babadeda | 582d3ef01508bca442c17fe30103052762c517978ce51e23346e6a1f7dc2e2e1

Analysis

max time kernel
136s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
26-06-2022 19:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

582d3ef01508bca442c17fe30103052762c517978ce51e23346e6a1f7dc2e2e1.msi
Size

33.1MB
MD5

a01326f71161ff1c61298c3e5e880f4f
SHA1

d95fe7c087d1075d94cb09d8278ab90497b32713
SHA256

582d3ef01508bca442c17fe30103052762c517978ce51e23346e6a1f7dc2e2e1
SHA512

0e5d514ef09cdafdec5739146edd4e6a3289e4a47f269ba6e051a412bcb09709c52c15c314653efd9a71211cdd4dfaba2163bc502ab947647ec18490b8d63bbc

Score

10^/10

babadeda crypter loader

Malware Config

Signatures

Babadeda
Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.
loader crypter babadeda

Babadeda Crypter 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\logo.png	family_babadeda
behavioral2/memory/3204-165-0x0000000007530000-0x000000000BE30000-memory.dmp	family_babadeda

Blocklisted process makes network request 1 IoCs

Processes:

msiexec.exe

flow pid process

6 1636 msiexec.exe
Executes dropped EXE 3 IoCs

Processes:

CRWindowsClientService.exeCRLogTransport.exeCoreSync.exe

pid process

4276 CRWindowsClientService.exe
3188 CRLogTransport.exe
3204 CoreSync.exe

flow	pid	process
6	1636	msiexec.exe

pid	process
4276	CRWindowsClientService.exe
3188	CRLogTransport.exe
3204	CoreSync.exe

Loads dropped DLL 14 IoCs

Processes:

MsiExec.exeCRWindowsClientService.exeCoreSync.exeCRLogTransport.exe

pid	process
1724	MsiExec.exe
1724	MsiExec.exe
1724	MsiExec.exe
1724	MsiExec.exe
4276	CRWindowsClientService.exe
4276	CRWindowsClientService.exe
3204	CoreSync.exe
3204	CoreSync.exe
3204	CoreSync.exe
3204	CoreSync.exe
3204	CoreSync.exe
3188	CRLogTransport.exe
3188	CRLogTransport.exe
3204	CoreSync.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe

Drops file in Windows directory 11 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7EED.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI74B8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI78EF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI797C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI79FA.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{867CFA9C-A3FD-43F8-93F3-74B6595ECA76}	msiexec.exe
File created	C:\Windows\Installer\e5672d3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5672d3.msi	msiexec.exe

Detects BABADEDA Crypter 2 IoCs

Detects BABADEDA Crypter.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\logo.png	BABADEDA_Crypter
behavioral2/memory/3204-165-0x0000000007530000-0x000000000BE30000-memory.dmp	BABADEDA_Crypter

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

CoreSync.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	CoreSync.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	CoreSync.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	CoreSync.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	CoreSync.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msiexec.exe

