Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
11/07/2024, 17:51
Static task
static1
Behavioral task
behavioral1
Sample
Riders-Republic-Windows-1-21-en.msi
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
Riders-Republic-Windows-1-21-en.msi
Resource
win10v2004-20240709-en
General
-
Target
Riders-Republic-Windows-1-21-en.msi
-
Size
176.5MB
-
MD5
7a2cf04ac0c504a8ea5aed805dde484d
-
SHA1
0536d7a178d1a42cea1476ea6b44bc53ed26bc63
-
SHA256
6f3f486d7a8409fc174198818c039152c6268bd9fdf210ee6be1c91bf832b7e9
-
SHA512
42aeed1d015ab279df3065e04adff8001672a13180f4d73121ace3bc8989783f12c7a5d0b50c684c74fd138fc1b4f451439acd7b6342d4f60c7d3a18034e0988
-
SSDEEP
3145728:oyKHxXZR5bsPL+buxE4ynkX+kKbtt3V8mIeDLhZ8muXNNE7byK88OmTZbOW/rXi:IP4PAwUnkuk8BNbLIxg7bUQ
Malware Config
Signatures
-
Blocklisted process makes network request 6 IoCs
flow pid Process 2 1824 msiexec.exe 7 1824 msiexec.exe 9 1824 msiexec.exe 46 5108 rundll32.exe 56 5408 rundll32.exe 58 3940 rundll32.exe -
Modifies file permissions 1 TTPs 2 IoCs
pid Process 5228 icacls.exe 5352 icacls.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe -
Drops file in System32 directory 15 IoCs
description ioc Process File created C:\Windows\SysWOW64\SETBE93.tmp DXSETUP.exe File opened for modification C:\Windows\SysWOW64\SETBF20.tmp DXSETUP.exe File opened for modification C:\Windows\SysWOW64\d3dcsx_43.dll DXSETUP.exe File opened for modification C:\Windows\SysWOW64\SETBE93.tmp DXSETUP.exe File created C:\Windows\SysWOW64\SETBEC2.tmp DXSETUP.exe File created C:\Windows\SysWOW64\SETBED2.tmp DXSETUP.exe File opened for modification C:\Windows\SysWOW64\SETBF4F.tmp DXSETUP.exe File opened for modification C:\Windows\SysWOW64\D3DCompiler_43.dll DXSETUP.exe File opened for modification C:\Windows\SysWOW64\xinput1_3.dll DXSETUP.exe File opened for modification C:\Windows\SysWOW64\SETBED2.tmp DXSETUP.exe File opened for modification C:\Windows\SysWOW64\SETBEC2.tmp DXSETUP.exe File opened for modification C:\Windows\SysWOW64\d3dx10_43.dll DXSETUP.exe File opened for modification C:\Windows\SysWOW64\d3dx11_43.dll DXSETUP.exe File created C:\Windows\SysWOW64\SETBF20.tmp DXSETUP.exe File created C:\Windows\SysWOW64\SETBF4F.tmp DXSETUP.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\en_CC.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ee_GH.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\sr_Cyrl.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\en_PG.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\uz_AF.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\uk_UA.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\az.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\naq.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\ff_Latn.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\es_PY.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\in_ID.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\tt_RU.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\fr_NC.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\sr_Cyrl_BA.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\tt.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\en_CY.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\ar_KM.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\en_AT.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\es_CL.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\gu.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\fr_MR.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lo_LA.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\ha_NE.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\saq.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\nyn.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\UI\SmallRoundedToggleLeft.png msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ia.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\uz.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\en_ZW.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\tk.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\ug.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\en_TV.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\en_TZ.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\rw.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\Localization\App\zh-Hans\App.locres msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\fr_CA.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\en_MW.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\rbnf\pt_PT.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\uz_Arab.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\en_SZ.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\ebu.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\so_KE.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\so_DJ.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\iw_IL.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\in.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\lb.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\rbnf\fi.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\fr_RE.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\tzm.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ff.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\en_SD.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\pool.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\ckb.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\lo.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\en_KE.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\en_CM.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zh_Hant_MO.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\ff_Latn_MR.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\en_FJ.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\New UI\button_hover.png msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\de.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\sr_Latn.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\fa.res msiexec.exe File created C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ti.res msiexec.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Logs\DirectX.log DXSETUP.exe File opened for modification C:\Windows\Installer\MSID479.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSID9CA.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File created C:\Windows\Installer\{B85FAA6E-A9AA-4655-9029-E1A4EDC05E1A}\Installer.ico msiexec.exe File opened for modification C:\Windows\Installer\MSIC330.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIEDD2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIEE31.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4B98.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4B98.tmp-\CustomActionManaged.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI98A1.tmp-\CustomActionManaged.dll rundll32.exe File opened for modification C:\Windows\Installer\e593dfc.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIEE31.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI428E.tmp-\CustomActionManaged.dll rundll32.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\E6AAF58BAA9A556409921E4ADE0CE5A1\1.3.93\F_CENTRAL_msvcp120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA msiexec.exe File opened for modification C:\Windows\Installer\MSIC244.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID479.tmp-\CustomActionManaged.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIEE31.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSI4E96.