e36962c7613c7cec9e09e4e20d044d59f48fd5b7f969bdc0251703f2dd0998bd

Analysis

max time kernel
242s
max time network
218s
platform
windows7_x64
resource
win7-20250207-en
resource tags

arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system
submitted
25/03/2025, 19:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

REPO-SteamRIP.com.rar
Size

410.8MB
MD5

8f37d082af95556e9de90ffad55e80ca
SHA1

49b4e1fd505b1c6d1188495487ce07bc51a26abf
SHA256

e36962c7613c7cec9e09e4e20d044d59f48fd5b7f969bdc0251703f2dd0998bd
SHA512

07410a2819c6778ae288c1f8678cf77c6bcd5060a7ee5614ba420bf2192e410d669a1ec11b740304fa22959810c52aecf952fc718a25bc71d66e26153cfd5639
SSDEEP

12582912:unSnXWmXdshrHNaN6Gxh8ocYQtixfiYY8h2a:unSnXTtshb48Ch8oimfiYIa

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 17 IoCs

pid	Process
1180	REPO.exe
2268	dotNetFx40_Full_setup.exe
1544	Setup.exe
2552	dxwebsetup.exe
2340	dxwsetup.exe
1748	oalinst.exe
1600	vcredist_2015-2019_x64.exe
1524	vcredist_2015-2019_x64.exe
1020	vcredist_2015-2019_x86.exe
592	vcredist_2015-2019_x86.exe
2940	Setup.exe
2808	Setup.exe
1704	DXSETUP.exe
2276	REPO.exe
2444	REPO.exe
2524	REPO.exe
2252	REPO.exe

Loads dropped DLL 64 IoCs

pid	Process
1216	Process not Found
1216	Process not Found
1216	Process not Found
1216	Process not Found
1216	Process not Found
1216	Process not Found
1216	Process not Found
1216	Process not Found
1216	Process not Found
1216	Process not Found
1180	REPO.exe
1216	Process not Found
1216	Process not Found
1180	REPO.exe
1180	REPO.exe
1216	Process not Found
2552	dxwebsetup.exe
2552	dxwebsetup.exe
2552	dxwebsetup.exe
2552	dxwebsetup.exe
2340	dxwsetup.exe
2340	dxwsetup.exe
2340	dxwsetup.exe
2340	dxwsetup.exe
1748	oalinst.exe
1748	oalinst.exe
1748	oalinst.exe
1748	oalinst.exe
1748	oalinst.exe
1748	oalinst.exe
1748	oalinst.exe
1748	oalinst.exe
1600	vcredist_2015-2019_x64.exe
1524	vcredist_2015-2019_x64.exe
1020	vcredist_2015-2019_x86.exe
592	vcredist_2015-2019_x86.exe
1704	DXSETUP.exe
1704	DXSETUP.exe
1704	DXSETUP.exe
1704	DXSETUP.exe
1704	DXSETUP.exe
1704	DXSETUP.exe
1704	DXSETUP.exe
1704	DXSETUP.exe
1704	DXSETUP.exe
1704	DXSETUP.exe
1704	DXSETUP.exe
1704	DXSETUP.exe
1704	DXSETUP.exe
1704	DXSETUP.exe
1704	DXSETUP.exe
1704	DXSETUP.exe
1704	DXSETUP.exe
1704	DXSETUP.exe
1360	MsiExec.exe
1216	Process not Found
1216	Process not Found
1216	Process not Found
1216	Process not Found
1216	Process not Found
1216	Process not Found
1216	Process not Found
1216	Process not Found
2276	REPO.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	dxwebsetup.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
21	1684	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	dxwsetup.exe
File opened (read-only)	\??\O:	dxwsetup.exe
File opened (read-only)	\??\Y:	dxwsetup.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\I:	dxwsetup.exe
File opened (read-only)	\??\S:	dxwsetup.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	dxwsetup.exe
File opened (read-only)	\??\Z:	dxwsetup.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	dxwsetup.exe
File opened (read-only)	\??\E:	dxwsetup.exe
File opened (read-only)	\??\Q:	dxwsetup.exe
File opened (read-only)	\??\T:	dxwsetup.exe
File opened (read-only)	\??\X:	dxwsetup.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	dxwsetup.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	dxwsetup.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	dxwsetup.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\J:	dxwsetup.exe
File opened (read-only)	\??\L:	dxwsetup.exe
File opened (read-only)	\??\N:	dxwsetup.exe
File opened (read-only)	\??\W:	dxwsetup.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	dxwsetup.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\U:	dxwsetup.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\H:	dxwsetup.exe
File opened (read-only)	\??\R:	dxwsetup.exe

