da7753e918cd9724db7460f148f52c1ed9d82a26f0d52996db07e4a0265f6d95

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 07:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

382af56f07093801a0ebdc5dd3591c14_JaffaCakes118.exe
Size

16.6MB
MD5

382af56f07093801a0ebdc5dd3591c14
SHA1

2463e605cf9a141097dd55757a0924a7991d6cb2
SHA256

da7753e918cd9724db7460f148f52c1ed9d82a26f0d52996db07e4a0265f6d95
SHA512

d454863bb9ab6e568d0cea00c1c96756dc35d98a20bd6499f38572cb465d4cd1e29d9d24ce6d37f1cdd873e47b876985d4790e4a9628db961b056227ad064158
SSDEEP

393216:uJjS/1DWcbM4UUx/ldheoiv8S13gFtyLLsJ2rKXs49Lun:MjSNWcQ4zzzivj13gFwDKc49Lun

Score

8^/10

discovery evasion persistence privilege_escalation spyware stealer trojan

Malware Config

Signatures

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 1 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	msiexec.exe

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\UxTuneUp\Parameters\ServiceDll = "%SystemRoot%\\System32\\uxtuneup.dll"	regsvr32.exe

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000500000001a468-515.dat	acprotect
behavioral1/files/0x000500000001a4c6-537.dat	acprotect

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 9 IoCs

pid	Process
2392	TUInstallHelper.exe
1036	TUInstallHelper.exe
2140	TUInstallHelper.exe
1696	TUInstallHelper.exe
3036	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
1564	TuneUpSystemStatusCheck.exe
852	TuneUpUtilitiesApp64.exe
828	TuneUpSystemStatusCheck.exe

Loads dropped DLL 64 IoCs

pid	Process
2392	TUInstallHelper.exe
2392	TUInstallHelper.exe
2392	TUInstallHelper.exe
2392	TUInstallHelper.exe
2392	TUInstallHelper.exe
2392	TUInstallHelper.exe
2392	TUInstallHelper.exe
2392	TUInstallHelper.exe
2392	TUInstallHelper.exe
2392	TUInstallHelper.exe
2392	TUInstallHelper.exe
2392	TUInstallHelper.exe
2392	TUInstallHelper.exe
2392	TUInstallHelper.exe
2392	TUInstallHelper.exe
2392	TUInstallHelper.exe
2392	TUInstallHelper.exe
2392	TUInstallHelper.exe
2392	TUInstallHelper.exe
2392	TUInstallHelper.exe
2392	TUInstallHelper.exe
2392	TUInstallHelper.exe
2392	TUInstallHelper.exe
2392	TUInstallHelper.exe
2392	TUInstallHelper.exe
2392	TUInstallHelper.exe
2392	TUInstallHelper.exe
2392	TUInstallHelper.exe
2392	TUInstallHelper.exe
2392	TUInstallHelper.exe
2392	TUInstallHelper.exe
2392	TUInstallHelper.exe
2392	TUInstallHelper.exe
1036	TUInstallHelper.exe
1036	TUInstallHelper.exe
1036	TUInstallHelper.exe
1036	TUInstallHelper.exe
1036	TUInstallHelper.exe
1036	TUInstallHelper.exe
1036	TUInstallHelper.exe
1036	TUInstallHelper.exe
1036	TUInstallHelper.exe
1036	TUInstallHelper.exe
1036	TUInstallHelper.exe
1036	TUInstallHelper.exe
1036	TUInstallHelper.exe
1036	TUInstallHelper.exe
1036	TUInstallHelper.exe
1036	TUInstallHelper.exe
1036	TUInstallHelper.exe
1036	TUInstallHelper.exe
1036	TUInstallHelper.exe
1036	TUInstallHelper.exe
1036	TUInstallHelper.exe
1036	TUInstallHelper.exe
1036	TUInstallHelper.exe
1036	TUInstallHelper.exe
1036	TUInstallHelper.exe
1036	TUInstallHelper.exe
1036	TUInstallHelper.exe
1036	TUInstallHelper.exe
1036	TUInstallHelper.exe
1036	TUInstallHelper.exe
1036	TUInstallHelper.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	TuneUpSystemStatusCheck.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	TuneUpSystemStatusCheck.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	TuneUpSystemStatusCheck.exe
File opened (read-only)	\??\K:	TuneUpSystemStatusCheck.exe
File opened (read-only)	\??\P:	TuneUpSystemStatusCheck.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	TuneUpSystemStatusCheck.exe
File opened (read-only)	\??\G:	TuneUpSystemStatusCheck.exe
File opened (read-only)	\??\L:	TuneUpSystemStatusCheck.exe
File opened (read-only)	\??\X:	TuneUpSystemStatusCheck.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\J:	TuneUpSystemStatusCheck.exe
File opened (read-only)	\??\M:	TuneUpSystemStatusCheck.exe
File opened (read-only)	\??\O:	TuneUpSystemStatusCheck.exe
File opened (read-only)	\??\R:	TuneUpSystemStatusCheck.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	TuneUpSystemStatusCheck.exe
File opened (read-only)	\??\U:	TuneUpSystemStatusCheck.exe
File opened (read-only)	\??\V:	TuneUpSystemStatusCheck.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	TuneUpSystemStatusCheck.exe
File opened (read-only)	\??\Z:	TuneUpSystemStatusCheck.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\B:	TuneUpSystemStatusCheck.exe
File opened (read-only)	\??\S:	TuneUpSystemStatusCheck.exe
File opened (read-only)	\??\T:	TuneUpSystemStatusCheck.exe
File opened (read-only)	\??\W:	TuneUpSystemStatusCheck.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	TuneUpSystemStatusCheck.exe
File opened (read-only)	\??\N:	TuneUpSystemStatusCheck.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\uxtuneup.dll	regsvr32.exe
File created	C:\Windows\system32\TURegOpt.exe	TUInstallHelper.exe
File created	C:\Windows\SysWOW64\authuitu.dll	TUInstallHelper.exe
File opened for modification	C:\Windows\SysWOW64\authuitu.dll	TUInstallHelper.exe
File created	C:\Windows\System32\authuitu.dll	regsvr32.exe
File opened for modification	C:\Windows\System32\authuitu.dll	regsvr32.exe
File created	C:\Windows\SysWOW64\uxtuneup.dll	TUInstallHelper.exe
File created	C:\Windows\System32\uxtuneup.dll	regsvr32.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_RegistryEditor_16x16.png	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_WindowsFirewall_16x16.ico	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\VistaDefault.tbs	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\TuneUpUtilities.gadget\flyout.html	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_SysInfo_Unit1_ilimg5_16x16.png	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\integrator\arrow_reg.png	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\integrator\jquery.js	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\PerformanceOptimizer\CommandLink\command_link_selected_tm.png	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_Functions_16x16.png	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_LogOff_32x32.png	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_uninstallmanager_32x32.png	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_UserInfo_32x32.png	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\tfi_rc_di_you_decide.tico	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\ttt_system-control.png	TUInstallHelper.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\TuneUpUtilities.gadget\images\btn01_stat2_hov.png	TuneUpSystemStatusCheck.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_processmanagerdetails_4_16x16.png	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_Shield_W7_32x32.png	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_SysInfo_Unit1_ilDriveIcons_0_16x16.png	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\nav_b_c_tr.png	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_ActionCenter_32x32.png	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_autorumsettings_ilSmall_0_16x16.ico	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\PerformanceOptimizer\first_tab_hover_r.png	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_Settings_48x48.png	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\Framework\jquery.layerbutton.js	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\integrator\styles\style_firefox.png	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_SysInfo_Unit1_ilimg7_16x16.png	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_SysInfo_Unit1_ilInfoStates1_16x16.png	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_uac_48x48.png	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\ApplicationHeader\images\pixel.gif	TUInstallHelper.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\TuneUpUtilities.gadget\js\maintenance.js	TuneUpSystemStatusCheck.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_Exclamation_16x16.ico	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_LogonScreen_Create_16x16.png	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\Framework\jquery.js	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\Images.xml	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\TUData.dat	msiexec.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\btn_web_hot_br.png	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_Folder_Hidden_16x16.ico	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_SysInfo_Unit1_ilDriveIcons_7_16x16.png	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_SysInfo_Unit1_ilDriveIcons_9_16x16.png	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_ufrmSysOpt_ilIcons_2_16x16.ico	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_Critical_8x8.png	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\ApplicationHeader\bgTabInactiveMouseover.png	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\btn_win7header_def_bm.png	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_Desktop_16x16.png	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_DocShortcut_48x48.png	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_Taskbar_48x48.png	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\pgb_mbg_middle.png	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\StartUpManager\ico_alpha_GoArrow_16x16.png	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\UninstallManager\um_sidebar.js	TUInstallHelper.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\TuneUpUtilities.gadget\images\btn02_stat1_reg.png	TuneUpSystemStatusCheck.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\btn_light_def_bl.png	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_copyusersettings_il4_16x16.png	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_folderup_16x16.png	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_Hint_16x16.png	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_IE_16x16.png	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_snaptobutton_32x32.ico	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\integrator\ig_nc_buttons.png	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\btn_web_def_tr.png	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_HiddenDrive_32x32.png	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\integrator\switch-bg.gif	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\TuneUpUtilities.gadget\images\turbo_off_hover.png	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_Search_16x16.ico	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\UninstallManager\nav_bg_light.gif	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\integrator\buy-btn-right.gif	TUInstallHelper.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\f76841e.msi	msiexec.exe
File created	C:\Windows\Installer\f768423.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f768424.msi	msiexec.exe
File created	C:\Windows\Installer\f768427.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIACB6.tmp	msiexec.exe
File created	C:\Windows\Installer\f76841e.msi	msiexec.exe
File created	C:\Windows\Installer\f768421.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI86AD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f768421.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File created	C:\Windows\Installer\f768429.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\f768427.ipi	msiexec.exe
File opened for modification	C:\Windows\WindowsUpdate.log	TuneUpSystemStatusCheck.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\f768424.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	TuneUpSystemStatusCheck.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	TuneUpSystemStatusCheck.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	TuneUpSystemStatusCheck.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	TuneUpSystemStatusCheck.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	TuneUpSystemStatusCheck.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	TuneUpSystemStatusCheck.exe