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC330.tmp-\CustomActionManaged.dll rundll32.exe File opened for modification C:\Windows\Installer\MSID526.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSI41F1.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI98A1.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC330.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID35F.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSID9CA.tmp-\CustomActionManaged.dll rundll32.exe File opened for modification C:\Windows\Installer\MSID479.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{57A956AB-4BCC-45C6-9B40-957E4E125568} msiexec.exe File opened for modification C:\Windows\Installer\MSIE18D.tmp msiexec.exe File created C:\Windows\Installer\e593df9.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI4B98.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\E6AAF58BAA9A556409921E4ADE0CE5A1 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\E6AAF58BAA9A556409921E4ADE0CE5A1\1.3.93\F_CENTRAL_msvcp120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA msiexec.exe File created C:\Windows\Installer\e593dfb.msi msiexec.exe File opened for modification C:\Windows\Installer\MSID35F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID9CA.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSIEE31.tmp-\CustomActionManaged.dll rundll32.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\E6AAF58BAA9A556409921E4ADE0CE5A1\1.3.93\F_CENTRAL_msvcr120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA msiexec.exe File opened for modification C:\Windows\Installer\MSIC330.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSID35F.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIDE50.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5241.tmp msiexec.exe File opened for modification C:\Windows\Installer\{B85FAA6E-A9AA-4655-9029-E1A4EDC05E1A}\Installer.ico msiexec.exe File opened for modification C:\Windows\Installer\MSIC5E1.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID479.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSID9CA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID526.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI428E.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSI4B98.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI5241.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\E6AAF58BAA9A556409921E4ADE0CE5A1\1.3.93\F_CENTRAL_vccorlib120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA msiexec.exe File opened for modification C:\Windows\Installer\MSI428E.tmp msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\E6AAF58BAA9A556409921E4ADE0CE5A1\1.3.93 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\E6AAF58BAA9A556409921E4ADE0CE5A1\1.3.93\F_CENTRAL_vccorlib120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA msiexec.exe File opened for modification C:\Windows\Installer\MSIC0EB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC310.tmp msiexec.exe File opened for modification C:\Windows\Installer\e593df9.msi msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\E6AAF58BAA9A556409921E4ADE0CE5A1\1.3.93\F_CENTRAL_msvcr120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA msiexec.exe File created C:\Windows\Installer\e593dfc.msi msiexec.exe File opened for modification C:\Windows\Installer\MSID526.tmp-\CustomActionManaged.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI98A1.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSID35F.tmp-\CustomActionManaged.dll rundll32.exe -
Executes dropped EXE 2 IoCs
pid Process 3068 DXSETUP.exe 5584 InstallChainer.exe -
Loads dropped DLL 64 IoCs
pid Process 4640 MsiExec.exe 4640 MsiExec.exe 4640 MsiExec.exe 3976 rundll32.exe 3976 rundll32.exe 3976 rundll32.exe 3976 rundll32.exe 3976 rundll32.exe 1696 MsiExec.exe 1696 MsiExec.exe 5108 rundll32.exe 5108 rundll32.exe 5108 rundll32.exe 5108 rundll32.exe 5108 rundll32.exe 1696 MsiExec.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 1696 MsiExec.exe 1940 rundll32.exe 1940 rundll32.exe 1940 rundll32.exe 1940 rundll32.exe 1940 rundll32.exe 4592 MsiExec.exe 1140 rundll32.exe 1140 rundll32.exe 1140 rundll32.exe 1140 rundll32.exe 1140 rundll32.exe 3068 DXSETUP.exe 3068 DXSETUP.exe 3068 DXSETUP.exe 3068 DXSETUP.exe 4592 MsiExec.exe 4592 MsiExec.exe 1696 MsiExec.exe 1696 MsiExec.exe 5408 rundll32.exe 5408 rundll32.exe 5408 rundll32.exe 5408 rundll32.exe 5408 rundll32.exe 1696 MsiExec.exe 5584 InstallChainer.exe 5584 InstallChainer.exe 1696 MsiExec.exe 5800 rundll32.exe 5800 rundll32.exe 5800 rundll32.exe 5800 rundll32.exe 5800 rundll32.exe 1696 MsiExec.exe 5932 rundll32.exe 5932 rundll32.exe 5932 rundll32.exe 5932 rundll32.exe 5932 rundll32.exe 1696 MsiExec.exe 6036 rundll32.exe 6036 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Installer Packages 1 TTPs 1 IoCs
pid Process 1824 msiexec.exe -
Checks SCSI registry key(s) 3 TTPs 8 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000095515e1ae5238f530000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000095515e1a0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090095515e1a000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d95515e1a000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000095515e1a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Modifies data under HKEY_USERS 46 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DXSETUP.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "1" DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DXSETUP.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DXSETUP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DXSETUP.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer DXSETUP.exe -
Modifies registry class 39 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.launcher msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.launcher\shell msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6AAF58BAA9A556409921E4ADE0CE5A1\ProductName = "Epic Games Launcher" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6AAF58BAA9A556409921E4ADE0CE5A1\Language = "1033" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.launcher\ = "Epic Games Launcher Link" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6AAF58BAA9A556409921E4ADE0CE5A1\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E6AAF58BAA9A556409921E4ADE0CE5A1 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6AAF58BAA9A556409921E4ADE0CE5A1\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6AAF58BAA9A556409921E4ADE0CE5A1\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.launcher\shell\ = "open" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.launcher\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E6AAF58BAA9A556409921E4ADE0CE5A1\ProductFeature msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6AAF58BAA9A556409921E4ADE0CE5A1\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6AAF58BAA9A556409921E4ADE0CE5A1\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.launcher\shell\open msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\com.epicgames.launcher\DefaultIcon msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.launcher\DefaultIcon\ = "C:\\Program Files (x86)\\Epic Games\\Launcher\\Portal\\Binaries\\Win32\\EpicGamesLauncher.exe,0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.launcher\shell\open\command\ = "\"C:\\Program Files (x86)\\Epic Games\\Launcher\\Portal\\Binaries\\Win32\\EpicGamesLauncher.exe\" %1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6AAF58BAA9A556409921E4ADE0CE5A1\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6AAF58BAA9A556409921E4ADE0CE5A1\ProductIcon = "C:\\Windows\\Installer\\{B85FAA6E-A9AA-4655-9029-E1A4EDC05E1A}\\Installer.ico" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\44F9670D954DF0540B48AC3E08267CB5\E6AAF58BAA9A556409921E4ADE0CE5A1 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6AAF58BAA9A556409921E4ADE0CE5A1\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.launcher\URL Protocol msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6AAF58BAA9A556409921E4ADE0CE5A1\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6AAF58BAA9A556409921E4ADE0CE5A1\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E6AAF58BAA9A556409921E4ADE0CE5A1\DirectXRedist msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6AAF58BAA9A556409921E4ADE0CE5A1\PackageCode = "CB07B31A6571B6945BD975BABA14A4D7" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6AAF58BAA9A556409921E4ADE0CE5A1\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6AAF58BAA9A556409921E4ADE0CE5A1\SourceList\PackageName = "Riders-Republic-Windows-1-21-en.msi" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\com.epicgames.launcher\shell\open msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\com.epicgames.launcher\shell msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\com.epicgames.launcher\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E6AAF58BAA9A556409921E4ADE0CE5A1\VCRedist msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6AAF58BAA9A556409921E4ADE0CE5A1 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6AAF58BAA9A556409921E4ADE0CE5A1\Version = "16973917" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\44F9670D954DF0540B48AC3E08267CB5 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6AAF58BAA9A556409921E4ADE0CE5A1\SourceList msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\com.epicgames.launcher msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6AAF58BAA9A556409921E4ADE0CE5A1\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 DXSETUP.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e76200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 DXSETUP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A DXSETUP.exe -
Suspicious behavior: EnumeratesProcesses 36 IoCs
pid Process 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 1696 MsiExec.exe 1696 MsiExec.exe 1696 MsiExec.exe 1696 MsiExec.exe 1696 MsiExec.exe 1696 MsiExec.exe 3868 msiexec.exe 3868 msiexec.exe 3868 msiexec.exe 3868 msiexec.exe 3868 msiexec.exe 3868 msiexec.exe 3868 msiexec.exe 3868 msiexec.exe 3868 msiexec.exe 3868 msiexec.exe 3868 msiexec.exe 3868 msiexec.exe 3868 msiexec.exe 3868 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1824 msiexec.exe Token: SeIncreaseQuotaPrivilege 1824 msiexec.exe Token: SeSecurityPrivilege 3868 msiexec.exe Token: SeCreateTokenPrivilege 1824 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1824 msiexec.exe Token: SeLockMemoryPrivilege 1824 msiexec.exe Token: SeIncreaseQuotaPrivilege 1824 msiexec.exe Token: SeMachineAccountPrivilege 1824 msiexec.exe Token: SeTcbPrivilege 1824 msiexec.exe Token: SeSecurityPrivilege 1824 msiexec.exe Token: SeTakeOwnershipPrivilege 1824 msiexec.exe Token: SeLoadDriverPrivilege 1824 msiexec.exe Token: SeSystemProfilePrivilege 1824 msiexec.exe Token: SeSystemtimePrivilege 1824 msiexec.exe Token: SeProfSingleProcessPrivilege 1824 msiexec.exe Token: SeIncBasePriorityPrivilege 1824 msiexec.exe Token: SeCreatePagefilePrivilege 1824 msiexec.exe Token: SeCreatePermanentPrivilege 1824 msiexec.exe Token: SeBackupPrivilege 1824 msiexec.exe Token: SeRestorePrivilege 1824 msiexec.exe Token: SeShutdownPrivilege 1824 msiexec.exe Token: SeDebugPrivilege 1824 msiexec.exe Token: SeAuditPrivilege 1824 msiexec.exe Token: SeSystemEnvironmentPrivilege 1824 msiexec.exe Token: SeChangeNotifyPrivilege 1824 msiexec.exe Token: SeRemoteShutdownPrivilege 1824 msiexec.exe Token: SeUndockPrivilege 1824 msiexec.exe Token: SeSyncAgentPrivilege 1824 msiexec.exe Token: SeEnableDelegationPrivilege 1824 msiexec.exe Token: SeManageVolumePrivilege 1824 msiexec.exe Token: SeImpersonatePrivilege 1824 msiexec.exe Token: SeCreateGlobalPrivilege 1824 msiexec.exe Token: SeCreateTokenPrivilege 1824 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1824 msiexec.exe Token: SeLockMemoryPrivilege 1824 msiexec.exe Token: SeIncreaseQuotaPrivilege 1824 msiexec.exe Token: SeMachineAccountPrivilege 1824 msiexec.exe Token: SeTcbPrivilege 1824 msiexec.exe Token: SeSecurityPrivilege 1824 msiexec.exe Token: SeTakeOwnershipPrivilege 1824 msiexec.exe Token: SeLoadDriverPrivilege 1824 msiexec.exe Token: SeSystemProfilePrivilege 1824 msiexec.exe Token: SeSystemtimePrivilege 1824 msiexec.exe Token: SeProfSingleProcessPrivilege 1824 msiexec.exe Token: SeIncBasePriorityPrivilege 1824 msiexec.exe Token: SeCreatePagefilePrivilege 1824 msiexec.exe Token: SeCreatePermanentPrivilege 1824 msiexec.exe Token: SeBackupPrivilege 1824 msiexec.exe Token: SeRestorePrivilege 1824 msiexec.exe Token: SeShutdownPrivilege 1824 msiexec.exe Token: SeDebugPrivilege 1824 msiexec.exe Token: SeAuditPrivilege 1824 msiexec.exe Token: SeSystemEnvironmentPrivilege 1824 msiexec.exe Token: SeChangeNotifyPrivilege 1824 msiexec.exe Token: SeRemoteShutdownPrivilege 1824 msiexec.exe Token: SeUndockPrivilege 1824 msiexec.exe Token: SeSyncAgentPrivilege 1824 msiexec.exe Token: SeEnableDelegationPrivilege 1824 msiexec.exe Token: SeManageVolumePrivilege 1824 msiexec.exe Token: SeImpersonatePrivilege 1824 msiexec.exe Token: SeCreateGlobalPrivilege 1824 msiexec.exe Token: SeCreateTokenPrivilege 1824 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1824 msiexec.exe Token: SeLockMemoryPrivilege 1824 msiexec.exe -
Suspicious use of FindShellTrayWindow 43 IoCs
pid Process 1824 msiexec.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 1824 msiexec.exe -
Suspicious use of SendNotifyMessage 41 IoCs
pid Process 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe 4972 taskmgr.exe -
Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 3868 wrote to memory of 4640 3868 msiexec.exe 87 PID 3868 wrote to memory of 4640 3868 msiexec.exe 87 PID 3868 wrote to memory of 4640 3868 msiexec.exe 87 PID 4640 wrote to memory of 3976 4640 MsiExec.exe 93 PID 4640 wrote to memory of 3976 4640 MsiExec.exe 93 PID 4640 wrote to memory of 3976 4640 MsiExec.exe 93 PID 3868 wrote to memory of 1696 3868 msiexec.exe 94 PID 3868 wrote to memory of 1696 3868 msiexec.exe 94 PID 3868 wrote to memory of 1696 3868 msiexec.exe 94 PID 1696 wrote to memory of 5108 1696 MsiExec.exe 95 PID 1696 wrote to memory of 5108 1696 MsiExec.exe 95 PID 1696 wrote to memory of 5108 1696 MsiExec.exe 95 PID 1696 wrote to memory of 2148 1696 MsiExec.exe 96 PID 1696 wrote to memory of 2148 1696 MsiExec.exe 96 PID 1696 wrote to memory of 2148 1696 MsiExec.exe 96 PID 1696 wrote to memory of 1940 1696 MsiExec.exe 97 PID 1696 wrote to memory of 1940 1696 MsiExec.exe 97 PID 1696 wrote to memory of 1940 1696 MsiExec.exe 97 PID 3868 wrote to memory of 4592 3868 msiexec.exe 104 PID 3868 wrote to memory of 4592 3868 msiexec.exe 104 PID 3868 wrote to memory of 4592 3868 msiexec.exe 104 PID 4592 wrote to memory of 1140 4592 MsiExec.exe 105 PID 4592 wrote to memory of 1140 4592 MsiExec.exe 105 PID 4592 wrote to memory of 1140 4592 MsiExec.exe 105 PID 3868 wrote to memory of 3068 3868 msiexec.exe 106 PID 3868 wrote to memory of 3068 3868 msiexec.exe 106 PID 3868 wrote to memory of 3068 3868 msiexec.exe 106 PID 4592 wrote to memory of 5228 4592 MsiExec.exe 114 PID 4592 wrote to memory of 5228 4592 MsiExec.exe 114 PID 4592 wrote to memory of 5228 4592 MsiExec.exe 114 PID 4592 wrote to memory of 5352 4592 MsiExec.exe 