8bbe9b2bf763f24eafb4a62927234f8831f1bb782e15811bb7a4299afe3b95b2

Analysis

max time kernel
142s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23/02/2024, 21:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

XMeye_org_VMS_V2.0.1.18.T.20210810.exe
Size

64.1MB
MD5

51b7127a2938538f45db3d9df68ff364
SHA1

60cf3995ec9cd6f4fb663b0f7597a3c4ed2889e9
SHA256

8bbe9b2bf763f24eafb4a62927234f8831f1bb782e15811bb7a4299afe3b95b2
SHA512

ed108323054cf3caceb06e2c2fc29e740bbaee35aa271b6aa1039dd7d5f9c453875acb92125102823f8ca02902901431a9f6ca6b24b6709124b0335c4b403ea9
SSDEEP

1572864:LPYNZZo+WK0VD4VqPx8F+e2VAVHbuw3f22HVfE0N:LgNgQ0VD4VqOeVOHbBflf/

Score

7^/10

discovery upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000\Control Panel\International\Geo\Nation	XMeye_org_VMS_V2.0.1.18.T.20210810.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000\Control Panel\International\Geo\Nation	irsetup.exe

Executes dropped EXE 2 IoCs

pid	Process
208	irsetup.exe
2524	VMS.exe

Loads dropped DLL 64 IoCs

pid	Process
208	irsetup.exe
2524	VMS.exe
2524	VMS.exe
2524	VMS.exe
2524	VMS.exe
2524	VMS.exe
2736	regsvr32.exe
2736	regsvr32.exe
2736	regsvr32.exe
2524	VMS.exe
2524	VMS.exe
2524	VMS.exe
2524	VMS.exe
2524	VMS.exe
2524	VMS.exe
2524	VMS.exe
2524	VMS.exe
2524	VMS.exe
2524	VMS.exe
2524	VMS.exe
2524	VMS.exe
2524	VMS.exe
2736	regsvr32.exe
2524	VMS.exe
2524	VMS.exe
2524	VMS.exe
2736	regsvr32.exe
2524	VMS.exe
2524	VMS.exe
2524	VMS.exe
2524	VMS.exe
2524	VMS.exe
2524	VMS.exe
2524	VMS.exe
4884	regsvr32.exe
4884	regsvr32.exe
4884	regsvr32.exe
4884	regsvr32.exe
4884	regsvr32.exe
2524	VMS.exe
2524	VMS.exe
2524	VMS.exe
2524	VMS.exe
2524	VMS.exe
2524	VMS.exe
2524	VMS.exe
2524	VMS.exe
2524	VMS.exe
2524	VMS.exe
2524	VMS.exe
2524	VMS.exe
2524	VMS.exe
2524	VMS.exe
2524	VMS.exe
2524	VMS.exe
2524	VMS.exe
2524	VMS.exe
2524	VMS.exe
2524	VMS.exe
2524	VMS.exe
2524	VMS.exe
2524	VMS.exe
2524	VMS.exe
2524	VMS.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00070000000231f9-5.dat	upx
behavioral2/memory/208-12-0x0000000000400000-0x00000000007CB000-memory.dmp	upx
behavioral2/memory/208-28-0x0000000000400000-0x00000000007CB000-memory.dmp	upx
behavioral2/memory/208-84-0x0000000000400000-0x00000000007CB000-memory.dmp	upx
behavioral2/memory/208-883-0x0000000000400000-0x00000000007CB000-memory.dmp	upx
behavioral2/memory/208-2128-0x0000000000400000-0x00000000007CB000-memory.dmp	upx
behavioral2/memory/208-3313-0x0000000000400000-0x00000000007CB000-memory.dmp	upx
behavioral2/memory/208-4050-0x0000000000400000-0x00000000007CB000-memory.dmp	upx
behavioral2/memory/208-4763-0x0000000000400000-0x00000000007CB000-memory.dmp	upx
behavioral2/memory/208-5028-0x0000000000400000-0x00000000007CB000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\VMS\lua5.1.dll	irsetup.exe
File created	C:\Program Files (x86)\VMS\skin\default_1.25\buttons\UserManager_press.png	irsetup.exe
File opened for modification	C:\Program Files (x86)\VMS\skin\default_1.5\buttons\AlarmIn_press.png	irsetup.exe
File opened for modification	C:\Program Files (x86)\VMS\skin\default_1.5\buttons\BatchUpgrade.png	irsetup.exe
File created	C:\Program Files (x86)\VMS\skin\default\icons\TimeDownload6.png	irsetup.exe
File created	C:\Program Files (x86)\VMS\skin\default_2.0\icons\VRSoft\VR_Wall_Normal.png	irsetup.exe
File opened for modification	C:\Program Files (x86)\VMS\skin\default\icons\selectSide8.bmp	irsetup.exe
