da7753e918cd9724db7460f148f52c1ed9d82a26f0d52996db07e4a0265f6d95

Analysis

max time kernel
147s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 07:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

382af56f07093801a0ebdc5dd3591c14_JaffaCakes118.exe
Size

16.6MB
MD5

382af56f07093801a0ebdc5dd3591c14
SHA1

2463e605cf9a141097dd55757a0924a7991d6cb2
SHA256

da7753e918cd9724db7460f148f52c1ed9d82a26f0d52996db07e4a0265f6d95
SHA512

d454863bb9ab6e568d0cea00c1c96756dc35d98a20bd6499f38572cb465d4cd1e29d9d24ce6d37f1cdd873e47b876985d4790e4a9628db961b056227ad064158
SSDEEP

393216:uJjS/1DWcbM4UUx/ldheoiv8S13gFtyLLsJ2rKXs49Lun:MjSNWcQ4zzzivj13gFwDKc49Lun

Score

8^/10

persistence

Malware Config

Signatures

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 1 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	msiexec.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation	382af56f07093801a0ebdc5dd3591c14_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 4 IoCs

pid	Process
5000	TUInstallHelper.exe
2552	TUInstallHelper.exe
3676	TUInstallHelper.exe
2256	TUInstallHelper.exe

Loads dropped DLL 64 IoCs

pid	Process
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe
5000	TUInstallHelper.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\authuitu.dll	TUInstallHelper.exe
File opened for modification	C:\Windows\SysWOW64\authuitu.dll	TUInstallHelper.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\Ico_alpha_EnergyOptions_48x48.png	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\TuneUpUtilities.gadget\images\btn02_stat2_reg.png	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\btn_win7header_dis_ml.png	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_autorumsettings_ilSmall_11_16x16.ico	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\btn_win7header_dwn_ml.png	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_cmDisplayStartmenuForm_il_9_16x16.ico	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_folders_specialfolders_il_2_16x16.png	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\Ico_alpha_TCP_RWIN_48x48.png	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_cmDisplayStartmenuForm_il_1_16x16.ico	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_DocShortcut_16x16.png	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_SysInfo_Unit1_ilInfoStates6_16x16.png	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\integrator\styles\style_security7.png	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\StartUpManager\tfi_rating_unnecessary.png	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_autorumsettings_ilSmall_13_16x16.ico	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_Critical_8x8.png	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_MinToTray_32x32.png	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\integrator\turbo-settings-hover.png	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\Disk_Doctor_48x48.png	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_MemoryOptimizerTray_3_16x16.ico	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\PerformanceOptimizer\first_tab_hover_m - Copy.png	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\btn_light_dwn_br.png	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_opera_32x32.png	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\btn_win7header_hot_bm.png	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\Ico_alpha_OperaSpeedDial_32x32.png	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_Reset_16x16.png	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\Webnav-BG-yellow.jpg	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\integrator\styles\style_firefox.png	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\TuneUpUtilities.gadget\images\logo.png	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\GR32_D6.bpl	msiexec.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\Ico_alpha_devicemanager_W7_48x48.png	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\Ico_alpha_TaskScheduling_48x48.png	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_FileAndFolder_24x24.png	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_Memory_32x32.png	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\integrator\style_visual_32x32.png	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_Desktop2_24x24.png	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_startupmanager_il_8_16x16.png	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\nav_w_o_ml.png	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\integrator\notification_warning_32x32.png	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\integrator\Styler.png	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_FixedDisk_16x16.ico	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_popup_32x32.png	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_WinStyler_32x32.png	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\TUTMSComponents.bpl	msiexec.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_Shredder_16x16.png	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\LiveOptimizer\liveoptimizer.js	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_Windows_Orb_32x32.png	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\GainDiskSpace\taskdlg_button_bl.png	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\TuneUpUtilities.gadget\js\speed.js	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_opera_16x16.png	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_registryeditor_il_17_16x16.ico	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_Undo_16x16.png	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\btn_light_def_br.png	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_TCPIP_32x32.png	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_MemoryOptimizerTray_14_16x16.ico	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_MinToTray_32x32.png	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_ScreenSaver_32x32.png	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_StartMenuXP_32x32.png	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\nav_w_c_tm.png	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\ttt_disk-doctor.png	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\box_header_bottom_right.jpg	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\btn_web_dwn_tr.png	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_MemoryOptimizerTray_23_16x16.ico	TUInstallHelper.exe
File opened for modification	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_Sound_16x16.ico	TUInstallHelper.exe
File created	C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_specialfolders_il7_16x16.png	TUInstallHelper.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e579c7e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e579c7e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9E53.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{FE3997D3-6B56-4AC4-A99C-9DDFC45359BF}	msiexec.exe
File opened for modification	C:\Windows\Installer\e579c83.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDF93.tmp	msiexec.exe
File created	C:\Windows\Installer\e579c87.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\e579c83.msi	msiexec.exe
File created	C:\Windows\Installer\e579c82.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000a79acd07d3da1f660000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000a79acd070000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900a79acd07000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1da79acd07000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000a79acd0700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TuneUp.Utilities.2010.Unlock.Code\DefaultIcon\ = "\"C:\\Program Files (x86)\\TuneUp Utilities 2010\\Integrator.exe\",0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tu2010code\ = "TuneUp.Utilities.2010.Unlock.Code"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\28F2473DA1C1CCD4BADBE0C7C31058CC\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00711705-12C5-420B-A4E5-6413F2AB3C7B}\InProcServer32\ = "%SystemRoot%\\SysWow64\\authuitu.dll"	TUInstallHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TuneUp.Visual.Style	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\28F2473DA1C1CCD4BADBE0C7C31058CC\SourceList\LastUsedSource = "n;1;C:\\Windows\\TEMP\\TU\\orig\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TuneUp.Icon.Package\Shell\Open\Command	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TuneUp.Logon.Screen\Shell\Open\Command	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.tvs	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbs\ = "TuneUp.Boot.Screen"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TuneUp.Logo.Animation	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\28F2473DA1C1CCD4BADBE0C7C31058CC\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\TuneUp.Visual.Style\EditFlags = "65536"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\28F2473DA1C1CCD4BADBE0C7C31058CC\SourceList\Net\1 = "C:\\Windows\\TEMP\\TU\\orig\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings	cmd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\TuneUp.Icon.Package\EditFlags = "65536"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TuneUp.Icon.Package\Shell\Open\Command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TuneUp.Logon.Screen	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TuneUp.Logon.Screen\Shell\Open\Command	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.tu2010code	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\28F2473DA1C1CCD4BADBE0C7C31058CC\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TuneUp.Icon.Package	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TuneUp.Logon.Screen	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TuneUp.Boot.Screen	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TuneUp.Boot.Screen\Shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\28F2473DA1C1CCD4BADBE0C7C31058CC\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	TUInstallHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\FC4E44DD52E725B479AF545C356FC331	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TuneUp.Logon.Screen\Shell\Open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TuneUp.Visual.Style\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\TuneUp Utilities 2010\\WinStyler.exe\" \"%1\""	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\TuneUp.Logo.Animation\EditFlags = "65536"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TuneUp.Logo.Animation\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\TuneUp Utilities 2010\\WinStyler.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TuneUp.Utilities.2010.Unlock.Code\Shell\Open\Command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\28F2473DA1C1CCD4BADBE0C7C31058CC\Complete	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\28F2473DA1C1CCD4BADBE0C7C31058CC\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TuneUp.Visual.Style\Shell\Open\Command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\TuneUp Undelete\Command\ = "\"C:\\Program Files (x86)\\TuneUp Utilities 2010\\Undelete.exe\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TuneUp.Boot.Screen\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\TuneUp Utilities 2010\\WinStyler.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00711705-12C5-420B-A4E5-6413F2AB3C7B}\InProcServer32\ThreadingModel = "Apartment"	TUInstallHelper.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.tico\DefaultIcon	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TuneUp.Visual.Style	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TuneUp.Visual.Style\Shell\Open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\28F2473DA1C1CCD4BADBE0C7C31058CC\SourceList\PackageName = "setup.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.tico	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TuneUp.Logo.Animation\Shell\Open\Command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TuneUp.Utilities.2010.Unlock.Code\Shell\Open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00711705-12C5-420B-A4E5-6413F2AB3C7B}\InProcServer32	TUInstallHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tls\ = "TuneUp.Logon.Screen"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TuneUp.Boot.Screen\Shell\Open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tla\ = "TuneUp.Logo.Animation"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\TuneUp Undelete\ = "TuneUp Undelete"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\28F2473DA1C1CCD4BADBE0C7C31058CC\Language = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TuneUp.Boot.Screen\Shell\Open\Command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TuneUp.Logo.Animation	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\TuneUp.Logon.Screen\EditFlags = "65536"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tip\ = "TuneUp.Icon.Package"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\TuneUp.Boot.Screen\EditFlags = "65536"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tico\DefaultIcon	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TuneUp.Icon.Package	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TuneUp.Icon.Package\Shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TuneUp.Visual.Style\Shell	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\28F2473DA1C1CCD4BADBE0C7C31058CC\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\28F2473DA1C1CCD4BADBE0C7C31058CC\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tvs\ = "TuneUp.Visual.Style"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3472	msiexec.exe
3472	msiexec.exe
3472	msiexec.exe
3472	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4616	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4616	msiexec.exe
Token: SeSecurityPrivilege	3472	msiexec.exe
Token: SeCreateTokenPrivilege	4616	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4616	msiexec.exe
Token: SeLockMemoryPrivilege	4616	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4616	msiexec.exe
Token: SeMachineAccountPrivilege	4616	msiexec.exe
Token: SeTcbPrivilege	4616	msiexec.exe
Token: SeSecurityPrivilege	4616	msiexec.exe
Token: SeTakeOwnershipPrivilege	4616	msiexec.exe
Token: SeLoadDriverPrivilege	4616	msiexec.exe
Token: SeSystemProfilePrivilege	4616	msiexec.exe
Token: SeSystemtimePrivilege	4616	msiexec.exe
Token: SeProfSingleProcessPrivilege	4616	msiexec.exe
Token: SeIncBasePriorityPrivilege	4616	msiexec.exe
Token: SeCreatePagefilePrivilege	4616	msiexec.exe
Token: SeCreatePermanentPrivilege	4616	msiexec.exe
Token: SeBackupPrivilege	4616	msiexec.exe
Token: SeRestorePrivilege	4616	msiexec.exe
Token: SeShutdownPrivilege	4616	msiexec.exe
Token: SeDebugPrivilege	4616	msiexec.exe
Token: SeAuditPrivilege	4616	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4616	msiexec.exe
Token: SeChangeNotifyPrivilege	4616	msiexec.exe
Token: SeRemoteShutdownPrivilege	4616	msiexec.exe
Token: SeUndockPrivilege	4616	msiexec.exe
Token: SeSyncAgentPrivilege	4616	msiexec.exe
Token: SeEnableDelegationPrivilege	4616	msiexec.exe
Token: SeManageVolumePrivilege	4616	msiexec.exe
Token: SeImpersonatePrivilege	4616	msiexec.exe
Token: SeCreateGlobalPrivilege	4616	msiexec.exe
Token: SeRestorePrivilege	3472	msiexec.exe
Token: SeTakeOwnershipPrivilege	3472	msiexec.exe
Token: SeRestorePrivilege	3472	msiexec.exe
Token: SeTakeOwnershipPrivilege	3472	msiexec.exe
Token: SeRestorePrivilege	3472	msiexec.exe
Token: SeTakeOwnershipPrivilege	3472	msiexec.exe
Token: SeRestorePrivilege	3472	msiexec.exe
Token: SeTakeOwnershipPrivilege	3472	msiexec.exe
Token: SeRestorePrivilege	3472	msiexec.exe
Token: SeTakeOwnershipPrivilege	3472	msiexec.exe
Token: SeRestorePrivilege	3472	msiexec.exe
Token: SeTakeOwnershipPrivilege	3472	msiexec.exe
Token: SeRestorePrivilege	3472	msiexec.exe
Token: SeTakeOwnershipPrivilege	3472	msiexec.exe
Token: SeRestorePrivilege	3472	msiexec.exe
Token: SeTakeOwnershipPrivilege	3472	msiexec.exe
Token: SeRestorePrivilege	3472	msiexec.exe
Token: SeTakeOwnershipPrivilege	3472	msiexec.exe
Token: SeRestorePrivilege	3472	msiexec.exe
Token: SeTakeOwnershipPrivilege	3472	msiexec.exe
Token: SeRestorePrivilege	3472	msiexec.exe
Token: SeTakeOwnershipPrivilege	3472	msiexec.exe
Token: SeRestorePrivilege	3472	msiexec.exe
Token: SeTakeOwnershipPrivilege	3472	msiexec.exe
Token: SeRestorePrivilege	3472	msiexec.exe
Token: SeTakeOwnershipPrivilege	3472	msiexec.exe
Token: SeRestorePrivilege	3472	msiexec.exe
Token: SeTakeOwnershipPrivilege	3472	msiexec.exe
Token: SeRestorePrivilege	3472	msiexec.exe
Token: SeTakeOwnershipPrivilege	3472	msiexec.exe
Token: SeRestorePrivilege	3472	msiexec.exe
Token: SeTakeOwnershipPrivilege	3472	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2336	msiexec.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 4528	2092	382af56f07093801a0ebdc5dd3591c14_JaffaCakes118.exe	86
PID 2092 wrote to memory of 4528	2092	382af56f07093801a0ebdc5dd3591c14_JaffaCakes118.exe	86
PID 2092 wrote to memory of 4528	2092	382af56f07093801a0ebdc5dd3591c14_JaffaCakes118.exe	86
PID 4528 wrote to memory of 2960	4528	cmd.exe	88
PID 4528 wrote to memory of 2960	4528	cmd.exe	88
PID 4528 wrote to memory of 2960	4528	cmd.exe	88
PID 4528 wrote to memory of 4616	4528	cmd.exe	89
PID 4528 wrote to memory of 4616	4528	cmd.exe	89
PID 4528 wrote to memory of 4616	4528	cmd.exe	89
PID 4528 wrote to memory of 2336	4528	cmd.exe	92
PID 4528 wrote to memory of 2336	4528	cmd.exe	92
PID 4528 wrote to memory of 2336	4528	cmd.exe	92
PID 3472 wrote to memory of 1136	3472	msiexec.exe	96
PID 3472 wrote to memory of 1136	3472	msiexec.exe	96
PID 3472 wrote to memory of 5000	3472	msiexec.exe	98
PID 3472 wrote to memory of 5000	3472	msiexec.exe	98
PID 3472 wrote to memory of 5000	3472	msiexec.exe	98
PID 3472 wrote to memory of 2552	3472	msiexec.exe	100
PID 3472 wrote to memory of 2552	3472	msiexec.exe	100
PID 3472 wrote to memory of 2552	3472	msiexec.exe	100
PID 3472 wrote to memory of 3676	3472	msiexec.exe	102
PID 3472 wrote to memory of 3676	3472	msiexec.exe	102
PID 3472 wrote to memory of 3676	3472	msiexec.exe	102
PID 3472 wrote to memory of 2256	3472	msiexec.exe	104
PID 3472 wrote to memory of 2256	3472	msiexec.exe	104
PID 3472 wrote to memory of 2256	3472	msiexec.exe	104

