9BF6} 26205⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1884
-
-
-
-
C:\Users\Admin\AppData\Roaming\Vintagestory\Vintagestory.exe"C:\Users\Admin\AppData\Roaming\Vintagestory\Vintagestory.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2056 -
C:\Users\Admin\AppData\Roaming\Vintagestory\VSCrashReporter.exe"C:\Users\Admin\AppData\Roaming\Vintagestory\VSCrashReporter.exe" C:\Users\Admin\AppData\Roaming\VintagestoryData\Logs4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:2488
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Loads dropped DLL
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7DD0A7A11CC1A5E138C0A9155211D8222⤵
- Loads dropped DLL
PID:1616
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 315E75B6D7B727A827F59649E905B6AD2⤵
- Loads dropped DLL
PID:1336
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 71811ED4F8DDBC74D9A4EADBD1CE6EDF2⤵
- Loads dropped DLL
PID:2832
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C7A4C66BA7010FF39CDCD86F2A00152E2⤵
- Loads dropped DLL
PID:1212
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD5caff91022a1ad03ccd8f6e03d05d3ceb
SHA17a61de3d7a216133fd8717d744c0f08a633c3a92
SHA25672f6f0d76a96dfe9c5c075f118d6ba41ea7e5f1f1f1af286f8923c8e0485124c
SHA512aab621ca81edd9ba9fa428a9a2bbe8288fffca80e1cebcb2889d99c5e871a33ac4ed8b45d6cfa74ab7aaab056d8369d18c7f97708366d4f833b8148b82c4fe7f
-
Filesize
8KB
MD573978482b0505956c21e27674e921326
SHA148f19e54a5d9933112bedcbb857dc9f80ab85e31
SHA256ad9189b06a43495d1774fa6155d35637e5e2d2c9eb7ac46e3beef4025727edaf
SHA512d2edc491b608b32b1c6083b068561a126da1c2cbb898d7198e71b247ac28317ffbd8139a9da7e98e483765fe14963553e28f1c2b3622f69a0f4777d23a88c3a8
-
Filesize
9KB
MD581d20022d50b1d600d58b1b8890489e2
SHA1b48d7114ea51c448b6751f92c948356fb0cbe3e6
SHA256f0028db3e9be404c5013d3575cece7bd985ef7fe6ed4c22eff7aa142de87db13
SHA5125061e70f8372929943675c7ea491ee71c6ce178379c2d2f993e836e740f1fee02d7dd1b704e885c02a6dda411b9acbafaf58028bd122f0dc57809c7062276f4e
-
Filesize
87KB
MD5a30c7e1c24b62e792c2cf2de7ac49bb4
SHA1bac3c34be86c7ef8d79e878be0173c7444b7bde5
SHA2565e8a0f0f4a74a3f29a6b4554cff00635f8c1da9a22325560ba64b5935c9c799b
SHA512af6b35d934df02de85bce6f347647ebc367b9dd3655b5453d309ce27d906ad3c3bc6c06e378edf09c7d7b75cd7c2ff8c324646eb20a7e19f38e4e87f67175177
-
Filesize
9KB
MD531c5a77b3c57c8c2e82b9541b00bcd5a
SHA1153d4bc14e3a2c1485006f1752e797ca8684d06d
SHA2567f6839a61ce892b79c6549e2dc5a81fdbd240a0b260f8881216b45b7fda8b45d
SHA512ad33e3c0c3b060ad44c5b1b712c991b2d7042f6a60dc691c014d977c922a7e3a783ba9bade1a34de853c271fde1fb75bc2c47869acd863a40be3a6c6d754c0a6
-
Filesize
85KB
MD5481ad608d2c3b3a5a0a3a529f2b2569e
SHA1e271613b837d2cda290808af2bbd104a8c104a10
SHA25629aec309fa6f036be931222385612088a3d98aa07ac2356243028a3072d0ce86
SHA51293dde6782e14ac259b8655a89b31f7efe6990f27bc560f90200f3c967645d20fc54510e8fb0346732ea54707728a7075c9b566a936e76586c50681de65c83afb
-
Filesize
376KB
MD5e189d28e7531dcf87f89db07296fe054
SHA162579b985072cf1c486ffbcfff583fac678fb63d
SHA2562174dbb389315f82d58b4344d2498852bb62f1aecc13c3205fa774e5c2bb9a02
SHA512e67a999f8fdef53e76788d5618ba52b6820104ff02a6c3ce2ea41eccc2d4b30e8a8911ed76638c9ee40446fc6d11a5ae0aa576bf17d454b811778f2873bb5aa0
-
Filesize
28KB
MD58f75deb343b7697685df5e7c3957b0e0
SHA18985dab119c8a337567b85bb8e231b244cb6032f
SHA256c6baa8088c81d56dc5097422d3659812d58ec274085c0e8a66c9838b874221d9
SHA5125f0287c15e19fc048c9f1adc79e6aca5d5ff4c43cf2687fda4a22808683db38ed9f5ce62f2cdc6924fedd67139c4a931f719a6f9f6861674b63c511aef03aa63
-
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\Microsoft.NETCore.App.runtimeconfig.json
Filesize159B
MD501da0d56ab33c0ed0e7ac85e5244190f
SHA19e1e4b59e590038f769e5fa01fb326109a7f38e5
SHA2567133274dc5efab688a6efe2f43ca33e78a2498ef39efcad231b0e07ad2c26d17
SHA512e11967ba33c719da1681a7f98056d40f450788d9b7c8b2f580d8bc7998fc35a78c53fc970301b097c527fab79fd477adad4eafcd75b4bb376d33c3fece9e8926
-
Filesize
11.1MB
MD55140994665a3b2e43c2f9e945ffcdfd6
SHA137f7a55499966fc26bc981303f73b6c22be4077f
SHA256499b4611059887cd4c9d3bd706d3c7164183b446faa09968220e2cf6cc1d0d16
SHA51214e32d4b43153eb34dfa944fd5eb6daabfa21b26bed6303b35dc387935516afbed9d9955ed8438f3acd3a21e71b113dcd62e88211770573de6cd026848335fe3
-
Filesize
62KB