File opened for modification	C:\Program Files (x86)\VMS\skin\default_1.25\buttons\split22.png	irsetup.exe
File opened for modification	C:\Program Files (x86)\VMS\skin\default_1.75\icons\PanelUpArrow.png	irsetup.exe
File opened for modification	C:\Program Files (x86)\VMS\skin\default\icons\TimeDownload10.png	irsetup.exe
File opened for modification	C:\Program Files (x86)\VMS\skin\default_1.25\buttons\split16.png	irsetup.exe
File opened for modification	C:\Program Files (x86)\VMS\skin\default_2.0\buttons\BallastConfig_dis.png	irsetup.exe
File opened for modification	C:\Program Files (x86)\VMS\skin\default_2.0\buttons\ChannelStatus_press.png	irsetup.exe
File created	C:\Program Files (x86)\VMS\skin\default_2.0\buttons\DeviceConfig_normal.png	irsetup.exe
File created	C:\Program Files (x86)\VMS\skin\default_2.0\buttons\RecordPlan.png	irsetup.exe
File created	C:\Program Files (x86)\VMS\skin\default_1.75\buttons\Network.png	irsetup.exe
File opened for modification	C:\Program Files (x86)\VMS\skin\default_2.0\buttons\AlarmIn_normal.png	irsetup.exe
File created	C:\Program Files (x86)\VMS\skin\default_1.25\icons\line2.bmp	irsetup.exe
File created	C:\Program Files (x86)\VMS\skin\default_1.5\buttons\StopAlarmLink.png	irsetup.exe
File opened for modification	C:\Program Files (x86)\VMS\translations\SimpChinese_Qt.qm	irsetup.exe
File created	C:\Program Files (x86)\VMS\Uninstall\IRIMG1.BMP	irsetup.exe
File opened for modification	C:\Program Files (x86)\VMS\Microsoft.VC80.CRT.manifest	irsetup.exe
File opened for modification	C:\Program Files (x86)\VMS\qwt.dll	irsetup.exe
File created	C:\Program Files (x86)\VMS\skin\default_1.25\buttons\FastNormal.png	irsetup.exe
File opened for modification	C:\Program Files (x86)\VMS\skin\default_1.25\icons\DVR_Connected.png	irsetup.exe
File opened for modification	C:\Program Files (x86)\VMS\skin\default_1.25\icons\selectSide7.bmp	irsetup.exe
File opened for modification	C:\Program Files (x86)\VMS\skin\default_1.25\icons\VRSoft\VR_Grid_1L_2R_Normal.png	irsetup.exe
File created	C:\Program Files (x86)\VMS\skin\default_1.25\map\map_Alarm.png	irsetup.exe
File created	C:\Program Files (x86)\VMS\skin\default_1.75\buttons\decoder_normal.png	irsetup.exe
File created	C:\Program Files (x86)\VMS\skin\default_1.75\icons\modifyip.png	irsetup.exe
File opened for modification	C:\Program Files (x86)\VMS\skin\default_2.0\icons\banDouble.bmp	irsetup.exe
File created	C:\Program Files (x86)\VMS\skin\default_2.0\icons\DVR_Connected.png	irsetup.exe
File created	C:\Program Files (x86)\VMS\skin\default\buttons\reduce.png	irsetup.exe
File opened for modification	C:\Program Files (x86)\VMS\skin\default_1.25\icons\Camera.png	irsetup.exe
File created	C:\Program Files (x86)\VMS\skin\default_1.25\icons\VRSoft\VR_Tool_Normal.png	irsetup.exe
File opened for modification	C:\Program Files (x86)\VMS\skin\default_1.5\buttons\ChannelManager_dis.png	irsetup.exe
File opened for modification	C:\Program Files (x86)\VMS\skin\default_1.5\icons\checked.png	irsetup.exe
File created	C:\Program Files (x86)\VMS\skin\default_1.75\icons\VRSoft\VR_Grid_3R_Select.png	irsetup.exe
File created	C:\Program Files (x86)\VMS\CMSClient.dll	irsetup.exe
File opened for modification	C:\Program Files (x86)\VMS\skin\default\icons\warning.png	irsetup.exe
File opened for modification	C:\Program Files (x86)\VMS\skin\default_1.5\icons\VRSoft\VR_Grid_4R_Normal.png	irsetup.exe