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\382af56f07093801a0ebdc5dd3591c14_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\382af56f07093801a0ebdc5dd3591c14_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\Temp\TU\setup_ru.cmd" "
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4528
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\TuneUp\Utilities\9.0" /f /v "ProductKey" /t REG_SZ /d "X2A702-YAEJNF-XV76MV-EN3TBY-K22E15-86NEX1"
    3⤵
    PID:2960
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Windows\TEMP\TU\ru-RUv\lng.msi" /qn
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4616
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Windows\TEMP\TU\orig\setup.msi" /qb-
    3⤵
    - Suspicious use of FindShellTrayWindow
    PID:2336

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3472
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1136
- C:\Program Files (x86)\TuneUp Utilities 2010\TUInstallHelper.exe
  "C:\Program Files (x86)\TuneUp Utilities 2010\TUInstallHelper.exe" --setup-extractData
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  PID:5000
- C:\Program Files (x86)\TuneUp Utilities 2010\TUInstallHelper.exe
  "C:\Program Files (x86)\TuneUp Utilities 2010\TUInstallHelper.exe" --setup-createShortcuts -IntegratorShortcut 1 -OCMShortcut 1 -AllUsers 1
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Program Files (x86)\TuneUp Utilities 2010\TUInstallHelper.exe
  "C:\Program Files (x86)\TuneUp Utilities 2010\TUInstallHelper.exe" --regwrite-serial
  2⤵
  - Executes dropped EXE
  PID:3676
- C:\Program Files (x86)\TuneUp Utilities 2010\TUInstallHelper.exe
  "C:\Program Files (x86)\TuneUp Utilities 2010\TUInstallHelper.exe" --setup-install -TrialPeriod 15 -GracePeriod 3
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  PID:2256

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e579c81.rbs

Filesize
12KB

MD5
947ceec43160521108cd7d5ad4ada2ed

SHA1
31a6f51b906839ec29eafc75d9ee61b179071789

SHA256
9f854ee8ddcef0b7189a4a9b9ac7a91b03d453e2f61aa5eab044d1b2e65abc16

SHA512
7eaaca3efb8e85f704d05df3a72b03ad2f4fffd90200581fa16e43270d754ef559744ef33387ff45a8a8923a4fced8ff4dc16a96d5f281ae421c3570fc6e71e7

Download Submit
C:\Program Files (x86)\TuneUp Utilities 2010\data\PerformanceOptimizer\Ico_alpha_Effects_16x16.png

Filesize
742B

MD5
d3b4203a4f857df115b441d62b918c88

SHA1
8be56e648d1391935535a32083483daa81dd2483

SHA256
ae5c43fe36af666e633eca4c00796d59cf8e876a31d4c05eabfad90096f7c101

SHA512
5eb776536d5a1bad6b34cc5c99458c24143b44bef24001bbb3b52c79dba79d31033f7ecbe689712c6a83daa1ae9467772810bc0b7778a59bcc51c4ecb4b4419f

Download Submit
C:\Program Files (x86)\TuneUp Utilities 2010\data\PerformanceOptimizer\command_link_hover.png

Filesize
722B

MD5
7af65707e275d0e50d86499f6a06fc70

SHA1
d2f85fe842c83c737e926432c17ffdb0a51ed416

SHA256
768a976b15d29738ff54bfb3a781791740485c39016725d2214cd63128e9df9b

SHA512
944919998e321ecddbbe5a1fc4c24f37c73aa02509da897acf99a153473bd90e9010e233b1b8a1d78f7fac9992a772f500c8e01a29bd316515921702a2752a6b

Download Submit
C:\Program Files (x86)\TuneUp Utilities 2010\data\PerformanceOptimizer\command_link_normal.png

Filesize
722B

MD5
1c55d16533f6c803f31e591f23b75793

SHA1
4ef111d0726e12c785c8a6b7c738cf73b4c3887c

SHA256
0a7ca1f44bf498ad298af212094136331d1cf4461d46aaf38ba3fdab58568fea

SHA512
546333b7761e1c15eff2e1c82411c72e60f60a9736379071f1e10ef073377f2965edcf7507dec856a77688bbcb20a11ba626856306ccfc7ee1ed854a177fa3b7

Download Submit
C:\Program Files (x86)\TuneUp Utilities 2010\data\TuneUpUtilities.gadget\images\blank.gif