116 PID 4592 wrote to memory of 5352 4592 MsiExec.exe 116 PID 4592 wrote to memory of 5352 4592 MsiExec.exe 116 PID 1696 wrote to memory of 5408 1696 MsiExec.exe 119 PID 1696 wrote to memory of 5408 1696 MsiExec.exe 119 PID 1696 wrote to memory of 5408 1696 MsiExec.exe 119 PID 3868 wrote to memory of 5584 3868 msiexec.exe 120 PID 3868 wrote to memory of 5584 3868 msiexec.exe 120 PID 3868 wrote to memory of 5584 3868 msiexec.exe 120 PID 1696 wrote to memory of 5800 1696 MsiExec.exe 121 PID 1696 wrote to memory of 5800 1696 MsiExec.exe 121 PID 1696 wrote to memory of 5800 1696 MsiExec.exe 121 PID 1696 wrote to memory of 5932 1696 MsiExec.exe 122 PID 1696 wrote to memory of 5932 1696 MsiExec.exe 122 PID 1696 wrote to memory of 5932 1696 MsiExec.exe 122 PID 1696 wrote to memory of 6036 1696 MsiExec.exe 123 PID 1696 wrote to memory of 6036 1696 MsiExec.exe 123 PID 1696 wrote to memory of 6036 1696 MsiExec.exe 123 PID 1696 wrote to memory of 3940 1696 MsiExec.exe 124 PID 1696 wrote to memory of 3940 1696 MsiExec.exe 124 PID 1696 wrote to memory of 3940 1696 MsiExec.exe 124 PID 4592 wrote to memory of 1248 4592 MsiExec.exe 125 PID 4592 wrote to memory of 1248 4592 MsiExec.exe 125 PID 4592 wrote to memory of 1248 4592 MsiExec.exe 125 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Riders-Republic-Windows-1-21-en.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1824
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7B3CD1CF1E9DC351BBF1BAE99A30035D C2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI3C46.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240729171 5 CustomActionManaged!CustomActionManaged.CustomActions.ValidatePathLength3⤵
- Loads dropped DLL
PID:3976
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7882A2EFF084CF7E59B1E3B43CAA08902⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI428E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240730796 10 CustomActionManaged!CustomActionManaged.CustomActions.TelemetrySendStart3⤵
- Blocklisted process makes network request
- Drops file in Windows directory
- Loads dropped DLL
PID:5108
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI4B98.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240733093 16 CustomActionManaged!CustomActionManaged.CustomActions.SetStartupCmdlineArgs3⤵
- Drops file in Windows directory
- Loads dropped DLL
PID:2148
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI5241.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240734812 22 CustomActionManaged!CustomActionManaged.CustomActions.CheckReparsePoints3⤵
- Drops file in Windows directory
- Loads dropped DLL
PID:1940
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSIC330.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240763703 50 CustomActionManaged!CustomActionManaged.CustomActions.TelemetrySendEnd3⤵
- Blocklisted process makes network request
- Drops file in Windows directory
- Loads dropped DLL
PID:5408
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSID35F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240767843 59 CustomActionManaged!CustomActionManaged.CustomActions.SetLauncherEpicGamesDirLoc3⤵
- Drops file in Windows directory
- Loads dropped DLL
PID:5800
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSID479.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240768125 65 CustomActionManaged!CustomActionManaged.CustomActions.SetLauncherInstallDirLoc3⤵
- Drops file in Windows directory
- Loads dropped DLL
PID:5932
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSID526.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240768281 71 CustomActionManaged!CustomActionManaged.CustomActions.SetServiceWrapperDirLoc3⤵
- Drops file in Windows directory
- Loads dropped DLL
PID:6036
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSID9CA.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240769468 77 CustomActionManaged!CustomActionManaged.TelemetryActions.TelemetrySendStart3⤵
- Blocklisted process makes network request
- Drops file in Windows directory
PID:3940
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 2E29B8D549726B18A16478587A2C9A44 E Global\MSI00002⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI98A1.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240752875 31 CustomActionManaged!CustomActionManaged.CustomActions.MoveChainerToFolder3⤵
- Drops file in Windows directory
- Loads dropped DLL
PID:1140
-
-
C:\Windows\SysWOW64\icacls.exe"icacls.exe" "C:\Program Files (x86)\Epic Games\Launcher" /grant "BUILTIN\Users":(OI)(CI)F3⤵
- Modifies file permissions
PID:5228
-
-
C:\Windows\SysWOW64\icacls.exe"icacls.exe" "C:\ProgramData\Epic" /grant "BUILTIN\Users":(OI)(CI)F3⤵
- Modifies file permissions
PID:5352
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSIEE31.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240774703 99 CustomActionManaged!CustomActionManaged.CustomActions.RegisterProductID3⤵
- Drops file in Windows directory
PID:1248
-
-
-
C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe"C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe" /silent2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Modifies system certificate store
PID:3068
-
-
C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exe"C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exe" 44 "C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\EpicOnlineServices.msi" "EOSPRODUCTID=EpicGamesLauncher" "C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win32\EpicGamesLauncher.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5584
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4972
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:1528
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵PID:544
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
52KB
MD5c234df417c9b12e2d31c7fd1e17e4786
SHA192f32e74944e5166db72d3bfe8e6401d9f7521dd
SHA2562acea6c8b9f6f7f89ec51365a1e49fbd0d8c42c53418bd0783dbf3f74a744e6d
SHA5126cbae19794533ad9401f92b10bd9549638ba20ce38375de4f9d0e20af20d78819e46856151cc6818325af9ac774b8128e18fbebd2da5da4efbd417fc2af51dab
-
Filesize
909KB
MD5f7f554aa613eccf065575b8c69717ef7
SHA18417886d47c19cf6892f4080ddd5aaa1a49db3e9
SHA256417eebd5b19f45c67c94c2d2ba8b774c0fc6d958b896d7b1ac12cf5a0ea06e0e
SHA512618f6dbb5bd9d44a8f10d119f5ef644f168fe3d8db986994e8cce31d1f11ff9ac872b389d1f218a82ff8b397bface587f97ca21e8f77433dbadb2ac475e9e6c1
-
Filesize
744KB
MD544dba9557f956787b66f285776c3dccb
SHA14560c64f8b6bbdeedd85398f2e18404c389e4d8b
SHA256e2c5a2cbba7f211b6ca72ff8e5f69cba1f83be06357311b19e64f582fd3d14e4
SHA51225fbc95346bac890fee8d2a0805015af1eda5e0bb17b12d4eef52ca446775d08898fe5c13239e983a0f8c8dd13f8f2a5247a70e8e785e2bae42ff5ab1cca4156
-
Filesize
192KB
MD5a89b98ab89e0d4ff9dae412d49e27c51
SHA118803d4bcc83ad39f25ff9f899baf136c89c10f1
SHA256a8cf71ffb80b683616d0621be96d3795b0ffda3877ed2d80cd958bfa393ddcfc
SHA5120b96a04663d2fbfb21901af832a5362785fb0270d1be0ef136549f07e2625653f8facd129889a5f3489fc8a1270abe474e4f1626ea630a3185a36812545b4dfd
-
Filesize
106KB
MD5758c5a459978cb2c68a300a60da153be
SHA166d12509137f2b5e1a668df39e6ccce6402822c3
SHA256a58cefe822e371d078eaf89319f832693352ba7d62079320074397f0f3425961
SHA512f33d6fd3354310e6cc4b483eae955a9652e7f71ceef7c444bdef84251ffa6ec0b89886a2344d18e0a1ad5285123ad808904372289e1e1c8d14242483f0426588
-
Filesize
94KB
MD5d495680aba28caafc4c071a6d0fe55ac
SHA15885ece90970eb10b6b95d6c52d934674835929e
SHA256e18a5404b612e88fa8b403c9b33f064c0a89528db7ef9a79aa116908d0e6afed
SHA512a25c647678661473b99462d7433c1d05af54823d404476e35315c11c93b3f5ece92c912560af0d9efe8f07e36ae68594362d73abf5d5de409a3f0a146fe31a10
-