Modifies data under HKEY_USERS 46 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TUAnalyzeInfo.TUAnalyzeResult\CLSID\ = "{FD8DB406-E813-4FF5-BEB0-6C6DC373B985}"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{64A3D41B-61A5-4834-9A42-FDE1C37B0007}\Flags = e8858f6600000000d2eec469c09e950774a7bcfb5203d4841000000000000000	TUInstallHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FCA02D56-BF9D-4591-AD41-E59AF763C64A}\Programmable	TuneUpUtilitiesService64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B04FEA5-A0E4-4233-A64B-9D34ACD508AC}	TuneUpUtilitiesService64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7D3CC621-0A71-4E03-9692-FF55946615BD}\ProxyStubClsid32	TuneUpUtilitiesService64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E7411C82-3791-429B-9412-7B0DA6C61194}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	TuneUpUtilitiesService64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TuneUp.Icon.Package	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00711705-12C5-420B-A4E5-6413F2AB3C7B}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2509ABBC-871E-42e5-A27B-F7DA394B1897}\ProgID	TuneUpUtilitiesService64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3D61672B-0DE5-46B9-BE0D-2E03FA9AD49C}\1.0\HELPDIR	TuneUpUtilitiesService64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCD3E0E5-9B0F-484E-BC6B-DC7C04B941B0}\TypeLib\Version = "1.0"	TuneUpUtilitiesService64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E7E5CFE9-2992-4D97-B877-DADC873D5573}\TypeLib\Version = "1.0"	TuneUpUtilitiesService64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TuneUp.Visual.Style	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TuneUp.Visual.Style\Shell\Open\Command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7986d495-ce42-4926-8afc-26dfa299cadb}\InProcServer32\{00711705-12C5-420B-A4E5-6413F2AB3C7B} = "authui.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\TuneUp Shredder Shell Extension	TUInstallHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD8DB406-E813-4FF5-BEB0-6C6DC373B985}\ProgID	TUInstallHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AC19D772-B03B-4246-A308-389836870B7C}\TypeLib	TuneUpUtilitiesService64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B37CB854-05E8-4B5D-B29D-A43404CF2593}	TuneUpUtilitiesService64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TuneUp.Logon.Screen\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\TuneUp Utilities 2010\\WinStyler.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\TuneUp Disk Space Explorer Shell Extension	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AC19D772-B03B-4246-A308-389836870B7C}\ = "ITUUSvcProcessInformation"	TuneUpUtilitiesService64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BB9F9A35-3649-4064-9101-90DA2E4285D8}\ = "ITUUSysTrayNotifications"	TuneUpUtilitiesService64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{215E32EF-C967-470A-AC60-B34F58CB957D}\TypeLib\ = "{3D61672B-0DE5-46B9-BE0D-2E03FA9AD49C}"	TuneUpUtilitiesService64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\TuneUp.Icon.Package\EditFlags = "65536"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tls\ = "TuneUp.Logon.Screen"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{91E9CFE3-5ABE-4308-9C68-416F436AA3A3}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	TuneUpUtilitiesService64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{73328DDE-7B66-4117-A7FB-8B3A37D9C239}\TypeLib\ = "{3D61672B-0DE5-46B9-BE0D-2E03FA9AD49C}"	TuneUpUtilitiesService64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7986d495-ce42-4926-8afc-26dfa299cadb}\InProcServer32\ = "authui.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{215E32EF-C967-470A-AC60-B34F58CB957D}\TypeLib	TuneUpUtilitiesService64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\28F2473DA1C1CCD4BADBE0C7C31058CC	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD8DB406-E813-4FF5-BEB0-6C6DC373B985}\ = "TUAnalyzeResult Class"	TUInstallHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2175E935-D63F-488A-ACEC-6FAA64232D59}\1.0\FLAGS	TUInstallHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7B04FEA5-A0E4-4233-A64B-9D34ACD508AC}\ProxyStubClsid32	TuneUpUtilitiesService64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7D3CC621-0A71-4E03-9692-FF55946615BD}\ProxyStubClsid32	TuneUpUtilitiesService64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{57D31357-1FC7-43D2-AB3C-530241E59388}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	TuneUpUtilitiesService64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\28F2473DA1C1CCD4BADBE0C7C31058CC\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TUAnalyzeInfo.TUAnalyzeResult\CLSID\ = "{FD8DB406-E813-4FF5-BEB0-6C6DC373B985}"	TUInstallHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\TUUtilitiesService.EXE	TuneUpUtilitiesService64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2509ABBC-871E-42e5-A27B-F7DA394B1897}\ProgID\ = "TuneUp.UtilitiesSvcTools.1"	TuneUpUtilitiesService64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{80776CF4-3378-4584-856B-CACC6E23D08F}\ = "ITUUSvcSettings"	TuneUpUtilitiesService64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TUAnalyzeInfo.TUAnalyzeResult\ = "TUAnalyzeResult Class"	TUInstallHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TUAnalyzeInfo.TUAnalyzeResult.1\CLSID\ = "{FD8DB406-E813-4FF5-BEB0-6C6DC373B985}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AC19D772-B03B-4246-A308-389836870B7C}\ProxyStubClsid32	TuneUpUtilitiesService64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6F40C842-72A6-48CB-8961-98F13873A60D}\ = "IWndMonitorCallback"	TuneUpUtilitiesService64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{80776CF4-3378-4584-856B-CACC6E23D08F}\TypeLib\ = "{3D61672B-0DE5-46B9-BE0D-2E03FA9AD49C}"	TuneUpUtilitiesService64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{691BA5CB-E2E7-4690-BDA1-81DEE8B1F101}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	TuneUpUtilitiesService64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E7411C82-3791-429B-9412-7B0DA6C61194}\TypeLib\ = "{3D61672B-0DE5-46B9-BE0D-2E03FA9AD49C}"	TuneUpUtilitiesService64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\28F2473DA1C1CCD4BADBE0C7C31058CC\SourceList\Net\1 = "C:\\Windows\\TEMP\\TU\\orig\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex\ContextMenuHandlers\TuneUp Shredder Shell Extension\ = "{4858E7D9-8E12-45a3-B6A3-1CD128C9D403}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TuneUp.UtilitiesSvcTools.1\CLSID\ = "{2509ABBC-871E-42e5-A27B-F7DA394B1897}"	TuneUpUtilitiesService64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FCD3E0E5-9B0F-484E-BC6B-DC7C04B941B0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	TuneUpUtilitiesService64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6F40C842-72A6-48CB-8961-98F13873A60D}\TypeLib	TuneUpUtilitiesService64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{57D31357-1FC7-43D2-AB3C-530241E59388}\TypeLib\Version = "1.0"	TuneUpUtilitiesService64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{91E9CFE3-5ABE-4308-9C68-416F436AA3A3}\ProxyStubClsid32	TuneUpUtilitiesService64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{02CF188C-BC73-4B78-B945-E3933449A406}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	TuneUpUtilitiesService64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E7F8549F-814B-417D-ADC6-C2AFD6ADF1BB}\TypeLib	TuneUpUtilitiesService64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{215E32EF-C967-470A-AC60-B34F58CB957D}\TypeLib\Version = "1.0"	TuneUpUtilitiesService64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E7F8549F-814B-417D-ADC6-C2AFD6ADF1BB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	TuneUpUtilitiesService64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{215E32EF-C967-470A-AC60-B34F58CB957D}	TuneUpUtilitiesService64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TuneUp.Icon.Package\Shell\Open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00711705-12C5-420B-A4E5-6413F2AB3C7B}\Parameters	regsvr32.exe

Runs .reg file with regedit 1 IoCs

pid	Process
2712	regedit.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1796	msiexec.exe
1796	msiexec.exe
1796	msiexec.exe
1796	msiexec.exe
1564	TuneUpSystemStatusCheck.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe
2020	TuneUpUtilitiesService64.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
472	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1968	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1968	msiexec.exe
Token: SeRestorePrivilege	1796	msiexec.exe
Token: SeTakeOwnershipPrivilege	1796	msiexec.exe
Token: SeSecurityPrivilege	1796	msiexec.exe
Token: SeCreateTokenPrivilege	1968	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1968	msiexec.exe
Token: SeLockMemoryPrivilege	1968	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1968	msiexec.exe
Token: SeMachineAccountPrivilege	1968	msiexec.exe
Token: SeTcbPrivilege	1968	msiexec.exe
Token: SeSecurityPrivilege	1968	msiexec.exe
Token: SeTakeOwnershipPrivilege	1968	msiexec.exe
Token: SeLoadDriverPrivilege	1968	msiexec.exe
Token: SeSystemProfilePrivilege	1968	msiexec.exe
Token: SeSystemtimePrivilege	1968	msiexec.exe
Token: SeProfSingleProcessPrivilege	1968	msiexec.exe
Token: SeIncBasePriorityPrivilege	1968	msiexec.exe
Token: SeCreatePagefilePrivilege	1968	msiexec.exe
Token: SeCreatePermanentPrivilege	1968	msiexec.exe
Token: SeBackupPrivilege	1968	msiexec.exe
Token: SeRestorePrivilege	1968	msiexec.exe
Token: SeShutdownPrivilege	1968	msiexec.exe
Token: SeDebugPrivilege	1968	msiexec.exe
Token: SeAuditPrivilege	1968	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1968	msiexec.exe
Token: SeChangeNotifyPrivilege	1968	msiexec.exe
Token: SeRemoteShutdownPrivilege	1968	msiexec.exe
Token: SeUndockPrivilege	1968	msiexec.exe
Token: SeSyncAgentPrivilege	1968	msiexec.exe
Token: SeEnableDelegationPrivilege	1968	msiexec.exe
Token: SeManageVolumePrivilege	1968	msiexec.exe
Token: SeImpersonatePrivilege	1968	msiexec.exe
Token: SeCreateGlobalPrivilege	1968	msiexec.exe
Token: SeRestorePrivilege	1796	msiexec.exe
Token: SeTakeOwnershipPrivilege	1796	msiexec.exe
Token: SeRestorePrivilege	1796	msiexec.exe
Token: SeTakeOwnershipPrivilege	1796	msiexec.exe
Token: SeRestorePrivilege	1796	msiexec.exe
Token: SeTakeOwnershipPrivilege	1796	msiexec.exe
Token: SeRestorePrivilege	1796	msiexec.exe
Token: SeTakeOwnershipPrivilege	1796	msiexec.exe
Token: SeRestorePrivilege	1796	msiexec.exe
Token: SeTakeOwnershipPrivilege	1796	msiexec.exe
Token: SeRestorePrivilege	1796	msiexec.exe
Token: SeTakeOwnershipPrivilege	1796	msiexec.exe
Token: SeRestorePrivilege	1796	msiexec.exe
Token: SeTakeOwnershipPrivilege	1796	msiexec.exe
Token: SeRestorePrivilege	1796	msiexec.exe
Token: SeTakeOwnershipPrivilege	1796	msiexec.exe
Token: SeRestorePrivilege	1796	msiexec.exe
Token: SeTakeOwnershipPrivilege	1796	msiexec.exe
Token: SeRestorePrivilege	1796	msiexec.exe
Token: SeTakeOwnershipPrivilege	1796	msiexec.exe
Token: SeRestorePrivilege	1796	msiexec.exe
Token: SeTakeOwnershipPrivilege	1796	msiexec.exe
Token: SeRestorePrivilege	1796	msiexec.exe
Token: SeTakeOwnershipPrivilege	1796	msiexec.exe
Token: SeRestorePrivilege	1796	msiexec.exe
Token: SeTakeOwnershipPrivilege	1796	msiexec.exe
Token: SeRestorePrivilege	1796	msiexec.exe
Token: SeTakeOwnershipPrivilege	1796	msiexec.exe
Token: SeRestorePrivilege	1796	msiexec.exe
Token: SeTakeOwnershipPrivilege	1796	msiexec.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
3012	msiexec.exe
3012	msiexec.exe
2020	TuneUpUtilitiesService64.exe
852	TuneUpUtilitiesApp64.exe
852	TuneUpUtilitiesApp64.exe
852	TuneUpUtilitiesApp64.exe
852	TuneUpUtilitiesApp64.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
852	TuneUpUtilitiesApp64.exe
852	TuneUpUtilitiesApp64.exe
852	TuneUpUtilitiesApp64.exe
852	TuneUpUtilitiesApp64.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 2744	2352	382af56f07093801a0ebdc5dd3591c14_JaffaCakes118.exe	30
PID 2352 wrote to memory of 2744	2352	382af56f07093801a0ebdc5dd3591c14_JaffaCakes118.exe	30
PID 2352 wrote to memory of 2744	2352	382af56f07093801a0ebdc5dd3591c14_JaffaCakes118.exe	30
PID 2352 wrote to memory of 2744	2352	382af56f07093801a0ebdc5dd3591c14_JaffaCakes118.exe	30
PID 2352 wrote to memory of 2744	2352	382af56f07093801a0ebdc5dd3591c14_JaffaCakes118.exe	30
PID 2352 wrote to memory of 2744	2352	382af56f07093801a0ebdc5dd3591c14_JaffaCakes118.exe	30
PID 2352 wrote to memory of 2744	2352	382af56f07093801a0ebdc5dd3591c14_JaffaCakes118.exe	30
PID 2744 wrote to memory of 2604	2744	cmd.exe	32
PID 2744 wrote to memory of 2604	2744	cmd.exe	32
PID 2744 wrote to memory of 2604	2744	cmd.exe	32
PID 2744 wrote to memory of 2604	2744	cmd.exe	32
PID 2744 wrote to memory of 1968	2744	cmd.exe	33
PID 2744 wrote to memory of 1968	2744	cmd.exe	33
PID 2744 wrote to memory of 1968	2744	cmd.exe	33
PID 2744 wrote to memory of 1968	2744	cmd.exe	33
PID 2744 wrote to memory of 1968	2744	cmd.exe	33
PID 2744 wrote to memory of 1968	2744	cmd.exe	33
PID 2744 wrote to memory of 1968	2744	cmd.exe	33
PID 2744 wrote to memory of 3012	2744	cmd.exe	35
PID 2744 wrote to memory of 3012	2744	cmd.exe	35
PID 2744 wrote to memory of 3012	2744	cmd.exe	35
PID 2744 wrote to memory of 3012	2744	cmd.exe	35
PID 2744 wrote to memory of 3012	2744	cmd.exe	35
PID 2744 wrote to memory of 3012	2744	cmd.exe	35
PID 2744 wrote to memory of 3012	2744	cmd.exe	35
PID 1796 wrote to memory of 2392	1796	msiexec.exe	39
PID 1796 wrote to memory of 2392	1796	msiexec.exe	39
PID 1796 wrote to memory of 2392	1796	msiexec.exe	39
PID 1796 wrote to memory of 2392	1796	msiexec.exe	39
PID 1796 wrote to memory of 2392	1796	msiexec.exe	39
PID 1796 wrote to memory of 2392	1796	msiexec.exe	39
PID 1796 wrote to memory of 2392	1796	msiexec.exe	39
PID 1796 wrote to memory of 1036	1796	msiexec.exe	41
PID 1796 wrote to memory of 1036	1796	msiexec.exe	41
PID 1796 wrote to memory of 1036	1796	msiexec.exe	41
PID 1796 wrote to memory of 1036	1796	msiexec.exe	41
PID 1796 wrote to memory of 1036	1796	msiexec.exe	41
PID 1796 wrote to memory of 1036	1796	msiexec.exe	41
PID 1796 wrote to memory of 1036	1796	msiexec.exe	41
PID 1796 wrote to memory of 2140	1796	msiexec.exe	42
PID 1796 wrote to memory of 2140	1796	msiexec.exe	42
PID 1796 wrote to memory of 2140	1796	msiexec.exe	42
PID 1796 wrote to memory of 2140	1796	msiexec.exe	42
PID 1796 wrote to memory of 2140	1796	msiexec.exe	42
PID 1796 wrote to memory of 2140	1796	msiexec.exe	42
PID 1796 wrote to memory of 2140	1796	msiexec.exe	42
PID 1796 wrote to memory of 1696	1796	msiexec.exe	43
PID 1796 wrote to memory of 1696	1796	msiexec.exe	43
PID 1796 wrote to memory of 1696	1796	msiexec.exe	43
PID 1796 wrote to memory of 1696	1796	msiexec.exe	43
PID 1796 wrote to memory of 1696	1796	msiexec.exe	43
PID 1796 wrote to memory of 1696	1796	msiexec.exe	43
PID 1796 wrote to memory of 1696	1796	msiexec.exe	43
PID 1696 wrote to memory of 2436	1696	TUInstallHelper.exe	44
PID 1696 wrote to memory of 2436	1696	TUInstallHelper.exe	44
PID 1696 wrote to memory of 2436	1696	TUInstallHelper.exe	44
PID 1696 wrote to memory of 2436	1696	TUInstallHelper.exe	44
PID 1696 wrote to memory of 2436	1696	TUInstallHelper.exe	44
PID 1696 wrote to memory of 2436	1696	TUInstallHelper.exe	44
PID 1696 wrote to memory of 2436	1696	TUInstallHelper.exe	44
PID 1696 wrote to memory of 1860	1696	TUInstallHelper.exe	45
PID 1696 wrote to memory of 1860	1696	TUInstallHelper.exe	45
PID 1696 wrote to memory of 1860	1696	TUInstallHelper.exe	45
PID 1696 wrote to memory of 1860	1696	TUInstallHelper.exe	45