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\SET1421.tmp	DXSETUP.exe
File created	C:\Windows\SysWOW64\SET1421.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\XAudio2_6.dll	DXSETUP.exe
File created	C:\Windows\system32\OpenAL32.new	oalinst.exe
File created	C:\Windows\SysWOW64\SET1480.tmp	DXSETUP.exe
File created	C:\Windows\SysWOW64\directx\websetup\SETD0B.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\tmp7CBF.tmp	oalinst.exe
File opened for modification	C:\Windows\SysWOW64\SET1392.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\SET1288.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\xinput1_3.dll	DXSETUP.exe
File created	C:\Windows\SysWOW64\SET1392.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\X3DAudio1_7.dll	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A44F4E7CB3133FF765C39A53AD8FCFDD	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\d3dx9_33.dll	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\directx\websetup\SETD0B.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\xactengine3_6.dll	DXSETUP.exe
File created	C:\Windows\SysWOW64\directx\websetup\SETD0C.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\tmp7CAF.tmp	oalinst.exe
File opened for modification	C:\Windows\SysWOW64\D3DX9_41.dll	DXSETUP.exe
File created	C:\Windows\SysWOW64\SET1410.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\SET1451.tmp	DXSETUP.exe
File created	C:\Windows\SysWOW64\SET1451.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\XAPOFX1_4.dll	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\DirectX\WebSetup	dxwsetup.exe
File created	C:\Windows\system32\wrap_oal.new	oalinst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A44F4E7CB3133FF765C39A53AD8FCFDD	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\SET1480.tmp	DXSETUP.exe
File created	C:\Windows\SysWOW64\SET1288.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\SET1410.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\directx\websetup\dsetup.dll	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\directx\websetup\SETD0C.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\directx\websetup\dsetup32.dll	dxwsetup.exe
File created	C:\Windows\SysWOW64\OpenAL32.new	oalinst.exe
File opened for modification	C:\Windows\SysWOW64\SET121A.tmp	DXSETUP.exe
File created	C:\Windows\SysWOW64\SET121A.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\DirectX\WebSetup\filelist.dat	dxwsetup.exe
File created	C:\Windows\SysWOW64\wrap_oal.new	oalinst.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\Feb2010_X3DAudio_x86.cab	msiexec.exe
File created	C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\Feb2010_XAudio_x86.cab	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\XNA\Framework\Shared\xnavisualizer.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\dsetup32.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\DSETUP.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\Feb2010_xact_x86.cab	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\XNA\Framework\v4.0\XnaNative.dll	msiexec.exe
File created	C:\Program Files (x86)\OpenAL\oalinst.exe	oalinst.exe
File created	C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\APR2007_d3dx9_33_x86.cab	msiexec.exe
File created	C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\dxupdate.cab	msiexec.exe
File created	C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\APR2007_xinput_x86.cab	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\XNA\Framework\Shared\XnaVisualizerPS.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\DXSETUP.exe	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\XNA\Framework\v4.0\EULA.en-US.txt	msiexec.exe
File created	C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\Mar2009_d3dx9_41_x86.cab	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\msdownld.tmp\AS792D2A.tmp	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS795AAF.tmp\dxupdate.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS798E0E.tmp\dxupdate.cab	dxwsetup.exe
File opened for modification	C:\Windows\Installer\f7a0732.msi	msiexec.exe
File created	C:\Windows\assembly\tmp\WW4TON3Z\Microsoft.Xna.Framework.Graphics.dll	msiexec.exe
File created	C:\Windows\assembly\tmp\EZ1V5O31\Microsoft.Xna.Framework.Input.Touch.dll	msiexec.exe
File created	C:\Windows\assembly\tmp\IB4LXQA8\Microsoft.Xna.Framework.Net.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\0AA7CFB2C445A3E47869763FEB56B59E\4.0.20823	msiexec.exe
File opened for modification	C:\Windows\msdownld.tmp\AS791C68.tmp\dxupdate.cab	dxwsetup.exe
File created	C:\Windows\Installer\f7a0735.msi	msiexec.exe
File created	C:\Windows\Installer\{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1597.tmp	msiexec.exe
File created	C:\Windows\msdownld.tmp\AS795562.tmp\dxupdate.cab	dxwsetup.exe
File created	C:\Windows\Installer\f7a0732.msi	msiexec.exe
File created	C:\Windows\assembly\GACLock.dat	msiexec.exe
File created	C:\Windows\assembly\tmp\SXL2CMUR\Microsoft.Xna.Framework.Xact.dll	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\0AA7CFB2C445A3E47869763FEB56B59E\4.0.20823\F_CENTRAL_msvcp100_x86.DF495DFD_79F6_34DF_BB1E_E58DB5BDCF2C	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\f7a0733.ipi	msiexec.exe
File opened for modification	C:\Windows\msdownld.tmp\AS793F04.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS795562.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS795562.tmp\dxupdate.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS7974E3.tmp\dxupdate.cab	dxwsetup.exe
File created	C:\Windows\assembly\tmp\1P74UVZD\Microsoft.Xna.Framework.Storage.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}\ProductIcon	msiexec.exe
File created	C:\Windows\msdownld.tmp\AS796F96.tmp\dxupdate.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS795AAF.tmp\dxupdate.cab	dxwsetup.exe
File created	C:\Windows\assembly\tmp\IMCEFHCE\Microsoft.Xna.Framework.Avatar.dll	msiexec.exe
File created	C:\Windows\msdownld.tmp\AS792444.tmp\dxupdate.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS792444.tmp	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS793238.tmp\dxupdate.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS7943E4.tmp\dxupdate.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS791C68.tmp\dxupdate.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS793238.tmp	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS7943E4.tmp\dxupdate.cab	dxwsetup.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File created	C:\Windows\assembly\tmp\TG6OR6HE\Microsoft.Xna.Framework.Video.dll	msiexec.exe
File opened for modification	C:\Windows\msdownld.tmp\AS793F04.tmp\dxupdate.cab	dxwsetup.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\0AA7CFB2C445A3E47869763FEB56B59E	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS795AAF.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS796F96.tmp	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS798E0E.tmp\dxupdate.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS798E0E.tmp	dxwsetup.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\0AA7CFB2C445A3E47869763FEB56B59E\4.0.20823\F_CENTRAL_msvcp100_x86.DF495DFD_79F6_34DF_BB1E_E58DB5BDCF2C	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\0AA7CFB2C445A3E47869763FEB56B59E\4.0.20823\F_CENTRAL_msvcr100_x86.DF495DFD_79F6_34DF_BB1E_E58DB5BDCF2C	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	DXSETUP.exe
File opened for modification	C:\Windows\msdownld.tmp\AS792444.tmp\dxupdate.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS79935B.tmp\dxupdate.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS79935B.tmp	dxwsetup.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\assembly\tmp\664E9B9K\Microsoft.Xna.Framework.dll	msiexec.exe
File opened for modification	C:\Windows\msdownld.tmp	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS792D2A.tmp\dxupdate.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS793238.tmp\dxupdate.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS7974E3.tmp\dxupdate.cab	dxwsetup.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\f7a0733.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File created	C:\Windows\assembly\tmp\2AMQELN9\Microsoft.Xna.Framework.Game.dll	msiexec.exe
File opened for modification	C:\Windows\security\logs\scecomp.log	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS791C68.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS792D2A.tmp\dxupdate.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS793F04.tmp\dxupdate.cab	dxwsetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oalinst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_2015-2019_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_2015-2019_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DXSETUP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxwebsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_2015-2019_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxwsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_2015-2019_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dotNetFx40_Full_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Setup.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DXSETUP.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DXSETUP.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DXSETUP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\500BB8FAD5F3D2A4D9EFC01E0702D939	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{cecec95a-d894-491a-bee3-5e106fb59f2d}\InProcServer32\ThreadingModel = "Both"	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A8122FF4-9E52-4374-B3D9-B4063E77109D}\InprocServer32\ThreadingModel = "Both"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A8122FF4-9E52-4374-B3D9-B4063E77109D}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0AA7CFB2C445A3E47869763FEB56B59E\DXRedist	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e48c5a3f-93ef-43bb-a092-2c7ceb946f27}	DXSETUP.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\DirectShow\MediaObjects\a8122ff4-9e52-4374-b3d9-b4063e77109d\OutputTypes = 6175647300001000800000aa00389b710100000000001000800000aa00389b71	MsiExec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.Xna.Framework.Video,fileVersion="4.0.20823.0",version="4.0.0.00000",culture="neutral",publicKeyToken="842CF8BE1DE50553",processorArchitecture="MSIL" = 6c00660060002e003200510046002b00300041004c0048005600370077003800680027002100740058004e0041004600720061006d00650077006f0072006b005200650064006900730074003e00550048004a0055006e0053003d0052005d00380048004d005d00250038005d00400059006900750000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248d8a3b-6256-44d3-a018-2ac96c459f47}\InProcServer32\ThreadingModel = "Both"	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e48c5a3f-93ef-43bb-a092-2c7ceb946f27}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_6.dll"	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{cecec95a-d894-491a-bee3-5e106fb59f2d}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_6.dll"	DXSETUP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\DirectShow\MediaObjects\Categories	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A8122FF4-9E52-4374-B3D9-B4063E77109D}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{cecec95a-d894-491a-bee3-5e106fb59f2d}\InProcServer32	DXSETUP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.Xna.Framework.Graphics,fileVersion="4.0.20823.0",version="4.0.0.00000",culture="neutral",publicKeyToken="842CF8BE1DE50553",processorArchitecture="x86" = 6c00660060002e003200510046002b00300041004c0048005600370077003800680027002100740058004e0041004600720061006d00650077006f0072006b005200650064006900730074003e0055006a0064003f003d002e00310076002400390053007e005a00340068007b0055006f007a00690000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\SourceList\PackageName = "xnafx40_redist.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e48c5a3f-93ef-43bb-a092-2c7ceb946f27}\ = "AudioVolumeMeter"	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{cecec95a-d894-491a-bee3-5e106fb59f2d}\ = "AudioReverb"	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\DirectShow\MediaObjects\a8122ff4-9e52-4374-b3d9-b4063e77109d\ = "XnaVisualizerDmo"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\DirectShow\MediaObjects	MsiExec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.Xna.Framework.GamerServices,fileVersion="4.0.20823.0",version="4.0.0.00000",culture="neutral",publicKeyToken="842CF8BE1DE50553",processorArchitecture="MSIL" = 6c00660060002e003200510046002b00300041004c0048005600370077003800680027002100740058004e0041004600720061006d00650077006f0072006b005200650064006900730074003e007a00770076007100640077006800410066003d007a0027006500360077004900760034006700560000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.Xna.Framework.Xact,fileVersion="4.0.20823.0",version="4.0.0.00000",culture="neutral",publicKeyToken="842CF8BE1DE50553",processorArchitecture="x86" = 6c00660060002e003200510046002b00300041004c0048005600370077003800680027002100740058004e0041004600720061006d00650077006f0072006b005200650064006900730074003e0058003600520051006200610026006500470040005b002d003200630041007600560064007300740000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\PackageCode = "CC1B48CD503865840BBC69BD0DED73A5"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\DirectShow\MediaObjects\Categories\f3602b3f-0592-48df-a4cd-674721e7ebeb	MsiExec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.Xna.Framework,fileVersion="4.0.20823.0",version="4.0.0.00000",culture="neutral",publicKeyToken="842CF8BE1DE50553",processorArchitecture="x86" = 6c00660060002e003200510046002b00300041004c0048005600370077003800680027002100740058004e0041004600720061006d00650077006f0072006b005200650064006900730074003e0065006a0036002d0051005b002d0065003900400060004a003d006e0079005e005b005d002a00710000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3eda9b49-2085-498b-9bb2-39a6778493de}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_6.dll"	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A8122FF4-9E52-4374-B3D9-B4063E77109D}\ = "VisualizerPlugin Class"	MsiExec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.Xna.Framework.Net,fileVersion="4.0.20823.0",version="4.0.0.00000",culture="neutral",publicKeyToken="842CF8BE1DE50553",processorArchitecture="MSIL" = 6c00660060002e003200510046002b00300041004c0048005600370077003800680027002100740058004e0041004600720061006d00650077006f0072006b005200650064006900730074003e00440072005900520072006c002d004a003d0041006b00390052007a005500210029006f005e00380000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\ProductName = "Microsoft XNA Framework Redistributable 4.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3eda9b49-2085-498b-9bb2-39a6778493de}	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\500BB8FAD5F3D2A4D9EFC01E0702D939\0AA7CFB2C445A3E47869763FEB56B59E	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.Xna.Framework.Input.Touch,fileVersion="4.0.20823.0",version="4.0.0.00000",culture="neutral",publicKeyToken="842CF8BE1DE50553",processorArchitecture="MSIL" = 6c00660060002e003200510046002b00300041004c0048005600370077003800680027002100740058004e0041004600720061006d00650077006f0072006b005200650064006900730074003e0050006a006300540058005b0053007b00610039003700380070002d005d0061006c0065004900260000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0AA7CFB2C445A3E47869763FEB56B59E	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0AA7CFB2C445A3E47869763FEB56B59E\XNAFrameworkRedist	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\Version = "67129687"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\Downloads\\gsdfg\\_CommonRedist\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248d8a3b-6256-44d3-a018-2ac96c459f47}	DXSETUP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\AuthorizedLUAApp = "0"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.Xna.Framework.Avatar,fileVersion="4.0.20823.0",version="4.0.0.00000",culture="neutral",publicKeyToken="842CF8BE1DE50553",processorArchitecture="MSIL" = 6c00660060002e003200510046002b00300041004c0048005600370077003800680027002100740058004e0041004600720061006d00650077006f0072006b005200650064006900730074003e006000490066005200610038006c007d006e00400064003100700042005b00330060002c003900350000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\SourceList\Net\1 = "C:\\Users\\Admin\\Downloads\\gsdfg\\_CommonRedist\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248d8a3b-6256-44d3-a018-2ac96c459f47}\InProcServer32	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3eda9b49-2085-498b-9bb2-39a6778493de}\ = "XAudio2"	DXSETUP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3eda9b49-2085-498b-9bb2-39a6778493de}\InProcServer32	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e48c5a3f-93ef-43bb-a092-2c7ceb946f27}\InProcServer32\ThreadingModel = "Both"	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\ProductIcon = "C:\\Windows\\Installer\\{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}\\ProductIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3eda9b49-2085-498b-9bb2-39a6778493de}\InProcServer32\ThreadingModel = "Both"	DXSETUP.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\DirectShow\MediaObjects\a8122ff4-9e52-4374-b3d9-b4063e77109d\InputTypes = 6175647300001000800000aa00389b710100000000001000800000aa00389b71	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A8122FF4-9E52-4374-B3D9-B4063E77109D}\InprocServer32\ = "C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\XNA\\Framework\\Shared\\xnavisualizer.dll"	MsiExec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e48c5a3f-93ef-43bb-a092-2c7ceb946f27}\InProcServer32	DXSETUP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{cecec95a-d894-491a-bee3-5e106fb59f2d}	DXSETUP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\DirectShow\MediaObjects\a8122ff4-9e52-4374-b3d9-b4063e77109d	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248d8a3b-6256-44d3-a018-2ac96c459f47}\ = "XACT Engine"	DXSETUP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.Xna.Framework.Storage,fileVersion="4.0.20823.0",version="4.0.0.00000",culture="neutral",publicKeyToken="842CF8BE1DE50553",processorArchitecture="MSIL" = 6c00660060002e003200510046002b00300041004c0048005600370077003800680027002100740058004e0041004600720061006d00650077006f0072006b005200650064006900730074003e007b0072006100690027004a006300710041003d00550070005d002e0026004d0043007a007100590000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\AdvertiseFlags = "388"	msiexec.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
2656	NOTEPAD.EXE
896	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1544	Setup.exe
1544	Setup.exe
1544	Setup.exe
1544	Setup.exe
2940	Setup.exe
2940	Setup.exe
2940	Setup.exe
2940	Setup.exe
2808	Setup.exe
2808	Setup.exe
2808	Setup.exe
2808	Setup.exe
2188	msiexec.exe
2188	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2780	7zFM.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	2780	7zFM.exe
Token: 35	2780	7zFM.exe
Token: SeSecurityPrivilege	2780	7zFM.exe
Token: SeSecurityPrivilege	2780	7zFM.exe
Token: SeRestorePrivilege	2340	dxwsetup.exe
Token: SeRestorePrivilege	2340	dxwsetup.exe
Token: SeRestorePrivilege	2340	dxwsetup.exe
Token: SeRestorePrivilege	2340	dxwsetup.exe
Token: SeRestorePrivilege	2340	dxwsetup.exe
Token: SeRestorePrivilege	2340	dxwsetup.exe
Token: SeRestorePrivilege	2340	dxwsetup.exe
Token: SeShutdownPrivilege	1684	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1684	msiexec.exe
Token: SeRestorePrivilege	2188	msiexec.exe
Token: SeTakeOwnershipPrivilege	2188	msiexec.exe
Token: SeSecurityPrivilege	2188	msiexec.exe
Token: SeCreateTokenPrivilege	1684	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1684	msiexec.exe
Token: SeLockMemoryPrivilege	1684	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1684	msiexec.exe
Token: SeMachineAccountPrivilege	1684	msiexec.exe
Token: SeTcbPrivilege	1684	msiexec.exe
Token: SeSecurityPrivilege	1684	msiexec.exe
Token: SeTakeOwnershipPrivilege	1684	msiexec.exe
Token: SeLoadDriverPrivilege	1684	msiexec.exe
Token: SeSystemProfilePrivilege	1684	msiexec.exe
Token: SeSystemtimePrivilege	1684	msiexec.exe
Token: SeProfSingleProcessPrivilege	1684	msiexec.exe
Token: SeIncBasePriorityPrivilege	1684	msiexec.exe
Token: SeCreatePagefilePrivilege	1684	msiexec.exe
Token: SeCreatePermanentPrivilege	1684	msiexec.exe
Token: SeBackupPrivilege	1684	msiexec.exe
Token: SeRestorePrivilege	1684	msiexec.exe
Token: SeShutdownPrivilege	1684	msiexec.exe
Token: SeDebugPrivilege	1684	msiexec.exe
Token: SeAuditPrivilege	1684	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1684	msiexec.exe
Token: SeChangeNotifyPrivilege	1684	msiexec.exe
Token: SeRemoteShutdownPrivilege	1684	msiexec.exe
Token: SeUndockPrivilege	1684	msiexec.exe
Token: SeSyncAgentPrivilege	1684	msiexec.exe
Token: SeEnableDelegationPrivilege	1684	msiexec.exe
Token: SeManageVolumePrivilege	1684	msiexec.exe
Token: SeImpersonatePrivilege	1684	msiexec.exe
Token: SeCreateGlobalPrivilege	1684	msiexec.exe
Token: SeBackupPrivilege	2352	vssvc.exe
Token: SeRestorePrivilege	2352	vssvc.exe
Token: SeAuditPrivilege	2352	vssvc.exe
Token: SeBackupPrivilege	2188	msiexec.exe
Token: SeRestorePrivilege	2188	msiexec.exe
Token: SeRestorePrivilege	2376	DrvInst.exe
Token: SeRestorePrivilege	2376	DrvInst.exe
Token: SeRestorePrivilege	2376	DrvInst.exe
Token: SeRestorePrivilege	2376	DrvInst.exe
Token: SeRestorePrivilege	2376	DrvInst.exe
Token: SeRestorePrivilege	2376	DrvInst.exe
Token: SeRestorePrivilege	2376	DrvInst.exe
Token: SeLoadDriverPrivilege	2376	DrvInst.exe
Token: SeLoadDriverPrivilege	2376	DrvInst.exe
Token: SeLoadDriverPrivilege	2376	DrvInst.exe
Token: SeRestorePrivilege	2188	msiexec.exe
Token: SeTakeOwnershipPrivilege	2188	msiexec.exe
Token: SeRestorePrivilege	2188	msiexec.exe
Token: SeTakeOwnershipPrivilege	2188	msiexec.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2780	7zFM.exe
2780	7zFM.exe
2780	7zFM.exe
1684	msiexec.exe
1684	msiexec.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 1544	2268	dotNetFx40_Full_setup.exe	41
PID 2268 wrote to memory of 1544	2268	dotNetFx40_Full_setup.exe	41
PID 2268 wrote to memory of 1544	2268	dotNetFx40_Full_setup.exe	41
PID 2268 wrote to memory of 1544	2268	dotNetFx40_Full_setup.exe	41
PID 2268 wrote to memory of 1544	2268	dotNetFx40_Full_setup.exe	41
PID 2268 wrote to memory of 1544	2268	dotNetFx40_Full_setup.exe	41
PID 2268 wrote to memory of 1544	2268	dotNetFx40_Full_setup.exe	41
PID 2552 wrote to memory of 2340	2552	dxwebsetup.exe	43
PID 2552 wrote to memory of 2340	2552	dxwebsetup.exe	43
PID 2552 wrote to memory of 2340	2552	dxwebsetup.exe	43
PID 2552 wrote to memory of 2340	2552	dxwebsetup.exe	43
PID 2552 wrote to memory of 2340	2552	dxwebsetup.exe	43
PID 2552 wrote to memory of 2340	2552	dxwebsetup.exe	43
PID 2552 wrote to memory of 2340	2552	dxwebsetup.exe	43
PID 1600 wrote to memory of 1524	1600	vcredist_2015-2019_x64.exe	47
PID 1600 wrote to memory of 1524	1600	vcredist_2015-2019_x64.exe	47
PID 1600 wrote to memory of 1524	1600	vcredist_2015-2019_x64.exe	47
PID 1600 wrote to memory of 1524	1600	vcredist_2015-2019_x64.exe	47
PID 1600 wrote to memory of 1524	1600	vcredist_2015-2019_x64.exe	47
PID 1600 wrote to memory of 1524	1600	vcredist_2015-2019_x64.exe	47
PID 1600 wrote to memory of 1524	1600	vcredist_2015-2019_x64.exe	47
PID 1020 wrote to memory of 592	1020	vcredist_2015-2019_x86.exe	49
PID 1020 wrote to memory of 592	1020	vcredist_2015-2019_x86.exe	49
PID 1020 wrote to memory of 592	1020	vcredist_2015-2019_x86.exe	49
PID 1020 wrote to memory of 592	1020	vcredist_2015-2019_x86.exe	49
PID 1020 wrote to memory of 592	1020	vcredist_2015-2019_x86.exe	49
PID 1020 wrote to memory of 592	1020	vcredist_2015-2019_x86.exe	49
PID 1020 wrote to memory of 592	1020	vcredist_2015-2019_x86.exe	49
PID 2568 wrote to memory of 2940	2568	vcredist_x64.exe	51
PID 2568 wrote to memory of 2940	2568	vcredist_x64.exe	51
PID 2568 wrote to memory of 2940	2568	vcredist_x64.exe	51
PID 2568 wrote to memory of 2940	2568	vcredist_x64.exe	51
PID 2568 wrote to memory of 2940	2568	vcredist_x64.exe	51
PID 2568 wrote to memory of 2940	2568	vcredist_x64.exe	51
PID 2568 wrote to memory of 2940	2568	vcredist_x64.exe	51
PID 884 wrote to memory of 2808	884	vcredist_x86.exe	53
PID 884 wrote to memory of 2808	884	vcredist_x86.exe	53
PID 884 wrote to memory of 2808	884	vcredist_x86.exe	53
PID 884 wrote to memory of 2808	884	vcredist_x86.exe	53
PID 884 wrote to memory of 2808	884	vcredist_x86.exe	53
PID 884 wrote to memory of 2808	884	vcredist_x86.exe	53
PID 884 wrote to memory of 2808	884	vcredist_x86.exe	53
PID 2188 wrote to memory of 1704	2188	msiexec.exe	59
PID 2188 wrote to memory of 1704	2188	msiexec.exe	59
PID 2188 wrote to memory of 1704	2188	msiexec.exe	59
PID 2188 wrote to memory of 1704	2188	msiexec.exe	59
PID 2188 wrote to memory of 1704	2188	msiexec.exe	59
PID 2188 wrote to memory of 1704	2188	msiexec.exe	59
PID 2188 wrote to memory of 1704	2188	msiexec.exe	59
PID 2188 wrote to memory of 1360	2188	msiexec.exe	61
PID 2188 wrote to memory of 1360	2188	msiexec.exe	61
PID 2188 wrote to memory of 1360	2188	msiexec.exe	61
PID 2188 wrote to memory of 1360	2188	msiexec.exe	61
PID 2188 wrote to memory of 1360	2188	msiexec.exe	61
PID 2188 wrote to memory of 1360	2188	msiexec.exe	61
PID 2188 wrote to memory of 1360	2188	msiexec.exe	61