Filesize
1.5MB
MD5d8fa7bb4fe10251a239ed75055dd6f73
SHA176c4bd2d8f359f7689415efc15e3743d35673ae8
SHA256fb0e534f9b0926e518f1c2980640dfd29f14217cdfa37cf3a0c13349127ed9a8
SHA51273f633179b1340c1c14d0002b72e44cab1919d0ef174f307e4bfe6de240b0b6ef233e67a8b0a0cd677556865ee7b88c6de152045a580ab9fbf1a50d2db0673b4
-
Filesize
505KB
MD5bf3f290275c21bdd3951955c9c3cf32c
SHA19fd00f3bb8a870112dae464f555fcd5e7f9200c0
SHA2568f47d7121ef6532ad9ad9901e44e237f5c30448b752028c58a9d19521414e40d
SHA512d2c354ee8b6977d01f23c6d2bb4977812bf653eae25e7a75a7d0a36b588c89fcdbdc2a8087c24d6ff687afebd086d4b7d0c92203ce39691b21dab71eafd1d249
-
Filesize
93KB
MD5eb701def7d0809e8da765a752ab42be5
SHA17897418f0fae737a3ebe4f7954118d71c6c8b426
SHA2562a61679eeedabf7d0d0ac14e5447486575622d6b7cfa56f136c1576ff96da21f
SHA5126ff8433c0dadc0e87d18f04289ab6f48624c908acbda506708f5e0f3c9522e9316e587e71f568938067ba9f37f96640b793fdfaa580caedc3bf9873dc221271f
-
Filesize
144B
MD5ae6774ad1b4e487d0992d22700f9087f
SHA146b5c49c76a7106f33bfa9bb13ec5b0f50eff50b
SHA256dc359b3a630dab0a5b4e728806547747fc25105b70abd3b22e8bff20a3995ef5
SHA512095b725d6f78b78a8f77dfa461b716a480219a969efc8246045bc0b93a18ba1377bc17bf4ff99b390038db71db3a387c4b6c658f858b735a897d41ce6c34ce79
-
Filesize
76B
MD5cf788fa9793fea6104e904fba48b9ade
SHA15105a53f269a6c445fe58f0ab7bb501bf5790960
SHA256d49d36962528cd70e638fe62c2a675838d5f6d13c229f6a107530d58c458d100
SHA512b07ced3b04e2ce33b0fa215ae03002e666d5408f31ade8fe84f46e2a7474d277b40887f090d5db6abea58b6a8df385f952dd614979ad903aaf31b524a06aa93b
-
Filesize
100B
MD574852472abc6dd63b12c4766472c9b74
SHA15b59504cccc2a557a39ab15bffac0270d4e4014a
SHA256bd31f37629afe5b5ca7801f26f251980f6f6a737c01c3c5be19e10b8f4840f00
SHA51280e3f257a80030becd995377e912bcb62940c2819cee559441cd3b9a141229a7e071fa75b91b4b868dcdbfd00ac389f5250c7d49d0f8096e8cdf9b045523d0db
-
C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\zh_Hant_HK.res
Filesize76B
MD5446a3139b2628b0370b88deded4d5382
SHA173a290ecc02be29b6e9dedd1dde7b0633cb5d5a8
SHA2565107405e84e52f18e47aa7071f183e499a2c325e6e4bda7fca2b59ecb55d81d7
SHA5126e6cbe46747664442464bccb8dc93dfad4a786c6ac390eda705c083498c898ff0d9083afa411e800f1dfc1db10799bee110e7c5371b3f559a806d72d42cdeb0c
-
C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\bs_Latn_BA.res
Filesize76B
MD5c64f71ae20060954b9e32c5b9da51c65
SHA11e33967c51e09874f6a1de9a9c3539db9ca82a63
SHA2561f132ca885d786c508137e5a798dca175fdd0d486a134931fcc3803db934b735
SHA512caaad60303a93e38e881d7fc3c711d7a52acb59511a65bee549193067f88b870bff2daebddfae6d4ed366f93d3d7003ec5b0ac13890b9187f9a37d2be8831d17
-
C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\en_IE.res
Filesize80B
MD5f290c99a3e9c928023e949819dfe38ee
SHA1e24ac7970af336c9455b5211bf1b865237d46e05
SHA2566dd348d1795c7e999a650b6cbf254544f9d62ebe48f53230334bc0d6fa44d47d
SHA512873c23e1aea6243172bd8f8efa2cb1ed8580e1def84764cc05a3638118d4c01f17f8f51967dc050c903727cb1784c4ea01d274a45c4969d9fe1e7efb881a0379
-
C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\en_LC.res
Filesize112B
MD508408c8d145ccd952dd7d40baa4853d6
SHA1cfad7e3b03106cec4678ab39cac25fbfb34dd5df
SHA25603ea59d7659ee65e93d76e0744b1a0497d63bc278692f2a85cfe54a1f8d7f1a9
SHA512df6c166aeae11ba470f588f2f7fb096493c74ec973ac25a21d354f92fa775189f487ef639bb31d59de64b4fab68b4045f1e3267d029ed612feaa57f2fdb5495f
-
C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\en_TC.res
Filesize80B
MD5d6186af2d25663529a1670149401c51a
SHA1cc73aaa889e5f7da2fced52a80448c64c5756a9d
SHA256c3dd2043cdd9a4430624cf43fe1d7c65938e1a6d029ed3ee2632796a8d4abb5a
SHA512c94e2e44c785414bf4894caece699225411498cac344f761a8a047a4f82c15bd26d9f78834d515264805ed6454bcb3ef05e7e622e241f2e2c9678cdd0376ce31
-
C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\sr_YU.res
Filesize76B
MD5a1a03e4ae0bb3120daa7f925f9754736
SHA1244855f29a028c974b0e908cd8e4cee11f65e56c
SHA256fd67c6594b5413b30f3d04973480904ec2179107b767666c37a8a55c90918ea6
SHA51204c5b3ffb40b64422f94929e0181879cb7de1e8d07d5b2c59aca1e5e88a33503ba3a6e377c064c5675d0522c49f6853bd28e5141b9227846336f2686d551e987
-
C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\uz_Latn.res
Filesize76B
MD51960ad3959332481f6d916f056b52339
SHA1cea9c67afc66f20e4104cb6aa2df781bccadfd5a
SHA256dcb5a6234f2f38bece4039140f59ea549c5cef8191cda68fdae9d5b6106d9b4f
SHA512c7be9fb55877d5418afb221f94f131e02a2c88c55216e2a1b9967b3dde70b47336d8878b97cb64228a7ddda55dc4665517f1f8e8df2b997e2895afe62f9a3986
-
C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\vai_Vaii.res
Filesize76B
MD5a60e02569784ac9d5c76e3021322c822
SHA1471960a6448f26bf0216f28f071e3860f1d6a271
SHA256338496ad90df4581131f024dd945f5d7455f0b9969ea0c924e9f1bc142083b18
SHA512a2d57f8efbe4e5d0b50faf54c6c44ceecf0ade4577872af3cace9df64d1733a68325494694b03e3517877560bf12cc124f662aaddf8c1f68b97862e75fc0cef2
-
Filesize
136B
MD58e8f7836852a74de789dd0f4c71797db
SHA17509333c6d134b2bad48486057f91336dc1aa009
SHA256d338e130fafe30c63a1dde8b6478a23dce8d1a3716b776c44fbf9e132a392c32
SHA5124c39dd6462ea0f1f0d674bb06e8a5153a86903a91b0c04166a06c7df3b511e6ce83cbfe19d7175c010867f97dcb80723c398b4985d68ba162c30dd15b52d1fd9
-
Filesize
80B
MD5dbed6cbf5b4e215e7bc058594652c5c6
SHA114ff2242eb58ded4ae8da0315f21ad1894cc848d
SHA256df819c5400d36259bca9e3f7fbdafb6f2da2ffa00c5cf03695d3a1a5a20e8592
SHA5120312dc0174e32aba5fdc8edc21d06dd613f0bc9bb24e1e502902379b997406d4b5e2a0c17e48bf582594c5d0988fa8dd3fd9a1ccc9fc386c4e453683196f2ec8
-
Filesize
80B
MD584781fb37996ae5ed3c3e0e3beb4455a
SHA1ecd887370a4453e67a642a46bef4bb4593c0cedd
SHA256b94b6bae10b1b207adfb721f38c9bdabf1b3619c2c82afe24c7a0f823f9ca38e
SHA512fffc82be344acdafa125a7a9ba3d79939f695b3c8a1aa66d8c0092847b7487385c979175f37d7df39eb3334f56621df78d3b2b087e7ae5d40972dd37ed42b109
-
Filesize
136B
MD59195559cd1c871889bae26ad19ca0c24
SHA17106db267cc6f7d978d00d4a9829010b1e653375
SHA256ab6683282cd7cd5a8a819796ff415a8c97933eb2a77e5f6b8b42048dd336eb70
SHA512231cff0ae144af4382b9f869807492ece979a809f0f4a912b8b41e09ebf4cc6f173ec62a507af72c28bf825a7f74624b1ab776f293d632038e7b3590c9b885c5
-
Filesize
76B
MD52e5503409ec26800fcf6a9b1d64dbe57
SHA15962f8204c362dfef2b60cda43363d4811d686c6
SHA256d5d3c00ca62f706f59183248bbe5fe5c6fb721e544d3a665a8bd03b4b5f73478
SHA512649675774963c12d5776f5d8d12580f79acd476c21056662d5391ac262e82a56adc751807ea94f8d59979733bbed2616a8bf1bca16af5d89350aa473e21108be
-
Filesize
132B
MD54cf3aa31b641864ab60ef738b2b9903a
SHA192db1cf0b23b8d187b404b1693c3841f16152bda
SHA2564d2bbe1d4d9d0a4266448241596bca9da40a34d96e4fd309a205350156de0134
SHA512e7e01ab79ce30f51b69b1c7094c325d55e08da3703c05ed0741b05d30b2c4d662587338141aa5bf6ee9015ce1dff2094982a40ba58f4abca7cf3e8c1a954e2ec
-
C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\en_CC.res
Filesize80B
MD568ae567d0c236da786e332a837c30299
SHA1dfeda196ef4cd20bbf63cc94d213ad031bab3dcb
SHA256b008ddd5d12fb7008ac7f0c345e57100ef0a0b69f6f92cb34496c34386f71b7f
SHA51260e949b0ab3e6ac8209473f4c19bf87eba3216f1de345f93e88cbaeaf68bf6fe7ce4f2dde4eab9966e1da237f644e116ab5f5dc107d846d3fc7d3971fe380734
-
C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\en_SC.res
Filesize80B
MD58ccd09fd382b155e658cb8e38a69d50d
SHA1beb2f210e55b9b72116cb9ca3b5a654e7bbf3066
SHA256673b9967e9bab1bab7bd65e184eeb02eb5e8dc38f33f0970e683b9445c967cc7
SHA51226d1444ac0d0dc7bd1a5e5081bdce4831fb7768d6c93747e6bae049d88136a95d13644763aaa86e4dea7cfc40a6d2ef80506a984e650debc3c036822d881282a
-
C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\es_BO.res
Filesize148B
MD57694951ef25993c308c192cb7f702a4d
SHA165c2b02876fb4c07ef7639d251c32e3752cfe22a
SHA256abbdcff69a749e45c85eb908f6228f7a2aa7626ca79a8bb34193c6c56099a41d