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\382af56f07093801a0ebdc5dd3591c14_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\382af56f07093801a0ebdc5dd3591c14_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Windows\Temp\TU\setup_ru.cmd" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\TuneUp\Utilities\9.0" /f /v "ProductKey" /t REG_SZ /d "X2A702-YAEJNF-XV76MV-EN3TBY-K22E15-86NEX1"
    3⤵
    PID:2604
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Windows\TEMP\TU\ru-RUv\lng.msi" /qn
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1968
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Windows\TEMP\TU\orig\setup.msi" /qb-
    3⤵
    - Suspicious use of FindShellTrayWindow
    PID:3012
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\TuneUp\Utilities\9.0" /f /v "UILanguage" /t REG_SZ /d "en-US"
    3⤵
    PID:1652
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\TuneUp\Utilities\9.0" /f /v "RemindAgainAfter" /t REG_BINARY /d 000000009c851841
    3⤵
    PID:1728
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\TuneUp\Utilities\9.0" /f /v "LaunchedUpdateWizard" /t REG_DWORD /d 0
    3⤵
    PID:1696
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c If Exist "C:\Users\Admin\AppData\Local\Temp\settings.reg" (REGEDIT /S "C:\Users\Admin\AppData\Local\Temp\settings.reg") Else (REGEDIT /S settings.reg)
  2⤵
  PID:2716
- - C:\Windows\SysWOW64\regedit.exe
    REGEDIT /S settings.reg
    3⤵
    - Runs .reg file with regedit
    PID:2712

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Program Files (x86)\TuneUp Utilities 2010\TUInstallHelper.exe
  "C:\Program Files (x86)\TuneUp Utilities 2010\TUInstallHelper.exe" --setup-extractData
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  PID:2392
- C:\Program Files (x86)\TuneUp Utilities 2010\TUInstallHelper.exe
  "C:\Program Files (x86)\TuneUp Utilities 2010\TUInstallHelper.exe" --setup-createShortcuts -IntegratorShortcut 1 -OCMShortcut 1 -AllUsers 1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1036
- C:\Program Files (x86)\TuneUp Utilities 2010\TUInstallHelper.exe
  "C:\Program Files (x86)\TuneUp Utilities 2010\TUInstallHelper.exe" --regwrite-serial
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Program Files (x86)\TuneUp Utilities 2010\TUInstallHelper.exe
  "C:\Program Files (x86)\TuneUp Utilities 2010\TUInstallHelper.exe" --setup-install -TrialPeriod 15 -GracePeriod 3
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Windows\system32\regsvr32.exe
    regsvr32.exe /s "C:\Program Files (x86)\TuneUp Utilities 2010\authuitu-x64.dll"
    3⤵
    - Drops file in System32 directory
    - Modifies registry class
    PID:2436
- - C:\Windows\system32\regsvr32.exe
    regsvr32.exe /s "C:\Program Files (x86)\TuneUp Utilities 2010\uxtuneup-x64.dll"
    3⤵
    - Server Software Component: Terminal Services DLL
    - Drops file in System32 directory
    PID:1860
- - C:\Windows\system32\regsvr32.exe
    regsvr32.exe /s "C:\Program Files (x86)\TuneUp Utilities 2010\SDShelEx-x64.dll"
    3⤵
    - Modifies registry class
    PID:348
- - C:\Windows\system32\regsvr32.exe
    regsvr32.exe /s "C:\Program Files (x86)\TuneUp Utilities 2010\DseShExt-x64.dll"
    3⤵
    - Modifies registry class
    PID:2328
- - C:\Windows\system32\regsvr32.exe
    regsvr32.exe /s "C:\Program Files (x86)\TuneUp Utilities 2010\TUAnalyzeInfo64.dll"
    3⤵
    - Modifies registry class
    PID:2408
- C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe
  "C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe" /Service /Start
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:3036
- C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpSystemStatusCheck.exe
  "C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpSystemStatusCheck.exe" /StartGadget /AllUsers 1 /Activate
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:1564

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:480

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "000000000000056C" "00000000000005DC"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2560

C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe
"C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:2020
- C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesApp64.exe
  "C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesApp64.exe" /TUStart /pid:2020
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:852
- C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpSystemStatusCheck.exe
  "C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpSystemStatusCheck.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Enumerates connected drives
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  PID:828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f768422.rbs

Filesize
12KB

MD5
c57be4223aeb60db61f3c554fce886b3

SHA1
bfaed1ce6624cfcbfc297833fe609c503e418a60

SHA256
38a41dcff83eca4ed483515c5ddbb9eb9a48c82296d6b43113647daf3a235286

SHA512
e5f6347d0f0b1bcc2bef4367c66160b126c236f4554d372489f539af538f25c4b92ab92dc211982f5435b85282b97671586af7ca9663f7cb7934da8ca4062c42

Download Submit
C:\Config.Msi\f768428.rbs

Filesize
38KB

MD5
26200e28dba08d30d1e84fe4cda4c58d

SHA1
d04eb89c11e6d38fca35240cfbd3b4ce3a3bb88e

SHA256
3586508050b662fd43e9cf3a8af91011f83a4ea0c0d5e50b3d5bbc175044b120

SHA512
eda04d393e83e907ff3b1494a34724193145ded36cba5a4bd102a294cbf0239b98ed54f8a7a30c34091e0a4d80aa76aaf1d66f87e41ec17597c7c235c40d597c

Download Submit
C:\Program Files (x86)\TuneUp Utilities 2010\TUInstallHelper.exe

Filesize
94KB

MD5
253893db9b72dbcfce1b8d97c56ad8b3

SHA1
482e7fd3034a6d90ca290987b021e2fe43f92b9f

SHA256
3ba6ff5e4b2e2015fa248c68d8d043ab5176d1f844be8e011e0c631ed7d191ed

SHA512
f67d877468504d0fe403a3b3bd8c4111137ed3aa2784a356751defa05f3b2aa51a83e87eba6dd6c7a486283d4fc221343f856fd3cb2f6c4afe38268348fa54ac

Download Submit
C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpSystemStatusCheck.exe

Filesize
220KB

MD5
29065c98b1542412861cf12584122dc0

SHA1
ce40ca7903a0997a4536363c224bbd6467b74fc8

SHA256
197e1e6c025cdb72b106bcebc0d9f90c1c1ebadca9416e41f75bf1e676e330ab

SHA512
d6ba86b538577f0691a624158d967c01050fea7ea590ebc33c9ef238dde05db7a4032e7776fd64b70890744f1e04b84d5500595e22d78074fb11efb02caa55f9

Download Submit
C:\Program Files (x86)\TuneUp Utilities 2010\data\PerformanceOptimizer\Ico_alpha_Effects_16x16.png

Filesize
742B

MD5
d3b4203a4f857df115b441d62b918c88

SHA1
8be56e648d1391935535a32083483daa81dd2483

SHA256
ae5c43fe36af666e633eca4c00796d59cf8e876a31d4c05eabfad90096f7c101

SHA512
5eb776536d5a1bad6b34cc5c99458c24143b44bef24001bbb3b52c79dba79d31033f7ecbe689712c6a83daa1ae9467772810bc0b7778a59bcc51c4ecb4b4419f

Download Submit
C:\Program Files (x86)\TuneUp Utilities 2010\data\PerformanceOptimizer\command_link_hover.png

Filesize
722B

MD5
7af65707e275d0e50d86499f6a06fc70

SHA1
d2f85fe842c83c737e926432c17ffdb0a51ed416

SHA256
768a976b15d29738ff54bfb3a781791740485c39016725d2214cd63128e9df9b

SHA512
944919998e321ecddbbe5a1fc4c24f37c73aa02509da897acf99a153473bd90e9010e233b1b8a1d78f7fac9992a772f500c8e01a29bd316515921702a2752a6b

Download Submit
C:\Program Files (x86)\TuneUp Utilities 2010\data\PerformanceOptimizer\command_link_normal.png

Filesize
722B

MD5
1c55d16533f6c803f31e591f23b75793

SHA1
4ef111d0726e12c785c8a6b7c738cf73b4c3887c

SHA256
0a7ca1f44bf498ad298af212094136331d1cf4461d46aaf38ba3fdab58568fea

SHA512
546333b7761e1c15eff2e1c82411c72e60f60a9736379071f1e10ef073377f2965edcf7507dec856a77688bbcb20a11ba626856306ccfc7ee1ed854a177fa3b7

Download Submit
C:\Program Files (x86)\TuneUp Utilities 2010\data\TuneUpUtilities.gadget\images\blank.gif

Filesize
43B

MD5
325472601571f31e1bf00674c368d335

SHA1
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a

SHA256
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

SHA512
717ea0ff7f3f624c268eccb244e24ec1305ab21557abb3d6f1a7e183ff68a2d28f13d1d2af926c9ef6d1fb16dd8cbe34cd98cacf79091dddc7874dcee21ecfdc

Download Submit
C:\Program Files (x86)\TuneUp Utilities 2010\data\TuneUpUtilities.gadget\js\jquery.js

Filesize
127KB

MD5
d098a8b737ef54dbf44053d6ab4b3397

SHA1
ef4458c1ae31e730fdbc55bf65e5a5934c48bf2a

SHA256
0352f0bc70e556c9a91780281c496d8c67e662352994f838b734bbc8f176c7c1

SHA512
272776247da67ab0342bc3e855361a930d964e4c894ae9de36e43af4cb7313efa1fe04d99dd7a2928a7889d95c7969afe1b29354d99ab024ff9dda49a9f1c984