MD5801b010b07632e3261372c1b67289550
SHA1690f9aacbd262c267fcdf22afe70aad77c009cb6
SHA2569457e47a2487b44b1f7e42bb87403c1b4883ec7584f76e93bbf8ce17086f7a3d
SHA512b6826e691743c79e1ad12420061419aab7f3ebc32dd4eeb912de43b25f18569b77ced92767f2840e1ad84aa29164778bbd7eee4dc4085103f63d27621d8cd85e
-
Filesize
42KB
MD5123aa58e6127ec3ce16f4c2a4b50c51f
SHA1613d41b28e66ae9debea557a23811d2c1ee78538
SHA2566478ba67d1f3a4b1a484d88f9dc749ab16026b29a389a946038e3ab2515e271e
SHA5124a4d7fa7c0d99ad58ca9d100aee91bfad80f6f4ed025a568ece23c55d98ebe8334459e3693dcdb8b0c201ebf0dfeeed25881a8cf82989acf7337ac465ffacdf6
-
Filesize
1.5MB
MD5732657670cf7c061072e9240a6fc0731
SHA1d6f3f2af0b56b19d0d7715aaf50209e02536c502
SHA256471cdae1ee0560b89c831b939fbc328972c30c7934790bd463368ce98aa4dd0e
SHA512d49328a7d0dbff11ec7a48ad88e51ff45c9d19b0d83ae9dc0557b293caca3488b109b6055d396ae0f07567bb524ce9a1e39c1205b3cb7736ac8f61ddecd11528
-
Filesize
134KB
MD5658c5dce3824db58a3b7d088c754e1b3
SHA180db3a74d21f520bba3ce83a1fa0f44d3d72c5c2
SHA2561cca18b453aaec821b1be86a0799c64eecd84cff4e57fb5be91881b8778acf3d
SHA5129e1d542ce7390230d1ab3c1777e9a2e176b391d0110b54ccfdb2404d9cfa96bcf8c7e4623d4c19331d7841e1a5687a989277eb0f280e903f763737f4d9ff7e10
-
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\Microsoft.WindowsDesktop.App.deps.json
Filesize30KB
MD5ee595fab7a1aee817b656b7f836b2816
SHA10212739524f03275c12c61aaab1e4f7d82cec3f3
SHA256b3ae4750069c500d9b71648df4e11c39493bcec4059618fef237ee2a264ab8d6
SHA512ab92d2294b303ae639b0a1ba63e0a159c50c5ca0d22cb8caca2a53c25ae9009c8ec238e03361677b581536cfa4174033057ad6c2793c9d3dd412021a9dcaf564
-
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\Microsoft.WindowsDesktop.App.runtimeconfig.json
Filesize289B
MD553b6bafd989101f77046d0fa461d62ae
SHA15c3c0ecd52120742699dd68bf3ea639bedde6be3
SHA256dcafc3f8553bd4b868045d1ae6a6086906b92a623a231a2748a7b23bdea0aee6
SHA512c9187f1e546293272c2ec95543a8cd07d6d690e989e53603e6577bed63c365c66d9190dc01fd84f8a06f123ea33203c3f3ab6b61e5ad5b3054c6d90a35b59c9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d571423d6555997cbd8b4d3c1fa0944a
SHA1b4c34f1dd15d67d42ce1e5ca4b236a9ef94f1f92
SHA2568ee07b67446e5a09bf69339772f7e66bd38e314e2bc8e34b2520467696b0777f
SHA5123f4efda399e0b6155587d45b9cb119a68bc96561d9e2fa632a51b284c60405e5385f2f2af382e7ebefa890f90ef46d39d255d1d624a98392231bf49dc26eadf2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD521fe3c69b32714b87e05aa943ad87a78
SHA1637a4ac75a5ada82eb1be1aef8505d89c69fe72f
SHA2569d72e38b2c8a45d5dfed45205e1d618e1b969ff7d9af69de820f90a5c12dc3a3
SHA51288515765be7c4fa4eca470c76970301b7e0ff0bd1affb828a3d1fe3d499775b98ece2ae18c277334abee82851239ed17792f9dadb57235c2a1d484608374c5b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50263acd05dbc4111576a23aa6f6cc5f8
SHA1539d52ab4ef1191983909a728b0f7535769c15a1
SHA25625bb3cc3b9b068af1fb5b186544425acecb16dfae254c354a402e2a72c7e815d
SHA5126ad61a5fa6f9b6418de7392786a5eca42745d0f9c144ab0c387244e19b25693a68dea817de29b7c9186e4b1628f242655d6003824e91c3c3226d1404cd8dae39
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.10_(x64)_20240709134102_000_dotnet_runtime_7.0.10_win_x64.msi.log
Filesize2KB
MD5b097515c6207767b52081bdf7927f7b3
SHA144fc7823b8a7bde8e25aeeaca633a6b0569e4e4e
SHA256aa06655d0b29f5bc27172e6f663f48e7c6f4992469fab7a6a3a7bf83a6f57939
SHA512a3c2a7f14d69d71bd0725ad37c9461d8acdc66a3c47993cd20c09646cbfee0bfe814835f12877f5da154d27ea69a33390d13edc7c019c327a2a78deb3d2b2720
-
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.10_(x64)_20240709134102_001_dotnet_hostfxr_7.0.10_win_x64.msi.log
Filesize2KB
MD521dba32fd20f10bfbd5923b5e4b75d24
SHA10bf0988e3c6ef8f6e480dd843587a464f9c0003b
SHA2561e06169b18cdfa3584d9c57ab5711b227a1a3d1ca8b3e5cb329cc4ec580915e5
SHA5127b4a0f7e6fb2a38a2719d4dd6291e8e7c2a880dde82042af0ddb356a56c4c0c875d42b2c21e4e22df8bc0cf21fb549f231bac1e855a57efaf25daa5c0023e096
-
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.10_(x64)_20240709134102_002_dotnet_host_7.0.10_win_x64.msi.log
Filesize2KB
MD5c4d2aada3cedd7f5c4fe7eabf3730f40
SHA1dd29d1293c626d3794f93c9ebc3ed78e4a92503c
SHA256d0c4174d7a7ee5f52c880c5ddda7597c763c41f31cd2f887cd17716d6687656b
SHA51208fc8f53b370bcb115ede4cc1f6318fa6c959328c039fa76f3225b1fe84ee9e54bf3dc9fd783acec6269d6a4fa8772399afb88d95d6c278c6b3ebf0b8ce95974