SHA5127de1eedc81ea2fbd7609014f999be352059dccebc7f14637d84f7b3e51cacd7cd17f2bb9d43d074078951c69911bc7ec8591d2330c02c73922a695763d356fd1
-
C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\he_IL.res
Filesize76B
MD5a0e7f0023efe9d9da802a0c5a941f8ce
SHA1e4522c97b99704605469449c21aeef8e03a0ad3e
SHA256756032017e2d9deb9ec1508dafb605009eadf6d859ff309bbcd6e49bb2d8d9f2
SHA5122b06564fb675f51d96e9945a303d9aadaeabb8173222ac644ac3415d5ac1aec958d70f651a5c85561cdd79e0f4b713d43117332a8536a251f4fb48800076ab01
-
C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\pt_MO.res
Filesize80B
MD5aae879c1e1523cd47b76124dfb953f5c
SHA19e6f3e4d87189a381ea5ca35148e2bc4c2618686
SHA2565ab1e574c48682e6feea216e71b16150335eea3d23af856a0e6f71ce715de137
SHA5127ff20635476d644ccdf277a9dfdb01dc95fbb46c92c4fd119cebc16758380935f09b4dd1b6b240e9336465e637ac47cdca02c32dfc67ca0ccb170b2b17ab89df
-
C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\sr_Cyrl.res
Filesize76B
MD5c2d04d672f4df81cff4bceead9be3750
SHA121413dc219200658c148c7adc2a3c47e7d4c3ffd
SHA256ddd8f7540d9a540ea6967bf394fddaf7262d47fd2484d4467cb4d2c747b6dd32
SHA5126a15d00e02638fae576327c856aa81a476fb76621febf62bf1160d6afd8fd7e5ceaf12fe7cce072bb45e0d371ed5be67b3059a19a45f0e7d452564475d69b598
-
C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\sr_RS.res
Filesize76B
MD5522cc1a65a354bc4ac2119c3ee5177e2
SHA15ff152aa8dec7e82399d07d29d1dc12be874f985
SHA256fd32948fd9cec6e575bb7e29a4102cdbf852ec752cf47399a028d04528c489b3
SHA512e95d63da5e61069be80017cbd7be335ec4a80d44a1acf9638c697b13817a832d8bfa7afcb562f3d9c36df13de27366c78ba0866bb9e463f5af455ae0983e385e
-
Filesize
76B
MD58e658e24e91577b14fb18bdc90a2e1c5
SHA12a12c0df79a4b42f048c50ba66c942aac4a256e8
SHA256829e57b045199ba2d82b08baae8107b9875c7a99488ff32e7c3e225ea16a8a67
SHA512eeed6686c5ca622dbeb27d18ac89606d55f759c8f450860adc1d5aa956aba14f5606aaee7a173846e947b7274f6be9ca039bf0838fea8d1fae08d2b6b0b386c3
-
Filesize
80B
MD51ebd2cf7b1b1688edba5e6481651878d
SHA1d7475c1e2105a5316f89bad639102a22e59e8206
SHA2568840adebc3abc62843f8e6350f2e28528a3ca15d65fa9979bed3bf44566867a9
SHA512208ef55200983034d2e782b061c3c065e60832cb443d5b4cfdbe9297d338e9867089b7f26fd2a7bd7c25bdd11e8b5c7c7bdaa77a409dc679a931256ca038aa0a
-
C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\rbnf\es_GT.res
Filesize96B
MD501ac728b63d66869b5a2d94a2f88b64f
SHA1e12801ed14cb0b7bb6252a3666c9c97820f15ee9
SHA25659a741f29db4fd6792c6b24842f42aa8f9ef4e61c3f9085fde8b92f29c76960c
SHA512132080285a86e399d3f920f470fafcf39ac76d5370a492bec00af161c2c537e8368335f675e006b2ee64f6ffb02a78423a4bc7bb636342c5b92f13f4ab4c3e39
-
C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\az_Latn_AZ.res
Filesize76B
MD53f209b3aa35603dcbb208a74caa36c86
SHA1249de057005be697205333aba0433c5b04653bbb
SHA256f3965e339c622c96879dee316de42f9e9f693ddeb7a52fdcebba027171f2c86a
SHA51202411ae5728814057e0ca78d850eea85b3aca16dfdbee97a7c01860da3b82640eebe60960938c7f64b05d9e9fe8bae0b826d242e24b33c40024836f716f17e31
-
C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\en_MG.res
Filesize80B
MD57621254d9d701161592f4f0cbbf6f7bf
SHA1d41412336a9893e9a9dd439b13a3c65435018da3
SHA256db13f9c7b55bccf734f5c6d3c56dfed65eda9dc7976e24f0a862f2408a6e529f
SHA512dfe7eacc4058d1862eb6ef8305a388bd27249fe2b91df08c3102928b066454b322fb55ac7a34de0e27a87d2112b6a374e674b27b1296240efe46c5bb135d0a20
-
C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\en_SD.res
Filesize80B
MD5847e775630f25d5d30746d2aba9615c0
SHA1a538e1d8a5acdbdec4c3fe3123a46e6311a466de
SHA2564b49d73f1dacc88c3c58bdc9c73014345f9535ad76af80b72881ca618e0ab804
SHA512c7a9c62d9ee17004fb9dabad8b1877d80387692b50447d1cbaf6178cba89e56fa4272f7292ba9e26bafa7585c403580093a5e022031f6d0b96e44c7ff4357bcb
-
C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\es_PA.res
Filesize124B
MD5df8c1b6c2e9d796cc17fdc48cde3cb5f
SHA16b58526e194eb5461eb52568711cf490fc6ce325
SHA2566423a955dc8a45912dc4ca81aaa6ede3554c2dad3efe200ff97428ec88995da0
SHA5127c8085034258ebacda4948e6fcebce0f4d9b56da4fc6377e4cc94b042fc54f9f775d93d6efbd9877d9e453c9c31876f905e8953298c71c37cf720dee2fef9db2
-
C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\pa_Guru.res
Filesize76B
MD57b02e28612fbff1a60da141244aef706
SHA178065b63c9d24feaa1f72752a39d3977449bce1e
SHA25615b23903878e867c7f8638b46048ffcbb245789c344bc16986851a7227687909
SHA512ea8c726496990c7fd4958181650b21b89fce23c5250e76bfc3b7d23acf827196791c312f96ff71d5fd0f90b03603646c26b3b31232d6fa2630492c4a315552f5
-
C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\pt_TL.res
Filesize80B
MD5606dd5e86352cba8a2a4f4561837824b
SHA15c0059f5cbdd887fb652fa79ad87aac0f8865ea8
SHA2563a85bade8a7a6db69c28c9388ef247294248df06f9d9d406198479426b31d70c
SHA51266c908320950530c345997b522e12d7d6603df931fe32b43644a2ddfa12be7795c9582c070adb744fbde9df287816fc8584f5f1a2bc2158abd8bfc9ba4b20e0c
-
C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\rwk.res
Filesize984B
MD52dc65410add51f24840be253b3de1e6a
SHA1555d4e6eb7c777e657dc6fa511950b6a31426ba1
SHA256e8647fd90a97c6c221deabe0e4e4f833e3b726c9424091695e2419045d7f2b60
SHA51201bec81c93895a11fdb507bcfe01386d0d590e20827aad4ab59ce50e25de3074801996fd2b3ac9d8231af80049dc5ecaab8e3ad38ae8fd9b4135706cdc53f60f
-
C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\sr_Cyrl_YU.res
Filesize76B
MD55c56677a0822b6f922124f4e4ae5a625
SHA1d1a78f3f6f949ca8c8593dfd24a8c248642bbf38
SHA2567d0e61f3ca3dae5bb75aaf6318bde4f128da9662fe1d75fc245f5d4b5e4188ce
SHA5120090c31c35af1b6718f4db3fe7aa2e6f06240b7895df417ff9500e08c66a9f9d98095378558131c2d96ea129fdc7df30be876f4b18b887872b0addfa9c3a59a8
-
C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\vai_Vaii.res
Filesize76B
MD5a0838e6d15b5072dc03baeb7f98ed41a
SHA198ab23737463e55ada302d75545a9bb32be19272
SHA256825e5f4187683fe01e0fff595d7cb7cab8654c5699f0d8386e6c3625a5e3b19f
SHA512b4f64fa488f5af2465e5f986c7b505df49c23166c022e13dbe764047833735551f67c2f3dacdfff46a30847e8303df96270471f990ac48353e6a5baacafc3d2a
-
Filesize
76B
MD503b4c2777b2ab020f0301b1f57b4486c
SHA11a8fe984f91940e6a8b86f9433bc64ce5d875b87
SHA2562001732718d567eddb29306e39fe186be95cd30bea89a14a5cffda73c6e95539
SHA512d7ff5c4032bb90e9123b3054783ded9abac3b1413da8e01f80bfcf0a07169ce7992b89454c839b3f5d1d4633b5ade2ab093a68e9ff09aa825e9303c371929859
-
C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\bas.res
Filesize76B
MD56134f4cd4d6c15ce86537d2613927036
SHA159d53b482f70551d8dea499a310e7da230219a18
SHA25668f743aec976a4117dca15a76760cac2f8580cedfa64b9c7d523a8f7bc0fe081
SHA512aab3c6a451737433d25e38d86d21f865d944541d8c3a1ea23d937afb33c3a06c56a436afa997d42343aae8395607819a1a79f0fcb60a8017ee4c6e4c9a140172
-
C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\en_MU.res
Filesize80B
MD54d8b9ed918a6a21826cf6acda10d7b8b
SHA1dec9bb0c1333322c691b9318a9fad5e0987319e7
SHA256e26840bbac4f0ed8e3601f62abb775fcc16bf38b70785540025d1818f7057881
SHA5127ae98d692352c530ae50ab24c00c7f0aeb6c2f74c6b77ebbbddf4bdd04b21e48816bf3f2698ee2b014d703f56f9e14958e28f298cd56027492c3a300fc4b619f
-
C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\en_ZM.res
Filesize80B
MD55c178e2fa9f7bfafd04671973597da85
SHA177beeb262833524ff0cb993f282abefc05b49323
SHA256dfecd526162a19ed0e877a733782593d1cf496e5d1435248c06bdf5386f36bbd
SHA512d4fad5f465b41fa87df52fb0bae6a5c4cdd48c3c43be1daae1de9b55b962f217cb666f47f7980599caaf0101aad46895f2a3f07e872a1b44146ebc64cff860b9
-
C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\es_CU.res
Filesize80B
MD59e46895540fd75ba1c21cc8bca9446b4
SHA109c5d01771b26a3f003757fd9788d13c0f10ae26
SHA25656b0002469f572cfd0cb8c8becea7a1005ea8f7ed1d3dd308e0c4ad28a88f0c6
SHA512b7b792042aba5729eb852ecda456087f05e459641f62c1bc6e951f3bd72a81b8c6d55a995fc07bffd2ce342cf87618010a4ad63271ca4518950c9b93b9b6df85
-