Download Submit
C:\Program Files (x86)\TuneUp Utilities 2010\data\UninstallManager\ico_alpha_Info_16x16.png

Filesize
636B

MD5
77b6b258ef82300655c993d71a8fcef8

SHA1
42d32eae292ca3475a887411cac038927856c176

SHA256
348fdac69629adbd736bdaf4d4ee04f196636178c91f6cd612fb6e6c09393ba3

SHA512
94daf41bad6553e9aa031fd5ed018625d62bab5fcc5b27d40a8f5533f276f187ae98767634a320d6096f4bef08789fdb223b9fb0bc535b813db4ff96c3cc055a

Download Submit
C:\Program Files (x86)\TuneUp Utilities 2010\data\UninstallManager\nav_bg_light.gif

Filesize
29KB

MD5
a39323dc5aebe5698862532f6a0b78fe

SHA1
5ba724f9903ae79ccd2ea4b3affc1c9d868ffbf4

SHA256
83dfb81aad84d3e8336895f741032618aaccc25f89fa4e45a535bb4620b036a9

SHA512
cd758e58662ab2218ad84039672577c8d1eeb2681271e63ad920980987f8077a9f3e499143e00dffe61d8f1563ca10261a3bb443656c2f45ee4b71b496175213

Download Submit
C:\Program Files (x86)\TuneUp Utilities 2010\data\btn_win7header_def_tl.png

Filesize
117B

MD5
cdbc03b2d2772d453167e6d0a100d3aa

SHA1
00a2245fe0b460b9680ed1cd3308e19293764cad

SHA256
b21f17716cdb5543c0783116509dc8c0543d794830fda541e256cce365a8e815

SHA512
b313a4b49fc56ad698492e78215e506cf4343db4e4923c7295606a395a97723e99600a39cf39df3af6f5f8f779bf3dbdd7525ac818eef554afcbe8b8eb42b7c7

Download Submit
C:\Program Files (x86)\TuneUp Utilities 2010\data\btn_win7header_dis_bm.png

Filesize
115B

MD5
1aefcb685ec7f472775b8828a3ac9f59

SHA1
3f33824f7e387077a40910f1f6126fd32ae8b599

SHA256
4d2975dc53dbc056890d2ec98a9904a05b973645e2685fcca945c9160b8e05c6

SHA512
308bc1773e0bdf34656d118d38cbce0ba6e886c6e4ed7efd96c7148f9b068d9bb2e94617db566f455dab26a376de5a4869b5bfc4d51e467b10523bea4d05ef74

Download Submit
C:\Program Files (x86)\TuneUp Utilities 2010\data\btn_win7header_dis_ml.png

Filesize
119B

MD5
f3ac032bad004c31ec20b87e28a942af

SHA1
fbd0415e14f8256ec2befb78b10c111144e98949

SHA256
6cbc7f01f841918d54c38edfac2183510a0c04d0ddc830abec77d45bd6627dcc

SHA512
019e35ce5427069b5879463e3f3936a3e7f0080947ac9e0fda9bd40b4b263a31eed4a2528d63730a97515d945d6adc2fcff261ad0cb59917496b94039c894ab2

Download Submit
C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_QOS_32x32.png

Filesize
1KB

MD5
6563ea1956040cffe40580ecb78f5734

SHA1
fa1331b5e523781d0207819366a74b8fadbd8466

SHA256
3550f9c49de89f210878d6d634f76d8a2a6b9ea6a1ab6b8511d1ec94fc43b860

SHA512
f684508e403e7f3999dc7c1832a029b5de9f990179b4cd962ce8b8b4c73fc67bd88233661d53febfd3882ccc5591e685caa39ada688407760d58434c1d8d4060

Download Submit
C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_WindowsUpdate_W7_32x32.png

Filesize
2KB

MD5
ea05ba9f693e3897ed5d3e39daf67a7c

SHA1
263a75cc5ac0389afa3e9e4196ce8599706787fb

SHA256
a3e18aff9c8762e26a32f40542117e4b9dcac035b1704fe70bb5f3e38c6e6a3a

SHA512
ffb9baf6831039fabbf83ead666a54f3eee1c8d9b623324ca4c173289374f9ddbfe96046a9f04b02652ba07ee05268559e261c0a00a630a376378ada7581a10e

Download Submit
C:\Program Files (x86)\TuneUp Utilities 2010\data\integrator\DiskSpace.png

Filesize
1KB

MD5
181337f74710ba98996e645001e4e902

SHA1
380a30f0d0939f29af257fe18aea56ac2042c189

SHA256
7ba0d5c2b53ab78568970296dcf4a003bf8c68ca04f88a65739140dcd6b9e4cd

SHA512
e40fe29b945099565de9d4fdce8d4992fe9ea32ef7d8920eab494c8de7d8afcdbc3863cbe75b4fcb3f0d07bb858d4c904aa2762cc9854d5124f99b7ce815dc35

Download Submit
C:\Program Files (x86)\TuneUp Utilities 2010\data\integrator\HighPerformanceMode.png

Filesize
1KB

MD5
56a41906cc41b5c81d7ae2ab9c62ec44

SHA1
6dac54ead07ef39ed368c0cb95a6f3a5252a37be

SHA256
9cb9ad4881a06d268389ebfc878c620d926951075497a4e5360ca01d58aa59a1

SHA512
b1d6645ada2639118274e340cacce743cdb8edf37b6f0daab5f36fd0386b8d8b6c3f492953966d667473e20c3af70ed0aa153a4a5ed1ce9f8023f483b97d0947

Download Submit
C:\Program Files (x86)\TuneUp Utilities 2010\data\integrator\RegistryCleaner.png

Filesize
2KB

MD5
865ae348fe3e6592fff6b426fde6f1f0

SHA1
d2e4a66ac1a95742e4eaff4781d9602445eacf67

SHA256
a3245631e50b5fab7ea9023483f90546f137b203b1033f8980ab878accb71898

SHA512
75f627f4d403d84d6ec959ae288dac4d7c8084d8ab52a64936fdc67bc8dbd0e1a76d7aab3a7b5b77c6b363af10d22dd4759cc5bbc7cc50ab2b5221f5257780df

Download Submit
C:\Program Files (x86)\TuneUp Utilities 2010\data\integrator\Schnelloptimierung.png

Filesize
2KB

MD5
78c6ce6ee7e9e02f717f5db4f94c3657

SHA1
289f52deec526d8958c077a74be25ede22a43edf

SHA256
8542e0794abb9e9934fa267ebf39787b6a14f17fa27a80900d72c823602d7fa9

SHA512
3d8ad0f5cc4653be2a2b5d0eb1afa289fbac7d671b021a442e07ecf9b945bcf7c207beddaa76304f90ee192f091791da501d65a3adbdc1b5005745018bb5bf0c

Download Submit
C:\Program Files (x86)\TuneUp Utilities 2010\data\integrator\ShortcutCleaner.png

Filesize
1KB

MD5
8986b4bcdf619d4ad2398bd910a391c5

SHA1
cce87ec17ab9ac3ffc442080e124f503b50c313d

SHA256
ae1081485ae29db55848c9f1b84ca14983d8035739c21985433f4c86e2e8666c

SHA512
680e36f2376edbb86e0eee3e49d09a02dfaa340bb7062e9ae2faf5d41341066c90471cba609c58d42782e164c8fca832c25e3eb12a9c95d7c071dc9adfdca4af

Download Submit
C:\Program Files (x86)\TuneUp Utilities 2010\data\integrator\StartUpManager.png

Filesize
1KB

MD5
9fa8a731084f5f7eb7835c30fab48920

SHA1
9ac2a0322ead8bb5d9fc368f90bba7cb511028bf

SHA256
389c782fbc0bc4472772316f6c953edc080dd484ad73a517e9b69143ed1e3fc7

SHA512
131c327e642261aab9f1292943c4b7148269e7483ac3aa0e0baf7e6de66dca8fc5a670eac6eed50c92d5c2a022678d96cafe3ebf2d31b4679907128fd1ebe899

Download Submit
C:\Program Files (x86)\TuneUp Utilities 2010\data\integrator\Styler.png

Filesize
2KB

MD5
7b1bbcbcc38ddb8926cbfd0d1f5590d0

SHA1
3e95cec724b56618eba67a6d63fafafaadc2cdb8

SHA256
37f466ab9ad0c692556c11a744c776c8fd8ebcdb08a08b2d0194d0d9186d8fae

SHA512
0d79a08bd301e87e0bb9446018d3a17255bf75cfc7543c644c632266dde534565281b9b85356f55563661f668730b0a5c6345be46587ae7e93b4bad2ab9bf165

Download Submit
C:\Program Files (x86)\TuneUp Utilities 2010\data\integrator\UninstallManager.png

Filesize
1KB

MD5
af5aee5228a3d2d4231304d3fcf06644

SHA1
0b6087de58622facaee7aa4e8b48da6606a31b04

SHA256
64eb7b11256677d37678c85a2e9dc6f9c16a67d030e24bfa8bab6465e99fea66

SHA512
f4a03892aa4c8098bd479b01336e4f7e029e6de6661ab6db78bc30de64df74e831a64ee2870c8d79f7460a185aae27c27879125d9900345c85d072d553491122

Download Submit
C:\Program Files (x86)\TuneUp Utilities 2010\data\integrator\empty.gif

Filesize
807B

MD5
925ceef2b2ece13b5c0429a63fa41bd2

SHA1
6e14417b697c88c3617464ca1cf7905e3d9e76da

SHA256
37a5915c0d646c11ce352461989e94e61d09ebc7d9064a7161bbd37a82748b79

SHA512
01ab4931aeea6ea03b178e86a4d4daa563cac6267db7650347db2eaa4156819076247e218b3a5d0ee01750eeee41d81d40f66e09a0363ac2948ac3081b4f6009

Download Submit
C:\Program Files (x86)\TuneUp Utilities 2010\data\integrator\style_startmenu_32x32.png

Filesize
1KB

MD5
82abe87401f9c0ea2f0ae3d56ede83b0

SHA1
9a56db98cd95ad1fe2939e0266c76e6265a8b5c3

SHA256
fb1ca995d6ad53da571010a08bbf828612bac176ce2c4d15a185f70468e03916

SHA512
270c85f84084c5dbb39eb319ac4244bc6daf90a0a2a35964b42e1a694251ed1fd4e4214aa544df4afabe02c5896f7e4f9f39fa27c8dc1d57ff993e7f99e37de9

Download Submit
C:\Program Files (x86)\TuneUp Utilities 2010\data\integrator\styles\style_bootscreen.png

Filesize
2KB

MD5
86b2ad055fcdb22c9ada7580673c1813

SHA1
1ef722b6933c2f9fde365ef2cd3bac1c752f15fd

SHA256
0a5942feb2ad5328ce3bae7562941f2fb2db9576582b9f4338c8f69e8a1b17bc

SHA512
f0b0328975a5531bda9a786d10ad5bb403f6d23dffe4898fdc45a1623194ab506af23922d725d9b3561228c5266949983625e598e7d24ddfd14f7698ff51cae8

Download Submit
C:\Program Files (x86)\TuneUp Utilities 2010\data\integrator\styles\style_logoanimation.png

Filesize
2KB

MD5
d925a2087758ef0126973fb6da3c1f65

SHA1
1e0ef77f58a43284d573b077e7e8db0f7bf0265d

SHA256
f2a06b42ad0b67acf909392cf8c6ab3f3d9c500e98c733af0dade57e72f53619

SHA512
8ace55a0951228f234f710a6e21843150c6750940313135f5f1d477b30cb39f929598504a1958b8ffc9f0ddbe67bb3e6b1c4be9b0184dee78cff6d2fdb536043

Download Submit
C:\Program Files (x86)\TuneUp Utilities 2010\data\nav_w_c_bl.png

Filesize
147B

MD5
ec99266921d19bf2bdb4531e00a5cc4d

SHA1
d135875c75b94b315c154d43785604b5b94863e7

SHA256
aa2bf16370c85f25cbe4b81ecc0342e5eb1c826353299ae5420aba3ccc10e41d

SHA512
d1c07d55b508585ea476eae87389ac8589e3ca40ebd368d8738b9dd175b6aaf548a8f7050d979af62df3d89528cf39df8a03fab5dbc2eec38d325fbcd29ae78e