Filesize
43B

MD5
325472601571f31e1bf00674c368d335

SHA1
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a

SHA256
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

SHA512
717ea0ff7f3f624c268eccb244e24ec1305ab21557abb3d6f1a7e183ff68a2d28f13d1d2af926c9ef6d1fb16dd8cbe34cd98cacf79091dddc7874dcee21ecfdc

Download Submit
C:\Program Files (x86)\TuneUp Utilities 2010\data\TuneUpUtilities.gadget\js\jquery.js

Filesize
127KB

MD5
d098a8b737ef54dbf44053d6ab4b3397

SHA1
ef4458c1ae31e730fdbc55bf65e5a5934c48bf2a

SHA256
0352f0bc70e556c9a91780281c496d8c67e662352994f838b734bbc8f176c7c1

SHA512
272776247da67ab0342bc3e855361a930d964e4c894ae9de36e43af4cb7313efa1fe04d99dd7a2928a7889d95c7969afe1b29354d99ab024ff9dda49a9f1c984

Download Submit
C:\Program Files (x86)\TuneUp Utilities 2010\data\UninstallManager\ico_alpha_Info_16x16.png

Filesize
636B

MD5
77b6b258ef82300655c993d71a8fcef8

SHA1
42d32eae292ca3475a887411cac038927856c176

SHA256
348fdac69629adbd736bdaf4d4ee04f196636178c91f6cd612fb6e6c09393ba3

SHA512
94daf41bad6553e9aa031fd5ed018625d62bab5fcc5b27d40a8f5533f276f187ae98767634a320d6096f4bef08789fdb223b9fb0bc535b813db4ff96c3cc055a

Download Submit
C:\Program Files (x86)\TuneUp Utilities 2010\data\UninstallManager\nav_bg_light.gif

Filesize
29KB

MD5
a39323dc5aebe5698862532f6a0b78fe

SHA1
5ba724f9903ae79ccd2ea4b3affc1c9d868ffbf4

SHA256
83dfb81aad84d3e8336895f741032618aaccc25f89fa4e45a535bb4620b036a9

SHA512
cd758e58662ab2218ad84039672577c8d1eeb2681271e63ad920980987f8077a9f3e499143e00dffe61d8f1563ca10261a3bb443656c2f45ee4b71b496175213

Download Submit
C:\Program Files (x86)\TuneUp Utilities 2010\data\btn_win7header_def_tl.png

Filesize
117B

MD5
cdbc03b2d2772d453167e6d0a100d3aa

SHA1
00a2245fe0b460b9680ed1cd3308e19293764cad

SHA256
b21f17716cdb5543c0783116509dc8c0543d794830fda541e256cce365a8e815

SHA512
b313a4b49fc56ad698492e78215e506cf4343db4e4923c7295606a395a97723e99600a39cf39df3af6f5f8f779bf3dbdd7525ac818eef554afcbe8b8eb42b7c7

Download Submit
C:\Program Files (x86)\TuneUp Utilities 2010\data\btn_win7header_dis_bm.png

Filesize
115B

MD5
1aefcb685ec7f472775b8828a3ac9f59

SHA1
3f33824f7e387077a40910f1f6126fd32ae8b599

SHA256
4d2975dc53dbc056890d2ec98a9904a05b973645e2685fcca945c9160b8e05c6

SHA512
308bc1773e0bdf34656d118d38cbce0ba6e886c6e4ed7efd96c7148f9b068d9bb2e94617db566f455dab26a376de5a4869b5bfc4d51e467b10523bea4d05ef74

Download Submit
C:\Program Files (x86)\TuneUp Utilities 2010\data\btn_win7header_dis_ml.png

Filesize
119B

MD5
f3ac032bad004c31ec20b87e28a942af

SHA1
fbd0415e14f8256ec2befb78b10c111144e98949

SHA256
6cbc7f01f841918d54c38edfac2183510a0c04d0ddc830abec77d45bd6627dcc

SHA512
019e35ce5427069b5879463e3f3936a3e7f0080947ac9e0fda9bd40b4b263a31eed4a2528d63730a97515d945d6adc2fcff261ad0cb59917496b94039c894ab2

Download Submit
C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_QOS_32x32.png

Filesize
1KB

MD5
6563ea1956040cffe40580ecb78f5734

SHA1
fa1331b5e523781d0207819366a74b8fadbd8466

SHA256
3550f9c49de89f210878d6d634f76d8a2a6b9ea6a1ab6b8511d1ec94fc43b860

SHA512
f684508e403e7f3999dc7c1832a029b5de9f990179b4cd962ce8b8b4c73fc67bd88233661d53febfd3882ccc5591e685caa39ada688407760d58434c1d8d4060

Download Submit
C:\Program Files (x86)\TuneUp Utilities 2010\data\ico_alpha_WindowsUpdate_W7_32x32.png

Filesize
2KB

MD5
ea05ba9f693e3897ed5d3e39daf67a7c

SHA1
263a75cc5ac0389afa3e9e4196ce8599706787fb

SHA256
a3e18aff9c8762e26a32f40542117e4b9dcac035b1704fe70bb5f3e38c6e6a3a

SHA512
ffb9baf6831039fabbf83ead666a54f3eee1c8d9b623324ca4c173289374f9ddbfe96046a9f04b02652ba07ee05268559e261c0a00a630a376378ada7581a10e

Download Submit
C:\Program Files (x86)\TuneUp Utilities 2010\data\integrator\DiskSpace.png

Filesize
1KB

MD5
181337f74710ba98996e645001e4e902

SHA1
380a30f0d0939f29af257fe18aea56ac2042c189

SHA256
7ba0d5c2b53ab78568970296dcf4a003bf8c68ca04f88a65739140dcd6b9e4cd

SHA512
e40fe29b945099565de9d4fdce8d4992fe9ea32ef7d8920eab494c8de7d8afcdbc3863cbe75b4fcb3f0d07bb858d4c904aa2762cc9854d5124f99b7ce815dc35

Download Submit
C:\Program Files (x86)\TuneUp Utilities 2010\data\integrator\HighPerformanceMode.png

Filesize
1KB

MD5
56a41906cc41b5c81d7ae2ab9c62ec44

SHA1
6dac54ead07ef39ed368c0cb95a6f3a5252a37be

SHA256
9cb9ad4881a06d268389ebfc878c620d926951075497a4e5360ca01d58aa59a1

SHA512
b1d6645ada2639118274e340cacce743cdb8edf37b6f0daab5f36fd0386b8d8b6c3f492953966d667473e20c3af70ed0aa153a4a5ed1ce9f8023f483b97d0947

Download Submit
C:\Program Files (x86)\TuneUp Utilities 2010\data\integrator\RegistryCleaner.png

Filesize
2KB

MD5
865ae348fe3e6592fff6b426fde6f1f0

SHA1
d2e4a66ac1a95742e4eaff4781d9602445eacf67

SHA256
a3245631e50b5fab7ea9023483f90546f137b203b1033f8980ab878accb71898

SHA512
75f627f4d403d84d6ec959ae288dac4d7c8084d8ab52a64936fdc67bc8dbd0e1a76d7aab3a7b5b77c6b363af10d22dd4759cc5bbc7cc50ab2b5221f5257780df

Download Submit
C:\Program Files (x86)\TuneUp Utilities 2010\data\integrator\Schnelloptimierung.png

Filesize
2KB

MD5
78c6ce6ee7e9e02f717f5db4f94c3657

SHA1
289f52deec526d8958c077a74be25ede22a43edf

SHA256
8542e0794abb9e9934fa267ebf39787b6a14f17fa27a80900d72c823602d7fa9

SHA512
3d8ad0f5cc4653be2a2b5d0eb1afa289fbac7d671b021a442e07ecf9b945bcf7c207beddaa76304f90ee192f091791da501d65a3adbdc1b5005745018bb5bf0c

Download Submit
C:\Program Files (x86)\TuneUp Utilities 2010\data\integrator\ShortcutCleaner.png

Filesize
1KB

MD5
8986b4bcdf619d4ad2398bd910a391c5

SHA1
cce87ec17ab9ac3ffc442080e124f503b50c313d

SHA256
ae1081485ae29db55848c9f1b84ca14983d8035739c21985433f4c86e2e8666c

SHA512
680e36f2376edbb86e0eee3e49d09a02dfaa340bb7062e9ae2faf5d41341066c90471cba609c58d42782e164c8fca832c25e3eb12a9c95d7c071dc9adfdca4af

Download Submit
C:\Program Files (x86)\TuneUp Utilities 2010\data\integrator\StartUpManager.png

Filesize
1KB

MD5
9fa8a731084f5f7eb7835c30fab48920

SHA1
9ac2a0322ead8bb5d9fc368f90bba7cb511028bf

SHA256
389c782fbc0bc4472772316f6c953edc080dd484ad73a517e9b69143ed1e3fc7

SHA512
131c327e642261aab9f1292943c4b7148269e7483ac3aa0e0baf7e6de66dca8fc5a670eac6eed50c92d5c2a022678d96cafe3ebf2d31b4679907128fd1ebe899

Download Submit
C:\Program Files (x86)\TuneUp Utilities 2010\data\integrator\Styler.png

Filesize
2KB

MD5
7b1bbcbcc38ddb8926cbfd0d1f5590d0

SHA1
3e95cec724b56618eba67a6d63fafafaadc2cdb8

SHA256
37f466ab9ad0c692556c11a744c776c8fd8ebcdb08a08b2d0194d0d9186d8fae

SHA512
0d79a08bd301e87e0bb9446018d3a17255bf75cfc7543c644c632266dde534565281b9b85356f55563661f668730b0a5c6345be46587ae7e93b4bad2ab9bf165

Download Submit
C:\Program Files (x86)\TuneUp Utilities 2010\data\integrator\UninstallManager.png