-
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.10_(x64)_20240709134102_003_windowsdesktop_runtime_7.0.10_win_x64.msi.log
Filesize2KB
MD5fbf4f7f3980748afb469bcb47e2ddd9b
SHA19115e16116785bbfb131c9ada6c2cc98a85195c5
SHA256ab9f4bfcc9849f2f3ed8e87747f0909e4e942306e36659574eec7512eb9984b3
SHA512f1e0f2d14259d8e9a2f39c873309eb73a4950e9d03d50748ff9af4f663a9a9a85ab2a500312614450573c83d4d457d788b2b6c8dd673540c886b179356e73f6b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
42KB
MD50b25e7fc1a79a9dca2e5f6c21ca50745
SHA165056eb73f2906b174f4775812586e9a252b2291
SHA256682a9894bc5b1ea68ed352e7b7bdc517cf22c2a9731e30da1b0b195a9f45b45b
SHA512bab0a25eb98257aa8f4fc0279b75d8abf979d66ea32d88db9f94709a78d46a4c93dc7326759f844fb1d77d717661b9bf81b3db5616a78823fd8703187e83d404
-
Filesize
92KB
MD5fa39ac5ec3ab8af13065f697a13958a8
SHA16663ac08c528c04e05804805dc87a776300dafcc
SHA2567f6004b25f83f1946dc13b57e504d86049cd319528770ddefbc3e13e130a162e
SHA512421d1b835c28804f47b4677a71a4fe4d162d85bcdcbb1b9f83ac63eef054497ab2b2b1b2c0d6100dcc5a94c17a8b88a303ec5a4fce6c3e2b198c55bbc123e270
-
Filesize
372B
MD5cc164c1b948924c198019ea9b728e06e
SHA1cc531f61753f5aa889a0d23526de40c9ea6c9717
SHA2560d2a78306989c968cd73f4a6b462eef0371639cbb8790248028e12cba035445a
SHA512402d464ff16a9c7d7d5b85063fce4027b6eab6bae2bff73b8bb35252acefe645c0c05c030cf2d1a6f38e8e1422829734d7985ea3609fe550e95c28285847dc70
-
Filesize
2.5MB
MD5c41bbeffdf4e3fde5ecc53600d222ebd
SHA14830485ad9dbd71c618c01b4e8cc2d029928ca08
SHA2560ccab2f0fc2f98c7bc5a952a8e15d909b43944cb496e261608bed8990f7b4a60
SHA512fa042ff075a7f8c3da821eef47067a5eaf907982d929d2f82c6024c3849ee4579d3834d6488a3f9a4951dc23f1584363c4386185ad0325b98cfde19b71553339
-
Filesize
25KB
MD5eeeb983f9dfd8191820a758db58f14a4
SHA1a8f181926cd52eeb5c4078c99f0ffa0f645420db
SHA256aa882a7bdd30d4cc7728c5770fcebcabd501df8f72f4b61248ebf1096db823c3
SHA512a77d47576798bda8e0acd248f75f74603adc7fcbd353aedbbfaaac103bbf2e138baa2c96ef3ab6509a45e2c4d2448f8607f7bca8d1cbe09c857dd4afaa722965
-
Filesize
26KB
MD54a74fbce42b25849ce87ed5e384f13ed
SHA162ed0b0d4e6d8b610f7bee23e8fbb014507b258d
SHA256bc601a119a8eb97fef0b8397b9133d17d961c391b6d7f8637a1e64025d99efe5
SHA5126341e5f532ff4055e0f10beaf373bc5d4ef96590106ac71629326aea35085d69e155c3039984c57aac29aeacb8dc06819a70548233b8f0681d72abb337eaa273
-
Filesize
24KB
MD5f6a7a0730197e797c3d29f298d9ee8fa
SHA17b4908cea10c3432f00e6cc0a8af5bb289bc1e88
SHA25687127c4a102d2aa9213388696e3964ae631edeaf22b5cc31a8bc8b51ab2e154f
SHA512447c3bdb0277c4c998a097d027bdbaacbfd2bd926d1d0d0425897a22b2d385e3d0b64b0efa3844eb30fb4af7963fb8e43b1160cb85406a69beb2fdc81066a6c4
-
Filesize
43KB
MD5344664688d8aa64cf1d8ee18d6970d00
SHA1abcd3b421242eb3d537d9a3ce640887496fa679c
SHA256a31840c2bb93ca0bc387a6e82d812e03c67553aa30f52586b2ddd3831b2ea54e
SHA5121bc5f51496156d4978329ccaad0e03e3d5784f18777269dae9cc84ff325a59802a388e89e79ae6551c08e02a3e226fa2f9aa8f9be3fabf02017734fb24533bd4
-
Filesize
224KB
MD59f29b0511c09bc963b6439efc1f21d4e
SHA1108001983cd46eae91ada8ee77deb4a91e40a9aa
SHA2568ef1c266bc20bfce187b595d2bf5296f82b66702308151c2d86f08d085bdd51f
SHA512ece0e6fe7d419bea31b63cd82a34532ab5785aa7835fa7c9349454287c5449ccb97b172dec1cca8e090ed0487b1f35cd685167be42bd34fc5239e5f1586c9c09
-
Filesize
227KB
MD55201370ab48910334f617a477bd54482
SHA1073ca183b2835f9651d2cdbaca394d1cf32d2751
SHA25686e68cfc85f29754751dfa2df6a7abad5bca28dcc90fa9386ac0427b6e2543ed
SHA5121bdf38895d3a0edf9838b8b7cbed533278a9bc4de6ef4344acc4be8c652c0fab0729dbc332d5d3fb1d3ca0cde47b1148041f19b1f937c3404298ddb352f62279
-
Filesize
220KB
MD5de63b078c6d93a995e6d2d77c3c4e303
SHA1e68ee46c917c6c7406a918396c791a378c70e561
SHA25640b63578e939d977bacbfb3434edc13e87b0fa4bcea7db9b3f275e426a25acc4
SHA512008c23bff260b6fae06d76b48f71d15ec72cac88ddb128f9a09f0dd84b046f39d0747a36cba1bd92e6767a3e2f3f40bcc2f8aec71d28b9dfb8fe1ff6a22bf17c
-
Filesize
222KB
MD572631269e4dc9b244bfb441ea22188fe
SHA15fa1ded5de4ce864556c861c2ba6f4ec19e1a21a
SHA256cb9fb5bba33081358660d16333b755ce74ddc2c34d03b7b4de41d561b3507d47
SHA51200db83c29a7c3089d448199ed853b0000bc6dc1ac5a263ebda6dedbd5e87d150c43a3b53de18ad837e98c5d2ecbefd4000eee73c1cc24d666cb4d6db39beaa05
-
Filesize
269KB
MD5fbb808e6927801ca2a97452f947ce0ba