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\REPO-SteamRIP.com.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2780

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2804

C:\Users\Admin\Downloads\R.E.P.O\REPO.exe
"C:\Users\Admin\Downloads\R.E.P.O\REPO.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1180

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\gsdfg\Read_Me_Instructions.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:2656

C:\Users\Admin\Downloads\gsdfg\_CommonRedist\dotNetFx40_Full_setup.exe
"C:\Users\Admin\Downloads\gsdfg\_CommonRedist\dotNetFx40_Full_setup.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2268
- F:\6551ef594afe4bd4ca62a0c2e64c\Setup.exe
  F:\6551ef594afe4bd4ca62a0c2e64c\\Setup.exe /x86 /x64 /ia64 /web
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:1544

C:\Users\Admin\Downloads\gsdfg\_CommonRedist\dxwebsetup.exe
"C:\Users\Admin\Downloads\gsdfg\_CommonRedist\dxwebsetup.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2340

C:\Users\Admin\Downloads\gsdfg\_CommonRedist\oalinst.exe
"C:\Users\Admin\Downloads\gsdfg\_CommonRedist\oalinst.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1748

C:\Users\Admin\Downloads\gsdfg\_CommonRedist\vcredist_2015-2019_x64.exe
"C:\Users\Admin\Downloads\gsdfg\_CommonRedist\vcredist_2015-2019_x64.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\Temp\{0DB959F9-BE74-4635-8B95-5063CFBE76FF}\.cr\vcredist_2015-2019_x64.exe
  "C:\Windows\Temp\{0DB959F9-BE74-4635-8B95-5063CFBE76FF}\.cr\vcredist_2015-2019_x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\gsdfg\_CommonRedist\vcredist_2015-2019_x64.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1524

C:\Users\Admin\Downloads\gsdfg\_CommonRedist\vcredist_2015-2019_x86.exe
"C:\Users\Admin\Downloads\gsdfg\_CommonRedist\vcredist_2015-2019_x86.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Windows\Temp\{B846B4E4-F692-4222-9AB4-442C4ED441FE}\.cr\vcredist_2015-2019_x86.exe
  "C:\Windows\Temp\{B846B4E4-F692-4222-9AB4-442C4ED441FE}\.cr\vcredist_2015-2019_x86.exe" -burn.clean.room="C:\Users\Admin\Downloads\gsdfg\_CommonRedist\vcredist_2015-2019_x86.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:592

C:\Users\Admin\Downloads\gsdfg\_CommonRedist\vcredist_x64.exe
"C:\Users\Admin\Downloads\gsdfg\_CommonRedist\vcredist_x64.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2568
- \??\f:\3baded371b9b753abd79db32\Setup.exe
  f:\3baded371b9b753abd79db32\Setup.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:2940

C:\Users\Admin\Downloads\gsdfg\_CommonRedist\vcredist_x86.exe
"C:\Users\Admin\Downloads\gsdfg\_CommonRedist\vcredist_x86.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:884
- \??\f:\80ee135c959f85fbe5\Setup.exe
  f:\80ee135c959f85fbe5\Setup.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:2808

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\gsdfg\_CommonRedist\xnafx40_redist.msi"
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1684

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\DXSETUP.exe
  "C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\DXSETUP.exe" /silent
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Modifies registry class
  PID:1704
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Microsoft Shared\XNA\Framework\Shared\xnavisualizer.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:1360

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2352

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000004C4" "0000000000000494"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2376