Filesize
1KB

MD5
af5aee5228a3d2d4231304d3fcf06644

SHA1
0b6087de58622facaee7aa4e8b48da6606a31b04

SHA256
64eb7b11256677d37678c85a2e9dc6f9c16a67d030e24bfa8bab6465e99fea66

SHA512
f4a03892aa4c8098bd479b01336e4f7e029e6de6661ab6db78bc30de64df74e831a64ee2870c8d79f7460a185aae27c27879125d9900345c85d072d553491122

Download Submit
C:\Program Files (x86)\TuneUp Utilities 2010\data\integrator\empty.gif

Filesize
807B

MD5
925ceef2b2ece13b5c0429a63fa41bd2

SHA1
6e14417b697c88c3617464ca1cf7905e3d9e76da

SHA256
37a5915c0d646c11ce352461989e94e61d09ebc7d9064a7161bbd37a82748b79

SHA512
01ab4931aeea6ea03b178e86a4d4daa563cac6267db7650347db2eaa4156819076247e218b3a5d0ee01750eeee41d81d40f66e09a0363ac2948ac3081b4f6009

Download Submit
C:\Program Files (x86)\TuneUp Utilities 2010\data\integrator\style_startmenu_32x32.png

Filesize
1KB

MD5
82abe87401f9c0ea2f0ae3d56ede83b0

SHA1
9a56db98cd95ad1fe2939e0266c76e6265a8b5c3

SHA256
fb1ca995d6ad53da571010a08bbf828612bac176ce2c4d15a185f70468e03916

SHA512
270c85f84084c5dbb39eb319ac4244bc6daf90a0a2a35964b42e1a694251ed1fd4e4214aa544df4afabe02c5896f7e4f9f39fa27c8dc1d57ff993e7f99e37de9

Download Submit
C:\Program Files (x86)\TuneUp Utilities 2010\data\integrator\styles\style_bootscreen.png

Filesize
2KB

MD5
86b2ad055fcdb22c9ada7580673c1813

SHA1
1ef722b6933c2f9fde365ef2cd3bac1c752f15fd

SHA256
0a5942feb2ad5328ce3bae7562941f2fb2db9576582b9f4338c8f69e8a1b17bc

SHA512
f0b0328975a5531bda9a786d10ad5bb403f6d23dffe4898fdc45a1623194ab506af23922d725d9b3561228c5266949983625e598e7d24ddfd14f7698ff51cae8

Download Submit
C:\Program Files (x86)\TuneUp Utilities 2010\data\integrator\styles\style_logoanimation.png

Filesize
2KB

MD5
d925a2087758ef0126973fb6da3c1f65

SHA1
1e0ef77f58a43284d573b077e7e8db0f7bf0265d

SHA256
f2a06b42ad0b67acf909392cf8c6ab3f3d9c500e98c733af0dade57e72f53619

SHA512
8ace55a0951228f234f710a6e21843150c6750940313135f5f1d477b30cb39f929598504a1958b8ffc9f0ddbe67bb3e6b1c4be9b0184dee78cff6d2fdb536043

Download Submit
C:\Program Files (x86)\TuneUp Utilities 2010\data\nav_w_c_bl.png

Filesize
147B

MD5
ec99266921d19bf2bdb4531e00a5cc4d

SHA1
d135875c75b94b315c154d43785604b5b94863e7

SHA256
aa2bf16370c85f25cbe4b81ecc0342e5eb1c826353299ae5420aba3ccc10e41d

SHA512
d1c07d55b508585ea476eae87389ac8589e3ca40ebd368d8738b9dd175b6aaf548a8f7050d979af62df3d89528cf39df8a03fab5dbc2eec38d325fbcd29ae78e

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\DiskDoctor.exe

Filesize
140KB

MD5
a6d7de55ed0134648b8d4c2c48085dee

SHA1
64f48afdbd9ab35656b8975d962ac9c05bafeb14

SHA256
39c8fff9fc877d97c73f8f1d2ad9ae716282e49a6a810441a802199789ad5e86

SHA512
917a87a1a4cbbf9a4c75e253c338d132d4fb3dbd682c0f15359f3963d21cfa8a8dd3c4d818c37caec7221768777b768ac10ba06bdc524c5fe9f5510179c419dd

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\DiskExplorer.exe

Filesize
425KB

MD5
173b3744febbd6aad2001a4bb4736d34

SHA1
1422741a2cdf669ccb3fc527bfea9ef42a505119

SHA256
cd401f406e943a76c3fcff6ba7eae8f0f6a15cb0a4c2a596040500616b766560

SHA512
73a1a189eb0f2f4607aa5047803469a075381c317a74e802ca56a3ecad3b42a053e747fabe2fb508d415a8d969a6ad3e61291a72f9bebe78b293a819099462e0

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\DriveDefrag.exe

Filesize
240KB

MD5
97f4c8864ecf58ddaabeeb287567dd5b

SHA1
9251f89f01b84dd9699dd94ec3ac5e24b6195be9

SHA256
1e61e7801ab1e4921f91098b9073f0820308eda6be0f90f234874817d5ee406f

SHA512
6968ad78d39303ee1b98edba9160c5defdd3a955fcfac33fe0e4084f2f8bc4d8d8aaf41316edd73341c4d4e8573c4098e9c670a6fb4276d47720e9ed4d93d746

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\GainDiskSpace.exe

Filesize
568KB

MD5
ffcbf377fdfd6da16044ca2ec8bc57e5

SHA1
d9f8b702718486f8f55f372e286bbd21bffbe4b7

SHA256
5f6b168a420af8da31e30ac508d250d54333637731dae7ed276cc391797127c2

SHA512
8a9ed6773ae694563d7ede43d8470ba84406a6d0de7486e006e558138b35b8579fdb91406025cea0ec51c5a7eaeaa9dbb2241b5029a261d7225319a01680b8d8

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\Integrator.exe

Filesize
564KB

MD5
bf333444a0454dec16e237f043bae406

SHA1
d0db8ad3bacb8154f98f045396c707c488a03039

SHA256
9291c1d479cb4b4996020fd676dba1eb1f09b3dee8667bd2a615bca35dc2c1d1

SHA512
4d2b267d4ef134d3f991ab51a1d6ef83a2039926abbef4874adf736ad31b0d8987d369107aa061c37852d8e96b606638fe83c461ec48da0a582e0eaea6dc1bd1

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\LiveOptimizer.exe

Filesize
145KB

MD5
032fd58c65ecbd9d5d02d818b667619b

SHA1
1506accbb07ef750c47f40a6279d4592132e3733

SHA256
08ab7c7d8137c5dbd289af7a901d1c9749038282f551fd31db0ff0d6e8456946

SHA512
bab1a5340463e95c2654d39929827f6a6f846af3fd27a2a34fc17a9767a48e2e4779368168f04190a499042cf0109095155be4aef375ca6158f1f71cfe776a59

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\MemOptimizer.exe

Filesize
109KB

MD5
ad011cd0e8c54913b36dc9606a041882

SHA1
4556d20eba6511b7907950b37b859204a34a5abf

SHA256
d6ee6f430843f8c241bb024ea50cb8f750005b646e4d1e7ad8906c2c523a0194

SHA512
0093d9a8a0283066aa0d0dc85f50230ba4811742f6a7e04f29257cbe10cb3bfc4a51ff585ad8b8b2a92aedde917a02a163ce1f2cd4ed03f6e7fbf4b1a498dabb

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\OneClick.exe

Filesize
632KB

MD5
654fa21be9a7c00ac72d1fd572bb09a1

SHA1
e3d2cde8aa753b7f8d97e03959bcab57df467107

SHA256
2543f72177c6f4a5c1cbf20d86caabc1ff71cfc981482bcba7995e0634339c49

SHA512
50e98ac99850f17d30362f853ca99a85ace6728bd8fb93edd09794b0146b51574426cc839ec9e15e4418deb7c40052bf4872b8b9641feefa28215e05e9a7ed49

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\OneClickStarter.exe

Filesize
340KB

MD5
6429a8d7fdbf0d36f8a14cd913ff99fd

SHA1
d823cff8edbbda7730c534ee7eb05a731e96d7f7

SHA256
b05e20646104d27b0f0d7512c9b635c0617e88c4c86e602fb938c8421d77328e

SHA512
5887080de12596a9b624e121fef6d81bb589071b13c853c01e9eeb823839c54bcab8b819b8572b4f14d0b08edfadd3d8bb7c49856d6089e481f0447b80a3b7c2

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\PerformanceOptimizer.exe

Filesize
533KB

MD5
4affcb4f5e0d0450e86cb8c88423cba9

SHA1
fd20dffbac48de75fd61c1cc20c0a702bfb30396

SHA256
893a77136cbb1bc05210b5bdac9a1707d1b9d90b2ee9e837392380ba669abf10

SHA512
a20cb8769c263bbc39cc1ef4f7ef33c24baba2e1bca72d8e8ec31702b0aac7ed87c43c8f5b7368f0e309dde9e2a08dad689fb9344bdfaa97e83e7b72293f9b36

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\ProcessManager.exe

Filesize
354KB

MD5
9f39adb192aa486a05cdf5131b7d1ffa

SHA1
89b44654a2970aecae0b9a8dfd230e99de8d115d

SHA256
783323c2f203acb02fa55a9fcbfaabcdc65d9431d825a624196320030667df13

SHA512
3ad00156d5f97d59d7fbf0144519e56d9b896697c99c1699140f9d0c0ca0dfc9867520b6e65811c6251d11d3fbde13ff5ea0a7f5fcd871df0af39ebf3ab43ed8

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\RegWiz.exe

Filesize
102KB

MD5
567c5da417fb3432e21700c355b0d6ad

SHA1
7be7af255dcd55ced9da9f56a6bab465cf9eacf3

SHA256
916438026b42887e3a889b6afef5887e81dbd9cde7ce74812ff7213a778918f3

SHA512
b51072525dd373021f6b2dc042b056f2c51e98a3a79871e08983a72805f835770d02fdac5091abdaf3b3e4082b0c92491d8a50c094361fa41449ed76f1eb4405