SHA14c5b03394078109a583a5ba77c74b045c02e3d9f
SHA2565d5caff8a7765bb0a4cb07f6dd8bfbcab7fce623b6b4f6ed29e41958cac563fa
SHA5121cf4397d1cfa9104d68dc6b83412abc0eaf684cbfd3248bd393cb186be5c427f5ce529b7ae65230fecc8e0e3d941ee3237a47460dae5cbbf8a831d78e4132dc2
-
Filesize
274KB
MD568024561c6031cb5b63e39ed43ba079b
SHA16ef9e488f6e5b51605a4f39f33ffb84b41247e50
SHA256642dc645909d5ed60f878ff7c4afa6a5f69b5d3163e76f55b16a3734b6ed5157
SHA51220f8d20d86d14753c74e7d83eb0182a1776adae52204256af87bb379b5e930027d7e453a867d1b0ed7301e0c52235cc0dc07f1a346ff9cb5c969df6f9a83e2f0
-
Filesize
269KB
MD5bb40fa8b509f69fbc0fd48259c9c2f00
SHA188f5665acbfbf732cceeee1a40b8c3431a6ca094
SHA256e771ab4bfbf5eb84bf4f86b882105d3c9ddd0cd45699fcfcc831e4ffa24f3f16
SHA512f38968c5b9df3a139fe388ef464f42a88057ad7f88782a7ee03e8f97a8a334d769e44b608a8a0632a923fd3c3bb43a2072226b1cfe0144a30a3ee5bb407891b5
-
C:\Users\Admin\AppData\Roaming\Vintagestory\assets\game\shapes\entity\humanoid\seraphskinparts\face\is-QGTA4.tmp
Filesize13KB
MD5166de15cffb700609e9e3a13318e9b9c
SHA18b6257d11f1cafb4cb3af727440a0861b86670ef
SHA256c1d53c32830ca5d6dc5a8d157a8a211b3fb826ae91af58bc68cac42cc1d2dcb6
SHA512cfe5279f17fd662b9d18ee5c4bf5bfd0616ec4f1389f213739d890038ce542704819c483bd7396ae0c3e9f1d0390a9dbcb288d78ab8bfa6d32088c059a4c4852
-
C:\Users\Admin\AppData\Roaming\Vintagestory\assets\game\shapes\entity\humanoid\seraphskinparts\face\is-RD6KH.tmp
Filesize13KB
MD5a85f866b952858bbd3d6f111dc6e3b48
SHA12aa0f3ae5e9a27d21f9132ff1c5831cef53dc444
SHA2563bcbb778eb18fed56a8c8eff8fa9e7e0c2f2ff1921d97daa30688c6e80720d82
SHA5123f914ec64d137bf0b0985f59fa7c0fb9fd8f5eb7e53f24c6fdc70c2ed40737b90615655a542ed56ab1b1bdf160b2853ff1a71fbb560e64699d2d59b70e88d8f1
-
C:\Users\Admin\AppData\Roaming\Vintagestory\assets\survival\shapes\block\clutter\bookshelves\is-R2M40.tmp
Filesize30KB
MD56d48d13db4c02b5f8a9b7eedd819cc6d
SHA13d1faed0e2d1acbbf919cdeb43ea7553764cd7ea
SHA2565e926be4b8f5afde890a61f304d5b425304a53b1e811aedff145c95028ac6510
SHA512eaca37c5d5856ba2dfc496f1a3b2ac7e04aeca2c98bd04fbda020c7c4675d9cc7192a0eff087ca124827bc2692628930bb76a84c5d98d9367489f6397b413a51
-
Filesize
19KB
MD53bf07b0152f043ef8f963ea2fa0900dc
SHA15b809ba5abc2566faddf2bf315e2b53e8506d25e
SHA2569fd6743e8f110420b20bc694f8e4c6881758911259f7f82d85239712563ee51f
SHA512aa16dc5497844d7d81860996074d5efa78ee8c3eab7c1ac1f6edd5395d262647bec857fed19fbcf5d87beac7ba4b03b619b1c36c5d25c18aa6af6fb7f0f99dc4
-
Filesize
19KB
MD50ae5463feb53b2e890cb02f8637e122b
SHA1bfe22915abef4010784f7796f4c7b379b1a9ed05
SHA2563e06a1d3d8e9f70a1aa787fbbe1d87756f9fcaf026e3d0a0ebbf48f759074673
SHA512f9a715fb4d6039a8cf9c2edddb74f23c3c56df4c3c7ddef7a57483e185fdbf874595d5166d75057e8e73fcf9aaad3ae63ce44d0d620ad8d78cc8554650011c40
-
C:\Users\Admin\AppData\Roaming\Vintagestory\assets\survival\shapes\block\locustnest\cage\is-H3RUO.tmp
Filesize17KB
MD5ed304bf2c32ddc540126001f554bb1c4
SHA178bce9dde4be8cffe6fff795dfd5f36948a13f78
SHA256c599cff633c26c333a09b6347f57c967dc70057fef26519e5e4ae299eb31c678
SHA512fd5dfecf93ac9644101f64df3fada0f27e46896b2c194ee08668043a76aab8ed60987b0446e3333b3704c445ca83177244c00f68b8a0f3917162199c41be69bd
-
C:\Users\Admin\AppData\Roaming\Vintagestory\assets\survival\shapes\block\metal\chandelier\is-24UTR.tmp
Filesize16KB
MD52496d74ca0aa20865bf1aae69f792e4d
SHA104e7b4661cf91eb07826340b13db85161e39f681
SHA256e0c4ccfcfe89e41754fce659b3faacf07e441d8ff223ede3035c08ace8d1a264
SHA5120630f24b08884fa5c648bdbd548a98809188f9bb078186930ea9c1dc2bb4758ef7be5ea00d0afc22d541397c1c1ec3e30ddd7d521c426542eeb67dc40a6132db
-
C:\Users\Admin\AppData\Roaming\Vintagestory\assets\survival\shapes\block\metal\chandelier\is-BRPH6.tmp
Filesize20KB
MD522f3cad2ab8f3887726e0d57e1746ba8
SHA113c007ecd96a98d5d5b159aa120c897e8f757c05
SHA2565f9806ae92a916109e7b3d94b6ebcdd14c13e6b1cd2d0a19099b31945d199ae5
SHA5120fc44c52a179167536142aa8a8ed5f0fde852cc3f4f598c44f6e580ebc625849ed8865f23f023c0c397bca2279d06afdd6f445e57a19946720435dc943e34b08
-
C:\Users\Admin\AppData\Roaming\Vintagestory\assets\survival\shapes\block\metal\furnacesection\is-60751.tmp
Filesize4KB
MD5006a12b4600af1dc68328098b5d25dbb
SHA16698e9aa02c8a042d4dd784233a2260a521c5769
SHA25603b98dec6d8abf967802e794b6a9e20f4863542dc58ef98cf6dff4a20ad56a81