C:\Users\Admin\Downloads\gsdfg\R.E.P.O\REPO.exe
"C:\Users\Admin\Downloads\gsdfg\R.E.P.O\REPO.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2276

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\gsdfg\Read_Me_Instructions.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:896

C:\Users\Admin\Downloads\gsdfg\R.E.P.O\REPO.exe
"C:\Users\Admin\Downloads\gsdfg\R.E.P.O\REPO.exe"
1⤵
- Executes dropped EXE
PID:2444

C:\Users\Admin\Downloads\gsdfg\R.E.P.O\REPO.exe
"C:\Users\Admin\Downloads\gsdfg\R.E.P.O\REPO.exe"
1⤵
- Executes dropped EXE
PID:2524

C:\Users\Admin\Downloads\gsdfg\R.E.P.O\REPO.exe
"C:\Users\Admin\Downloads\gsdfg\R.E.P.O\REPO.exe"
1⤵
- Executes dropped EXE
PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f7a0734.rbs

Filesize
16KB

MD5
481f4f265498c00eafdefca57caa2177

SHA1
80027aca2a5d2acdca3a5886f485a75c2829f17f

SHA256
2ba08bdea3cc9354b590e3bccdb05652682f9b80a4722e50dc9a741e95c5d4b6

SHA512
2f0e293f4fb48607a8d5cd7c8e6fe8bb346a39749cf0dd5f169a79c6276d2aaef19ad31c8f0fd294c65ca5064f078e547864e948d9cf9a6a0f70074627fe0eeb

Download Submit
C:\Config.Msi\f7a0736.rbs

Filesize
596B

MD5
9aca740dc122ac37ff1e5d3211b48e69

SHA1
b041a9dbc292ad7a8d26728f92a524a972fa5895

SHA256
4757081c27f303b099be50d62f19348bde8dd2ade4d75d493f58714214b6a179

SHA512
5560837dd19c78cca73a97c9db7918188d121cd3582c74990b25ebece64e6df81ddb453cca46def247089e2558d217225a112e29c694cb92363cde7d7abe9df0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
71KB

MD5
83142242e97b8953c386f988aa694e4a

SHA1
833ed12fc15b356136dcdd27c61a50f59c5c7d50

SHA256
d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

SHA512
bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXC8E.tmp\FEB2010_X3DAudio_x86.inf

Filesize
1KB

MD5
e84adf38d499ae39090ad60fd76d76e3

SHA1
6af4d58bc04aac2723e8b97649f1b35fb1aca84c

SHA256
d4da3e530982812d1e2a31570b80af541fac1b13c72997d2aad7ea3bfeaf4a4a

SHA512
6714992e7aee7bd0798fbec68f92c97ee502127580e21e1b6693ed6737312b44dbc9fd9ef579fe552590e9e5a4904df94e4116334265a34699a04aa76ab87c24

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXC8E.tmp\FEB2010_XACT_x86.inf

Filesize
1KB

MD5
82c10b720e33be099f69e4010d44ecd2

SHA1
e95a2eb23db3fd610d71089500aad523f93c9469

SHA256
e850fdb84bcac0f667927e53fee943efd3f43be6c6a0ae1e17f3fff83ddb2635

SHA512
853261c439b26cdc8991ac289b9f9925976452ed613481b0cf09e75444882805ffa15633eba441d8e1a04641f5f6378b68e2270a6a48d3911d7f9c2c0b1235bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXC8E.tmp\FEB2010_XAudio_x86.inf

Filesize
1KB

MD5
e6e942a2cfbb587bfcc4203b5bb34fd4

SHA1
2e0172ea1936911a98e11a6e98990703e24172c0

SHA256
74c827ef94881099761e04397ef8f162fd0ccaf4876a5503c4b53a5216d2acca

SHA512
3d70d76e6f459819a1703c5019a2e10fe518ee6e8eb5d3313fe57d3d1b6313b52c4904398a26841c78a9ecf9d715e1201e834ab3df47265e070ec94417a78e4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXC8E.tmp\Mar2009_d3dx9_41_x86.inf

Filesize
1KB

MD5
b37a5ff044eb65521a290c79ba1a3e00

SHA1
ed505464894bd3e52654834487f3821ae117edfe

SHA256
bd29711cc2ecd924990167ffa95f48842e24aeed3acef1023717040240b4bbb6

SHA512
eae4408cfa7f9c39b101489688cc570a184b8a57f3d20d3b0452a581fb80c4f485dc2f512a39669a92a5bde81fbf474e1585f566ff482e87610780c23126c21e

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXC8E.tmp\X3DAudio1_7.dll

Filesize
21KB

MD5
c811e70c8804cfff719038250a43b464

SHA1
ec48da45888ccea388da1425d5322f5ee9285282

SHA256
288c701bdedf1d45c63dd0b7d424a752f8819f90feb5088c582f76bc98970ba3

SHA512
09f2f4d412485ef69aceacc90637c90fad25874f534433811c5ed88225285559db1d981a3ab7bc3a20336e96fb43b4801b4b48a3668c64c21436ee3ea3c32f45

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXC8E.tmp\XAPOFX1_4.dll

Filesize
72KB

MD5
e4ce2af32f501a7f7dddd908704a0ee6

SHA1
9dc2976efb15b6fba08bebdeb98929b6961063a5

SHA256
0aee44b12913a95840ee6431d90518b0d72c54a27392e21ee6995e2151554a06

SHA512
ec14a58414d595a36c6b575cdae690f11481cd3f0b35fd2f4c6a6d162a6272882cfe03da865e09a34972775790529f51c80b69056a2fcb909f25b549ed2f7f01

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXC8E.tmp\XAudio2_6.dll

Filesize
515KB

MD5
4976243bd70fae3d1d24e49739ab2710

SHA1
6ef27b10bcf4e697fe77c3e964b326be11e4444f

SHA256
61b57170f7c6365714396072d22cb98746718c0f44c9f0d5c62fdb1b218639c7

SHA512
af2d6aaad44bed880a1a2ee947618b142c76a5eca42d4608196b74df9108a9649059d8207e84a58b76ad43aefe9b66ffcc519f8126667177011cf4199f163e83

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXC8E.tmp\apr2007_d3dx9_33_x86.inf

Filesize
1KB

MD5
044cae9c30c88bda73727243f5e5206d

SHA1
de744e349cf4ea458b10657d510966d21ad08d67

SHA256
349a09a2791d697bffffc61410a536cdcf258f0d7c86dda44a297e8aec4bdf00

SHA512
18e501142004afbcd28b41bdd3a9b19e2eebc047d7858ee11a9135f19759cfd8c643ff074a51e937bbcab7162888fd95effc146be21fe63dfc300ef03ed44056

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXC8E.tmp\apr2007_xinput_x86.inf

Filesize
1KB

MD5
e188f534500688cec2e894d3533997b4

SHA1
f073f8515b94cb23b703ab5cdb3a5cfcc10b3333

SHA256
1c798cb80e9e46ce03356ea7316e1eff5d3a88ccdd7cbfbfcdce73cded23b4e5

SHA512
332ccb25c5ed92ae48c5805a330534d985d6b41f9220af0844d407b2019396fcefea7076b409439f5ab8a9ca6819b65c07ada7bd3aa1222429966dc5a440d4f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXC8E.tmp\d3dx9_33.dll

Filesize
3.3MB

MD5
cdb1cd22baff21f48606b3c1a18b000b

SHA1
9315b5db975a34dbebdb4dcae652ba1db01c482c

SHA256
c6b7b2ad7742dde5dd8d1a35fdc1c185e586e551ad9c74d3fb21759cd8ca4da8

SHA512
c5fb24de8f1ee6fc1ed6e74580b5d22599ea4eb6c3589645fff0b15dc8dca051c4917e60fbc00ca86542dd63a8f5e40da92ea77e24826c0c6bdba9b58c36d4db

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXC8E.tmp\d3dx9_41.dll

Filesize
4.0MB

MD5
3fa06cf5079b84155d18b05c08f7131b

SHA1
fafe52876151a08f39dbb6b4aa137dd85558ba5f

SHA256
6ac4df203af419d3f3b7d9a99e14a3490ea3ad307c474bfe36baea642b1421f6

SHA512
24d29c3ffb6532da860fef4dd93e61f7532cea3af94928495a3af0231e7dff6db5cad25713451a2e722c076462b94818cd6969a1c7d8905585b0f64e12174d1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXC8E.tmp\dxupdate.inf

Filesize
12KB

MD5
8c281fcb5546d1ed3cdaf6e3f7303139

SHA1
de342a17f2df0386f6584e2f55ae43c558ceb6c4

SHA256
7530c6e18dbb522c5f4fbf6714962c185ea318f9eab7aeb833b0cc07cd2fe656

SHA512
344ea0a375c8851fcf413f441a1cac3013b3748d1630a4d677da72e98f41823bf9427d896de7e1fe35bf868279538cf3b8322aa6ef20025bff48a6bb7f8c42d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXC8E.tmp\xactengine3_6.dll

Filesize
233KB

MD5
f81c4678a55ffee585ac75825faf5582

SHA1
8fb2e6cf2a022eaed2ff5e3e225b3ca1e453d1cc

SHA256
8a7e7c5ac2e6230f0249d46751522e7ecf85e7490cf7491ab73bf2e7e59e4c0f

SHA512
8c8071bc2640d5c0fcf140ad68d4788cbb0706d17313c3cb74e25624a748b282acbf77eda678cf0d5fecf2ec3d583508c6f4eaf5c84073909b616f59b4f4e5fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXC8E.tmp\xinput1_3.dll

Filesize
79KB

MD5
77f595dee5ffacea72b135b1fce1312e

SHA1
d2a710b332de3ef7a576e0aed27b0ae66892b7e9

SHA256
8d540d484ea41e374fd0107d55d253f87ded4ce780d515d8fd59bbe8c98970a7

SHA512
a8683050d7758c248052c11ac6a46c9a0b3b3773902cca478c1961b6d9d2d57c75a8c925ba5af4499989c0f44b34eaf57abafafa26506c31e5e4769fb3439746

Download Submit
C:\Users\Admin\AppData\Local\Temp\HFIF661.tmp.html

Filesize
15KB

MD5
cd131d41791a543cc6f6ed1ea5bd257c

SHA1
f42a2708a0b42a13530d26515274d1fcdbfe8490

SHA256
e139af8858fe90127095ac1c4685bcd849437ef0df7c416033554703f5d864bb

SHA512
a6ee9af8f8c2c7acd58dd3c42b8d70c55202b382ffc5a93772af7bf7d7740c1162bb6d38a4307b1802294a18eb52032d410e128072af7d4f9d54f415be020c9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1AD8.tmp

Filesize
183KB

MD5
109cab5505f5e065b63d01361467a83b

SHA1
4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

SHA256
ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

SHA512
753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

Download Submit
C:\Users\Admin\Downloads\R.E.P.O\MonoBleedingEdge\etc\mono\4.0\settings.map