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\RegistryCleaner.exe

Filesize
303KB

MD5
041c462f37704421ff2616af41c86e85

SHA1
9c2bec57dd94ec4e12eaa5a2ab6dd8f7a52cc629

SHA256
5afcaf203b4d39fd8cd3982f734a82a64d795f42db326bba0872f404648e7853

SHA512
ef1f52a636d578a79d602d385f369aaf15bce614bde70797100a94f16670e6ab48b3b4a897dd1a49990035bb4679d990c51014245924ae835d33bd1f18676061

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\RegistryDefrag.exe

Filesize
141KB

MD5
4203643911776f2eaf0bd9f89d3e2419

SHA1
aef495c1b108954c7c50fc51f4820c942a9a883f

SHA256
91b126802f3273105a6f74fbcbbe0592a0fb5d4e7a40f0b7c45f824ae6e41af1

SHA512
f574eff2d06130b88380021ea9e56a6679b227f065c47d95db7c40969abbe52b95bad0d0fe657044f60f2488de2a34ce7915996613bf7263002c2e7ee5adb3a9

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\RegistryEditor.exe

Filesize
307KB

MD5
7e4dfe7472d4cb404355bdb27fb0069a

SHA1
360fe6eefb6cd709bb27c1c34518a75ca5eb6d2e

SHA256
4234a0e4121ff6d7e3ee6ebadd581d9cc1be0e540d8ac4255fcbc4907778bd46

SHA512
84e4fd369fb69c5ebbe68b69a595c0b01fa22ca7d3a0d56192e21eadc87850de6b702dd274cbecb43c1aed174b58723c481cc071ab66a91cfde805d18f8459ba

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\RepairWizard.exe

Filesize
152KB

MD5
e40c2be4aa32f84f6511c2d9ea18369e

SHA1
2a4cb8a2cdd7a6a7427dd1f997a712d70ba362d4

SHA256
d0e3c783ddf0c7f0cb50f42de0d4e4453ebc8e685d8aad58fea6688d369fdec7

SHA512
015e6817c51dee160c08710d2df3d4cef22f0e22bfb9734514706103e625520fe5ea540ea40e0324a1e9b46dd76e39d760aef52a1af96bd927ae996101832c0b

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\Report.exe

Filesize
139KB

MD5
c55cb38c435a5644d56c1d2185defb47

SHA1
5f6a759fb414b1f83b21e25b03dd0dd50215888f

SHA256
eecccb8ac60ec24b73e0cf0333ce091c034365bb419d8265191129247c22f3e5

SHA512
847803177f0a9a9b7f7d116b0da791935eb0417e93615a74a5dfcd38dcd3b9529beb3bc408bea6d59ff84059577d3deb1da4f3f67050b20a5e87ad85d1d5a321

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\RescueCenter.exe

Filesize
169KB

MD5
cb9068e86fb3b92b7f13e93e606b22fd

SHA1
17ac47dfb5753aff266fe5d5a53e25cab44e862e

SHA256
5769d65841dd74539c463e4ba85a5cce2e8a8b6c27703766742ca9816631c946

SHA512
3690efa1a2c39c3fab64bd96ee0fae7349307bcf835d052932d6ca635b45ea327e343848c1cef5dbfc1b51f290470ad6e460017a05b072760ad9804714a77fbc

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\ShortcutCleaner.exe

Filesize
240KB

MD5
eac0b1e73566840dc0bcfa85b53685dc

SHA1
e9e82e29b46864eddd4f1a576939184840b8d828

SHA256
2c40036115901bee6f4be73bebf7aa0aa6eaa93bdd9a82b6853cd4f311c34029

SHA512
877ebd1f0467a5248adc4b303d57355ed116b8a23d08c018638587baad71a42b3df89887eb07761d61203d716c920092160ce23fa2fd44371af39c2fc942d008

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\Shredder.exe

Filesize
145KB

MD5
70f4fb81947224b06791f6e32f5c7b01

SHA1
32c6c6266099525ca6412db3703896d2cf7ab9ff

SHA256
e5c20dadf8fba5c01808bbe0957d81b98a1ecf680c321beeb5de2362416ff140

SHA512
52814bafc6c79e114dd26456b96f4145eef656b792ee995cd0932b6545c376506193b49bc5e399f026afd5644bbed4547caa912e4fee0dc9ef3f258ff8e94c0c

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\StartUpManager.exe

Filesize
302KB

MD5
a0254695add5f49a90961c5c16eda0bc

SHA1
a8b2c95f2ef4ea4d5494a728b6c35828836bef8c

SHA256
0dccb171aba622bd88757bbecf19c23dc00018520fc3fd2a2a860daac6b6c63f

SHA512
f4b90c4ff010d1a351ebd29257fb0c789275496ab85936c392513d0297fb08b9b54e96db99ef9aa78bbd89b1055cd6922388ffa94e8284f7d490f8d22943e0f7

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\StartupOptimizer.exe

Filesize
450KB

MD5
79a845c8657c731f1270d3d6265ac729

SHA1
858d4342955c74f822f65002842948c5d810b5d0

SHA256
8c82570bdbaf553a4370aa96ff56b7859821f8a59c03cc4a3ea9cd92e74d9edf

SHA512
ecf9ddbe5f0b936c015e5518cd955fc77383069079251ed5f5dad20beee31cd75b626873a9ce4eb0fc56fa88b93b110214239fe4dd07a9879721ce03bafa3f64

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\SystemControl.exe

Filesize
117KB

MD5
eb879c22b9be3a042a1fa8d1d9ef8c9e

SHA1
668d55b210e442bf38d02a5fbd5d2ededb6538e4

SHA256
249845c9def6901a86545f54f350ab631a51caeb0eb244c4c25d8e2738a31a7e

SHA512
f947be435d109f237d944481e856bfba13c17d88dcc2308c58e083a3221bff88f74be954f4e6f05536b2d9e4a87515fd6c99feab7245f066fb6f8c999265fabe

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\SystemInformation.exe

Filesize
291KB

MD5
7f3a0c894e7ccd6c0527100b89e0c8b0

SHA1
cb1be8dd15448dd2da9b2356ba0ab8ed52396572

SHA256
98afb266a39992db0f12b8ea58c2f02fc9e6f471364a68ef6b14c380e92fbbf2

SHA512
2e4d1758012259ca7bb8e892d4a901798708ba062b91f6c33f72c61cc359dce4724bc9e3bb80250a71ae75e3503862061b3b8247048cca7eb08050b97d3a3fdb

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\TURegOpt32.exe

Filesize
29KB

MD5
88fbc25662bb434a8eec53f6ef94067d

SHA1
da01d180c141d79816cffd19350448ce376c2e7d

SHA256
ff83762f88842d4fa35f117a2e35692257cb99864f9d5bf4221951af2e21d405

SHA512
4a1d1c236574f3363afda0f26e5892a4a40dee97a6205e3bbd977934aead48ab222c04c6cdd384d2e6aa8b3999c65a3e63901f3d45b49499c113c3eec35b13fc

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\TURegOpt64.exe

Filesize
33KB

MD5
799d54ee7ec6162166ae3fbc8a017683

SHA1
a96b45387909bc73efc197a0b4d70d1bdff9eacf

SHA256
bd21830d91f36550bc0d8aed37d8318141801968b2c20d2491196ca2a0bde95e

SHA512
2322777d458d5b5f86a8984e51dc95e5fb2925880ebb3341d83a0ca9672bbf7d7e478eb94268ec73f791d1b7c96073f16577006cf74de65676c8e48435a8bb6b

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\TurboConfig.exe

Filesize
118KB

MD5
752547c36f80a67eb9ad301d0276652c

SHA1
cc87fafddee7a0ed57b8abe1bd962ea761a34b39

SHA256
fa2fb2b4bf5bcee662d92c001723d0d2a00499cceb0726c173d5c03e5d3ac76d

SHA512
010217b6a7ac7474c6786a58abde33705be60d806d26c0375c9d188fa4ae32ca9183f24584958edbb280d7699e2c8b1b3564bb109fd255075ceb85abf5cc5308

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\Undelete.exe

Filesize
202KB

MD5
9b4fd6953cd020af4ba3edaeaa061708

SHA1
87347c9356533e4c7465d63212c62199f9ad6481

SHA256
6ac5af4e4d1ede9303f234d052bd5e328c2c6634b8b2ca2a532e0ae3c9c3266a

SHA512
bbd066a9161939e5a938e46d64d8c7d9905ed34cf2ae00a9abbaa7de08e336af4b505e45feb5b0f6efdb54507e81c20f784e5665964ce442d09b299fcdb8934e

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\WinStyler.exe

Filesize
925KB

MD5
75ccb2345cc2850e47e16fc492519aab

SHA1
72d4dc8a46346ee06c196175978691821b8778af

SHA256
8dbec3a9bbb36d8328b1047cec6e2a1282b5452812ca32ed78c86d0f91ce793e

SHA512
68339817212e7109f6e788fc89e25f434bea0bf1fc58cf752bf39482b9feb24feec936d3f2556ffe12c9bcf3916bfe2b067a0e127567c054aed2f913332c54ef

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\cmCommon.bpl

Filesize
41KB

MD5
e84ca5eab814a120657f24b942d7dad9

SHA1
da3ff4c037e8b332790fd709b1e4f10fcaac5b35

SHA256
cf24f359de54260de4bec6a1307b0c6a6255bac78739deb19dd56770b2fe8d25

SHA512
7f894f43bea27bca722dedb5111671508163602dd0f63b41b7fcdb7cae5f14f9015adac19b6c06d36073e72e795368d1f301a51a271a108b0be8b32cf4865fa6

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\cmDisplay.bpl

Filesize
327KB

MD5
fa85a62e40c6449f9ad2f4e545cb581c

SHA1
05df7aa2d12acab9d507e9303ade689bc3e6766c

SHA256
25e188541d7e9fedaf2e68354eefee881f7c57203af952cc8d81375aa7df340e

SHA512
115019e2b272b1d1670f48d753b544a98c6c90990dac93ce0ad81b8d179d963277d8bf4bcbf0859b9202ad35dceaf4a7a5612493ca5943764e27ccdd950bacc9