SHA51290da24588ac2255b9af4c6eb25e44c4b52be34f0bdaebce06664b74c023342ff52178ecb68b4ad9c962b62f07c5e7089da5fe1b6bceaab5c9f2ca729257a3ff3
-
C:\Users\Admin\AppData\Roaming\Vintagestory\assets\survival\shapes\block\metal\furnacesection\is-IAKOC.tmp
Filesize4KB
MD58a6af256f11b64580a766f37299ef704
SHA1db341925bd52a4c9e5648f16d1d2c4a055ad6375
SHA25676c286d345deb5e0aaf563e2ead5b17c5c58319f2a77b3de1d562e8005e162db
SHA512828b7814ebb034addf1097844f31ee3c58cea5553b59ccddb820f94f069abfddf1d7c8eb0e2fa2f5823cc054924a8e544da7f780d191dbd9c7f83f3ee2f2bc72
-
C:\Users\Admin\AppData\Roaming\Vintagestory\assets\survival\shapes\block\plant\bamboo\green\is-DEM3S.tmp
Filesize52B
MD5c8b8185f3892d5d089a43b453abf38df
SHA191d97d17791f5a5d8819743c0c34629ae8305ca1
SHA2564dd631845ef519b40f11b93ceb57cf45e3cea687e26fc82c8ad53ef7caaa0b2d
SHA51242282cb48c243f7c64a994b384cf969fb12fb5ab85d873b81add3fba84db7b6752e5a7ad9c67a25fb260e9323ec46e5a9622d202a20d832ecf64da0a6cc6e126
-
C:\Users\Admin\AppData\Roaming\Vintagestory\assets\survival\shapes\block\wood\bookshelf\is-K7C61.tmp
Filesize17KB
MD53b48b814331fe0a1528262ba67a48ae2
SHA12190ac041fd6e4b6b306d3aafa8f07e231dfab80
SHA256636e057ea9e1d016786610c4116249202fa4a1535c9112f36c1637098ec5cfee
SHA512efdaaa5a9fbbd8ad8dddb4a55fa0d1cca969766766898917c4dc833360e3669068d9fea74ccb112151fcdbdda7e0a05f99932ec66e3f9459689fc00cb7e67807
-
Filesize
7KB
MD55cb6fe864c099679edb1bf8e2b2b74b7
SHA10edb428231f8dc366682ddfe03e29058d9dff7eb
SHA2569b51715b32afe4315c585a5a38c9af7278be254a22d22f25db10667b0fad8080
SHA51214442f53582d483c41b99575a82ad0a2b297ab78aeda3633cf4fb7a77aa1eb2716db4b9b9b5f78a5a2e07202e4325f81ebbf17d34dfca9c2f83bf6072aa2429a
-
Filesize
10KB
MD5db7eaf4f9f8fc5824f13c1e71b85db2c
SHA12a85a239eb3d45e9f72c73bb257a75c3a316287b
SHA25680e87ea954ec9b2186278c11ceb024cfa846aca2343605a20caf42827ed75f67
SHA51298db0254932e1204865a31e4f2780aef81c229ae853fd9b05ee33becd4b8ac21fb9e3e1110fa8ab44f28817a3185839d0134bc711bf98db58cfb917ee833aca1
-
C:\Users\Admin\AppData\Roaming\Vintagestory\assets\survival\shapes\block\wood\mechanics\is-BRP29.tmp
Filesize95KB
MD5c836f191b4715e3230e4c49ae8b23e55
SHA12649e84f170c5bf7697036043bf6f4bdf2da9836
SHA256d1f0e00b49775a1c6ce39b78819981f385501ae9042a1ef45be0233d858928af
SHA512fad2faf2b459d5a68fe2dd2050665a7ab824df71a036077cd99276565983cd1a2d57ef19f304ef8e1ad8412e300c00394a2e23c79a4e9cf93176bf5f2230f0d0
-
C:\Users\Admin\AppData\Roaming\Vintagestory\assets\survival\shapes\block\wood\roughfence\is-6JIN9.tmp
Filesize33KB
MD58aac98384f14fc8b3d0e9c038bb56745
SHA10a7f960a424ad5d5f4294636cee019158d71535f
SHA25636c9aee2cc935dc2e6c22896279feb6047c69806c3f28cb3670664fa11a73313
SHA512a9d1a32aa08cd4265f2408c1657914811ca95df4a42ac222b9a2db445aa63e1c37903ca0bb591192ac090a0ae86dd9cdc83c2574913a4ba0a83072742e610568
-
C:\Users\Admin\AppData\Roaming\Vintagestory\assets\survival\shapes\block\wood\roughfence\is-EG1L5.tmp
Filesize22KB
MD52d4f954b87b9c07b483a9a2e57b5e2be
SHA1538f0dbc086a94534ca2e8b5c516831f218ea891
SHA25617ea679352ce37d2b1749b287495b9d1c5d60dc3ac1e47fcb60d5919cbdce666
SHA512183e54d7dd229602bf06dc9b0eae2d879f99ad21c3328ea852587f858b1526f0ec8a254e265b8fe2950856faf76dc95243b6333385353484bf047502b0857d55
-
C:\Users\Admin\AppData\Roaming\Vintagestory\assets\survival\shapes\block\wood\roughfence\is-FS67P.tmp
Filesize22KB
MD52a2337bcf8d8f98bf37d5cafec80d68b
SHA1efd3f666a48302e7d7070f4dd4cb624edb8da97a
SHA25626a5ad38882d4e764b9914933e0e55ab305f02a84d55d7b4d6f80aad56325148
SHA5121ed1b8a1a5612fbe68611b5d6e778a5ada9e33fe3e67360183234f8ec978d293b77b249c2c08865e79e65970180a4f1ff6cbb0c4547290975d23049b09c07545
-
C:\Users\Admin\AppData\Roaming\Vintagestory\assets\survival\shapes\block\wood\roughfence\is-G89VC.tmp
Filesize19KB
MD5372ab08cf6770b70c2fcd6d33b66eb64
SHA18e95229cdd666d9ce96d5f8299d4845060b90ad3
SHA2565c1be930cfa3dd6a6fe3ec7489743de6ed4e5dea6f605bc2851b4042ec735fbf
SHA512c78184b85b92ee2ed2b912e4109b5a18783f26dcaa004f03a71cb13b13a17a8d914c00ad7f02ae63f336296b2a2389408d2cc4c0b2c06f8d81a51aa0ec6d2531
-
C:\Users\Admin\AppData\Roaming\Vintagestory\assets\survival\shapes\entity\land\hooved\goat\turdag\is-BV6OE.tmp
Filesize33KB
MD5773e5b4557c09141de84dda7b7a26a53
SHA154a0534dc08b026612b6099196d165927e48eba1
SHA25680f67a231426ddd90cd2c99c7ce416cf37dd177f4287c68a42c43cd27a1023f4