pid process

3024 msiexec.exe
3024 msiexec.exe

pid	process
3024	msiexec.exe
3024	msiexec.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	1636	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1636	msiexec.exe
Token: SeSecurityPrivilege	3024	msiexec.exe
Token: SeCreateTokenPrivilege	1636	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1636	msiexec.exe
Token: SeLockMemoryPrivilege	1636	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1636	msiexec.exe
Token: SeMachineAccountPrivilege	1636	msiexec.exe
Token: SeTcbPrivilege	1636	msiexec.exe
Token: SeSecurityPrivilege	1636	msiexec.exe
Token: SeTakeOwnershipPrivilege	1636	msiexec.exe
Token: SeLoadDriverPrivilege	1636	msiexec.exe
Token: SeSystemProfilePrivilege	1636	msiexec.exe
Token: SeSystemtimePrivilege	1636	msiexec.exe
Token: SeProfSingleProcessPrivilege	1636	msiexec.exe
Token: SeIncBasePriorityPrivilege	1636	msiexec.exe
Token: SeCreatePagefilePrivilege	1636	msiexec.exe
Token: SeCreatePermanentPrivilege	1636	msiexec.exe
Token: SeBackupPrivilege	1636	msiexec.exe
Token: SeRestorePrivilege	1636	msiexec.exe
Token: SeShutdownPrivilege	1636	msiexec.exe
Token: SeDebugPrivilege	1636	msiexec.exe
Token: SeAuditPrivilege	1636	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1636	msiexec.exe
Token: SeChangeNotifyPrivilege	1636	msiexec.exe
Token: SeRemoteShutdownPrivilege	1636	msiexec.exe
Token: SeUndockPrivilege	1636	msiexec.exe
Token: SeSyncAgentPrivilege	1636	msiexec.exe
Token: SeEnableDelegationPrivilege	1636	msiexec.exe
Token: SeManageVolumePrivilege	1636	msiexec.exe
Token: SeImpersonatePrivilege	1636	msiexec.exe
Token: SeCreateGlobalPrivilege	1636	msiexec.exe
Token: SeRestorePrivilege	3024	msiexec.exe
Token: SeTakeOwnershipPrivilege	3024	msiexec.exe
Token: SeRestorePrivilege	3024	msiexec.exe
Token: SeTakeOwnershipPrivilege	3024	msiexec.exe
Token: SeRestorePrivilege	3024	msiexec.exe
Token: SeTakeOwnershipPrivilege	3024	msiexec.exe
Token: SeRestorePrivilege	3024	msiexec.exe
Token: SeTakeOwnershipPrivilege	3024	msiexec.exe
Token: SeRestorePrivilege	3024	msiexec.exe
Token: SeTakeOwnershipPrivilege	3024	msiexec.exe
Token: SeRestorePrivilege	3024	msiexec.exe
Token: SeTakeOwnershipPrivilege	3024	msiexec.exe
Token: SeRestorePrivilege	3024	msiexec.exe
Token: SeTakeOwnershipPrivilege	3024	msiexec.exe
Token: SeRestorePrivilege	3024	msiexec.exe
Token: SeTakeOwnershipPrivilege	3024	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

1636 msiexec.exe
1636 msiexec.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

CoreSync.exe

pid process

3204 CoreSync.exe

pid	process
1636	msiexec.exe
1636	msiexec.exe

pid	process
3204	CoreSync.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

msiexec.exe

description	pid	process	target process
PID 3024 wrote to memory of 1724	3024	msiexec.exe	MsiExec.exe
PID 3024 wrote to memory of 1724	3024	msiexec.exe	MsiExec.exe
PID 3024 wrote to memory of 1724	3024	msiexec.exe	MsiExec.exe
PID 3024 wrote to memory of 3188	3024	msiexec.exe	CRLogTransport.exe
PID 3024 wrote to memory of 3188	3024	msiexec.exe	CRLogTransport.exe
PID 3024 wrote to memory of 3188	3024	msiexec.exe	CRLogTransport.exe
PID 3024 wrote to memory of 4276	3024	msiexec.exe	CRWindowsClientService.exe
PID 3024 wrote to memory of 4276	3024	msiexec.exe	CRWindowsClientService.exe
PID 3024 wrote to memory of 4276	3024	msiexec.exe	CRWindowsClientService.exe
PID 3024 wrote to memory of 3204	3024	msiexec.exe	CoreSync.exe
PID 3024 wrote to memory of 3204	3024	msiexec.exe	CoreSync.exe
PID 3024 wrote to memory of 3204	3024	msiexec.exe	CoreSync.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\582d3ef01508bca442c17fe30103052762c517978ce51e23346e6a1f7dc2e2e1.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1636

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3024

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 27F0EEF8EA716713F509C7DC96DB5133
2⤵
- Loads dropped DLL
PID:1724

C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\CRLogTransport.exe
"C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\CRLogTransport.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3188

C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\CRWindowsClientService.exe
"C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\CRWindowsClientService.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4276

C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\CoreSync.exe
"C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\CoreSync.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
PID:3204

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\CRClient.dll
Filesize
370KB

MD5
fd1bed00e5c6fa0e3cf096d99e06267d

SHA1
0777f7acdd690ba5ad0ebde72f97e1e48f7bda6b

SHA256
93a0721dccaec4d430480fb8e556b8257914d18b90bc3b55011f704e5e71b8f2

SHA512
dcbc955c427ae72af8202bc62c8ce4cf62f80a9c9ba4bbf82cfbe1e712c659bc2cfb6a2c09c02661d55a80817e43d6783e9aa7b18d9fc99cf12f0e5499550c36