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\cmNetwork.bpl

Filesize
422KB

MD5
b7f1f4047cafc20fd3c70fcf9df022a6

SHA1
51ea43a1a638249fcf34416ace64a833c9d76746

SHA256
2b5407b12b773b26a63c467ed381e1bc8fe57dab41a74908ac116745e922cd99

SHA512
fc8fe1c081597e89f3944840731498d98e5606010583766ec7f25d050fa28bf45b13c6d5d7c9b90e35d21e7c2234286eb8c3568d5515c7219d90ab1a120a45a7

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\cmSystem.bpl

Filesize
387KB

MD5
f38b6f197ed9cd5a5ec718f5fc25b6c9

SHA1
6798c2475a121fa6248441be18b7f8ed07354737

SHA256
39e293f6b1ce943bd67e1546be59a9f1a7c167b641dedaca21133a0eeeea83dc

SHA512
5985c675a43d258559df2ac2cb66fb0ce385c9820e10a276cccf2ec9725983803b57d289a4145476b908c314a37696be334629d7442752c35e74bc58ea0b31ab

Download Submit
C:\Windows\TEMP\TU\orig\TuneUp Utilities 2010\cmWizards.bpl

Filesize
56KB

MD5
5639ef6a2fc108c40cf33ad3da3230fc

SHA1
9d92bfff278cbc818fe26bf8375998ee6823ca4a

SHA256
fb0b24db6e1d5b8ab122b086fd18fa7136206ad09b382be180399605d9c05c67

SHA512
51059b85b9eebc7a1e03cf90d58504599736f47fa7ad80c438a6346a27efd10304f7df1cf859379f5c025a6ceca38ade44565614a6b2ee76c1d4ab26c8b561be

Download Submit
C:\Windows\TEMP\TU\orig\setup.msi

Filesize
566KB

MD5
81e708f827739710c8f62ae95612966b

SHA1
b769d2250266b6e9829a55cd5bd680bcc1db74b6

SHA256
d7578072617110a802cbca91c4eb111e3ec3eba313968687551b0a44b827e05a

SHA512
9e7cd4c8f3fe94e9bbe97da14d8ac72b4f85bac0fdd92fa04ed60b158327a1dc4417bd4292bd8015fdd8feeaa99438f8e92b1849d4c8cedc269c9fac4b63dd12

Download Submit
C:\Windows\TEMP\TU\ru-RUv\TuneUp Software\TuneUp Utilities 2010\en-US\ProductInfo.dat

Filesize
513KB

MD5
44397fdf777b40cea58e841eb28dcdbc

SHA1
800e5c661140702ba0d28a56bcca9e93d36ff159

SHA256
b6c697db3905078b7e99b306058fa92402692641989e4bf25bbcc979eeb2b285

SHA512
3559122a4fc2b6859dbb8053f183148a636b0cc11610401215b5536ab8eb09d71539c9847af99b3ec0f23e3b3365d265d413a989828813d1f9d9bd23b8eb5b7e

Download Submit
C:\Windows\TEMP\TU\ru-RUv\TuneUp Software\TuneUp Utilities 2010\en-US\TUSearchScopes.xml

Filesize
4KB

MD5
d750b869e44235138669431a3de049b4

SHA1
b57e2bafa7a5ed135a7b29c21e6aca43bccf0d19

SHA256
61e65da5c24e98da4e6eba81047d6baf67c8bfa67f5070c88704bc6d2b723717

SHA512
fb0589898465d14cf57eee80c7bfc258fd8479517ff5278777ca92737c1348eb3e2fb82c25692082a0871d4c764b369f702a87f0a76bcd055e4e8edb87f62105

Download Submit
C:\Windows\TEMP\TU\ru-RUv\TuneUp Software\TuneUp Utilities 2010\en-US\cm_diskspaceVista.png

Filesize
43KB

MD5
41c6dcda758770ea2da3805e226d58dd

SHA1
1e0e91e2559f3679fbac97893aa7ac66487a913b

SHA256
314e8f4593e57c212612d2bd4b60c4b7b53b7d38562a7abeb584d856c5db7769

SHA512
561fe9db574248a9ab89b645d5ee219072654d70c9b49aec60645297ce447a9ae1983103e624185c9cbbf4ef505390a3b21838bc56f24648ba6593535309aa85

Download Submit
C:\Windows\TEMP\TU\ru-RUv\TuneUp Software\TuneUp Utilities 2010\en-US\cm_diskspaceW7.png

Filesize
29KB

MD5
ff19a54992e54c6b1a22822980a5967e

SHA1
376f438222ef363e670b5cb79f9d87c44710d3d9

SHA256
81574ec7fe9c29191e075a21e8f5ce9b04ef3f547f67061c66dbcc5e5cf4e340

SHA512
93fd07ea631042fa2a45c79f0f48fddafbe4ec4e09c779870564c0b13637aa90163435ad9b686acf9968fafe41034162c2125fd83f931c9c98e33ce23dc65a63

Download Submit
C:\Windows\TEMP\TU\ru-RUv\TuneUp Software\TuneUp Utilities 2010\en-US\cm_diskspaceXP.png

Filesize
31KB

MD5
cd5bd1830ff5b316f8c529163b4ce9d8

SHA1
7cc0f497ab0136ec4c0a405f46fba80f77a60bd9

SHA256
c3c80adbbad2ed0f7b4824f7c99e243f9c193c40efbd6f45a85ab8b2f664d4b5

SHA512
f36aec1b0029c5f44cd509a350d45436cf086979fdef4b2a72775bb9c85253b4518775c9fe3af40d20b8c8ffafe858b7b853838436d60ce7b8e45c0049f88835

Download Submit
C:\Windows\TEMP\TU\ru-RUv\TuneUp Software\TuneUp Utilities 2010\en-US\cm_logonVista.png

Filesize
45KB

MD5
367dc55660ba0d6584e58568035bdbef

SHA1
c94a67ea7c59c841739543c893f3510097fb25f1

SHA256
935fc452abb3e7f1e0d8b4319d72ffc019f910c294daf3d7c3856b1bf5d90455

SHA512
612629072bafdcd37e2ea049d176e43a1aef93e6d57f2d652b38f2fd7dafee4398f6a7103646dd03635dcfa721eea2ff21a84faa1ac319f5432fb0f60c0dc381

Download Submit
C:\Windows\TEMP\TU\ru-RUv\TuneUp Software\TuneUp Utilities 2010\en-US\cm_logonW7.png

Filesize
46KB

MD5
8a645cbb95b8ffad25dcf1ed32d635d8

SHA1
af4a29c4fd3669276c9ef835d4bda89be6ac322b

SHA256
5492bce33a07f8c1fb10739e1d9cc75c9e1ba5e2566f82ed4064a986b78086e9

SHA512
b4e50a2f6b8fa3049fc799efe165fb08be592154b239fa5f5c0439e6a3e7e0b48d6a50ad69d80ea61312787836383ee9e88e3de981b87673b7dfba26f11d4698

Download Submit
C:\Windows\TEMP\TU\ru-RUv\TuneUp Software\TuneUp Utilities 2010\en-US\cm_logonXP_new.png

Filesize
13KB

MD5
4fd64ac5ceaf66b82ed8cf7dfca73944

SHA1
6814cdb550de60831093f60d57ace612f4ad648d

SHA256
a211237a1c3d1092b2f2a3c8b189692404469f347a6bf0e37af38cff0adb5779

SHA512
4efdfa598eb1c20e5271fbd91d5244dd8203868338871a8eef93988cb07d8321e43b5947019a267a9075adebd993ce3a464f608d293e64c15cb04d504db93883

Download Submit
C:\Windows\TEMP\TU\ru-RUv\TuneUp Software\TuneUp Utilities 2010\en-US\cm_logonXP_old.png

Filesize
7KB

MD5
fba3db8f1d26e1696cbe44cd734d06f5

SHA1
225753f68a1a727091c11c8a57c3dae2dbd76421

SHA256
043f0935664e90b13caad05b69e579d98178bac6d1815f5de43acfd12aeb2874

SHA512
42b5d68a219379f34a0e3f52bdf3162dbe912a5fc618f8ad7dd04162c8e17552be14d11cdcb15f7072bba4229a57b1d60dbf3fe25c3c436a09a9a2dff5ead633

Download Submit
C:\Windows\TEMP\TU\ru-RUv\TuneUp Software\TuneUp Utilities 2010\en-US\cm_report_noui.jpg

Filesize
16KB

MD5
60d7db3bdc1f6e67db6413f1c5c3e6e0

SHA1
48ce2d87f8e47baba80483ff4ffb7b09e1b286a5

SHA256
64eddc5fd4192dee8388389c9c7fd0a2b8be17ab33aaff950c04931090ee2e64

SHA512
f54da7456e5b9d013fed22bf11e6e69d86ef87265855eacec627a281ca509099d274d3e2941c66bd064b3a7ffb79f1d4883074b69f4d4fa9ab0f4c23cc805178

Download Submit
C:\Windows\TEMP\TU\ru-RUv\TuneUp Software\TuneUp Utilities 2010\en-US\cm_report_send.jpg

Filesize
23KB

MD5
776e4e4812f89c99e6d577e2ef7aade4

SHA1
ddde4b39eb07efaed28d5917290ffe2991258d00

SHA256
1b240ecb4f5fb75ae2de35c19f961110ce7d379307b48c9e97705d56802a0d30

SHA512
11a992f1524c1190910d544ac50f9403ad9c5205f709fa4dc1bd7bbd437c4865018e97a209781892111cf72f8490adbc29b38cbea278a6f3e65e985fc1697e0c

Download Submit
C:\Windows\TEMP\TU\ru-RUv\TuneUp Software\TuneUp Utilities 2010\en-US\cm_report_showui.jpg