Filesize
2KB

MD5
ba17ade8a8e3ee221377534c8136f617

SHA1
8e17e2aec423a8e6fb43e8cbe6215040217bb8a3

SHA256
ce1db1ad8a9512073164e3eccdc193f7eda036e1a9733caec4635de21b2865c8

SHA512
c18bcbcbd4b9a20a72b1a934d70db1eafef047f34f3ba2c6357d8e3afed07ecaab861e5571ceb58c22d4d3e5ebb34b51e366a0553c3153fbc263d1d80472e297

Download Submit
C:\Users\Admin\Downloads\R.E.P.O\MonoBleedingEdge\etc\mono\4.0\web.config

Filesize
18KB

MD5
d081581e16b06480a5aaef8cdfb305ab

SHA1
771648fadc7ed9a422b4bc26e38d854d066742d7

SHA256
e38bb8cc68fe5b4edecdfd288d094b9e8ced7629039b2a347682aba0d8bd7492

SHA512
6312269cfd726a991e574b1da0c3b8a2978b248118c1610d4e8791e83f3aa6d42bdd1f4f81850eaa94c026d51e73c515971a58580cd9dfbbcadf9ba0584749c4

Download Submit
C:\Users\Admin\Downloads\R.E.P.O\MonoBleedingEdge\etc\mono\4.5\Browsers\Compat.browser

Filesize
1KB

MD5
0d831c1264b5b32a39fa347de368fe48

SHA1
187dff516f9448e63ea5078190b3347922c4b3eb

SHA256
8a1082057ac5681dcd4e9c227ed7fb8eb42ac1618963b5de3b65739dd77e2741

SHA512
4b7549eda1f8ed2c4533d056b62ca5030445393f9c6003e5ee47301ff7f44b4bd5022b74d54f571aa890b6e4593c6eded1a881500ac5ba2a720dc0ff280300af

Download Submit
C:\Users\Admin\Downloads\R.E.P.O\MonoBleedingEdge\etc\mono\4.5\DefaultWsdlHelpGenerator.aspx

Filesize
59KB

MD5
f7be9f1841ff92f9d4040aed832e0c79

SHA1
b3e4b508aab3cf201c06892713b43ddb0c43b7ae

SHA256
751861040b69ea63a3827507b7c8da9c7f549dc181c1c8af4b7ca78cc97d710a

SHA512
380e97f7c17ee0fdf6177ed65f6e30de662a33a8a727d9f1874e9f26bd573434c3dedd655b47a21b998d32aaa72a0566df37e901fd6c618854039d5e0cbef3f5

Download Submit
C:\Users\Admin\Downloads\R.E.P.O\UnityPlayer.dll

Filesize
29.5MB

MD5
b33d91200048e718c7207367f49d60fe

SHA1
cc95b2632f33ec9a533852df3402c58ef3faf0c1

SHA256
4b34672318371b54be9d89c9482a91ab3d26ae5d209935b8ad5919e00ec4f1d9

SHA512
edc94d2deab48e3aa57566904ebafc7082d63f14901c36067783deb10538e74124cdbadc72d40ec3c9db09c9e1cd27b18bdfd1969545e2607d34d5d12ec1d220

Download Submit
C:\Users\Admin\Downloads\R.E.P.O\dlllist.txt

Filesize
139B

MD5
7dd443df8404c42b7db22908ad5132b9

SHA1
302f827ca20c8b4c7d71a466907c2421661429e1

SHA256
4b93c54c0d588197645352d11ebc066f6f8150a2826ed04c1525ae865ce00153

SHA512
a5be18614385400aadc57c2bd09760ac58a367b3bd1643b2e4aaa2db5426e5fe806a5428568fadc896243f65f7391c12f71b83475ed6db9ad175de6c3ab9f530

Download Submit
C:\Users\Admin\Downloads\gsdfg\Read_Me_Instructions.txt

Filesize
1KB

MD5
a62b5c2e28d534162b6fe9ab6795aeba

SHA1
12a94a8d49108b4d6072a838ba5977ca686fefc9

SHA256
1a3623d7653b8b056d4c471412445ca22bc9e8708f6f64d062f4742cd654f570

SHA512
67c22fac03db4fe2e23ffee90489c573849a1e3e896c9573492d1de37579fe6839f6c433181a15de43d4dd0d6b95e8cbced6661d5c6890263b8f295a57da0ff7

Download Submit
C:\Users\Admin\Downloads\gsdfg\_CommonRedist\dotNetFx40_Full_setup.exe

Filesize
868KB

MD5
53406e9988306cbd4537677c5336aba4

SHA1
06becadb92a5fcca2529c0b93687c2a0c6d0d610

SHA256
fa1afff978325f8818ce3a559d67a58297d9154674de7fd8eb03656d93104425

SHA512
4f89da81b5a3800aa16ff33cc4a42dbb17d4c698a5e2983b88c32738decb57e3088a1da444ad0ec0d745c3c6b6b8b9b86d3f19909142f9e51f513748c0274a99

Download Submit
C:\Windows\Installer\f7a0732.msi

Filesize
6.7MB

MD5
97c2eebb30c5a88c68c8f24f37183f1d

SHA1
49efdc29f65fc8263c196338552c7009fc96c5de

SHA256
e6c41d692ebcba854dad4b1c52bb7ddd05926bad3105595d6596b8bab01c25e7

SHA512
c9d1017b274ceb1b4ee624cf7e628787c32a727c64f715fbce1f1ae929d9114f8fe1291e34583cec615619b0128c01206b07efc878e7a5c57b792453f73fd0da

Download Submit
C:\Windows\Logs\DirectX.log

Filesize
2KB

MD5
868bb86f59ea95f952f27188edf66ddd

SHA1
d2ab0f497deb095822289857e5948a505b5c2e41

SHA256
57ca8d193e84ad9faca75a02e45608d04b8d2b06eab7d9379d39bfae7c0662cb

SHA512
9d3fb25b26e37e0ff18c8c1dd6622346b4f0c20139b374f77d047acf6983bd6581979a1f5138d2f6e0924d620ec963a5f037bc97b1c2f901fb70060585070680

Download Submit
C:\Windows\Logs\DirectX.log

Filesize
2KB

MD5
8776a00cd6696c0a6d3335137f1cc0f7

SHA1
089745739d3465705619abaa2c4705c87c0eaf60

SHA256
a277ea0bd2ce03c0d2319f157a4b7746e402089f053f18c29ee6b941a843ab63

SHA512
7b60fa852aaf102297be9f1ccc701751cc55539217de01d4468bee667f9c0d3c31d590a65bf5c784273042805a7ea306354421266aa19d55c840e1f1b677873d

Download Submit
C:\Windows\Logs\DirectX.log

Filesize
4KB

MD5
44c5ba6d325d4a7a54252ba38ba2347a

SHA1
cdde4d1d692a724fb1a04c2ffa31ce07babf9c33

SHA256
7a9eac77498645f3ad0cc7cfaddadaf84fac7b9802ea6934de6ebcd721760fd9

SHA512
eb9c6eddeac9560ffc61e848ddcfb9f24e1dced35909e4be3aa1eb4e956e01124891937a15d283f9682c4a541fe43a2a614b82eac007720b6c2c6be634685749

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Filesize
109KB

MD5
e8c7b89d720804b578858bd82bb60e2e

SHA1
7ccaf7a74488b32f987974d2d44765fa909d6492

SHA256
f15f4be4b52775268017dc0d4ed52ec266ab0538a1475602c52ca909e9244223

SHA512
55a17aea6f028c23e58811e8a36bab70aa907eee81e0a551220f01d20da81f57e3ee5b1dc7cd9d59ae04dd7f10a48cb1b0d248628ec966fb0751a61e51ceeb85

Download Submit
C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Xna.Framework.Graphics\v4.0_4.0.0.0__842cf8be1de50553\Microsoft.Xna.Framework.Graphics.dll

Filesize
417KB

MD5
c76b932d5308f2c33b2b25077fc93fdc

SHA1
3877403187dc35eb57cbe9940166e57021b2275b

SHA256
39aed7fd8e308ccace5ce9390256f1c829ca72c2eccd97d4a0f629f24015d3a5

SHA512
d84c39c2aaff47a0a9899a695ccf450b1c126388f25e9c186a313a31c81f584768d8a5928916fe6e0a7dafee66c7d11909ebdd1468b7b80a3892de1ddf252f74

Download Submit
C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Xna.Framework.Xact\v4.0_4.0.0.0__842cf8be1de50553\Microsoft.Xna.Framework.Xact.dll

Filesize
74KB

MD5
cf7788e795f1c743d6ee0bf8de3fa502

SHA1
db2bf000c096a91aca46da5fe35326761c63053f

SHA256
6824bb0b7b42626d1ed5b7ab7e4dab4a380fa010175d4de0fadb1c3904e491d1

SHA512
13cd0d8d7479d7bb9b721cbd8109764bfb58e4dc01661e8fd6819f1cb182e408766e7cc61103e95763bdc1e11ab4b901ae05c8748e18b5f730ec78c5868f7781

Download Submit
C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Xna.Framework\v4.0_4.0.0.0__842cf8be1de50553\Microsoft.Xna.Framework.dll

Filesize
657KB

MD5
343f79fe3dcfe0828f7ac2a13f8f7210

SHA1
8daafd2b9e44f0b46b2dc6ba4607ef155964db0e

SHA256
8b7aa4c4939f243b21432747281cc8aacdcda56191a16d9eaa036b4136cf0da4

SHA512
651d7acf8effe6a77ce094c88163adb950830d2f5779f900129391f2f9ca7393163749084e861fbd742e26f61c350225107d64dcf888c0b5d4ac9de8ae99d44a

Download Submit
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Xna.Framework.Avatar\v4.0_4.0.0.0__842cf8be1de50553\Microsoft.Xna.Framework.Avatar.dll

Filesize
24KB

MD5
7b26de335983eb8b800a67ef5ff077d5

SHA1
f614672dd8b25985a417ed339a6a6532c9e57800

SHA256
7688ebdffc98433eef8aada293a8c4beec6d6acfc0e1f91ca8eb2f1c350e7cec

SHA512
fc14dcda0703c8ade152bee32b4c4175c37e98500cc1370d4de0ffd0eac398edae3a42d29711e6ec841231fab0eed228fc6eba69347b54a8e125866ae6822043

Download Submit
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Xna.Framework.GamerServices\v4.0_4.0.0.0__842cf8be1de50553\Microsoft.Xna.Framework.GamerServices.dll

Filesize
70KB

MD5
f1e460b7805cbc4901c410f2767912ab

SHA1
01e7f335e58af5140bc7953518739f43c59f1c98

SHA256
627e84c06cc4e409870b068c9ec9149adba425e47e64185f92d839db2aa35484

SHA512
3f34bb839deb6af6b68946aaeac17fa3a1e419d2f8310f37d1f460bda329c2bd46e380fe18f883389dcc64e482e596a0b31e0291b202abefe1c6976d5dec8751

Download Submit
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Xna.Framework.Input.Touch\v4.0_4.0.0.0__842cf8be1de50553\Microsoft.Xna.Framework.Input.Touch.dll