SHA5121d3e990383e008283715f9d40768c80d6a12f183560179087022640878a514979f19cd2e3ea5c6f63e644063bd0ea6618f4c453a014788e8570125b2a5315487
-
C:\Users\Admin\AppData\Roaming\Vintagestory\assets\survival\textures\block\clay\brickstairs\is-K0KRE.tmp
Filesize2KB
MD579dfa52dd251409ca4e00a8e2addaa84
SHA1b9e6d00ec6774ae01f34b66b5a10c5466cd6820c
SHA256949d5f70d88a518c8c7b3d7658fa6771cd2e9084b9618b7c460d7fd2a1c76367
SHA512a0b920b4e905c435b32b0e83f170343db10ea28355eff83ec24ce81cba9e168db8a43e74afc4c884d5fb9949150277459041c3cd22540f6dd1e366de5e1ac543
-
C:\Users\Admin\AppData\Roaming\Vintagestory\assets\survival\textures\block\clay\flowerpot\topbottom\is-PTLPU.tmp
Filesize1KB
MD5e7b931a9905399c039b8b71cbdc93853
SHA143c87de497935de01485d2d93233c6914abd4dda
SHA256c5e37dbbb48e5ff26bc1d200130d6ff502e81b66f8db996eba0ccd9f77f2b1d7
SHA512666e17bb2e90ba21ae7c8fef6b8ef71689d0daba6f883e50fa4c95cfb78c4212811dbad7a0d2101431451c019bdef53cec7d73cb6c25a31d492754f4743523ba
-
Filesize
1KB
MD581b4b72293c54ccee8b8eb7fbfb62c51
SHA1c8ede06fa3e5ef5afa1f2d254814890ce105b21d
SHA25687496f5e34c95af8f9e686cb7082670233f17a8cf92fcc92d60feaaa26f32fb6
SHA5121f52f951d2aac5a16435a25fd0dc1e8365955bbf0644c37ba3b6566ce278061e0bc342eb4980abe64f1b6540300a13b892224e582523bfa980e30cd642a02a01
-
C:\Users\Admin\AppData\Roaming\Vintagestory\assets\survival\textures\block\metal\sheet-plain\is-50FRF.tmp
Filesize2KB
MD5f358c24ea4589802ee62f2ba6ca0004a
SHA1795344052bc4e2153eb26812fe5d4848983fe027
SHA25605745a38e4c7c38b994005b3aa293c00a880141362accb56ecd53bd8fab0d7b2
SHA512e8e5e0d7898fa14230e294830b0d1bbe1a33e64095a3e45aee5cdb42cbb9f948f4486e5373eadc63cd3211f5d7f1c26467721364a9615ceb47c13a9240af2489
-
C:\Users\Admin\AppData\Roaming\Vintagestory\assets\survival\textures\block\metal\sheet-plain\is-77C6J.tmp
Filesize1KB
MD5e3ce91b3b389d2837325449dd221c805
SHA100d9418b5bcd63db51e2bc169ecc14f87b69a0bd
SHA2561b1cb36d14a2c7710133d331539f25182624aa4e9ce4eeabecf8fd5ca21282bf
SHA5124612e794f8e19640044cd955bf32a9b7f855d8c8b51aba1dff147fe6f8c66bd0bcc386f741e8f58d3a565fa6093d937ec02a98db2af4baed247320729071809b
-
Filesize
2KB
MD55d50b6e7787ee4c43833ac8ab7fc21cc
SHA1fc9d9184c1036ab5ab6d8e7805eb6f1d31420596
SHA2560b2af0578efececfe0df88b41d83c3359a62adfdc7b80be0a24ed868e9304da6
SHA512dd3f259e5358a1611010fd886101968bcc48f9eeb1882c35b3a50b60adfddd124049f00248208166c987454498e20e83f021ba3a4e8415fbbaf2a8620d1e30a3
-
Filesize
1KB
MD55604b92b422eb3dd1dfb3e46409eb7de
SHA1f6086bf80b81e262cce7b0b5172164d956eaefe1
SHA2569b1c4616afb114e2ebb48bb83e7a16372dbd747baa6f7d32d493878f2e00892d
SHA51233dca4bfbbc35952f05acc02f387aa84a7e0b2b536c869fc425a5539f9026909a3d1a4a12aa51c5315cb1d569b17c8fe0dc88566fd425feecd11ba1cd59d4151
-
C:\Users\Admin\AppData\Roaming\Vintagestory\assets\survival\textures\block\metal\tarnished\is-5NIQO.tmp
Filesize2KB
MD58afccf8702d0a34a0b9053c648aaadaa
SHA1cde012422d47bb44ec5c1ec99550906225d4bf16
SHA2565f3b40d251271c2244b40132fd17d2a9bd0f4c9b7e90f155691f043d02296d8c
SHA5127d2d8c79143680d0042317a2d90546f5eb4c89f52aad0f0b1324561e52a909e441ac37fc83fd01ea51022ce37736ac021d59b274c261d4efdf16611c2f75bc7d
-
C:\Users\Admin\AppData\Roaming\Vintagestory\assets\survival\textures\block\overlay\cracked\is-631QS.tmp
Filesize468B
MD505d0c1f731da14530ea80ac0486e3ea6
SHA148725410af7f6fb47ddab4d7473d608f8fc4f178
SHA25631274c9f3f8cdf86eeebaac664b31688a773aeb8ef857c82cf9438675a6682f0
SHA512e73ba0234b40aa43eb44743632bfcb46dbd7a109cef08ad1574fa1f693b91ca1081ebe7f8b3857f71fa97264efa067592b2c1b51a5eba55982c396abd9cd86cc
-
C:\Users\Admin\AppData\Roaming\Vintagestory\assets\survival\textures\block\overlay\cracked\is-S61PL.tmp
Filesize437B
MD5f5beb99545f93518c354435dc7f5d644
SHA10621843354a6efdad5ce52d737493c445d16d162
SHA25628fca32445ad7afdcd6535c5db86c9bdf7cd35d89ae01f038dc41ed1da95c68a
SHA512dff3b5197358a93ce36a30ccb18d39bb30c9ec57fcecc1fdd34565805174d9561d7aede0fef09d3174a73c4f3f1272b65bc3def51f14d4a7375b53bfa4e7249e
-
C:\Users\Admin\AppData\Roaming\Vintagestory\assets\survival\textures\block\overlay\cracked\is-UG6DP.tmp
Filesize460B
MD53602a7f985a1290dde735154a7f92302
SHA14efc3236f71c3d691b3a68e4571f2cd97de8346c
SHA256360f66916f7e6a6846828cb5fe99ab618d1c2bf9103c66093a8a5ee6af740e28