Filesize
18KB

MD5
7b7f36a751ee03fefab221b754dba10c

SHA1
8ec7c389941260ac596df823a96bd2bb51792cda

SHA256
114f142b5d05bcfdcced5c0a2742459d4be53909f33a3f561c839ccd8565244c

SHA512
3046753e082d12f017e614eccbc9b55c33ab6bcdf3f409d5b7bad21679e6ef2286f1ea09d4256ee083868148d0670428a0e45a9ff6f08ce694e7fb0cd43ca524

Download Submit
C:\Windows\TEMP\TU\ru-RUv\TuneUp Software\TuneUp Utilities 2010\en-US\cm_werconsent1.jpg

Filesize
46KB

MD5
4deae0523f4face6cc0795b192b77604

SHA1
922b1a5122486b05433fa76af3dc3d18b9a21389

SHA256
a927e1668e728c035449ec514ac1b7fec0be7f54852dd63f59e9528a7053e994

SHA512
4ccd13aefb61cd69d7b85661f995a3320451a99250d6959cb16ffe76087f7f219acbf3fa33001d4efb6c967563bff8e123227708bd08f9cfa9f8db6fdcf4f353

Download Submit
C:\Windows\TEMP\TU\ru-RUv\TuneUp Software\TuneUp Utilities 2010\en-US\cm_werconsent1_W7.jpg

Filesize
47KB

MD5
8daf97f13136990d15e2bfc83b695f11

SHA1
ec0c7383c8348a41aa191271dfc28881b137ee0c

SHA256
d05462fbe83712d5e4b171875db6c0792c2ca5f2aedd52e6480b422d31eabd63

SHA512
9a0c5b22f1a608b47c030e271a478378814f5c12142586afbc25dbe909ac39442e627bbfc340bce69c288c55190061b26a5d0a9d5665fdf0e8b367dbab0347df

Download Submit
C:\Windows\TEMP\TU\ru-RUv\TuneUp Software\TuneUp Utilities 2010\en-US\cm_werconsent3.jpg

Filesize
46KB

MD5
486ce522d809c8f6123e0d6face706aa

SHA1
8e92e1351c55c87a37032343975ecb99075435b8

SHA256
5783576bf94df9a486988b40cad758dc991558db2fa90c2ad9af5a31e74c34cb

SHA512
8941cbb68e5a5d601bee62b3429ae915dda3fd61c2e39ae419676b162d24c18b3ede805f3b0b3c75ffae151c25182d1a91c392d15b6b4d45430f6529b6f12499

Download Submit
C:\Windows\TEMP\TU\ru-RUv\TuneUp Software\TuneUp Utilities 2010\en-US\cm_werconsent3_W7.jpg

Filesize
46KB

MD5
32255fe66a9b2d9943964641fc29d01f

SHA1
61f301dcd8870da91c0d1bf6354f0858121713d6

SHA256
bb708158b84356cd7bc7851571c50fefee4f93b7cc679c159f3b4ac623bdee3b

SHA512
9af712d80b9fc05d09d9975e00abaf48d9f498bd13a334c95d548ea6a09757b5e88b3b1622e5da530877ebe220426ca62904732268ac84552db39a6b8987d798

Download Submit
C:\Windows\TEMP\TU\ru-RUv\TuneUp Software\TuneUp Utilities 2010\en-US\cm_werconsent4_W7.jpg

Filesize
48KB

MD5
be59d974174caeedbe9ed68801ef1d88

SHA1
25894925a63d90005cec338f8ae66c0493c6201f

SHA256
50e7c85143932c19c01c1ee02b7a80c6f044d5ac6c31abc08744e483bc880a40

SHA512
4a378a03719429cdb4c9dd4865ab1ea41bc697b197f55c811492f6d78dca14898873507c9276943088b864192ff5befcb5e98365a79ca455c02b817879c8caa7

Download Submit
C:\Windows\TEMP\TU\ru-RUv\TuneUp Software\TuneUp Utilities 2010\en-US\default.mo

Filesize
2.3MB

MD5
53049dd8b00eaee044abacdba4ad7d2a

SHA1
5ae9c3354b35d8fcc1adcc8887a3cce044fbc812

SHA256
6ecc904c7b047b8bd54b4f12a71cc21866fa39b6e498cc1f0be6713a04e656c5

SHA512
5c8443da0e5826b62ce6bb6f89d82b66ebf2db348f7cf11c6a80549981f53b252d4963f0f3dddce3a46d73323dc3c907c7ca544109c51e0b2c2d5264aa078c3e

Download Submit
C:\Windows\TEMP\TU\ru-RUv\TuneUp Software\TuneUp Utilities 2010\en-US\iecontextmenu.ini

Filesize
3KB

MD5
f7ddefaf1df1679143bbde90d75c3af7

SHA1
a5b6c8e47adac939e5b13fb625c031f0b92f6086

SHA256
27f304ef8755af9d7b13b507737de14d17a79d6eabcb1994993a2e6d7ad0574a

SHA512
daca08490af8a97753809f9e2e428633e65bf0d3762fe7abaa6f380aa3bca9db34002343389e824e154f6d46d120585625aeac95e281a8ee48ad1661b8b8b0fe

Download Submit
C:\Windows\TEMP\TU\ru-RUv\TuneUp Software\TuneUp Utilities 2010\en-US\license.rtf

Filesize
16KB

MD5
b29b9aa4f22f6bcfbfd354099d3922f5

SHA1
66bb626beba1da0432613d6a99a5078d59af42ef

SHA256
39a2546cd463f791d9be9983dac6a5c8e819e75788d6d08141e168ff26ac90c8

SHA512
347f2edb0a3efd2ef593519182510a64fc8f48cf030351f8315e36482a687c3e19f6c904a12fc3bfcd7aa131da953c24166ee67707827ab79cd81d34dfc5bb55

Download Submit
C:\Windows\TEMP\TU\ru-RUv\TuneUp Software\TuneUp Utilities 2010\en-US\main_7.chm

Filesize
346KB

MD5
bd63624ec81771384e3e1e443b44cd72

SHA1
9a63d8dc263353b3f9c023c35ab13a8067554a9b

SHA256
f40e1fdac6a860cb48edc6355b048038ea12a0c396c6c1c260e66e7f97c55d14

SHA512
3edf49feb780559d6a013a0ea1c756efabab06d4cc610652c3251fcf723b1bbffefbfae036a1f78abcf184ad1bdf1c494543b75938da988f6c7dd2cfd9af8cc7

Download Submit
C:\Windows\TEMP\TU\ru-RUv\TuneUp Software\TuneUp Utilities 2010\en-US\main_vista.chm

Filesize
351KB

MD5
66b2d8732a90178ad1520b4bd700440b

SHA1
cd688952bcff486c9643a9bec27bcd18549a8c41

SHA256
cd725af72fd9394620fa19662d206c614a34ed6bc991a87c5bb1eb809cebda5c

SHA512
d7771f1c3cd45caec1126209c75e9db8b8f62edef5eaa9d19799ccb41b5e766f4248324d3b90e949c7b1a5d3934e320ffef712be3018a0359f3e351248c4666a

Download Submit
C:\Windows\TEMP\TU\ru-RUv\TuneUp Software\TuneUp Utilities 2010\en-US\main_xp.chm

Filesize
344KB

MD5
f07e787a5b5d343ffc1aeeeb6b18f0b9

SHA1
6ff0ef662fdf46b08a08adb9c2d2ae9d4974e119

SHA256
57d4e66af9687c92e4d98c7ab757b08eb5d266d5837e36558e2a509200e38d87

SHA512
63797edcce4537289731b5e72bfc334d420094ae2b894afe51cb332f3542bbba1c294c0c9535092a404e897edd050331865c57088e2bf91b89800838034fcfa8

Download Submit
C:\Windows\TEMP\TU\ru-RUv\TuneUp Software\TuneUp Utilities 2010\en-US\regwiz_country.diz

Filesize
3KB

MD5
945a2ad7e04d1e6861d239dabcd50538

SHA1
c59547b9212b85cfe3f242b78990622817a25c80

SHA256
aa52a469cb426231f08d27d9245e955e41ce0366f27c3f48b4253f0b4744522a

SHA512
6bef394b8f637c434e050ccb63c7ed27bb55c4ecbd1f5f6fe2d56c4c96e53ce5068669d473a2de2a3471b4266241920ed67826a7a80b703c6c288b490f4205ac

Download Submit
C:\Windows\TEMP\TU\ru-RUv\TuneUp Software\TuneUp Utilities 2010\en-US\startmenu_nonscroll.png

Filesize
19KB

MD5
610cd616c5b95bff6c1956307b814ac8

SHA1
6e2431e08c79a4c28b72f098e5a850cef1e72823

SHA256
9b06913695a863f41d5c507e8bfe10dedf8a05d08efdb545f4ad38eda19a2a1c

SHA512
4485aaf743e6680c1e7b1c661959a60fca0bb45c367f41458dfcadd6af9a90bd67f07cf8141a0d432221c57583d67bd4c7e48aa350da3a76f268fd7b1a1fea72

Download Submit
C:\Windows\TEMP\TU\ru-RUv\TuneUp Software\TuneUp Utilities 2010\en-US\startmenu_scroll.png

Filesize
16KB

MD5
53a83e5775e73429d36df7ae734d22a8

SHA1
577f7781f7d07afe920e415989240587a9108f7a

SHA256
aa65c29599439c1f8eae3e0f10c5302db4a254ade9c6806f830448e5aa1ebb3d

SHA512
19f784029a2687ea2798124820106c449cee4fe0596851f10973020c6f2a2ecef8a7bd96ad3514fae8f237812bd8f19163ab507cf6e17a83a00ab4cf189492b9