Filesize
22KB

MD5
911fbe5496efbaed4ea67497fa63c633

SHA1
570911a579cd752ceedbe9b07efc1c8c832cfda9

SHA256
2191bad4540b50723acbda55bd2c6e5d80cc6f84ad989ff89ddda672348577b2

SHA512
6ffc30116c62f9a91e5d6fee4133e87417df14aafdf5443f7002b46c20ddbf0eca242ea54f8711b31defb42ad0ef3f5f11b16e699ce3dbdaa728ec1661e00d7d

Download Submit
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Xna.Framework.Net\v4.0_4.0.0.0__842cf8be1de50553\Microsoft.Xna.Framework.Net.dll

Filesize
53KB

MD5
378479eead647cedc6b74bf84e5514a2

SHA1
8dac9af1bec30f93a4aa6650ced1f64dd0791841

SHA256
3c0b37068ad56193fd613eb8f6bd321e7e08a99b9cf85606ccddf060afb1263b

SHA512
6b0cb09a21121d2eed1277c0989d5ae142b6c724886ada5f713f762c61641901fadbb4fdea115cbdb662ceee220aa7d684e5a7a0613fc3a642bbad36e9c22e88

Download Submit
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Xna.Framework.Storage\v4.0_4.0.0.0__842cf8be1de50553\Microsoft.Xna.Framework.Storage.dll

Filesize
20KB

MD5
17c4074e1d0977182060959ec63e18a6

SHA1
af73bc4b90899793525ca472a1b90312c33063e9

SHA256
7edbb80c699ce3ead8aee5a512ee34c7718cb5dceeb1d0577e788ad8d0ad9383

SHA512
b7d7fc7b21f3fd480e6ee40cfb3682b898382ad2397cc38ef7258db68dcac31de0f64b8adae5ac92d0b31c3cf85c2489a04dfa77675104134d874fb4871e91b0

Download Submit
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Xna.Framework.Video\v4.0_4.0.0.0__842cf8be1de50553\Microsoft.Xna.Framework.Video.dll

Filesize
17KB

MD5
94b8554692a89f1955b9219e0f26442b

SHA1
cd34862740a30b2f0fd391fa16b082edb79d155b

SHA256
63c7673c936747abd9ebe779e8837c8b8add2c078a31216684fbf8c6bcab2745

SHA512
9a6762e9cd8bd26dd347c8166dc59b31159c9e5295d39773c69228d73b5f3f850bbd41f733b1f880623bcd4c929f13d66e2168f2e1972842a6e031d069ec92b4

Download Submit
C:\Windows\SysWOW64\directx\websetup\dsetup.dll

Filesize
87KB

MD5
0a23038ea472ffc938366ef4099d6635

SHA1
6499d741776dc4a446c22ea11085842155b34176

SHA256
8f2c455c9271290dcde2f68589cf825f9134beecb7e8b7e2ecbcabeab792280a

SHA512
dcc1c2ea86fd3a7870cd0369fa42f63d493895c546dcdd492ee19079a0d0696d689bbfe7b686d4fa549841896a54e673fc4581b80783d7aa255dfad765b9dc88

Download Submit
C:\Windows\SysWOW64\directx\websetup\dsetup32.dll

Filesize
1.7MB

MD5
7672509436485121135c2a0e30b9e9ff

SHA1
f557022a9f42fe1303078093e389f21fb693c959

SHA256
d7ea3cf1b9b639010005e503877026597a743d1068ae6a453ce77cc202796fea

SHA512
e46ff68c4a532017f8ab15b1e46565508f6285b72c7a1cbe964ed5e75320c8e14587d01fee61b3966f43636bfe74cebd21f7665b4a726281e771cf9230e69863

Download Submit
C:\Windows\SysWOW64\directx\websetup\filelist.dat

Filesize
111B

MD5
24701b46dccc4ac0b74d23bf457b15a8

SHA1
2d82c069cc6e05fd6d0bcb7665171ffaf136f8ea

SHA256
9ee5f6b1a1202f3bbf64e7fbdd13963fadb2bf299630c17b1397ab2aa15d6731

SHA512
4ee56e6cee09bd3e01f9574b01210402acf90f5efb2ff697dcff4eb8f26016462f9d7b1927aa8e34b8a2b3c8eccd7ae148a7c65a07cce663fe27a750249a1be5

Download Submit
C:\Windows\SysWOW64\tmp7CAF.tmp

Filesize
790KB

MD5
694f54bd227916b89fc3eb1db53f0685

SHA1
21fdc367291bbef14dac27925cae698d3928eead

SHA256
b8f39714d41e009f75efb183c37100f2cbabb71784bbd243be881ac5b42d86fd

SHA512
55bc0de75a7f27f11eb8f4ee8c9934dfe1acd044d8b7b2151c506bdcbead3ab179df7023f699c9139c77541bbc4b1c0657e93c34a6bc4309b665c6cb7636a7e5

Download Submit
C:\Windows\Temp\{436B9C5E-4A63-413F-ADBF-18A87E4E1995}\.ba\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Windows\Temp\{7E768CC0-2A00-4B1A-9B63-E559DFB0D6EC}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
F:\3baded371b9b753abd79db32\1028\SetupResources.dll

Filesize
13KB

MD5
7c136b92983cec25f85336056e45f3e8

SHA1
0bb527e7004601e920e2aac467518126e5352618

SHA256
f2e8ca58fa8d8e694d04e14404dec4e8ea5f231d3f2e5c2f915bd7914849eb2b

SHA512
06da50ddb2c5f83e6e4b4313cbdae14eed227eec85f94024a185c2d7f535b6a68e79337557727b2b40a39739c66d526968aaedbcfef04dab09dc0426cfbefbf4

Download Submit
F:\6551ef594afe4bd4ca62a0c2e64c\1025\LocalizedData.xml

Filesize
72KB

MD5
c5bf74c96a711b3f7004ca6bddecc491

SHA1
4c4d42ff69455f267ce98f1db8f2c5d76a1046da

SHA256
6b67c8a77c1a637b72736595afdf77bdb3910aa9fe48d959775806a0683ffa66

SHA512
2f2071bf9966bffe64c90263f4b9bd5efcac4f976c4e42fbdeaa5d6a6dee51c33f4902cf5e3d0897e1c841e9182e25c86d42e392887bc3ce3d9ed3d780d96ac9

Download Submit
F:\6551ef594afe4bd4ca62a0c2e64c\1029\LocalizedData.xml

Filesize
79KB

MD5
0b6ed582eb557573e959e37ebe2fca6a

SHA1
82c19c7eafb28593f453341eca225873fb011d4c

SHA256
8a0da440261940ed89bad7cd65bbc941cc56001d9aa94515e346d57b7b0838fc

SHA512
aba3d19f408bd74f010ec49b31a2658e0884661d2efda7d999558c90a4589b500570cc80410ba1c323853ca960e7844845729fff708e3a52ea25f597fad90759

Download Submit
F:\6551ef594afe4bd4ca62a0c2e64c\1030\LocalizedData.xml

Filesize
75KB

MD5
69925e463a6fedce8c8e1b68404502fb

SHA1
76341e490a432a636ed721f0c964fd9026773dd7

SHA256
5f370d2ccdd5fa316bce095bf22670123c09de175b7801d0a77cdb68174ac6b7

SHA512
5f61abec49e1f9cc44c26b83aa5b32c217ebeba63ed90d25836f51f810c59f71ec7430dc5338efba9be720f800204891e5ab9a5f5ec1ff51ef46c629482e5220

Download Submit
F:\6551ef594afe4bd4ca62a0c2e64c\1031\LocalizedData.xml

Filesize
80KB

MD5
8505219c0a8d950ff07dc699d8208309

SHA1
7a557356c57f1fa6d689ea4c411e727438ac46df

SHA256
c48986cdb7fe3401234e0a6540eb394c1201846b5beb1f12f83dc6e14674873a

SHA512
7bcdad0cb4b478068434f4ebd554474b69562dc83df9a423b54c1701ca3b43c3b92de09ee195a86c0d244aa5ef96c77b1a08e73f1f2918c8ac7019f8df27b419

Download Submit
F:\6551ef594afe4bd4ca62a0c2e64c\1032\LocalizedData.xml

Filesize
84KB

MD5
3bf8da35b14fbcc564e03f6342bb71f2

SHA1
8f9139f0bb813bf95f8c437548738d32848d8940

SHA256
39efe12c689edfea041613b0e4d6ec78afec8fe38a0e4adc656591ffef8f415d

SHA512
31b050647ba4bd0c2762d77307e1ed2a324e9b152c06ed496b86ea063cdc18bf2bb1f08d2e9b4af3429a2bc333d7891338d7535487c83495304a5f78776dbc03

Download Submit
F:\6551ef594afe4bd4ca62a0c2e64c\1033\LocalizedData.xml

Filesize
75KB

MD5
326518603d85acd79a6258886fc85456

SHA1
f1cef14bc4671a132225d22a1385936ad9505348

SHA256
665797c7840b86379019e5a46227f888fa1a36a593ea41f9170ef018c337b577

SHA512
f8a514efd70e81d0f2f983282d69040bca6e42f29aa5df554e6874922a61f112e311ad5d2b719b6ca90012f69965447fb91e8cd4103efb2453ff160a9062e5d3

Download Submit
F:\6551ef594afe4bd4ca62a0c2e64c\1033\SetupResources.dll

Filesize
16KB

MD5
9547d24ac04b4d0d1dbf84f74f54faf7

SHA1
71af6001c931c3de7c98ddc337d89ab133fe48bb

SHA256
36d0159ed1a7d88000737e920375868765c0a1dd6f5a5acbb79cf7d97d9e7a34

SHA512
8b6048f4185a711567679e2de4789407077ce5bfe72102d3cb1f23051b8d3e6bfd5886c801d85b4e62f467dd12da1c79026a4bc20b17f54c693b2f24e499d40f

Download Submit
F:\6551ef594afe4bd4ca62a0c2e64c\1035\LocalizedData.xml

Filesize
75KB

MD5
1aa252256c895b806e4e55f3ea8d5ffb

SHA1
0322ee94c3d5ea26418a2fea3f7e62ec5d04b81d

SHA256
8a68b3b6522c30502202ecb8d16ae160856947254461ac845b39451a3f2db35f

SHA512
ce57784892c0be55a00ced0adc594a534d8a40819790ca483a29b6cd544c7a75ae4e9bde9b6dc6de489ceceb7883b7c2ea0e98a38fcc96d511157d61c8aa3e63

Download Submit
F:\6551ef594afe4bd4ca62a0c2e64c\1036\LocalizedData.xml

Filesize
81KB

MD5
1dad88faed661db34eef535d36563ee2

SHA1
0525b2f97eddbd26325fddc561bf8a0cda3b0497

SHA256
9605468d426bcbbe00165339d84804e5eb2547bfe437d640320b7bfef0b399b6

SHA512
ccd0bffbf0538152cccd4b081c15079716a5ff9ad04cee8679b7f721441f89eb7c6f8004cff7e1dde9188f5201f573000d0c078474edf124cfa4c619e692d6bc