SHA51235db7dd601ddeab16246d28579dbaa01dce345b25c0818c77132eb8d9388d192db309bfa5d1b4303c7074d6b6fcf51b2f7e6bc1d7f7b566fcb91c6b4770a9d9d
-
C:\Users\Admin\AppData\Roaming\Vintagestory\assets\survival\textures\block\plant\berrybush\small\flower\is-I56JH.tmp
Filesize632B
MD5fddac0c59d6b8f5110495b23f4de1b61
SHA196881afcc2e80db2689ba3eabaef728b254d53ff
SHA2564fe30af11aa35a14dab78d3d68e94471f936f1231fe7c295f14ae410e7b0c560
SHA5124399055e57497908576bd933c5451aa20d7b5694143c811f888be7efe4cc1155aca6f472850a3f71a2e1e28110f999286a8a0a71f4516432f2120542f546dfc4
-
C:\Users\Admin\AppData\Roaming\Vintagestory\assets\survival\textures\block\plant\flower\stem\is-KMQBT.tmp
Filesize142B
MD5855d32a8f0f5c1f313367ae8ab780056
SHA1664a4218ba3f35f1a335cf1f3677e863bf2f34ab
SHA25659eb8bafa3d88944865bcdf1be7e7bca412b5735c2bbab1abc2aa099571334ed
SHA5122de1057dd58bf3a63408d7211153080f16d97cb219926a0bf1127ee2fb2b4c5203b24012877d55c4aa7eed2013f3fb01c23f8bfdcbc5c707372e466230309792
-
C:\Users\Admin\AppData\Roaming\Vintagestory\assets\survival\textures\block\plant\fruittree\yellowapple\is-LR6MQ.tmp
Filesize2KB
MD530e1b2566e9dbf3d598adcffb2ecf811
SHA1a8368955acd550402b932175cb86fd0c33cc1574
SHA256dc71e7c1ea3cbd2244f094abe73378f4cffeb1913e07de5f50f384ee6a537f37
SHA512d1c5533e882c4884f1cc6670a89cc5438d944e6a812a9b158c1e88b4fd040700df66f599ebdfa3aa1abb06108ca91b98d7b699e59524255cefb72b4274d98795
-
C:\Users\Admin\AppData\Roaming\Vintagestory\assets\survival\textures\block\plant\fruittree\yellowapple\is-Q2MO0.tmp
Filesize2KB
MD5340abe479d733eca4d8262ad8591d793
SHA1e30c67df63b652a0e64e8e151e59febb212873e1
SHA25690481e073622472dc28721210d64d8a34792f127e3c7bb32f78efca1f24842cc
SHA512fc5630721a83f62731f7c0418af754f0f2c9699ebab3adff4024ca8fef5c8c485b23d8f7af3aa71360c6abf5c32ef9b289c69546249a4baac17c31f6c62e26f1
-
C:\Users\Admin\AppData\Roaming\Vintagestory\assets\survival\textures\block\plant\leaves\small\is-5A61E.tmp
Filesize1KB
MD581ba7736506e2673facae13cb035a3a8
SHA1e068e1bf94660e0c85dd6d4aff798580bcd0b799
SHA256278d1b4302f9713ffee5379505f13f69d06491db80d2a735f43d0be44c7816fc
SHA5128375bfe3d1b8e8560c8795343ee4f368efe295aefe64a53cc6735a0d73fe3c09bc8923ff0514e9e1ec7d6e85b2f78e63827ed81bb9754e54f14dbafafb3095c4
-
C:\Users\Admin\AppData\Roaming\Vintagestory\assets\survival\textures\block\stone\cobbleskull\is-OSJFM.tmp
Filesize2KB
MD513e4338b89a9c1c7756e90ea742073c7
SHA1167dfdd7b2af6b0ce0d68105009bf4785f812615
SHA256842d7e11801faac3a48b4785f3b660d37a3179cd7fb3d1e78fc14b4457a380e2
SHA51274120de50e4a9af4c12820253c53332b502151b5e02a25106f26068f915d6102606e11f56fc907da1d45d575398dbd796a1da9e7f7c2f45007c442eddf72c605
-
Filesize
893B
MD52e8e91537705ed5f52cccc8dfa651aed
SHA1168c65e5d386eb16aad37194c35deabbbca48ff8
SHA256ec5c9e6b9f65d927dbde7b3aa53a0bc4ff2ec3e8d105b45e373a5903bb165027
SHA512513279e3ce6d6940db7d002c31b6d3cfb2760b15153a1080d8028ae9cb770f93c39fde31f88ea0c0a1e53a552a48c8eca794300be3b3009e566a4575b72f87d2
-
C:\Users\Admin\AppData\Roaming\Vintagestory\assets\survival\textures\block\wood\bed\normal\pillowmatresssides\is-BECR9.tmp
Filesize1KB
MD55ab0f25460f204f5ee71b9bf220c952a
SHA15bcadfcd0c7f74032f0336f0c763859b9d105f40
SHA256ff17c58403dc5250a2a366cdc8d3d6b9e96794a1d033e6cb6eda3313884516f1
SHA51286e76b37c5b1980a2c786b96e7b08d827f91229a34e6f18c76db8cfdac812beae3345ce91e8d0c67a54936ab1461ee35414f73f74ce8e11d0d61abb8118c2da2
-
C:\Users\Admin\AppData\Roaming\Vintagestory\assets\survival\textures\block\wood\treetrunk\is-NCT1R.tmp
Filesize2KB
MD578d6a5a7557c6fe7a25e2452927f5a08
SHA123fed7d212495bccae3d3c46e5ec97bcc7d4d236
SHA256f3cb8fe35f477c434a8296968c3b27429aee684195f6338dd8a3417e9e9b8c74
SHA512fce18c2cbf4671b684268b0879bfde09de44a1e96580d10c70f09a999b6fb871dc182f52010542d7d0fa781dd8c21da6d2da95a8e0cf4a9af5420c9435ce5b40
-
Filesize
22KB
MD58c10fa137df44ecaadaf8144782c2d7f
SHA1e9fb8c1f3f9525f5a21b8c3e9e9c4ab7bec8cfe0
SHA25626545a48d3862a4130762b7aeb9e19858cff43efafd8a30f9dad1d9e3e280a4e
SHA51283ba7f02a8e0d6f957241361f430d556d0866ce5d4b3596f0eb9404362f126cba226fc57d65c76af23dc2f55a7822272d9bf762c2ca9dad3db48b92cad04ed73
-
C:\Users\Admin\AppData\Roaming\Vintagestory\assets\survival\textures\environment\seasons\fern\is-8ER3R.tmp
Filesize5KB
MD59c50859cf411a76bdb18ddf2434a81a2
SHA1eb5966b0f2f1b23a8ede01df834dba4d75a930a9