Download Submit
C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\CRClient.dll
Filesize
370KB

MD5
fd1bed00e5c6fa0e3cf096d99e06267d

SHA1
0777f7acdd690ba5ad0ebde72f97e1e48f7bda6b

SHA256
93a0721dccaec4d430480fb8e556b8257914d18b90bc3b55011f704e5e71b8f2

SHA512
dcbc955c427ae72af8202bc62c8ce4cf62f80a9c9ba4bbf82cfbe1e712c659bc2cfb6a2c09c02661d55a80817e43d6783e9aa7b18d9fc99cf12f0e5499550c36

Download Submit
C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\CRLogTransport.exe
Filesize
203KB

MD5
2bcb48e8be0872eaa87e5c180b29d589

SHA1
bdb1f1b09e774f68b148bf3843771a27f04531c2

SHA256
f6ba8405774e1df6c2e4b411d195169abec578af5306906af85fad729756dced

SHA512
04f969eb0c5493ad754e774ce94d409a49e0b2884415fd6264fe02001f561bef323a7f35809cdbb11010e41b979fd236545878f14ba31b14d96ed7de0cb97bee

Download Submit
C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\CRLogTransport.exe
Filesize
203KB

MD5
2bcb48e8be0872eaa87e5c180b29d589

SHA1
bdb1f1b09e774f68b148bf3843771a27f04531c2

SHA256
f6ba8405774e1df6c2e4b411d195169abec578af5306906af85fad729756dced

SHA512
04f969eb0c5493ad754e774ce94d409a49e0b2884415fd6264fe02001f561bef323a7f35809cdbb11010e41b979fd236545878f14ba31b14d96ed7de0cb97bee

Download Submit
C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\CRWindowsClientService.exe
Filesize
308KB

MD5
fbdc40b60036a6ea191c20884bbce061

SHA1
152541b911367b64f0de0051b73436558530ecd9

SHA256
96b282bdbbaf82563f49ba8af8089a8b9a121149c52de0211e1a9c8bb8c066fd

SHA512
f46ac7cee271adb68b2abb8664a0d601be72823230d1a10940bec1056dca2735d3b4cb978ec7c851078e9df3f31c71c4f032dc4e44b2f4e7708d75ff7272bc84

Download Submit
C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\CRWindowsClientService.exe
Filesize
308KB

MD5
fbdc40b60036a6ea191c20884bbce061

SHA1
152541b911367b64f0de0051b73436558530ecd9

SHA256
96b282bdbbaf82563f49ba8af8089a8b9a121149c52de0211e1a9c8bb8c066fd

SHA512
f46ac7cee271adb68b2abb8664a0d601be72823230d1a10940bec1056dca2735d3b4cb978ec7c851078e9df3f31c71c4f032dc4e44b2f4e7708d75ff7272bc84

Download Submit
C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\CoreSync.exe
Filesize
20.5MB

MD5
adfd398f7bae6d24389161c5bd52d2c4

SHA1
fd44d71b326ea4df4625358b8cb00594783927c0

SHA256
9ca3b6a3030cdfbfff6295a5befca6d39dfd05f5d6d7c866c4f7a40cc196b51c

SHA512
7f107b30a772c66f30cc89e0659fa6aef159b44b8ae9168fd0d2802c159d044b652d71e261b05c79439a19dddde9df7eae08ffb0c1ac622465cd075eae112f3e

Download Submit
C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\CoreSync.exe
Filesize
20.5MB

MD5
adfd398f7bae6d24389161c5bd52d2c4

SHA1
fd44d71b326ea4df4625358b8cb00594783927c0

SHA256
9ca3b6a3030cdfbfff6295a5befca6d39dfd05f5d6d7c866c4f7a40cc196b51c

SHA512
7f107b30a772c66f30cc89e0659fa6aef159b44b8ae9168fd0d2802c159d044b652d71e261b05c79439a19dddde9df7eae08ffb0c1ac622465cd075eae112f3e

Download Submit
C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\MSVCP140.dll
Filesize
439KB