Download Submit
F:\6551ef594afe4bd4ca62a0c2e64c\1037\LocalizedData.xml

Filesize
70KB

MD5
16e6416756c1829238ef1814ebf48ad6

SHA1
c9236906317b3d806f419b7a98598dd21e27ad64

SHA256
c0ee256567ea26bbd646f019a1d12f3eced20b992718976514afa757adf15dea

SHA512
aa595ed0b3b1db280f94b29fa0cb9db25441a1ef54355abf760b6b837e8ce8e035537738e666d27dd2a8d295d7517c325a5684e16304887ccb17313ca4290ce6

Download Submit
F:\6551ef594afe4bd4ca62a0c2e64c\1038\LocalizedData.xml

Filesize
84KB

MD5
89d4356e0f226e75ca71d48690e8ec15

SHA1
2336caa971527977f47512bc74e88cec3f770c7d

SHA256
fcbb619deb2d57b791a78954b0342dbb2fef7ddd711066a0786c8ef669d2b385

SHA512
fa03d55a4aafe94cbf5c134a65bd809fc86c042bc1b8ffbc9a2a5412eb70a468551c05c44b6ce81f638df43cca599aa1dd6f42f2df3012c8a95a3612df7c821e

Download Submit
F:\6551ef594afe4bd4ca62a0c2e64c\1040\LocalizedData.xml

Filesize
78KB

MD5
eda1ec689d45c7faa97da4171b1b7493

SHA1
807fe12689c232ebd8364f48744c82ca278ea9e6

SHA256
80faa30a7592e8278533d3380dcb212e748c190aaeef62136897e09671059b36

SHA512
8385a5de4eb6b38169dd1eb03926bc6d4604545801f13d99cee3acede3d34ec9f9d96b828a23ae6246809dc666e67f77a163979679956297533da40f9365bf2c

Download Submit
F:\6551ef594afe4bd4ca62a0c2e64c\1041\LocalizedData.xml

Filesize
66KB

MD5
64ffa6ff8866a15aff326f11a892bead

SHA1
378201477564507a481ba06ea1bc0620b6254900

SHA256
7570390094c0a199f37b8f83758d09dd2cecd147132c724a810f9330499e0cbf

SHA512
ea5856617b82d13c9a312cb4f10673dbc4b42d9ac5703ad871e8bdfcc6549e262e61288737ab8ebcf77219d24c0822e7dacf043d1f2d94a97c9b7ec0a5917ef2

Download Submit
F:\6551ef594afe4bd4ca62a0c2e64c\1042\LocalizedData.xml

Filesize
63KB

MD5
78c16da54542c9ed8fa32fed3efaf10d

SHA1
ad8cfe972c8a418c54230d886e549e00c7e16c40

SHA256
e3e3a2288ff840ab0e7c5e8f7b4cfb1f26e597fb17cfc581b7728116bd739ed1

SHA512
d9d7bb82a1d752a424bf81be3d86abea484acbb63d35c90a8ee628e14cf34a7e8a02f37d2ea82aa2ce2c9aa4e8416a7a6232c632b7655f2033c4aaab208c60bf

Download Submit
F:\6551ef594afe4bd4ca62a0c2e64c\1043\LocalizedData.xml

Filesize
77KB

MD5
6506b4e64ebf6121997fa227e762589f

SHA1
71bc1478c012d9ec57fc56a5266dd325b7801221

SHA256
415112ae783a87427c2fadd7b010ade4f1a7c23b27e4b714b7b507c16b572a1c

SHA512
39024ea9d42352f7c1bd6fefe0574054eceb4059f773cfaeb26c42faada2540ae95fb34718d30ccb6da157d2597f80d12a024461fbd0e8d510431ba6ffa81ec2

Download Submit
F:\6551ef594afe4bd4ca62a0c2e64c\1044\LocalizedData.xml

Filesize
77KB

MD5
120104fa24709c2a9d8efc84ff0786cd

SHA1
b513fa545efae045864d8527a5ec6b6cebe31bb9

SHA256
516525636b91c16a70aef8d6f6b424dc1ee7f747b8508b396ee88131b2bb0947

SHA512
1ea8eb2be9d5f4ef6f1f2c0d90cb228a9bb58d7143ccafe77e18ce52ec4aca25dde0ba18430fd4d3d7962d079ccbe7e2552b2c7090361e03c6fdfb7c2b9c7325

Download Submit
F:\6551ef594afe4bd4ca62a0c2e64c\1045\LocalizedData.xml

Filesize
80KB

MD5
bdb583c7a48f811be3b0f01fcea40470

SHA1
e8453946a6b926e4f4ae5b02ba1d648daf23e133

SHA256
611b7b7352188adffd6380b9c8a85b8ff97c09a1c293bb7ac0ef5478a0e18ac8

SHA512
27b02226f8f86ca4d00789317c79e8ca0089f5b910bed14aa664eeab6be66e98de3bafd7670c895d70ab9c34ece5f05199f3556fddc1b165904e3432a51c008d

Download Submit
F:\6551ef594afe4bd4ca62a0c2e64c\1046\LocalizedData.xml

Filesize
78KB

MD5
a03d2063d388fc7a1b4c36d85efa5a1a

SHA1
88bd5e2ff285ee421ccc523f7582e05a8c3323f8

SHA256
61d8339e89a9e48f8ae2d929900582bb8373f08d553ec72d5e38a0840b47c8a3

SHA512
3a219f36e57d90ca92e9faec4dfd34841c2c9244da4fe7e1d70608dde7857aa36325bdb46652a42922919f782bb7c97f567e69a9fc51942722b8fd66cd4ecaf0

Download Submit
F:\6551ef594afe4bd4ca62a0c2e64c\1049\LocalizedData.xml

Filesize
79KB

MD5
349b52a81342a7afb8842459e537ecc6

SHA1
6268343e82fbbabe7618bd873335a8f9f84ed64d

SHA256
992bf5aeb06aa3701d50c23fa475b4b86d8997383c9f0e3425663cfbd6b8a2a5

SHA512
ef4cbd3f7f572a9f146a524cfbc2efbd084e6c70a65b96a42339adc088e3f0524bc202548340969481e7f3df3ac517ac34b200b56a3b9957802abd0efa951c49

Download Submit
F:\6551ef594afe4bd4ca62a0c2e64c\1053\LocalizedData.xml

Filesize
75KB

MD5
b3b1a89458bec6af82c5386d26639b59

SHA1
d9320b8cc862f40c65668a40670081079b63cea1

SHA256
1ef312e8be9207466fbfdecee92bfc6c6b7e2da61979b0908eaf575464e7b7a0

SHA512
478ce08619490ed1ecdd8751b5f60da1ee4ac0d08d9a97468c3f595ac4376feca59e9c72dd9c83b00c8d78b298be757c6f24a422b7be8c041f780524844998bf

Download Submit
F:\6551ef594afe4bd4ca62a0c2e64c\1055\LocalizedData.xml

Filesize
75KB

MD5
65e771fed28b924942a10452bbbf5c42

SHA1
586921b92d5fb297f35effc2216342dac1ae2355

SHA256
45e30569a756d9bcbc5f9dae78bda02751fd25e1c0aee471ce112cb4464a6ee2

SHA512
d014a2a96f3a5c487ef1caddd69599dbec15da5ad689d68009f1ca4d5cb694105a7903f508476d6ffec9d81386cb184df6fc428d34f056190cee30715514a8f7

Download Submit
F:\6551ef594afe4bd4ca62a0c2e64c\2052\LocalizedData.xml

Filesize
59KB

MD5
10da125eeabcbb45e0a272688b0e2151

SHA1
6c4124ec8ca2d03b5187ba567c922b6c3e5efc93

SHA256
1842f22c6fd4caf6ad217e331b74c6240b19991a82a1a030a6e57b1b8e9fd1ec

SHA512
d968abd74206a280f74bf6947757cca8dd9091b343203e5c2269af2e008d3bb0a17ff600eb961dbf69a93de4960133ade8d606fb9a99402d33b8889f2d0da710

Download Submit
F:\6551ef594afe4bd4ca62a0c2e64c\2070\LocalizedData.xml

Filesize
78KB

MD5
7fa9926a4bc678e32e5d676c39f8fb97

SHA1
bba4311dd30261a9b625046f8a6ea215516c9213

SHA256
a25ee75c78c24c50440ad7de9929c6a6e1cc0629009dc0d01b90cbac177dd404

SHA512
e06423bc1ea50a566d341dc513828608e9b6611fea81d33fca471a38f6b2b61b556ea07a5dec0830f3e87194975d87f267a5e5e1a2be5e6a86b07c5bb2bddcb6

Download Submit
F:\6551ef594afe4bd4ca62a0c2e64c\3076\LocalizedData.xml

Filesize
59KB

MD5
967a6d769d849c5ed66d6f46b0b9c5a4

SHA1
c0ff5f094928b2fa8b61e97639c42782e95cc74f

SHA256
0bc010947bff6ec1ce9899623ccfdffd702eee6d2976f28d9e06cc98a79cf542

SHA512
219b13f1beeb7d690af9d9c7d98904494c878fbe9904f8cb7501b9bb4f48762f9d07c3440efa0546600ff62636ac34cb4b32e270cf90cb47a9e08f9cb473030c

Download Submit
F:\6551ef594afe4bd4ca62a0c2e64c\3082\LocalizedData.xml

Filesize
78KB

MD5
2d54fe70376db0218e8970b28c1c4518

SHA1
83ee9ac93142751f23d5bb858f7264e27ea2eab0

SHA256
d17c5b638e2a4d43212d21a2052548c8d4909eb6410e30b8a951a292bcdbbedd

SHA512
20c0fb9a046911bc2d702ab321c3992262ac0f80f33ddda5ec2ccafe9ef07611774223369e0dc7cb91c9cda1cbd65c598a7e1c914d6e6ca4b00205a16411be30

Download Submit
F:\6551ef594afe4bd4ca62a0c2e64c\ParameterInfo.xml

Filesize
265KB

MD5
7213da83e0f0b8ae4fea44ae1cb7f62b

SHA1
f2e3fcc77a1ad4d042253bd2e0010bcb40b68ed3

SHA256
59e67e4fb46e5490eee63d8b725324f1372720ade7345c74c6138c4a76ea73d9

SHA512
86186ab0f2cb38e520dd1284042eced157f96874846eb9061be9cf56b84a1cab5901a4879e105a8b04b336bbc43b03f4bdf198d43af868be188602347db829e0

Download Submit
F:\6551ef594afe4bd4ca62a0c2e64c\Setup.exe

Filesize
76KB

MD5
006f8a615020a4a17f5e63801485df46

SHA1
78c82a80ebf9c8bf0c996dd8bc26087679f77fea

SHA256
d273460aa4d42f0b5764383e2ab852ab9af6fecb3ed866f1783869f2f155d8be

SHA512
c603ed6f3611eb7049a43a190ed223445a9f7bd5651100a825917198b50c70011e950fa968d3019439afa0a416752517b1c181ee9445e02da3904f4e4b73ce76