Download Submit
C:\Program Files\Windows Sidebar\Shared Gadgets\TuneUpUtilities.gadget\images\flyout_critical.png

Filesize
732B

MD5
5073b7887d9d540798f6a6a2f870ec32

SHA1
5597eb77353bc4d3026540101342112ae9d1c67e

SHA256
f39e2740f5c0c15016fbb56c90ffd6564dbcdb6935833dbaeb89e61833c2c6ed

SHA512
6ce6a4a5793044e054217909c83a9366dfc83268220ea4a62ca7282b8952745228bea0b04b26c9aba4cd5b70dc9caa47997a4b7d99d19fa1569da6443270b6b8

Download Submit
C:\Program Files\Windows Sidebar\Shared Gadgets\TuneUpUtilities.gadget\images\flyout_good.png

Filesize
782B

MD5
92b73bc298f1364075115ae2cd941d83

SHA1
848ae7125f7d086f36dd698e57d5945463dad62b

SHA256
c10dbca8d21a70b0023ee81f518cd7cb59c74fb7c44d01918f03c674fe62aa41

SHA512
c6be917b65f923a4a2cd0ab1e28c6563575019a5663ff2e014c9f40a9d964e0bc72223cd2d9f1bedb20bcb7744b8b5a636e033108f55efeef96972731913d1d3

Download Submit
C:\Program Files\Windows Sidebar\Shared Gadgets\TuneUpUtilities.gadget\images\flyout_warning.png

Filesize
627B

MD5
cfa9555f76a847f4df1642de1da03d21

SHA1
1339740286095300c2aa4a8de9781fde58ba8349

SHA256
e0897affedbd6f9d3ee404b5d51dac5cd79d5a9e00f94cf3341a5f63889a0ccd

SHA512
9ac485e1dccffe41acb664b5f284a7824b18f5458c2c54fae40438b82a47ef4fe239aae188fe6b5b49e32913362aba0d0fa1b5e4d8bed44e32e41e7292ff6d73

Download Submit
C:\Program Files\Windows Sidebar\Shared Gadgets\TuneUpUtilities.gadget\images\ico_alpha_turbomode_16x16.png

Filesize
905B

MD5
429139fdf77099f023e77a2cb84d1beb

SHA1
56b03736de5db0d88fbf9a0599a7210b010f9e28

SHA256
62484db3f3770318e974579a4cbdc70a4845380af6be5472bb9dbbc630566a18

SHA512
ee42fc6b888b79d9fa09b4277f008755754649fc574d974618af36a0eae7c46689c286db03af41b020e8f7a4a8b0f846109a4396134d4791136c5174bf2738e1

Download Submit
C:\ProgramData\TuneUp Software\TuneUp Utilities 2010\en-US\TUSearchScopes.xml

Filesize
4KB

MD5
d750b869e44235138669431a3de049b4

SHA1
b57e2bafa7a5ed135a7b29c21e6aca43bccf0d19

SHA256
61e65da5c24e98da4e6eba81047d6baf67c8bfa67f5070c88704bc6d2b723717

SHA512
fb0589898465d14cf57eee80c7bfc258fd8479517ff5278777ca92737c1348eb3e2fb82c25692082a0871d4c764b369f702a87f0a76bcd055e4e8edb87f62105

Download Submit
C:\ProgramData\TuneUp Software\TuneUp Utilities 2010\en-US\cm_werconsent3_W7.jpg

Filesize
46KB

MD5
32255fe66a9b2d9943964641fc29d01f

SHA1
61f301dcd8870da91c0d1bf6354f0858121713d6

SHA256
bb708158b84356cd7bc7851571c50fefee4f93b7cc679c159f3b4ac623bdee3b

SHA512
9af712d80b9fc05d09d9975e00abaf48d9f498bd13a334c95d548ea6a09757b5e88b3b1622e5da530877ebe220426ca62904732268ac84552db39a6b8987d798

Download Submit
C:\ProgramData\TuneUp Software\TuneUp Utilities 2010\en-US\startmenu_nonscroll.png

Filesize
19KB

MD5
610cd616c5b95bff6c1956307b814ac8

SHA1
6e2431e08c79a4c28b72f098e5a850cef1e72823

SHA256
9b06913695a863f41d5c507e8bfe10dedf8a05d08efdb545f4ad38eda19a2a1c

SHA512
4485aaf743e6680c1e7b1c661959a60fca0bb45c367f41458dfcadd6af9a90bd67f07cf8141a0d432221c57583d67bd4c7e48aa350da3a76f268fd7b1a1fea72

Download Submit
C:\ProgramData\TuneUp Software\TuneUp Utilities 2010\en-US\startmenu_scroll.png

Filesize
16KB

MD5
53a83e5775e73429d36df7ae734d22a8

SHA1
577f7781f7d07afe920e415989240587a9108f7a

SHA256
aa65c29599439c1f8eae3e0f10c5302db4a254ade9c6806f830448e5aa1ebb3d

SHA512
19f784029a2687ea2798124820106c449cee4fe0596851f10973020c6f2a2ecef8a7bd96ad3514fae8f237812bd8f19163ab507cf6e17a83a00ab4cf189492b9

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Software\TuneUp Utilities\WinStyler\LogoAnimations\_default.tla

Filesize
99KB

MD5
7abbf181291a7c8739e993ee8f136520

SHA1
cfd697738ae73c893d8d60dff70678ecfa30105d

SHA256
a1a41540b63360fdbd5a08e1ddcc9b43d85a385f20eda81754538a0859d036ce

SHA512
5a41a7f915876ed52d5c4f21ee14e877360ee8cef6ad42c60016f295bd5f3f90a5b2948ffae85b70550cabfa0bfd48215193c055631d9429e5edee498f331f8d

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\AclUIHlp.dll

Filesize
42KB

MD5
ecb304ea1ed666c5d11c3c03805cbc46

SHA1
f82f7ac41df184d4c92ddc04123ff7ba28d7d0df

SHA256
4df1c12173732e88c1d4fb7cd54411b97f03cc3a49f8d81222cfa2c8cad1e124

SHA512
1decbed033e45b11d8d55960b57ec9521c0435bdef1d13ff68fd542a403f29e08ed0aa8855ed90d819ce4d194806c56230e55a88f29dc309f142c66ca8427ee1

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\AppInitialization.bpl

Filesize
92KB

MD5
f35224086673151689911ea998be9216

SHA1
2f9eb71933bd4f9041a6f7577be6292885b7f1a6

SHA256
fdf4bc78a64346e8fe02d947978499b8a5b30b2857403bd655aa6db16cd57cf9

SHA512
fc679da1a58c0f4f0d7ceb97bf49c9edd544bd31280ce9d069381503fef295d17bbc2eec60f2adb39032d3ad6d22c98007b2833b85e96fbbe22c3fea24fbf090

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\Charts.bpl

Filesize
38KB

MD5
dce80b7885aa28857815f493d8082eaa

SHA1
1c0a456945734401eb5ad45a3695ba758e41e9e5

SHA256
e25eafe5d1ac473392291dc0cb02e1c72a47eed67dc2fa40fdc7d513ef7b9afe

SHA512
f9da8004795f2e592fdfa1aa7f636a9ccb06297728e6be63d5f6a531825ab4f0f78f6c4b1bbf07c68f1d26bb5ca2a3bfd6c8c011454cd64ce08c247c0d91e589

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\CommonForms.bpl

Filesize
43KB

MD5
ece366e51da406cb31da4543b9913cd6

SHA1
fbb3f9cfb02cf2c91d6de27c8c6b6b0374a323b9

SHA256
2accf4922b29f923b26c1217fadd406a98fd90fec41675181f553e9533351d73

SHA512
76d6c73b35812471b3933d7488357af06262a17ca705ce067b822988fec06c2f4310357a3f0096ef4de0224773e908e186de40c501491ccb7244fd88da73bc19

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\DEC.bpl

Filesize
368KB

MD5
2b9f7fb1bca86436b317ac5f1c7cac8e

SHA1
f833e9afc4f3b23d66534f28182f880ce0215bfc

SHA256
05a35ce4e0420102fd406f05054d9d4ab437e9b3874b9af11cd2e748b9d1ddb8

SHA512
92d6573aa87c32a932acb69973f1ef635c7ef85daf1319e714e275746287b7a10bad1a504e7c272055cb029824d6dcdd3b91d80de6d55bcb006f8c7694c25c85

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\DiskDoctor.exe

Filesize
140KB

MD5
a6d7de55ed0134648b8d4c2c48085dee

SHA1
64f48afdbd9ab35656b8975d962ac9c05bafeb14

SHA256
39c8fff9fc877d97c73f8f1d2ad9ae716282e49a6a810441a802199789ad5e86

SHA512
917a87a1a4cbbf9a4c75e253c338d132d4fb3dbd682c0f15359f3963d21cfa8a8dd3c4d818c37caec7221768777b768ac10ba06bdc524c5fe9f5510179c419dd

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\DiskExplorer.exe

Filesize
425KB

MD5
173b3744febbd6aad2001a4bb4736d34

SHA1
1422741a2cdf669ccb3fc527bfea9ef42a505119

SHA256
cd401f406e943a76c3fcff6ba7eae8f0f6a15cb0a4c2a596040500616b766560

SHA512
73a1a189eb0f2f4607aa5047803469a075381c317a74e802ca56a3ecad3b42a053e747fabe2fb508d415a8d969a6ad3e61291a72f9bebe78b293a819099462e0

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\DriveDefrag.exe

Filesize
240KB

MD5
97f4c8864ecf58ddaabeeb287567dd5b

SHA1
9251f89f01b84dd9699dd94ec3ac5e24b6195be9

SHA256
1e61e7801ab1e4921f91098b9073f0820308eda6be0f90f234874817d5ee406f

SHA512
6968ad78d39303ee1b98edba9160c5defdd3a955fcfac33fe0e4084f2f8bc4d8d8aaf41316edd73341c4d4e8573c4098e9c670a6fb4276d47720e9ed4d93d746

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\DseShExt-x64.dll

Filesize
23KB

MD5
0f646a3ee4c8e19a3d0400752a6dfb5a

SHA1
4a10861ec0913d95ae88a27879aadb1d2bee8ef3

SHA256
d46fb2cff70492932dea4f1f7ec78fb0ba37b19f07ab184189979f8840f51c04

SHA512
f6f9fe0179d1ccf5081356d5cedc46c6313fb2711ba1ac2b9ba48102b10b65c057ed739e557581bcee2fc8b4b464aee8ad3a0e585947ad22ab94e480cbf3f77c

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\DseShExt-x86.dll

Filesize
25KB

MD5
b02ad4f41fcce16752660f1124d9b9af

SHA1
3e54afe366dffee33336edea1d3f7a8eda36606d

SHA256
5bc9dcecbd4e76f70cdc065f5f4176e0686027554ef48ee7645678cad2c37956

SHA512
f368b92871ea1ee96c9bd6adab4716171164058b4fbeb41055bd77af16d32c00bb67eb9a16db359477bbe2cf3bf05744321331d36a758ccd335fb714d23697b3

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\DxVersion.dll

Filesize
17KB

MD5
d279087d2d21dfcfeddc6027342fdb26

SHA1
06e985ecaeb546ab1f2c3bace8cf5cb1771abd88

SHA256
8f7ff1b79691d74721d4172e624a479e17c2faa04a34e3e62fa2c5d0e361775c

SHA512
8c0ee40c4ac49e305d48ebe4d94d11cc4ca33bd98a3597b06aa44c9fbfb30b42abb8d6658086ede67d64f50800ffc0e83ecb4b2fd38541a235d986e1597e8805

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\EmbeddedWebBrowser_D2006.bpl

Filesize
831KB

MD5
0755449d9b46f8e35fcc38dfee4ae632

SHA1
aa2de138cf2aa4c2ec9d33116186101b3f793770

SHA256
cc820290ac73ad93bbb98a6e49b23be810f05369050c75a50486b5dafc5595f1

SHA512
ecce88a61636112b72f8eef22a98ef627629b665a36a14d7772cd92c84a5d68c40a72359774f573b7661656309186ae79005f38946a757ed4eb00109207ba5f2