MD5
5ff1fca37c466d6723ec67be93b51442

SHA1
34cc4e158092083b13d67d6d2bc9e57b798a303b

SHA256
5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062

SHA512
4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546

Download Submit
C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\VCRUNTIME140.dll
Filesize
78KB

MD5
a37ee36b536409056a86f50e67777dd7

SHA1
1cafa159292aa736fc595fc04e16325b27cd6750

SHA256
8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825

SHA512
3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

Download Submit
C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\VulcanMessage5.dll
Filesize
1013KB

MD5
34e0c18e133ebe3240be1d2b315d2183

SHA1
80713bfbdd85cbede32246370e24d6493144cd10

SHA256
3d701e0037da4fc592006ed963b614a9e3ed753865d65d0eb56c94f3ffa9bca9

SHA512
c3d8d1ff571f926b17a2df6c33a2d1f8068f2f159e589d61d3eb589b3362bd5f2778c6b6e7b202f32225cfb87d08e27005ce545c421efac16a9a54b83cd0eec6

Download Submit
C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\VulcanMessage5.dll
Filesize
1013KB

MD5
34e0c18e133ebe3240be1d2b315d2183

SHA1
80713bfbdd85cbede32246370e24d6493144cd10

SHA256
3d701e0037da4fc592006ed963b614a9e3ed753865d65d0eb56c94f3ffa9bca9

SHA512
c3d8d1ff571f926b17a2df6c33a2d1f8068f2f159e589d61d3eb589b3362bd5f2778c6b6e7b202f32225cfb87d08e27005ce545c421efac16a9a54b83cd0eec6

Download Submit
C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\VulkanBroker.dll
Filesize
196KB

MD5
831c0c3c3ffd5c9f7041532aeff8996b

SHA1
1093b4e98a4b7de8db758faacb4aa40a90c4d041

SHA256
b3672e1db6d2c35acabb04d80a811f443c57af4c0f998976d2a379f43fa64661

SHA512
157ca4c875a249467dc97a90de55188c3aecf3df20593aa3e4ecabfb8ecb196af111a6cd4b284e908b59ee343982055d51b57bd80eb7da567a3432ee8d1d12a6

Download Submit
C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\VulkanBroker.dll
Filesize
196KB

MD5
831c0c3c3ffd5c9f7041532aeff8996b

SHA1
1093b4e98a4b7de8db758faacb4aa40a90c4d041

SHA256
b3672e1db6d2c35acabb04d80a811f443c57af4c0f998976d2a379f43fa64661

SHA512
157ca4c875a249467dc97a90de55188c3aecf3df20593aa3e4ecabfb8ecb196af111a6cd4b284e908b59ee343982055d51b57bd80eb7da567a3432ee8d1d12a6

Download Submit
C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\libvicon.dll
Filesize
43.6MB

MD5
78e615e9dcd39ce887b9af835d692ae9

SHA1
75cfa4aa83b68f93dc5851ccce0425157cbf6fd7

SHA256
a11cf6bbcd073b1577e708536e433f24ed1baad32446d3aa1403b5077e9f2c53

SHA512
c971500bf08eaba6421bca0855c259b5a854ba4644cc0f040e675e7780821a0e2c43b86468079fcad9606620275f615a551a858fac18785a181dc76e235f65bb

Download Submit
C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\libvicon.dll
Filesize
43.6MB

MD5
78e615e9dcd39ce887b9af835d692ae9

SHA1
75cfa4aa83b68f93dc5851ccce0425157cbf6fd7

SHA256
a11cf6bbcd073b1577e708536e433f24ed1baad32446d3aa1403b5077e9f2c53

SHA512
c971500bf08eaba6421bca0855c259b5a854ba4644cc0f040e675e7780821a0e2c43b86468079fcad9606620275f615a551a858fac18785a181dc76e235f65bb

Download Submit
C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\logo.png
Filesize
544KB

MD5
811fa24550577e0a15619c21e87b436c

SHA1
483648138d3cb3a520a8aa648cf9a77dfcea452d

SHA256
7f999111e1d0610c0fe4b1e0c0fdabe3e9dbd8611337da497ea4fbda0ddd562d

SHA512
a978a2a5683821d88aab32d9ffa53e0b69fe5b0a926de6d09291e6968377e86b50c4399edcc6a0e0bd1fa61dadde6dfe2748da2c79d4a114076552b670fa6f90