Download Submit
F:\6551ef594afe4bd4ca62a0c2e64c\SetupEngine.dll

Filesize
788KB

MD5
84c1daf5f30ff99895ecab3a55354bcf

SHA1
7e25ba36bcc7deed89f3c9568016ddb3156c9c5a

SHA256
7a0d281fa802d615ea1207bd2e9ebb98f3b74f9833bba3cb964ba7c7e0fb67fd

SHA512
e4fb7e4d39f094463fdcdc4895ab2ea500eb51a32b6909cec80a526bbf34d5c0eb98f47ee256c0f0865bf3169374937f047bf5c4d6762779c8ca3332b4103be3

Download Submit
F:\6551ef594afe4bd4ca62a0c2e64c\SetupUi.dll

Filesize
288KB

MD5
eb881e3dddc84b20bd92abcec444455f

SHA1
e2c32b1c86d4f70e39de65e9ebc4f361b24ff4a1

SHA256
11565d97287c01d22ad2e46c78d8a822fa3e6524561d4c02dfc87e8d346c44e7

SHA512
5750cec73b36a3f19bfb055f880f3b6498a7ae589017333f6272d26f1c72c6f475a3308826268a098372bbb096b43fbd1e06e93eecc0a81046668228bc179a75

Download Submit
F:\6551ef594afe4bd4ca62a0c2e64c\SetupUi.xsd

Filesize
29KB

MD5
2fadd9e618eff8175f2a6e8b95c0cacc

SHA1
9ab1710a217d15b192188b19467932d947b0a4f8

SHA256
222211e8f512edf97d78bc93e1f271c922d5e91fa899e092b4a096776a704093

SHA512
a3a934a8572ff9208d38cf381649bd83de227c44b735489fd2a9dc5a636ead9bb62459c9460ee53f61f0587a494877cd3a3c2611997be563f3137f8236ffc4ca

Download Submit
F:\6551ef594afe4bd4ca62a0c2e64c\SplashScreen.bmp

Filesize
40KB

MD5
0966fcd5a4ab0ddf71f46c01eff3cdd5

SHA1
8f4554f079edad23bcd1096e6501a61cf1f8ec34

SHA256
31c13ecfc0eb27f34036fb65cc0e735cd444eec75376eea2642f926ac162dcb3

SHA512
a9e70a2fb5a9899acf086474d71d0e180e2234c40e68bcadb9bf4fe145774680cb55584b39fe53cc75de445c6bf5741fc9b15b18385cbbe20fc595fe0ff86fce

Download Submit
F:\6551ef594afe4bd4ca62a0c2e64c\Strings.xml

Filesize
13KB

MD5
8a28b474f4849bee7354ba4c74087cea

SHA1
c17514dfc33dd14f57ff8660eb7b75af9b2b37b0

SHA256
2a7a44fb25476886617a1ec294a20a37552fd0824907f5284fade3e496ed609b

SHA512
a7927700d8050623bc5c761b215a97534c2c260fcab68469b7a61c85e2dff22ed9cf57e7cb5a6c8886422abe7ac89b5c71e569741db74daa2dcb4152f14c2369

Download Submit
F:\6551ef594afe4bd4ca62a0c2e64c\UiInfo.xml

Filesize
37KB

MD5
8b8b0a935dc591799a0c6d52fdc33460

SHA1
ce2748bd469aad6e90b06d98531084d00611fb89

SHA256
57a9ccb84cae42e0d8d1a29cfe170ac3f27bdcae829d979cddfd5e757519b159

SHA512
93009b3045939b65a0c1d25e30a07a772bd73dda518529462f9ce1227a311a4d6fd7595f10b4255cc0b352e09c02026e89300a641492f14df908ad256a3c9d76

Download Submit
F:\6551ef594afe4bd4ca62a0c2e64c\graphics\print.ico

Filesize
1KB

MD5
7e55ddc6d611176e697d01c90a1212cf

SHA1
e2620da05b8e4e2360da579a7be32c1b225deb1b

SHA256
ff542e32330b123486797b410621e19eafb39df3997e14701afa4c22096520ed

SHA512
283d381aa396820b7e15768b20099d67688da1f6315ec9f7938c2fcc3167777502cded0d1beddf015a34cc4e5d045bcb665ffd28ba2fbb6faf50fdd38b31d16e

Download Submit
F:\6551ef594afe4bd4ca62a0c2e64c\graphics\save.ico

Filesize
1KB

MD5
7d62e82d960a938c98da02b1d5201bd5

SHA1
194e96b0440bf8631887e5e9d3cc485f8e90fbf5

SHA256
ae041c8764f56fd89277b34982145d16fc59a4754d261c861b19371c3271c6e5

SHA512
ab06b2605f0c1f6b71ef69563c0c977d06c6ea84d58ef7f2baecba566d6037d1458c2b58e6bfd70ddef47dccbdea6d9c2f2e46dea67ea9e92457f754d7042f67

Download Submit
F:\6551ef594afe4bd4ca62a0c2e64c\graphics\setup.ico

Filesize
35KB

MD5
3d25d679e0ff0b8c94273dcd8b07049d

SHA1
a517fc5e96bc68a02a44093673ee7e076ad57308

SHA256
288e9ad8f0201e45bc187839f15aca79d6b9f76a7d3c9274c80f5d4a4c219c0f

SHA512
3bde668004ca7e28390862d0ae9903c756c16255bdbb3f7e73a5b093ce6a57a3165d6797b0a643b254493149231aca7f7f03e0af15a0cbe28aff02f0071ec255

Download Submit
F:\6551ef594afe4bd4ca62a0c2e64c\graphics\warn.ico

Filesize
9KB

MD5
b2b1d79591fca103959806a4bf27d036

SHA1
481fd13a0b58299c41b3e705cb085c533038caf5

SHA256
fe4d06c318701bf0842d4b87d1bad284c553baf7a40987a7451338099d840a11

SHA512
5fe232415a39e0055abb5250b120ccdcd565ab102aa602a3083d4a4705ac6775d45e1ef0c2b787b3252232e9d4673fc3a77aab19ec79a3ff8b13c4d7094530d2

Download Submit
F:\6551ef594afe4bd4ca62a0c2e64c\sqmapi.dll

Filesize
141KB

MD5
3f0363b40376047eff6a9b97d633b750

SHA1
4eaf6650eca5ce931ee771181b04263c536a948b

SHA256
bd6395a58f55a8b1f4063e813ce7438f695b9b086bb965d8ac44e7a97d35a93c

SHA512
537be86e2f171e0b2b9f462ac7f62c4342beb5d00b68451228f28677d26a525014758672466ad15ed1fd073be38142dae478df67718908eae9e6266359e1f9e8

Download Submit
\Users\Admin\Downloads\R.E.P.O\REPO.exe

Filesize
651KB

MD5
37e2e7e012343ccef500133286fcbf27

SHA1
4b7e66039d04b14ddcfb580a6e6a395ea52222be

SHA256
1643ff9ed131adde7a22363f26d36308b4b4fb8f9ba61e5afce3b6803c5cb302

SHA512
418dcb69e506f42248c00459eb3fa5a576006fead83cb5372e5710a8e95265654c316bbb314e4b8afa69e393a7cdf01219b7e17095d1990ab418f0aed68c687e

Download Submit
\Users\Admin\Downloads\R.E.P.O\SteamOverlay64.dll

Filesize
114KB

MD5
0a5429b888c75f6525e1100e32dd2b69

SHA1
8ae224580aa0838a7b1570c79d4d8f27a1b46d19

SHA256
f784b4b85b627c7ea541bd2a90c9fc6e9736a0731707c31265aa86fe684dc2df

SHA512
5f77ac9619ccb5baebabb2e406ce265148ad18c6e1162c7d4c3a5656f38abedf90f756a829da856312689a738a3258382f37a279843bf7db0c14ac953c6992ef

Download Submit
\Users\Admin\Downloads\R.E.P.O\UnityCrashHandler64.exe

Filesize
1.1MB

MD5
9fbd5305c2c2fc8458c9774d3dd815e4

SHA1
4bb449696116301c686f51135699302d62770a0c

SHA256
670e0fe0d0b8e5d42109b0b4dec606c6f8252b8c98af807e36b40117c07f269f

SHA512
2ea7aecd995bbb102d03766ffc4a5419a784fc69cdee263afebcde70d2db795f88b9c39f591c0b1fcee7ab52334766b50e8827204b39b9f9cc497dc6f854684e

Download Submit
\Users\Admin\Downloads\R.E.P.O\winmm.dll

Filesize
512KB

MD5
e59aac558d9f9c5d1312ac24d09c51d5

SHA1
2f11c4b00f5f92d4466348f9501aa657c9bf6fa7

SHA256
ba37009eef6c041bc6d0a271c13679fb9e14a005bd7e038cee596cd4064cf8b3

SHA512
1c3b357074d62d5ca11c92d71ffdacb4a7e3d6fb17cbd4b489e5bea0032cea43650a6809388e98e4b98256b477c6b5dbd8fd2c7f4e3e08af00ef68e0ed4406d0

Download Submit
memory/1544-1248-0x0000000074150000-0x0000000074218000-memory.dmp

Filesize
800KB

Download
memory/1544-1249-0x0000000073E10000-0x0000000073E34000-memory.dmp

Filesize
144KB

Download
memory/2188-3986-0x0000000000AE0000-0x0000000000AF8000-memory.dmp

Filesize
96KB

Download
memory/2188-3980-0x0000000000AD0000-0x0000000000ADC000-memory.dmp

Filesize
48KB

Download
memory/2188-3989-0x0000000000E60000-0x0000000000E78000-memory.dmp

Filesize
96KB

Download
memory/2188-4007-0x0000000000F50000-0x0000000000F66000-memory.dmp

Filesize
88KB

Download
memory/2188-4004-0x0000000000EC0000-0x0000000000ECA000-memory.dmp

Filesize
40KB

Download
memory/2188-4001-0x0000000000EB0000-0x0000000000EBC000-memory.dmp

Filesize
48KB

Download
memory/2188-3998-0x0000000000E90000-0x0000000000EA4000-memory.dmp

Filesize
80KB

Download
memory/2188-3983-0x0000000001E90000-0x0000000001F3A000-memory.dmp

Filesize
680KB

Download
memory/2188-3995-0x0000000000E80000-0x0000000000E8C000-memory.dmp

Filesize
48KB

Download
memory/2188-3992-0x0000000002170000-0x00000000021DC000-memory.dmp

Filesize
432KB

Download
memory/2808-3901-0x0000000073990000-0x0000000073A58000-memory.dmp

Filesize
800KB

Download
memory/2808-3902-0x0000000073720000-0x0000000073744000-memory.dmp

Filesize
144KB

Download
memory/2940-3789-0x0000000073710000-0x0000000073734000-memory.dmp

Filesize
144KB

Download
memory/2940-3788-0x0000000073980000-0x0000000073A48000-memory.dmp

Filesize
800KB

Download