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\EngineerIPS.dll

Filesize
20KB

MD5
87f965bd8ca3d80a6186d12ec885ce28

SHA1
b051e08cd23ab2bc3111e9e88d40d51126738f78

SHA256
a91760037f5ee7c757abc4cb7dadc98ef484169a2305c7f1eb86b045f93df657

SHA512
6e7aedc191e7618712dbfc731e437a8b27836d05dd2fa2b3af5cfa1c745d8fadce3d3a1531221e5a7f87d721c6ca3cda269930e1bdd1dccda5d5999f287aadcb

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\TURegOpt64.exe

Filesize
33KB

MD5
799d54ee7ec6162166ae3fbc8a017683

SHA1
a96b45387909bc73efc197a0b4d70d1bdff9eacf

SHA256
bd21830d91f36550bc0d8aed37d8318141801968b2c20d2491196ca2a0bde95e

SHA512
2322777d458d5b5f86a8984e51dc95e5fb2925880ebb3341d83a0ca9672bbf7d7e478eb94268ec73f791d1b7c96073f16577006cf74de65676c8e48435a8bb6b

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\aprdlgs60.bpl

Filesize
132KB

MD5
4a4d107307abdfb7b30bc96e86316726

SHA1
689f9c625adfcb1efda00a4bde73b36e697ef636

SHA256
80eaa16eee3557e0df3211e8af9d58720431777281f3797f9444e6f66256277a

SHA512
bf89b8408e24ca9858b1e94767ee227465622491e8850ca8b5842921f79724ac4409988e647976cce87edbf3d5237ce63a12ef398eba1050c8be0a38a723bf02

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\authuitu-x64.dll

Filesize
25KB

MD5
84fb451d08c42450c57400e91aea33b7

SHA1
024889fedc661c225fe40567af8e4bf39f6fed7f

SHA256
8050125e57db2c7b0a44922a0d57533f2406aab15b9d03f7166211adac001ef5

SHA512
fdd8f2514f5faca115ddf93d12aec99f9bbcb0bd27ff3590b1258f7625f9ec2acb981b2e028df9f0b3389baf4ae3100671b70e26d25b85af5f5cf129fc09e272

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\authuitu-x86.dll

Filesize
20KB

MD5
f3634118db0ea0f212bbc19dfd4bf6ae

SHA1
c9383b9f669deeb5fac880853eb2de8389ddf15d

SHA256
972d09449a26bb26096a148b80618b761a5147e1be60edfa124c7f2c2c51c952

SHA512
c09b31d870c77714b2103bdd81a09a9f00fc93dad9c43dd025c867924c4d02ddfffccd1030f497f9299f4f9b10f0497c624fa8e2e8fed62caf801dc0a56de9e3

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\cmCommon.bpl

Filesize
41KB

MD5
e84ca5eab814a120657f24b942d7dad9

SHA1
da3ff4c037e8b332790fd709b1e4f10fcaac5b35

SHA256
cf24f359de54260de4bec6a1307b0c6a6255bac78739deb19dd56770b2fe8d25

SHA512
7f894f43bea27bca722dedb5111671508163602dd0f63b41b7fcdb7cae5f14f9015adac19b6c06d36073e72e795368d1f301a51a271a108b0be8b32cf4865fa6

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\cmDisplay.bpl

Filesize
327KB

MD5
fa85a62e40c6449f9ad2f4e545cb581c

SHA1
05df7aa2d12acab9d507e9303ade689bc3e6766c

SHA256
25e188541d7e9fedaf2e68354eefee881f7c57203af952cc8d81375aa7df340e

SHA512
115019e2b272b1d1670f48d753b544a98c6c90990dac93ce0ad81b8d179d963277d8bf4bcbf0859b9202ad35dceaf4a7a5612493ca5943764e27ccdd950bacc9

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\cmNetwork.bpl

Filesize
422KB

MD5
b7f1f4047cafc20fd3c70fcf9df022a6

SHA1
51ea43a1a638249fcf34416ace64a833c9d76746

SHA256
2b5407b12b773b26a63c467ed381e1bc8fe57dab41a74908ac116745e922cd99

SHA512
fc8fe1c081597e89f3944840731498d98e5606010583766ec7f25d050fa28bf45b13c6d5d7c9b90e35d21e7c2234286eb8c3568d5515c7219d90ab1a120a45a7

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\cmSystem.bpl

Filesize
387KB

MD5
f38b6f197ed9cd5a5ec718f5fc25b6c9

SHA1
6798c2475a121fa6248441be18b7f8ed07354737

SHA256
39e293f6b1ce943bd67e1546be59a9f1a7c167b641dedaca21133a0eeeea83dc

SHA512
5985c675a43d258559df2ac2cb66fb0ce385c9820e10a276cccf2ec9725983803b57d289a4145476b908c314a37696be334629d7442752c35e74bc58ea0b31ab

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\cmWizards.bpl

Filesize
56KB

MD5
5639ef6a2fc108c40cf33ad3da3230fc

SHA1
9d92bfff278cbc818fe26bf8375998ee6823ca4a

SHA256
fb0b24db6e1d5b8ab122b086fd18fa7136206ad09b382be180399605d9c05c67

SHA512
51059b85b9eebc7a1e03cf90d58504599736f47fa7ad80c438a6346a27efd10304f7df1cf859379f5c025a6ceca38ade44565614a6b2ee76c1d4ab26c8b561be

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\cxLibraryD12.bpl

Filesize
821KB

MD5
bd7ddb6221c3352f3987327d5bf4d950

SHA1
88ad440af53facf9a63bd9e146eb8b4ab559bd5f

SHA256
080fdd484da8979c39633c3df67dfcbb2721bc93d451c3fe93c27438df6591b2

SHA512
0c54db5891c28d0984d6113cbf84ec95281e8d54affebcf70ab7f59ad0d6924ac7f31709601bff6c4011d31823586d5b44ee07fc786193c0262137834fd9268d

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\dbrtl120.bpl

Filesize
321KB

MD5
e23564a12890e232942346945833f705

SHA1
38ba98cc975ae45dfe809767ce6472a0fd42950e

SHA256
abe5087a42ab4012df5248d43634cf60df7aea237f2f795ddff6e69cf3db9433

SHA512
eefb05c624d240195a5e701fa70fa6dd6d9afc7b92b68a0148f08648fdf35c5cf78445a7c44922f4402718fe39d63962ffe90ce1e15024c3e5478e6c95eb6ee3

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\dxBarD12.bpl

Filesize
1.1MB

MD5
c9994d3b10442b438d94bfed062217f3

SHA1
033e75435a0f728378a3336724fd5a18782a0ca2

SHA256
15b5043f273ea202b68e3c15bc4bf5e4eda59ceaa4bba3fde5fad06e27362a89

SHA512
5469eb2b3c5e7dbc1e1ca9b6d4a491017e85cdf9f316ff46d31feb9604103f05b08eb476a1c48ca11b670d2736357566da4893f0acba7a60a812154df29ab76d

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\dxBarExtItemsD12.bpl

Filesize
207KB

MD5
1e802b4320f55f87de2133046f687c24

SHA1
bb7c7ebc300f31eeadadf54341962f3db403a71a

SHA256
38d73b9ed85eb97bd2d4cfca5558f8498be204b2d4d5e5c02f7d8874fd2be5c5

SHA512
e36b1320ac4c29e68084fadf28051ebaa7cc627c2938f5207fcdf5b34af033422a7b3bf2d9af949aefd31bd280265381c1c83b878e3164b7ac0defe122500577

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\dxComnD12.bpl

Filesize
44KB

MD5
a80017fc1bda689a477c576e6fddafdd

SHA1
20485ac2e0d295517b89cde55ecb0530419517cf

SHA256
e20a22717273b9331b10f71695f82c5fae01f46ff37d77938dd1c0af2cd2e712

SHA512
bd0d6ee35bd6004e6dbe3966692bbb521cf33a2b6d5c7f5ddd3f5d01a60205989c6c2f0cddbd5c7bd627ef1b0b104668118db777f1328831309467e7e47c7818

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\dxCoreD12.bpl

Filesize
29KB

MD5
c6547c60bd39667592d19e7b5e44eeac

SHA1
cb0307ba44675427878c98023572eab761377784

SHA256
1d6cc46c0cb134a1bd3b5bc915dfec685817b49426da374dd09355d0a23c2465

SHA512
7dd3675a9e75e0671cb601ebf0eef48a2e352ce0f6f9d1b5f6280f3b9e9ea6e40e1dc8b1fa31c734ee044abd90cc23ed047c59513f1ce76991f68d489313aee3

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\dxDockingD12.bpl

Filesize
307KB

MD5
9ddd466fb186570ad0c583bbb7a64ea6

SHA1
82782e914ce19003ae12b1bdd64457af33df4f76

SHA256
a78fa4e0f99596b41b0554bf38f66fb5d6d3de9b0b1856c8ea878d39799c2b6c

SHA512
fb9afe14f1276a8ca329475db29b5bf38123e91c57977a7ba43c73225da070b8ecf4730f74fffc335340cfd0d6cc617849de6d51849915d3bd5a2983a2164f97

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\dxGDIPlusD12.bpl

Filesize
57KB

MD5
0dc1ebf3de1b6ea8ea7dfbb622d9a8a3

SHA1
2f53b03d7bb7dacbf9194fd391e8b59398338f79

SHA256
d87a9b59b469f224cde32c4b7a54144ac14c5115c612701f52c9d6653da24254

SHA512
c771212db33ce73d44af584f886e6b898e7572b0269e8548186fa8cdfccad91c293753c19d4454a65be4ea9681439588b54ee6d156c5bc2de95b1eef917021ad

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\dxRibbonD12.bpl

Filesize
851KB

MD5
d0c4e17ae36ceca2560909329197fbae

SHA1
ccd924653509a24d5a71035405d3507654926a82

SHA256
8356b08bad79f310582da8bbaf0b09d276d4ae38d6dfac4ef97354fe7db029c7

SHA512
757be3a01290c413176346c36f4657eb26af88b938ed76270bdcd96171b86c3cda98c48931ba096a83a8a405ac80273d0fa0154453ab218b4c7314ac8bbeb6d2

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\dxSkinsCoreD12.bpl

Filesize
710KB

MD5
24e2f35fb6f1f14c19deef333d78c7ea

SHA1
eacd9f74f3a6346412c60a0e05016baf9633852b

SHA256
7fc620376ff4b9724a4f20c282b2419615f065b56fba9cfaa74d202d278dc9f5

SHA512
ae0973efc4d6a7e81c9e39643fcd5b2bcc57a8dce2993b0c78e6cb674a93b2d669e2bf78817d613c50bab1f2cf76fc6bb27f5d6f21074380aca36e3f8d9b1f2e

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\dxThemeD12.bpl

Filesize
54KB

MD5
00b1ca90f23a2e2c5afcd30874369eca

SHA1
f7a5943b3f4d714d10965a9e462d0f87766f2ba7

SHA256
f4cdf4624990218228f5e0d3483649a7905f90ba43310db649d368d505e3214e

SHA512
dfcf8fd802fcc64357152e37e4ab8eca106373b8074768a94dc01fbfcad176cc4458cc10e2acf15c71a4e0035e1546101e5867aa765f8cef992e5d54955bad6b

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\ehs_d6.bpl

Filesize
69KB

MD5
a4b6e26bd67a71865e299947489e847c

SHA1
b51699bc91fab939534bd927dc06f12edac543c2

SHA256
1dab761314fa91b9328cfefd600afa5214e7896a7c14c179e15664644b4d9929

SHA512
500a010fa53fad8bfa0306df839369d479b820ea42ac7b52b0d7e4951bbaf84d1ccc29f90c573cdaf423ca6cb6a8d357190096045eb9b7788c9c1815e1653174

Download Submit
C:\Windows\TEMP\TU\orig\setup.msi

Filesize
566KB

MD5
81e708f827739710c8f62ae95612966b

SHA1
b769d2250266b6e9829a55cd5bd680bcc1db74b6

SHA256
d7578072617110a802cbca91c4eb111e3ec3eba313968687551b0a44b827e05a

SHA512
9e7cd4c8f3fe94e9bbe97da14d8ac72b4f85bac0fdd92fa04ed60b158327a1dc4417bd4292bd8015fdd8feeaa99438f8e92b1849d4c8cedc269c9fac4b63dd12