C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\pa_Arab.res
Filesize80B
MD56a9273af56e5d1f6f2d24203334ddf9b
SHA1bd7ca1cb1ba90b6036803043b8e351e6ec499da5
SHA256f1d94fcb430e36370fa030c9d9892214dcb624289bc5282d432bf2a49378a08c
SHA512066cc289321c632ca0657aac15f9f0e121c506b3ebd752e19277a5087417430e3c40525e0b410b930ef3a238328906aa64bf2a53b0febb26724918333c500508
-
C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\pt_MZ.res
Filesize80B
MD55e3e0a089d7bacd2f1ac2684ee9bef02
SHA14bd888ae18fa11258d13f8fa615d8915777ca4ee
SHA256f963a5003bfc4bcf7a310c34bdaded866bfe24561fef032e89fecab13bc3ffbb
SHA512a65c63add4db82803f2aca5d2ca2ebdadd12faff258472d36b0f735617104c352ff28b49afc19446fcab396e1febdc9a08bd91d2ef43f96ee25658d3a216c4bf
-
C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\sr_Cyrl.res
Filesize76B
MD585a6974221a7807b04c9e016b6c8904c
SHA1421c17e072a104975c29e5c4a51575c5a9542489
SHA256939c1da1c4ed3e97227cfc94d46bacdfbbb8d2bff721ec42618b641db731ad3d
SHA512eadbc62801b0d5aba4b9a2bbdf469f007493fe613e04b640aa511383a4e3d707ac0adcff3e5d80f1598090e12cd65c5985dfcdf0cf8d46af807bad00204182cc
-
C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\sr_YU.res
Filesize76B
MD588ca5d2b5f3baa53f32d1a17affb3cc4
SHA1b603ef247d2e23125e79c34f3695b44853a2024e
SHA256413c50ef83d5a3ff6c6f693e50594ff033a0301dcb807c2ad1efdeb25fcb7642
SHA512be26d85b7ea633275de857127a7e8891fe0bd1eb66ba33e83ee6b652a76c0618bf052da6a43fb9e21394941732d9805dc2fb801a5065b7ee8cda6ea77ff3914d
-
C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\th_TH.res
Filesize76B
MD5c34486d88a5544f3392a4fb031eca28c
SHA1287ae38b9011fd9bf97fac414b405f1748b748fb
SHA256f7835f43b81af073e115dcdbdd71e6d274c476853ffe6befcff4a6dd26e02cc6
SHA512dd334e26082cd5f5b9cf2dd581930db2dcfc8ae136fea02b0a7e8376baa2c0582236086c7d973a84c14eb3f873c6f540e70fe65917d757c6fa630e56cd780c35
-
C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\uz_Latn_UZ.res
Filesize76B
MD5f637999c3373220f35094ab85161afbb
SHA124891e13d210b7e6b7d0053cbf5a945566f79938
SHA256eb0040acad7de2a57e33a3ad90fb1711651a7ff071d21653a3b6bc7aa39cec7b
SHA512d7b2cd72563f0a9015a2d3239d4660a3086262f633b680128b0b6f86c3ab8051838858133488768d9bd0d1db97f64c4b61172a7f6f7556c8d2295db48673708f
-
C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\en_CM.res
Filesize152B
MD5a2fecb24b478f9a9e53e5bd8cb82947b
SHA13eba18a74e53bc95b39065ad1c229181284f3bde
SHA25655d9048a31ccfb28f5da7a418a221d2cf8d488da50dc7a125a7bbb0eb7bd01b4
SHA51269a04cf483233f71dfe3e3730a11e4a5e86b57946a3bc9be823dcb7c5e0b3c26c771962242e226c82e8a72abd29133e90dcc0aefafa2ceab146ed4fb321439c1
-
C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\en_FM.res
Filesize80B
MD57b933f365b0f6a04c6db118e4a5c302e
SHA1193d872892e0be99bdeb813cf9bc6e6b9ae2022f
SHA25621eda0dea9e1f55f8e7a899b005526ea9d3d08e9338b7a57524e35c0d472d903
SHA51291c56392f9924f26bf28a803377b5ef517a3f4d0e5dda3541c0a73ba33bce1ec6b78b325c59b4defcce830c4133e4bcaf118372067a5d9d05a0ac4e592d75980
-
C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\en_SX.res
Filesize80B
MD57c270f310229b7a3bceabd9ae3be08b8
SHA1b4fb1a986654111beaa667e79a6ee7efd3958c21
SHA256a865ec010c2680b1674f3f258f1aff7a401e7ed6459f98c0699287fc05b8c520
SHA5121967b7f33051c0e665cde999bf594921ba1376017895e2cd74b3863d8704beabe9cb4d7e44be46c038225a24c205a31310198682885e8bc7a14575860c5cc988
-
C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\en_ZM.res
Filesize152B
MD5584b7ed10634a00ed0e4f58e9404cd0f
SHA1f167a677fbc727a61d5ac6a326cf1f2eaa8e6073
SHA256d3e4b494d598c2c08dcdbb9379b164c95158bb673aae0ad789124f46170937f3
SHA512f32c2e4fd559487d4b3e8a67392d5989ec99212453e1afa2dcbbd22ab69c3e21c589790653d357a5c048c670e2961a1810af3718823038ba9523164478468d0e
-
C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\es_BR.res
Filesize80B
MD510e40df5115f3c4978dce4da2e0d6451
SHA1bc28046e014f618395e2ccccc316c17ed91daa4a
SHA256876f59b33ba2ca4dfcb619bae86da6165df4955b09ec4fc989bc4e8fd4f1df89
SHA51200e5df6097b58acfee5b47748856a95f4e0cd920ae9c33a4d6ed71425b1714e7f2dc6031febc5ec4ccf216a1e3e3cab2a3950999dc8343b746ee20747dbcf6ff
-
C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\pt_ST.res
Filesize176B
MD50314889a62d29f92898f2e84fb0d88d6
SHA15e274dbbd7f357ad6d09b3b822a4b92d3109c8b4
SHA256c1991718a07aefc99fb6206f3bc6c99afa7ff678e9f6a01b4a475ddc2b288b23
SHA51204b0c28f2ba9cc19a5a89d0946050c41874617f8ec2cb3c1f268931446af51c4b3850f4a3a627e14eb34c504435f726cc4f8b11733fcc5f2d73ef2371bacb1cd
-
C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\shi_Tfng.res
Filesize76B
MD5264c63861ceef0e1a4cc72d014aa43fc
SHA174b6aafbfe5d4dce23ec1950246d948a8af12cef
SHA2562c7e3796404241f7ff344f6e838eb3dfb77569152bfeb1880927e4347b50c642
SHA512a65e31c1fa603f4a893236a84d56b04a9563e8a9520100839a997c62a2d749c3a47ff862f195d8c731194f1e9ffa9d7112214e6d3c06fac5c940a26611217b9b
-
C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\sr_Cyrl_YU.res
Filesize76B
MD57a74fc755d1e0d6d48cd5b4c2361592b
SHA1f35ee9e8b2b8ad42d48265ab5f32617b664a77fe
SHA256028a167d99b424b29176736eafd35631bacf7a4f087e765c6e244cef0d12203e
SHA512be38f81fe8d53b9fa2adad5d2b403dae7e6223f6aa4438f5ddd5c3be3b88795a720e90197a96263dc8251abc10f96a7c5e987dbea84a00cb88f60394278f54f6
-
C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\sr_Latn_BA.res
Filesize76B
MD54f880c5d6bddf339f850a87f0dc7be2d
SHA190f0e7728bf802b7e962db8434d1c562705f0613
SHA256b175f94ed5ce958a83aab63677471aa4c0b2ea04faba7c42681a5aeaef8e5530
SHA512c9fc5b2f71f055d42c8501aaaaf6e6b6c290a6018cf1cfcb993735a01868850d0b3c5eaad3a611c80d456af9319dcf1f20ce4a8a0db54736ba8c8d7089b54144
-
C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\zh_Hans.res
Filesize76B
MD5cbf1e43602d294e22f60cdefffbe1133
SHA1e9b337c3ee0c3fe63b741faa70a51fb5a8475970
SHA256968f1197df1b8b6f2ff8113b28253086818ea2c8e21c049509dc10d50adeb7f8
SHA51266979d342beba1c32521f3797499c19fa3895e8efe74ae6e50caac65aa72b282180bb3be55ad6b4a479c393e992f88f0f12b4d2b5429fefd5681076d519041eb
-
Filesize
23KB
MD54a3181a2e93579124799a9b81263768e
SHA133c8c8ebd802c3d802133ad10475f1db0e5194c3
SHA2561130e54261add0069c5b700555631b780e950a3040e20f3ad6cc984f0251730e
SHA51250b1c8a4766e8c83382a5df10dca451f8fadd3b012cc2c82dec9cfdb48d3b8f6dcad26d8baad9c31426a3e04c6ad672eb599ab6a4ea1fb3a4188e622eaea5b2e
-
C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\Microsoft.Deployment.WindowsInstaller.dll
Filesize186KB
MD5735ac22b2774c06f1d46b6bf968b1b52
SHA1dc003ad2ea8b9fa616e4f2189a0e4d0282174af2
SHA25623376c15d8b1ac063e69251088081b879c575e133cba252574b0ccfe81f289f2
SHA512b042e74082df0ab2bf9a92559ec6a602c5e05cca7f3b98562ff7cd53ddbe0893f105c1e0dd0a78edc72e2b14fc635d9455b21ecb95eaaddbe4b3b52ac9ce055c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5
Filesize471B
MD5bc9b2d9625ab55cfd9aa4414f0d902d0
SHA105b5c92585fe88607220be47f50f11e20d7304ca
SHA256caed1ec662ea40a2eb1593b44040d593edd56748157df8ccfa1b1b9852d09360
SHA5124fbd1b9903365256407c1230eada7c9617fb711070a6d45df602493586b18430102621a7bfb3e486fbdbfe03fd3385aa334b7893c8380146334157d0949b2170
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66AE3BFDF94A732B262342AD2154B86E_9040490E275779DE86373A998E4711FB
Filesize471B
MD5efc791e8ec5301a3fcf5292b8c5015ac
SHA1092418e68f250b7e2d638f567f070646bafff545
SHA256069b974943320462c5ad051a901239ebaf1f041b7aeb0ca6a4699042a769ea3c
SHA51215cf42cf0c34d5ef53aadc8add883de1f841d54fda6612281f202eb82c5a2f21f7db59a1aca797efe55c26809dd6cf01abedf18ad9f6752c6d6b6f6b833a7dee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5
Filesize404B
MD5c32b7458c7d09d1897c81a77d47a8b22
SHA11b26aafade99ff6771d63a51d7343d1ec440a9e5
SHA25620eeeb7c8567f39ea99d90707febc5eeae2fb8dc3bf4113fa1228b013749ab1b