Download Submit
C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\msvcp140.dll
Filesize
439KB

MD5
5ff1fca37c466d6723ec67be93b51442

SHA1
34cc4e158092083b13d67d6d2bc9e57b798a303b

SHA256
5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062

SHA512
4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546

Download Submit
C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\msvcp140.dll
Filesize
439KB

MD5
5ff1fca37c466d6723ec67be93b51442

SHA1
34cc4e158092083b13d67d6d2bc9e57b798a303b

SHA256
5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062

SHA512
4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546

Download Submit
C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\msvcp140.dll
Filesize
439KB

MD5
5ff1fca37c466d6723ec67be93b51442

SHA1
34cc4e158092083b13d67d6d2bc9e57b798a303b

SHA256
5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062

SHA512
4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546

Download Submit
C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\vcruntime140.dll
Filesize
78KB

MD5
a37ee36b536409056a86f50e67777dd7

SHA1
1cafa159292aa736fc595fc04e16325b27cd6750

SHA256
8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825

SHA512
3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

Download Submit
C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\vcruntime140.dll
Filesize
78KB

MD5
a37ee36b536409056a86f50e67777dd7

SHA1
1cafa159292aa736fc595fc04e16325b27cd6750

SHA256
8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825

SHA512
3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

Download Submit
C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\vcruntime140.dll
Filesize
78KB

MD5
a37ee36b536409056a86f50e67777dd7

SHA1
1cafa159292aa736fc595fc04e16325b27cd6750

SHA256
8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825

SHA512
3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

Download Submit
C:\Windows\Installer\MSI74B8.tmp
Filesize
495KB

MD5
cfab78ac0d042a1d8ad7085a94328ef6

SHA1
b3070cc847ba2739450dc9bd05040df83e7d85d2

SHA256
17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

SHA512
647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

Download Submit
C:\Windows\Installer\MSI74B8.tmp
Filesize
495KB

MD5
cfab78ac0d042a1d8ad7085a94328ef6

SHA1
b3070cc847ba2739450dc9bd05040df83e7d85d2

SHA256
17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

SHA512
647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

Download Submit
C:\Windows\Installer\MSI78EF.tmp
Filesize
495KB

MD5
cfab78ac0d042a1d8ad7085a94328ef6

SHA1
b3070cc847ba2739450dc9bd05040df83e7d85d2

SHA256
17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

SHA512
647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

Download Submit
C:\Windows\Installer\MSI78EF.tmp
Filesize
495KB

MD5
cfab78ac0d042a1d8ad7085a94328ef6

SHA1
b3070cc847ba2739450dc9bd05040df83e7d85d2

SHA256
17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

SHA512
647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

Download Submit
C:\Windows\Installer\MSI797C.tmp
Filesize
495KB

MD5
cfab78ac0d042a1d8ad7085a94328ef6

SHA1
b3070cc847ba2739450dc9bd05040df83e7d85d2

SHA256
17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

SHA512
647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

Download Submit
C:\Windows\Installer\MSI797C.tmp
Filesize
495KB

MD5
cfab78ac0d042a1d8ad7085a94328ef6

SHA1
b3070cc847ba2739450dc9bd05040df83e7d85d2

SHA256
17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

SHA512
647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

Download Submit
C:\Windows\Installer\MSI79FA.tmp
Filesize
495KB

MD5
cfab78ac0d042a1d8ad7085a94328ef6

SHA1
b3070cc847ba2739450dc9bd05040df83e7d85d2

SHA256
17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

SHA512
647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

Download Submit
C:\Windows\Installer\MSI79FA.tmp
Filesize
495KB

MD5
cfab78ac0d042a1d8ad7085a94328ef6

SHA1
b3070cc847ba2739450dc9bd05040df83e7d85d2

SHA256
17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

SHA512
647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

Download Submit
memory/1724-130-0x0000000000000000-mapping.dmp

Download
memory/3188-139-0x0000000000000000-mapping.dmp

Download
memory/3204-148-0x0000000000000000-mapping.dmp

Download
memory/3204-165-0x0000000007530000-0x000000000BE30000-memory.dmp

Filesize
73.0MB

Download
memory/4276-140-0x0000000000000000-mapping.dmp

Download