Download Submit
C:\Windows\TEMP\TU\ru-RUv\TuneUp Software\TuneUp Utilities 2010\en-US\ProductInfo.dat

Filesize
513KB

MD5
44397fdf777b40cea58e841eb28dcdbc

SHA1
800e5c661140702ba0d28a56bcca9e93d36ff159

SHA256
b6c697db3905078b7e99b306058fa92402692641989e4bf25bbcc979eeb2b285

SHA512
3559122a4fc2b6859dbb8053f183148a636b0cc11610401215b5536ab8eb09d71539c9847af99b3ec0f23e3b3365d265d413a989828813d1f9d9bd23b8eb5b7e

Download Submit
C:\Windows\TEMP\TU\ru-RUv\TuneUp Software\TuneUp Utilities 2010\en-US\cm_diskspaceVista.png

Filesize
43KB

MD5
41c6dcda758770ea2da3805e226d58dd

SHA1
1e0e91e2559f3679fbac97893aa7ac66487a913b

SHA256
314e8f4593e57c212612d2bd4b60c4b7b53b7d38562a7abeb584d856c5db7769

SHA512
561fe9db574248a9ab89b645d5ee219072654d70c9b49aec60645297ce447a9ae1983103e624185c9cbbf4ef505390a3b21838bc56f24648ba6593535309aa85

Download Submit
C:\Windows\TEMP\TU\ru-RUv\TuneUp Software\TuneUp Utilities 2010\en-US\cm_diskspaceW7.png

Filesize
29KB

MD5
ff19a54992e54c6b1a22822980a5967e

SHA1
376f438222ef363e670b5cb79f9d87c44710d3d9

SHA256
81574ec7fe9c29191e075a21e8f5ce9b04ef3f547f67061c66dbcc5e5cf4e340

SHA512
93fd07ea631042fa2a45c79f0f48fddafbe4ec4e09c779870564c0b13637aa90163435ad9b686acf9968fafe41034162c2125fd83f931c9c98e33ce23dc65a63

Download Submit
C:\Windows\TEMP\TU\ru-RUv\TuneUp Software\TuneUp Utilities 2010\en-US\cm_diskspaceXP.png

Filesize
31KB

MD5
cd5bd1830ff5b316f8c529163b4ce9d8

SHA1
7cc0f497ab0136ec4c0a405f46fba80f77a60bd9

SHA256
c3c80adbbad2ed0f7b4824f7c99e243f9c193c40efbd6f45a85ab8b2f664d4b5

SHA512
f36aec1b0029c5f44cd509a350d45436cf086979fdef4b2a72775bb9c85253b4518775c9fe3af40d20b8c8ffafe858b7b853838436d60ce7b8e45c0049f88835

Download Submit
C:\Windows\TEMP\TU\ru-RUv\TuneUp Software\TuneUp Utilities 2010\en-US\cm_logonVista.png

Filesize
45KB

MD5
367dc55660ba0d6584e58568035bdbef

SHA1
c94a67ea7c59c841739543c893f3510097fb25f1

SHA256
935fc452abb3e7f1e0d8b4319d72ffc019f910c294daf3d7c3856b1bf5d90455

SHA512
612629072bafdcd37e2ea049d176e43a1aef93e6d57f2d652b38f2fd7dafee4398f6a7103646dd03635dcfa721eea2ff21a84faa1ac319f5432fb0f60c0dc381

Download Submit
C:\Windows\TEMP\TU\ru-RUv\TuneUp Software\TuneUp Utilities 2010\en-US\cm_logonW7.png

Filesize
46KB

MD5
8a645cbb95b8ffad25dcf1ed32d635d8

SHA1
af4a29c4fd3669276c9ef835d4bda89be6ac322b

SHA256
5492bce33a07f8c1fb10739e1d9cc75c9e1ba5e2566f82ed4064a986b78086e9

SHA512
b4e50a2f6b8fa3049fc799efe165fb08be592154b239fa5f5c0439e6a3e7e0b48d6a50ad69d80ea61312787836383ee9e88e3de981b87673b7dfba26f11d4698

Download Submit
C:\Windows\TEMP\TU\ru-RUv\TuneUp Software\TuneUp Utilities 2010\en-US\cm_logonXP_new.png

Filesize
13KB

MD5
4fd64ac5ceaf66b82ed8cf7dfca73944

SHA1
6814cdb550de60831093f60d57ace612f4ad648d

SHA256
a211237a1c3d1092b2f2a3c8b189692404469f347a6bf0e37af38cff0adb5779

SHA512
4efdfa598eb1c20e5271fbd91d5244dd8203868338871a8eef93988cb07d8321e43b5947019a267a9075adebd993ce3a464f608d293e64c15cb04d504db93883

Download Submit
C:\Windows\TEMP\TU\ru-RUv\TuneUp Software\TuneUp Utilities 2010\en-US\cm_logonXP_old.png

Filesize
7KB

MD5
fba3db8f1d26e1696cbe44cd734d06f5

SHA1
225753f68a1a727091c11c8a57c3dae2dbd76421

SHA256
043f0935664e90b13caad05b69e579d98178bac6d1815f5de43acfd12aeb2874

SHA512
42b5d68a219379f34a0e3f52bdf3162dbe912a5fc618f8ad7dd04162c8e17552be14d11cdcb15f7072bba4229a57b1d60dbf3fe25c3c436a09a9a2dff5ead633

Download Submit
C:\Windows\TEMP\TU\ru-RUv\TuneUp Software\TuneUp Utilities 2010\en-US\cm_report_noui.jpg

Filesize
16KB

MD5
60d7db3bdc1f6e67db6413f1c5c3e6e0

SHA1
48ce2d87f8e47baba80483ff4ffb7b09e1b286a5

SHA256
64eddc5fd4192dee8388389c9c7fd0a2b8be17ab33aaff950c04931090ee2e64

SHA512
f54da7456e5b9d013fed22bf11e6e69d86ef87265855eacec627a281ca509099d274d3e2941c66bd064b3a7ffb79f1d4883074b69f4d4fa9ab0f4c23cc805178

Download Submit
C:\Windows\TEMP\TU\ru-RUv\TuneUp Software\TuneUp Utilities 2010\en-US\cm_report_send.jpg

Filesize
23KB

MD5
776e4e4812f89c99e6d577e2ef7aade4

SHA1
ddde4b39eb07efaed28d5917290ffe2991258d00

SHA256
1b240ecb4f5fb75ae2de35c19f961110ce7d379307b48c9e97705d56802a0d30

SHA512
11a992f1524c1190910d544ac50f9403ad9c5205f709fa4dc1bd7bbd437c4865018e97a209781892111cf72f8490adbc29b38cbea278a6f3e65e985fc1697e0c

Download Submit
C:\Windows\TEMP\TU\ru-RUv\TuneUp Software\TuneUp Utilities 2010\en-US\cm_report_showui.jpg

Filesize
18KB

MD5
7b7f36a751ee03fefab221b754dba10c

SHA1
8ec7c389941260ac596df823a96bd2bb51792cda

SHA256
114f142b5d05bcfdcced5c0a2742459d4be53909f33a3f561c839ccd8565244c

SHA512
3046753e082d12f017e614eccbc9b55c33ab6bcdf3f409d5b7bad21679e6ef2286f1ea09d4256ee083868148d0670428a0e45a9ff6f08ce694e7fb0cd43ca524

Download Submit
C:\Windows\TEMP\TU\ru-RUv\TuneUp Software\TuneUp Utilities 2010\en-US\cm_werconsent1.jpg

Filesize
46KB

MD5
4deae0523f4face6cc0795b192b77604

SHA1
922b1a5122486b05433fa76af3dc3d18b9a21389

SHA256
a927e1668e728c035449ec514ac1b7fec0be7f54852dd63f59e9528a7053e994

SHA512
4ccd13aefb61cd69d7b85661f995a3320451a99250d6959cb16ffe76087f7f219acbf3fa33001d4efb6c967563bff8e123227708bd08f9cfa9f8db6fdcf4f353

Download Submit
C:\Windows\TEMP\TU\ru-RUv\TuneUp Software\TuneUp Utilities 2010\en-US\cm_werconsent1_W7.jpg

Filesize
47KB

MD5
8daf97f13136990d15e2bfc83b695f11

SHA1
ec0c7383c8348a41aa191271dfc28881b137ee0c

SHA256
d05462fbe83712d5e4b171875db6c0792c2ca5f2aedd52e6480b422d31eabd63

SHA512
9a0c5b22f1a608b47c030e271a478378814f5c12142586afbc25dbe909ac39442e627bbfc340bce69c288c55190061b26a5d0a9d5665fdf0e8b367dbab0347df

Download Submit
C:\Windows\TEMP\TU\ru-RUv\TuneUp Software\TuneUp Utilities 2010\en-US\cm_werconsent3.jpg

Filesize
46KB

MD5
486ce522d809c8f6123e0d6face706aa

SHA1
8e92e1351c55c87a37032343975ecb99075435b8

SHA256
5783576bf94df9a486988b40cad758dc991558db2fa90c2ad9af5a31e74c34cb

SHA512
8941cbb68e5a5d601bee62b3429ae915dda3fd61c2e39ae419676b162d24c18b3ede805f3b0b3c75ffae151c25182d1a91c392d15b6b4d45430f6529b6f12499

Download Submit
C:\Windows\TEMP\TU\ru-RUv\TuneUp Software\TuneUp Utilities 2010\en-US\cm_werconsent4_W7.jpg

Filesize
48KB

MD5
be59d974174caeedbe9ed68801ef1d88

SHA1
25894925a63d90005cec338f8ae66c0493c6201f

SHA256
50e7c85143932c19c01c1ee02b7a80c6f044d5ac6c31abc08744e483bc880a40

SHA512
4a378a03719429cdb4c9dd4865ab1ea41bc697b197f55c811492f6d78dca14898873507c9276943088b864192ff5befcb5e98365a79ca455c02b817879c8caa7

Download Submit
C:\Windows\TEMP\TU\ru-RUv\TuneUp Software\TuneUp Utilities 2010\en-US\default.mo

Filesize
2.3MB

MD5
53049dd8b00eaee044abacdba4ad7d2a

SHA1
5ae9c3354b35d8fcc1adcc8887a3cce044fbc812

SHA256
6ecc904c7b047b8bd54b4f12a71cc21866fa39b6e498cc1f0be6713a04e656c5

SHA512
5c8443da0e5826b62ce6bb6f89d82b66ebf2db348f7cf11c6a80549981f53b252d4963f0f3dddce3a46d73323dc3c907c7ca544109c51e0b2c2d5264aa078c3e

Download Submit
C:\Windows\TEMP\TU\ru-RUv\TuneUp Software\TuneUp Utilities 2010\en-US\iecontextmenu.ini

Filesize
3KB

MD5
f7ddefaf1df1679143bbde90d75c3af7

SHA1
a5b6c8e47adac939e5b13fb625c031f0b92f6086

SHA256
27f304ef8755af9d7b13b507737de14d17a79d6eabcb1994993a2e6d7ad0574a

SHA512
daca08490af8a97753809f9e2e428633e65bf0d3762fe7abaa6f380aa3bca9db34002343389e824e154f6d46d120585625aeac95e281a8ee48ad1661b8b8b0fe

Download Submit
C:\Windows\TEMP\TU\ru-RUv\TuneUp Software\TuneUp Utilities 2010\en-US\license.rtf

Filesize
16KB

MD5
b29b9aa4f22f6bcfbfd354099d3922f5

SHA1
66bb626beba1da0432613d6a99a5078d59af42ef

SHA256
39a2546cd463f791d9be9983dac6a5c8e819e75788d6d08141e168ff26ac90c8

SHA512
347f2edb0a3efd2ef593519182510a64fc8f48cf030351f8315e36482a687c3e19f6c904a12fc3bfcd7aa131da953c24166ee67707827ab79cd81d34dfc5bb55

Download Submit
C:\Windows\TEMP\TU\ru-RUv\TuneUp Software\TuneUp Utilities 2010\en-US\main_7.chm

Filesize
346KB

MD5
bd63624ec81771384e3e1e443b44cd72

SHA1
9a63d8dc263353b3f9c023c35ab13a8067554a9b

SHA256
f40e1fdac6a860cb48edc6355b048038ea12a0c396c6c1c260e66e7f97c55d14

SHA512
3edf49feb780559d6a013a0ea1c756efabab06d4cc610652c3251fcf723b1bbffefbfae036a1f78abcf184ad1bdf1c494543b75938da988f6c7dd2cfd9af8cc7