SHA5125f21decad00917012b6b9049187a699e7c61050a76bd7a368f8d70d93b1dedf2f60e26b8056859cd2873e831895181623837de40bf18784f3fb0eb8c48e788ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_9040490E275779DE86373A998E4711FB
Filesize404B
MD53f226d2cdf1bde94417b28642c1f2687
SHA1fad7cbc7f54f71cd41d6774c4f3979f53d503c80
SHA256ef914271d3037d91d43b1c93970a7696cba587ccdc63abd952d35507d29158d5
SHA512a7f464e9b25ea80d54670d46ac25f9978155fb6f62fc7f738cb40b9f4b2e25e45cc5df497ab8400b8364e9b3ce502f0799521fcc5d4635d3728263b32f0def79
-
Filesize
651B
MD59bbfe11735bac43a2ed1be18d0655fe2
SHA161141928bb248fd6e9cd5084a9db05a9b980fb3a
SHA256549953bd4fc8acc868a9374ec684ebd9e7b23939adf551016f3433b642697b74
SHA512a78c52b2ddc057dabf260eeb744b9f55eab3374ad96e1938a291d2b17f204a0d6e1aa02802de75f0b2cd6d156540d2ddee15e889b89d5e619207054df4c1d483
-
Filesize
2.0MB
MD51c9b45e87528b8bb8cfa884ea0099a85
SHA198be17e1d324790a5b206e1ea1cc4e64fbe21240
SHA2562f23182ec6f4889397ac4bf03d62536136c5bdba825c7d2c4ef08c827f3a8a1c
SHA512b76d780810e8617b80331b4ad56e9c753652af2e55b66795f7a7d67d6afcec5ef00d120d9b2c64126309076d8169239a721ae8b34784b639b3a3e2bf50d6ee34
-
Filesize
1KB
MD51a86443fc4e07e0945904da7efe2149d
SHA137a6627dbf3b43aca104eb55f9f37e14947838ce
SHA2565dd568919e1b3cbcb23ab21d0f2d6c1a065070848aba5d2a896da39e55c6cbbf
SHA512c9faa6bb9485b1a0f8356df42c1efe1711a77efa566eee3eb0c8031ece10ffa045d35adb63e5e8b2f79f26bf3596c54c0bd23fea1642faae11baf2e97b73cf5e
-
Filesize
1KB
MD5cf70b3dd13a8c636db00bd4332996d1a
SHA148dd8fc6fa3dae23cb6ca8113bc7ad837b4570d7
SHA256d5200b332caf4fff25eb3d224527a3944878c5c3849512779a2afcfeae4c3ca1
SHA512ae31a9e20743a2052deec5d696a555460a03d400720679ed103759241b25d55e2fbc247170da3c0c0891f32b131ab6a6845de56c2d3387ad233aa11db970b313
-
Filesize
1KB
MD553a24faee760e18821ef0960c767ab04
SHA14548db4234dbacbfb726784b907d08d953496ff9
SHA2564d4263cbb11858c727824c4a071f992909675719be3076b4a47852bf6affd862
SHA5128371471624f54db0aca3ea051235937fc28575c0f533b89f7d2204c776814d4cd09ee1a37b41163239885e878fb193133ad397fe3c18232ad3469626af2d2ed1
-
Filesize
1KB
MD5fb5d27c88b52dcbdbc226f66f0537573
SHA12cbf1012fbdcbbd17643f7466f986ecd3ce2688a
SHA2563925c924eb4ec4f5a643b2d14d2eda603341fbbd22118cdd8ae04aaa96f443c0
SHA5128aa2200f91eca91d7ee3221bc7c8f2a9c8d913a5d633aa00835d5fb243d9cb8afa60fe34a4c3daa0731a21914bc52266d05d6b80bfc30b2a255d7acdf0d18eb5
-
Filesize
1KB
MD5e188f534500688cec2e894d3533997b4
SHA1f073f8515b94cb23b703ab5cdb3a5cfcc10b3333
SHA2561c798cb80e9e46ce03356ea7316e1eff5d3a88ccdd7cbfbfcdce73cded23b4e5
SHA512332ccb25c5ed92ae48c5805a330534d985d6b41f9220af0844d407b2019396fcefea7076b409439f5ab8a9ca6819b65c07ada7bd3aa1222429966dc5a440d4f7
-
Filesize
1.8MB
MD583eba442f07aab8d6375d2eec945c46c
SHA1c29c20da6bb30be7d9dda40241ca48f069123bd9
SHA256b46a44b6fce8f141c9e02798645db2ee0da5c69ea71195e29f83a91a355fa2ca
SHA512288906c8aa8eb4d62440fe84deaa25e7f362dc3644dafc1227e45a71f6d915acf885314531db4757a9bf2e6cb12eaf43b54e9ff0f6a7e3239cabb697b07c25ea
-
Filesize
459KB
MD520c835843fcec4dedfcd7bffa3b91641
SHA15dd1d5b42a0b58d708d112694394a9a23691c283
SHA25656fcd13650fd1f075743154e8c48465dd68a236ab8960667d75373139d2631bf
SHA512561eb2bb3a7e562bab0de6372e824f65b310d96d840cdaa3c391969018af6afba225665d07139fc938dcff03f4f8dae7f19de61c9a0eae7c658a32800dc9d123
-
Filesize
242KB
MD58e0bb968ff41d80e5f2c747c04db79ae
SHA169b332d78020177a9b3f60cb672ec47578003c0d
SHA256492e960cb3ccfc8c25fc83f7c464ba77c86a20411347a1a9b3e5d3e8c9180a8d
SHA5127d71cb5411f239696e77fe57a272c675fe15d32456ce7befb0c2cf3fc567dce5d38a45f4b004577e3dec283904f42ae17a290105d8ab8ef6b70bad4e15c9d506
-
Filesize
173KB
MD57ed554b08e5b69578f9de012822c39c9
SHA1036d04513e134786b4758def5aff83d19bf50c6e
SHA256fb4f297e295c802b1377c6684734b7249d55743dfb7c14807bef59a1b5db63a2
SHA5127af5f9c4a3ad5c120bcdd681b958808ada4d885d21aeb4a009a36a674ad3ece9b51837212a982db6142a6b5580e5b68d46971b802456701391ce40785ae6ebd9
-
Filesize
12KB
MD5e6a74342f328afa559d5b0544e113571
SHA1a08b053dfd061391942d359c70f9dd406a968b7d
SHA25693f5589499ee4ee2812d73c0d8feacbbcfe8c47b6d98572486bc0eff3c5906ca
SHA5121e35e5bdff1d551da6c1220a1a228c657a56a70dedf5be2d9273fc540f9c9f0bb73469595309ea1ff561be7480ee92d16f7acbbd597136f4fc5f9b8b65ecdfad
-
Filesize
79KB
MD577f595dee5ffacea72b135b1fce1312e
SHA1d2a710b332de3ef7a576e0aed27b0ae66892b7e9
SHA2568d540d484ea41e374fd0107d55d253f87ded4ce780d515d8fd59bbe8c98970a7
SHA512a8683050d7758c248052c11ac6a46c9a0b3b3773902cca478c1961b6d9d2d57c75a8c925ba5af4499989c0f44b34eaf57abafafa26506c31e5e4769fb3439746
-
Filesize
113KB
MD54fdd16752561cf585fed1506914d73e0
SHA1f00023b9ae3c8ce5b7bb92f25011eaebe6f9d424
SHA256aecd2d2fe766f6d439acc2bbf1346930ecc535012cf5ad7b3273d2875237b7e7
SHA5123695e7eb1e35ec959243a91ab5b4454eb59aeef0f2699aa5de8e03de8fbb89f756a89130526da5c08815408cb700284a17936522ad2cad594c3e6e9d18a3f600
-
Filesize
253KB
MD5f54843af156794ba61ae0ec764251229
SHA1069ba2232c67729a23841ec6c69021ce63b59a37
SHA25602a22318281d8f0475076239a63434189b142f2f533ca378d074ab9eb4e9cfda
SHA5122d687454aefcf93667b4d044092f549650c048e9311ed0a474f7e573f5bc8f9e3e18cecd00a69eb6f2fecedaa23cc63ad882c193b310d52dbacc6e8049e7ce5c
-
Filesize
35KB
MD52b54558c365370886723974967a60b45
SHA1faf9bf7ac38bf35701db8bd14321ba5e97a0103f
SHA256a7c459ca67d6388eb3c8d16a210e1dc73f6abffbb8a78bcf071c22f809942afa
SHA512a47e0589fe690d45eebdd540033fb1c0bef88dbb6a9ed6fdda0b989def4ebe5683a387ca2f72819727ba5ba372368bc35f76fc6bb32ef860f298fc13525bab84
-
Filesize
179KB
MD51a5caea6734fdd07caa514c3f3fb75da
SHA1f070ac0d91bd337d7952abd1ddf19a737b94510c
SHA256cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca
SHA512a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1
-
Filesize
211KB
MD5a3ae5d86ecf38db9427359ea37a5f646
SHA1eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
SHA256c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
SHA51296ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
-
Filesize
1KB
MD53a35350940b2fa2c5a9c57bdb25aae3f
SHA1f4d32d9e007478c80c23f7b70245d6401550ce6a
SHA256361f2f5623b1e11403827ffd625c9edc5d7977d584393d6475fc5e6559c3edb7
SHA51262756d9247cd6ead152f00d5ff7627e3158e5f0beae00520510830eeb9b1ff5b3a33201bc81240bd31f066198c6b639e3f2cbceb9155c2ce994900ab3a685e8b
-
Filesize
1KB
MD501c01d040563a55e0fd31cc8daa5f155
SHA13c1c229703198f9772d7721357f1b90281917842
SHA25633d947c04a10e3aff3dca3b779393fa56ce5f02251c8cbae5076a125fdea081f
SHA5129c3f0cc17868479575090e1949e31a688b8c1cdfa56ac4a08cbe661466bb40ecfc94ea512dc4b64d5ff14a563f96f1e71c03b6eeacc42992455bd4f1c91f17d5
-
Filesize
50KB
MD52cf9fe3247bb25daf0aaddefd6d40763
SHA1dc9b4f8e2bb6e202500061e0e03dddb102e42f26
SHA256dd24f8ef3ef4b6bc58b08ade93e4aac64856ee681909201b42cb0111a45fe9e6
SHA5124af9a34082dd04179a080918c88fffd2ddbc1d7e34779c50f8b9a2eec9cfb65f2de3ea016fa0843de97dfea5b0ca7e86f07ec0d7d1358df6a3bccb54c806a11c
-
Filesize
474B
MD591171a53a095eefe38bdc6af4cc26c6f
SHA1c24ab18c0dd16c86a91ba9ee1b27feb1e4fcded5
SHA256c2c5ac4fcf42dbf5eeecab02d574442da33bff9be72a3e47833bcb38b9bf4938
SHA512c2dfee6b00bcf3ea5af52a22ff9f98b94712b635bca40eff0c59459c22fe779a9b2747deb171e3fe89cb72a0d3c0a04125d2f7e9ba2c5689790f97bf0fb85a76
-
Filesize
2KB
MD58ad8ad241278aa1a4c4aac9de8786b35
SHA15494897b24d33e16758d77806573ccf26eec345d
SHA256b36a5ab7352d15261f439c92c289a9964c2c96a5d0bb8fe9af5f22063f7edec2
SHA512a30c482c49200797184f7a972872a185abfdc9205ca37cb3ab0159634f3d6f3e4e9f369f732879c31b5307ccb3a03d2ddc83b080772f0744f8e1c28eeec2d9bb
-
Filesize
4KB
MD58dec6e3b916846c73d7e684b7c13a9b9
SHA101a933abe838d9c7a123b264aea7d00845e69723
SHA256f6e36d9d79ebebc6168b8b2e5c077816fb81916cbbd8eb75b677bdb9e9b7677e
SHA5125def39159f0bf13d5f99c1867e8d2855e3ac5c39d46860f517074b0dce465601c19e4b06dfe90664b4ba96ac87c025db721b6fa7240d07eec80074b258c5cdd6