SHA2567e4ac5a981cb6600bd52815929f8fd53b94a8ea1594e47db4f3a17c8271d9f0d
SHA512c69e33628a26d2dabf3743bc9a61b70ea896067b5fda9785ffbd73ebb36a828726864c04b45d21699968872ea5c419346932ccc1b3d433dafd269d62d2bf6e0f
-
Filesize
244KB
MD516fd23e0653267acb01f07a3eb7cd0e4
SHA1a0046f19a44e5c6abe7d297f5a70dc13d93963fb
SHA256d376c553507dc60a177bdc1b53c634f730c5675db0a6cf16654d896b7fbb4d86
SHA5123dab2e6558264ad0e6edc10e5b3565a5270c96f23c7b862c864c4eb051e85dec8cf92afe70e6fe802d9ebb2c9cffd8f265ee05831a5ec2b2232d44a3d4f5c307
-
Filesize
4KB
MD59eb0320dfbf2bd541e6a55c01ddc9f20
SHA1eb282a66d29594346531b1ff886d455e1dcd6d99
SHA2569095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
SHA5129ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d
-
Filesize
744KB
MD550d398437b49d4c692c597c5507381a6
SHA17e89a4c2e169e13b598d0c418c2be92eff451462
SHA2566c443de369f8a18d7eb2626285c5007fdf0fcc16ad9db95fd09659ea86cb579b
SHA5127d2784b7babebf8fa141328a59c9d422c945f6cd2e0b0265fc8232406743bbcd6f29eaa10f9c457fbf8bc2758c3bc976c2da04db99f3f80c20794d7404113bfe
-
Filesize
808KB
MD5867efb44d1c9e41bf8271da4891b80e8
SHA159cdcafdda45accc48f661a2803a5f115efa9a72
SHA256bf7f3f331848a36a15886428266a0070003f974501658a89bd9ba9fe0583a756
SHA512de281c5331d3accd07f535853c4ff4b24448fb1d743a5b15620b35bd46115e2d01a11b645b4ffecf96f215d531451a90ab52065bea1fa6bcca3814b8b7aed18c
-
Filesize
25.9MB
MD53b09bf50efedc6b92b537ff4fcdaaca3
SHA154e05ef56842aa929e71489f4e816bbd16a25eac
SHA2560d56dca7685065fac30c56a8bac84e7e058af22cef3186cca051d524ae44a981
SHA5127e96f5ea56f4b10abe7daaf62f779bb507c840bbef748895a2f3893db7617bbe0d732c89b2e3ca41f77824ead41b6bc3466ba95f6651dcb47fc4cf63b2b13bd5
-
Filesize
28.6MB
MD5fd22d7fafd81e572e4900c31e4d26335
SHA1eb5f9cd03d2f0cfb7fc6182db6be3e20979c3a6a
SHA25659ce18dcfe91d4df494ff97f149c859236b5a9d470aeb8497b2bcfabe7fd0306
SHA51201703f082b6d830d6f4f80920a1ee48ad5d2fc45e992c32455a1a226cae995eac271968a0a0e5afd4237a1159a3d90e9a484852b378852caa9ac4926a206bcfd
-
Filesize
181KB
MD5300368025001fc695692bf8075f63dd4
SHA18280be910b0df995054c856af6486bcd99c756f8
SHA2560231da8a0a14ce528f1e1935953ce0094db46e98f6da8924ed9e607ea2e48b70
SHA512ddf0a3c2ef6fd69c17843591d0b0dc2a53b60741b4cb2bacc7c735bd2e2127ca79e0866d8bb93002fe2c57dc3f5a4db72741b1770829faae36a7fef46b28b006
-
Filesize
4.9MB
MD5e6e1cf4e5ab2bf6fae04fc23d6e4936c
SHA18628914c44e3d75d8f3a14d31039f083a27cb2dc
SHA256156f788281f8e74bcbcb1aa11289df637c4dfa4b4e8e037766b8af47462c36e5
SHA5120ffdb60b51c199cd9ca117942047c66245f8d44a167505dfd4571549d5fab9bbe0687f4c7c78851d4225315a21730fa1ddb213a5d08b827c002330f66057d970
-
Filesize
385KB
MD5bc868f56552a4619e3894d201f1795cc
SHA184521c1099b28de8a470728a4708ee2dadf0f403
SHA2560478b74cd29fc2950722a4665b60f3408e5a571a10da364eb975b1620570d745
SHA51271f3144f3188783e1d762f662805b85bac2ace6dc4b3b0d461c5b718baecc6c1a43e3d951435815e3b4d2b8185663a5ec27be3a6589db1e070a3cd75c9fcd8d5
-
Filesize
3.2MB
MD5e61945d6fc27561190dfa8f220ba86f3
SHA1a9d0645e82830a2a150cde87d73d83d4f67d75a8
SHA2566871dd1e729f60271936c92a1a1040176f0b133913c1d0d74492e4caa7d6d1ab
SHA51264e69efe1eb55548a8527d258e0b91c2671416227d9ca9acfa949978f16c6d5a478e782ccf4cc249a12efd0d065c8b0117db9450f5569232536ef232641fb23d
-
Filesize
142KB
MD55f6469960e0016d44be090160b889077
SHA1114b94c1401d039903e5e8b11cacbb737230365a
SHA256cb5714eb1f8b3938233823f465173c45ccef73e5b0ee122391853a3f2a305294
SHA512a3cacbab7a8a2b0a914b2eb6043f20e60761dbedfefa12fa5353d326370c087845a9eed2024675284449bbcbb8510da72b8832114f003dd2473b45357cf5c670
-
Filesize
225KB
MD5d711da8a6487aea301e05003f327879f
SHA1548d3779ed3ab7309328f174bfb18d7768d27747
SHA2563d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283
SHA512c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681
-
Filesize
610KB
MD541171a13c942bacb34fd73c40a590740
SHA1edc607a7937169bb2ac2641e3225f5498afacaa0
SHA25612a919d5269650efbca7ba4e918c1396e7453e4414bf1be9169e77f969f405a5
SHA512795e8c3db97ee89642b6c28e76f6c3a3c937712a998c0ef03433ec633daa802f6986225da11cbad2cee7faf88f9e85942fd097566ab1f228b1e14d8a95d5d8c9
-
Filesize
197KB
MD54356ee50f0b1a878e270614780ddf095
SHA1b5c0915f023b2e4ed3e122322abc40c4437909af
SHA25641a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104
SHA512b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691