Download Submit
C:\Windows\TEMP\TU\ru-RUv\TuneUp Software\TuneUp Utilities 2010\en-US\main_vista.chm

Filesize
351KB

MD5
66b2d8732a90178ad1520b4bd700440b

SHA1
cd688952bcff486c9643a9bec27bcd18549a8c41

SHA256
cd725af72fd9394620fa19662d206c614a34ed6bc991a87c5bb1eb809cebda5c

SHA512
d7771f1c3cd45caec1126209c75e9db8b8f62edef5eaa9d19799ccb41b5e766f4248324d3b90e949c7b1a5d3934e320ffef712be3018a0359f3e351248c4666a

Download Submit
C:\Windows\TEMP\TU\ru-RUv\TuneUp Software\TuneUp Utilities 2010\en-US\main_xp.chm

Filesize
344KB

MD5
f07e787a5b5d343ffc1aeeeb6b18f0b9

SHA1
6ff0ef662fdf46b08a08adb9c2d2ae9d4974e119

SHA256
57d4e66af9687c92e4d98c7ab757b08eb5d266d5837e36558e2a509200e38d87

SHA512
63797edcce4537289731b5e72bfc334d420094ae2b894afe51cb332f3542bbba1c294c0c9535092a404e897edd050331865c57088e2bf91b89800838034fcfa8

Download Submit
C:\Windows\TEMP\TU\ru-RUv\TuneUp Software\TuneUp Utilities 2010\en-US\regwiz_country.diz

Filesize
3KB

MD5
945a2ad7e04d1e6861d239dabcd50538

SHA1
c59547b9212b85cfe3f242b78990622817a25c80

SHA256
aa52a469cb426231f08d27d9245e955e41ce0366f27c3f48b4253f0b4744522a

SHA512
6bef394b8f637c434e050ccb63c7ed27bb55c4ecbd1f5f6fe2d56c4c96e53ce5068669d473a2de2a3471b4266241920ed67826a7a80b703c6c288b490f4205ac

Download Submit
C:\Windows\Temp\TU\ru-RUv\lng.msi

Filesize
26KB

MD5
ac58984962e5ec029304d5039c45155b

SHA1
a3f6084218452414183c6616ea193665d0885a20

SHA256
4ed98e0c01f56d16ca642057ec85ea654d50b0e53a2d72690cce402e3f100747

SHA512
ee43d8431b4b0c51e64128f91f3849822a6a503a0fd6fbcb470d48c8bfce807ced32df48581b837e7169b2e68aae81bf88a8b1d68fd43fbd267dd8abc22eeaa8

Download Submit
C:\Windows\Temp\TU\setup_ru.cmd

Filesize
484B

MD5
0cb36cd96eddf5dacd5dd34ba6ca7dba

SHA1
529bd2943fe489e35f60bf6b47a36629bf1454a2

SHA256
c4ec611341ded47106ebdfd94d9809f5f2de68a9e1885f5a6e89575b59ed190f

SHA512
9db0b3913aa178f2412010fe356e42e1feef752cefa99b909b5d6020529909f6bea7f9a5b29433075ae14460f610eebb7a4048c8fae7a4c2efda236b69d43041

Download Submit
memory/828-5041-0x00000000002A0000-0x00000000002EE000-memory.dmp

Filesize
312KB

Download
memory/828-5044-0x0000000074E50000-0x0000000074ECE000-memory.dmp

Filesize
504KB

Download
memory/828-5076-0x00000000002A0000-0x00000000002EE000-memory.dmp

Filesize
312KB

Download
memory/828-5077-0x0000000074E50000-0x0000000074ECE000-memory.dmp

Filesize
504KB

Download
memory/1036-4562-0x0000000073C30000-0x0000000073CAE000-memory.dmp

Filesize
504KB

Download
memory/1036-4556-0x0000000000F70000-0x0000000000FE6000-memory.dmp

Filesize
472KB

Download
memory/1036-4547-0x0000000000D20000-0x0000000000DA4000-memory.dmp

Filesize
528KB

Download
memory/1036-4552-0x0000000000DB0000-0x0000000000E46000-memory.dmp

Filesize
600KB

Download
memory/1036-4548-0x00000000001D0000-0x000000000021E000-memory.dmp

Filesize
312KB

Download
memory/1036-4550-0x0000000000220000-0x0000000000232000-memory.dmp

Filesize
72KB

Download
memory/1036-4551-0x00000000003C0000-0x00000000003D4000-memory.dmp

Filesize
80KB

Download
memory/1036-4553-0x0000000000E50000-0x0000000000F05000-memory.dmp

Filesize
724KB

Download
memory/1036-4554-0x0000000000F10000-0x0000000000F6D000-memory.dmp

Filesize
372KB

Download
memory/1036-4546-0x0000000000350000-0x00000000003B1000-memory.dmp

Filesize
388KB

Download
memory/1036-4557-0x0000000000FF0000-0x0000000001013000-memory.dmp

Filesize
140KB

Download
memory/1036-4591-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1036-4555-0x00000000003E0000-0x00000000003FC000-memory.dmp

Filesize
112KB

Download
memory/1036-4594-0x0000000000350000-0x00000000003B1000-memory.dmp

Filesize
388KB

Download
memory/1036-4596-0x0000000050120000-0x000000005030D000-memory.dmp

Filesize
1.9MB

Download
memory/1036-4599-0x0000000000220000-0x0000000000232000-memory.dmp

Filesize
72KB

Download
memory/1036-4616-0x0000000073C30000-0x0000000073CAE000-memory.dmp

Filesize
504KB

Download
memory/1036-4595-0x0000000000D20000-0x0000000000DA4000-memory.dmp

Filesize
528KB

Download
memory/1036-4593-0x00000000001D0000-0x000000000021E000-memory.dmp

Filesize
312KB

Download
memory/1036-4592-0x0000000050000000-0x0000000050116000-memory.dmp

Filesize
1.1MB

Download
memory/1036-4597-0x0000000040830000-0x0000000040878000-memory.dmp

Filesize
288KB

Download
memory/1564-4919-0x0000000000120000-0x000000000016E000-memory.dmp

Filesize
312KB

Download
memory/1564-4742-0x0000000073C20000-0x0000000073C9E000-memory.dmp

Filesize
504KB

Download
memory/1564-4741-0x0000000000120000-0x000000000016E000-memory.dmp

Filesize
312KB

Download
memory/1564-4920-0x0000000073C20000-0x0000000073C9E000-memory.dmp

Filesize
504KB

Download
memory/1696-4686-0x0000000073C30000-0x0000000073CAE000-memory.dmp

Filesize
504KB

Download
memory/1696-4685-0x0000000000140000-0x000000000018E000-memory.dmp

Filesize
312KB

Download
memory/1696-4720-0x0000000073C30000-0x0000000073CAE000-memory.dmp

Filesize
504KB

Download
memory/1696-4719-0x0000000000140000-0x000000000018E000-memory.dmp

Filesize
312KB

Download
memory/2140-4634-0x0000000073CB0000-0x0000000073D2E000-memory.dmp

Filesize
504KB

Download
memory/2140-4633-0x00000000001C0000-0x000000000020E000-memory.dmp

Filesize
312KB

Download
memory/2140-4661-0x0000000073CB0000-0x0000000073D2E000-memory.dmp

Filesize
504KB

Download
memory/2140-4660-0x00000000001C0000-0x000000000020E000-memory.dmp

Filesize
312KB

Download
memory/2392-703-0x0000000001170000-0x0000000001184000-memory.dmp

Filesize
80KB

Download
memory/2392-4520-0x0000000050000000-0x0000000050116000-memory.dmp

Filesize
1.1MB

Download
memory/2392-4521-0x0000000000140000-0x000000000018E000-memory.dmp

Filesize
312KB

Download
memory/2392-4522-0x0000000000190000-0x00000000001F1000-memory.dmp

Filesize
388KB

Download
memory/2392-4523-0x00000000002D0000-0x0000000000354000-memory.dmp

Filesize
528KB

Download
memory/2392-4532-0x0000000000D20000-0x0000000000DD5000-memory.dmp

Filesize
724KB

Download
memory/2392-4525-0x0000000040830000-0x0000000040878000-memory.dmp

Filesize
288KB

Download
memory/2392-4526-0x0000000000020000-0x0000000000031000-memory.dmp

Filesize
68KB

Download
memory/2392-4527-0x0000000000200000-0x0000000000212000-memory.dmp

Filesize
72KB

Download
memory/2392-4528-0x0000000000220000-0x0000000000234000-memory.dmp

Filesize
80KB

Download
memory/2392-4529-0x0000000059000000-0x000000005904B000-memory.dmp

Filesize
300KB

Download
memory/2392-4530-0x0000000057000000-0x000000005702D000-memory.dmp

Filesize
180KB

Download
memory/2392-4531-0x0000000000360000-0x00000000003F6000-memory.dmp

Filesize
600KB

Download
memory/2392-4533-0x0000000000240000-0x0000000000250000-memory.dmp

Filesize
64KB

Download
memory/2392-4534-0x0000000000DE0000-0x0000000000E3D000-memory.dmp

Filesize
372KB

Download
memory/2392-4535-0x0000000050310000-0x0000000050349000-memory.dmp

Filesize
228KB

Download
memory/2392-4536-0x0000000000E40000-0x0000000000E5C000-memory.dmp

Filesize
112KB

Download
memory/2392-4537-0x0000000000FA0000-0x0000000001016000-memory.dmp

Filesize
472KB

Download
memory/2392-4538-0x0000000000E60000-0x0000000000E83000-memory.dmp

Filesize
140KB

Download
memory/2392-4540-0x0000000001080000-0x0000000001139000-memory.dmp

Filesize
740KB

Download
memory/2392-4541-0x0000000001140000-0x0000000001168000-memory.dmp

Filesize
160KB

Download
memory/2392-4542-0x000000005B000000-0x000000005B017000-memory.dmp

Filesize
92KB

Download
memory/2392-4543-0x0000000001170000-0x0000000001184000-memory.dmp

Filesize
80KB

Download
memory/2392-4544-0x0000000073CB0000-0x0000000073D2E000-memory.dmp

Filesize
504KB

Download
memory/2392-4539-0x0000000001020000-0x0000000001079000-memory.dmp

Filesize
356KB

Download
memory/2392-4524-0x0000000050120000-0x000000005030D000-memory.dmp

Filesize
1.9MB

Download
memory/2392-4519-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2392-704-0x0000000073CB0000-0x0000000073D2E000-memory.dmp

Filesize
504KB

Download
memory/2392-702-0x0000000001140000-0x0000000001168000-memory.dmp

Filesize
160KB

Download
memory/2392-701-0x0000000001080000-0x0000000001139000-memory.dmp

Filesize
740KB

Download
memory/2392-700-0x0000000001020000-0x0000000001079000-memory.dmp

Filesize
356KB

Download
memory/2392-699-0x0000000000E60000-0x0000000000E83000-memory.dmp

Filesize
140KB

Download
memory/2392-698-0x0000000000FA0000-0x0000000001016000-memory.dmp

Filesize
472KB

Download
memory/2392-697-0x0000000000E40000-0x0000000000E5C000-memory.dmp

Filesize
112KB

Download
memory/2392-696-0x0000000000DE0000-0x0000000000E3D000-memory.dmp

Filesize
372KB

Download
memory/2392-695-0x0000000000D20000-0x0000000000DD5000-memory.dmp

Filesize
724KB

Download
memory/2392-694-0x0000000000360000-0x00000000003F6000-memory.dmp

Filesize
600KB

Download
memory/2392-693-0x0000000000220000-0x0000000000234000-memory.dmp

Filesize
80KB

Download
memory/2392-692-0x0000000000200000-0x0000000000212000-memory.dmp

Filesize
72KB

Download
memory/2392-691-0x0000000000020000-0x0000000000031000-memory.dmp

Filesize
68KB

Download
memory/2392-690-0x00000000002D0000-0x0000000000354000-memory.dmp

Filesize
528KB

Download
memory/2392-689-0x0000000000140000-0x000000000018E000-memory.dmp

Filesize
312KB

Download
memory/2392-688-0x0000000000190000-0x00000000001F1000-memory.dmp

Filesize
388KB

Download