Download Submit
C:\Windows\Temp\TU\ru-RUv\lng.msi

Filesize
26KB

MD5
ac58984962e5ec029304d5039c45155b

SHA1
a3f6084218452414183c6616ea193665d0885a20

SHA256
4ed98e0c01f56d16ca642057ec85ea654d50b0e53a2d72690cce402e3f100747

SHA512
ee43d8431b4b0c51e64128f91f3849822a6a503a0fd6fbcb470d48c8bfce807ced32df48581b837e7169b2e68aae81bf88a8b1d68fd43fbd267dd8abc22eeaa8

Download Submit
C:\Windows\Temp\TU\setup_ru.cmd

Filesize
484B

MD5
0cb36cd96eddf5dacd5dd34ba6ca7dba

SHA1
529bd2943fe489e35f60bf6b47a36629bf1454a2

SHA256
c4ec611341ded47106ebdfd94d9809f5f2de68a9e1885f5a6e89575b59ed190f

SHA512
9db0b3913aa178f2412010fe356e42e1feef752cefa99b909b5d6020529909f6bea7f9a5b29433075ae14460f610eebb7a4048c8fae7a4c2efda236b69d43041

Download Submit
memory/2256-4719-0x0000000000180000-0x00000000001CE000-memory.dmp

Filesize
312KB

Download
memory/2256-4661-0x0000000000180000-0x00000000001CE000-memory.dmp

Filesize
312KB

Download
memory/2256-4720-0x00000000738C0000-0x000000007393E000-memory.dmp

Filesize
504KB

Download
memory/2552-4525-0x0000000000DD0000-0x0000000000DE4000-memory.dmp

Filesize
80KB

Download
memory/2552-4594-0x0000000000D80000-0x0000000000DCE000-memory.dmp

Filesize
312KB

Download
memory/2552-4570-0x0000000057000000-0x000000005702D000-memory.dmp

Filesize
180KB

Download
memory/2552-4572-0x0000000040830000-0x0000000040878000-memory.dmp

Filesize
288KB

Download
memory/2552-4539-0x00000000738C0000-0x000000007393E000-memory.dmp

Filesize
504KB

Download
memory/2552-4569-0x0000000050000000-0x0000000050116000-memory.dmp

Filesize
1.1MB

Download
memory/2552-4531-0x00000000022F0000-0x0000000002313000-memory.dmp

Filesize
140KB

Download
memory/2552-4595-0x00000000738C0000-0x000000007393E000-memory.dmp

Filesize
504KB

Download
memory/2552-4533-0x0000000002390000-0x0000000002406000-memory.dmp

Filesize
472KB

Download
memory/2552-4532-0x0000000002320000-0x0000000002381000-memory.dmp

Filesize
388KB

Download
memory/2552-4538-0x0000000000D80000-0x0000000000DCE000-memory.dmp

Filesize
312KB

Download
memory/2552-4529-0x00000000021D0000-0x0000000002285000-memory.dmp

Filesize
724KB

Download
memory/2552-4537-0x0000000002530000-0x0000000002589000-memory.dmp

Filesize
356KB

Download
memory/2552-4528-0x0000000000E20000-0x0000000000E3C000-memory.dmp

Filesize
112KB

Download
memory/2552-4526-0x0000000002140000-0x00000000021C4000-memory.dmp

Filesize
528KB

Download
memory/2552-4527-0x0000000000DF0000-0x0000000000E01000-memory.dmp

Filesize
68KB

Download
memory/2552-4530-0x0000000002290000-0x00000000022ED000-memory.dmp

Filesize
372KB

Download
memory/2552-4568-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2552-4534-0x00000000024B0000-0x00000000024C2000-memory.dmp

Filesize
72KB

Download
memory/2552-4535-0x0000000002410000-0x00000000024A6000-memory.dmp

Filesize
600KB

Download
memory/2552-4536-0x00000000024D0000-0x000000000252D000-memory.dmp

Filesize
372KB

Download
memory/3676-4638-0x00000000738C0000-0x000000007393E000-memory.dmp

Filesize
504KB

Download
memory/3676-4637-0x0000000000D60000-0x0000000000DAE000-memory.dmp

Filesize
312KB

Download
memory/3676-4599-0x0000000000D60000-0x0000000000DAE000-memory.dmp

Filesize
312KB

Download
memory/5000-661-0x00000000001D0000-0x00000000001E4000-memory.dmp

Filesize
80KB

Download
memory/5000-4517-0x0000000002DE0000-0x0000000002E08000-memory.dmp

Filesize
160KB

Download
memory/5000-4516-0x0000000002B40000-0x0000000002BF9000-memory.dmp

Filesize
740KB

Download
memory/5000-4515-0x000000005B000000-0x000000005B017000-memory.dmp

Filesize
92KB

Download
memory/5000-4514-0x0000000003210000-0x0000000003222000-memory.dmp

Filesize
72KB

Download
memory/5000-4513-0x0000000003150000-0x00000000031A9000-memory.dmp

Filesize
356KB

Download
memory/5000-4512-0x0000000000EA0000-0x0000000000EB0000-memory.dmp

Filesize
64KB

Download
memory/5000-4511-0x00000000030B0000-0x0000000003146000-memory.dmp

Filesize
600KB

Download
memory/5000-4510-0x0000000002EB0000-0x0000000002F26000-memory.dmp

Filesize
472KB

Download
memory/5000-4509-0x0000000002E40000-0x0000000002EA1000-memory.dmp

Filesize
388KB

Download
memory/5000-4508-0x0000000002E10000-0x0000000002E33000-memory.dmp

Filesize
140KB

Download
memory/5000-4507-0x0000000002CC0000-0x0000000002D1D000-memory.dmp

Filesize
372KB

Download
memory/5000-4506-0x0000000000E60000-0x0000000000E7C000-memory.dmp

Filesize
112KB

Download
memory/5000-4505-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/5000-4504-0x0000000002C00000-0x0000000002CB5000-memory.dmp

Filesize
724KB

Download
memory/5000-4503-0x0000000002AB0000-0x0000000002B34000-memory.dmp

Filesize
528KB

Download
memory/5000-4502-0x0000000000E40000-0x0000000000E51000-memory.dmp

Filesize
68KB

Download
memory/5000-4501-0x00000000001D0000-0x00000000001E4000-memory.dmp

Filesize
80KB

Download
memory/5000-4500-0x0000000000DF0000-0x0000000000E3E000-memory.dmp

Filesize
312KB

Download
memory/5000-4499-0x0000000040830000-0x0000000040878000-memory.dmp

Filesize
288KB

Download
memory/5000-4498-0x0000000050120000-0x000000005030D000-memory.dmp

Filesize
1.9MB

Download
memory/5000-4497-0x0000000057000000-0x000000005702D000-memory.dmp

Filesize
180KB

Download
memory/5000-4496-0x0000000050000000-0x0000000050116000-memory.dmp

Filesize
1.1MB

Download
memory/5000-4524-0x00000000738C0000-0x000000007393E000-memory.dmp

Filesize
504KB

Download
memory/5000-4519-0x0000000002F30000-0x0000000002F3D000-memory.dmp

Filesize
52KB

Download
memory/5000-4520-0x0000000002F40000-0x0000000003011000-memory.dmp

Filesize
836KB

Download
memory/5000-4521-0x0000000003020000-0x0000000003032000-memory.dmp

Filesize
72KB

Download
memory/5000-4523-0x0000000002D20000-0x0000000002D30000-memory.dmp

Filesize
64KB

Download
memory/5000-4522-0x00000000032B0000-0x00000000033C6000-memory.dmp

Filesize
1.1MB

Download
memory/5000-4518-0x0000000000E80000-0x0000000000E94000-memory.dmp

Filesize
80KB

Download
memory/5000-4495-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/5000-664-0x0000000000E60000-0x0000000000E7C000-memory.dmp

Filesize
112KB

Download
memory/5000-668-0x0000000002E40000-0x0000000002EA1000-memory.dmp

Filesize
388KB

Download
memory/5000-663-0x0000000002AB0000-0x0000000002B34000-memory.dmp

Filesize
528KB

Download
memory/5000-666-0x0000000002CC0000-0x0000000002D1D000-memory.dmp

Filesize
372KB

Download
memory/5000-665-0x0000000002C00000-0x0000000002CB5000-memory.dmp

Filesize
724KB

Download
memory/5000-667-0x0000000002E10000-0x0000000002E33000-memory.dmp

Filesize
140KB

Download
memory/5000-669-0x0000000002EB0000-0x0000000002F26000-memory.dmp

Filesize
472KB

Download
memory/5000-670-0x0000000003150000-0x00000000031A9000-memory.dmp

Filesize
356KB

Download
memory/5000-671-0x00000000030B0000-0x0000000003146000-memory.dmp

Filesize
600KB

Download
memory/5000-672-0x0000000003210000-0x0000000003222000-memory.dmp

Filesize
72KB

Download
memory/5000-675-0x0000000002DE0000-0x0000000002E08000-memory.dmp

Filesize
160KB

Download
memory/5000-674-0x0000000002B40000-0x0000000002BF9000-memory.dmp

Filesize
740KB

Download
memory/5000-676-0x0000000000E80000-0x0000000000E94000-memory.dmp

Filesize
80KB

Download
memory/5000-677-0x0000000003020000-0x0000000003032000-memory.dmp

Filesize
72KB

Download
memory/5000-678-0x0000000002F40000-0x0000000003011000-memory.dmp

Filesize
836KB

Download
memory/5000-680-0x00000000738C0000-0x000000007393E000-memory.dmp

Filesize
504KB

Download
memory/5000-679-0x00000000032B0000-0x00000000033C6000-memory.dmp

Filesize
1.1MB

Download
memory/5000-673-0x0000000000DF0000-0x0000000000E3E000-memory.dmp

Filesize
312KB

Download
memory/5000-662-0x0000000000E40000-0x0000000000E51000-memory.dmp

Filesize
68KB

Download
memory/5000-660-0x0000000000DF0000-0x0000000000E3E000-memory.dmp

Filesize
312KB

Download