File opened for modification	C:\Program Files (x86)\VMS\skin\default_2.0\buttons\Cloud.png	irsetup.exe
File created	C:\Program Files (x86)\VMS\skin\default_2.0\buttons\TourConfig_press.png	irsetup.exe
File opened for modification	C:\Program Files (x86)\VMS\skin\default\buttons\TVWallConfig2_normal.png	irsetup.exe
File opened for modification	C:\Program Files (x86)\VMS\skin\default_2.0\buttons\TVWall2_normal.png	irsetup.exe
File created	C:\Program Files (x86)\VMS\skin\default_2.0\icons\TimeDownload11.png	irsetup.exe
File created	C:\Program Files (x86)\VMS\skin\default_1.25\buttons\AlarmOut_dis.png	irsetup.exe
File opened for modification	C:\Program Files (x86)\VMS\skin\default_1.5\logos\loading.gif	irsetup.exe
File created	C:\Program Files (x86)\VMS\skin\default_1.75\icons\TimeDownload14.png	irsetup.exe
File created	C:\Program Files (x86)\VMS\skin\default_1.5\VideoWnd\record.png	irsetup.exe
File created	C:\Program Files (x86)\VMS\skin\default_1.25\buttons\MoreFunction.png	irsetup.exe
File opened for modification	C:\Program Files (x86)\VMS\skin\default_1.25\icons\TimeDownload14.png	irsetup.exe
File opened for modification	C:\Program Files (x86)\VMS\skin\default_1.5\buttons\PreFrameNormal.png	irsetup.exe
File opened for modification	C:\Program Files (x86)\VMS\skin\default_1.5\buttons\UserManager_normal.png	irsetup.exe
File opened for modification	C:\Program Files (x86)\VMS\skin\default_1.5\icons\toD.png	irsetup.exe
File created	C:\Program Files (x86)\VMS\RecordPlan.pdb	irsetup.exe
File created	C:\Program Files (x86)\VMS\skin\default\buttons\ChannelMode_dis.png	irsetup.exe
File created	C:\Program Files (x86)\VMS\skin\default\buttons\TourConfig.png	irsetup.exe
File opened for modification	C:\Program Files (x86)\VMS\skin\default_1.75\buttons\Backup_normal.png	irsetup.exe
File created	C:\Program Files (x86)\VMS\skin\default_1.25\buttons\UserManager_dis.png	irsetup.exe
File opened for modification	C:\Program Files (x86)\VMS\skin\default_1.5\buttons\PTZConfig_press.png	irsetup.exe
File opened for modification	C:\Program Files (x86)\VMS\skin\default_2.0\icons\image_enlarg.png	irsetup.exe
File created	C:\Program Files (x86)\VMS\skin\default\icons\information.png	irsetup.exe
File created	C:\Program Files (x86)\VMS\skin\default_1.5\buttons\Default_press.png	irsetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 22 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.h264	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.h264\Source Filter = "{D4DA6077-2239-4C9E-AE16-C78DD9F35631}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D4DA6077-2239-4C9E-AE16-C78DD9F35631}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{76C90120-D6E9-4CDD-8163-466B950BB133}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{76C90120-D6E9-4CDD-8163-466B950BB133}\ = "H264 File Source Property Page"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{76C90120-D6E9-4CDD-8163-466B950BB133}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{D4DA6077-2239-4C9E-AE16-C78DD9F35631}\CLSID = "{D4DA6077-2239-4C9E-AE16-C78DD9F35631}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.h265\Source Filter = "{D4DA6077-2239-4C9E-AE16-C78DD9F35631}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.h26x\Source Filter = "{D4DA6077-2239-4C9E-AE16-C78DD9F35631}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D4DA6077-2239-4C9E-AE16-C78DD9F35631}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D4DA6077-2239-4C9E-AE16-C78DD9F35631}\ = "H264 File Source"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D4DA6077-2239-4C9E-AE16-C78DD9F35631}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{D4DA6077-2239-4C9E-AE16-C78DD9F35631}\FriendlyName = "H264 File Source"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.h26x	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D4DA6077-2239-4C9E-AE16-C78DD9F35631}\InprocServer32\ = "C:\\Program Files (x86)\\VMS\\MediaPlayer\\MediaDecFilter.ax"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{76C90120-D6E9-4CDD-8163-466B950BB133}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.h265	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.h26X	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{76C90120-D6E9-4CDD-8163-466B950BB133}\InprocServer32\ = "C:\\Program Files (x86)\\VMS\\MediaPlayer\\MediaDecFilter.ax"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{D4DA6077-2239-4C9E-AE16-C78DD9F35631}	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{D4DA6077-2239-4C9E-AE16-C78DD9F35631}\FilterData = 020000000000200001000000000000003070693308000000000000000100000000000000000000003074793300000000380000003800000000000000000000000000000000000000	regsvr32.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
208	irsetup.exe
208	irsetup.exe
208	irsetup.exe
208	irsetup.exe
2524	VMS.exe
2524	VMS.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 208	1872	XMeye_org_VMS_V2.0.1.18.T.20210810.exe	93
PID 1872 wrote to memory of 208	1872	XMeye_org_VMS_V2.0.1.18.T.20210810.exe	93
PID 1872 wrote to memory of 208	1872	XMeye_org_VMS_V2.0.1.18.T.20210810.exe	93
PID 208 wrote to memory of 5036	208	irsetup.exe	107
PID 208 wrote to memory of 5036	208	irsetup.exe	107
PID 208 wrote to memory of 5036	208	irsetup.exe	107
PID 5036 wrote to memory of 2736	5036	cmd.exe	110
PID 5036 wrote to memory of 2736	5036	cmd.exe	110
PID 5036 wrote to memory of 2736	5036	cmd.exe	110
PID 208 wrote to memory of 2524	208	irsetup.exe	109
PID 208 wrote to memory of 2524	208	irsetup.exe	109
PID 208 wrote to memory of 2524	208	irsetup.exe	109
PID 5036 wrote to memory of 4884	5036	cmd.exe	111
PID 5036 wrote to memory of 4884	5036	cmd.exe	111
PID 5036 wrote to memory of 4884	5036	cmd.exe	111

C:\Users\Admin\AppData\Local\Temp\XMeye_org_VMS_V2.0.1.18.T.20210810.exe
"C:\Users\Admin\AppData\Local\Temp\XMeye_org_VMS_V2.0.1.18.T.20210810.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1809778 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\XMeye_org_VMS_V2.0.1.18.T.20210810.exe" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-1790404759-2178872477-2616469472-1000"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:208
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\VMS\MediaPlayer\register.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5036
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /u -s "C:\Program Files (x86)\VMS\MediaPlayer\MediaDecFilter.ax"
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:2736
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 -s "C:\Program Files (x86)\VMS\MediaPlayer\MediaDecFilter.ax"
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:4884
- - C:\Program Files (x86)\VMS\VMS.exe
    "C:\Program Files (x86)\VMS\VMS.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\VMS\AudioRender.dll

Filesize
107KB

MD5
5c3ffaf46a56c045bfbf67caf6937b0b

SHA1
c9a1c6e9bb723748e978f4fae1b9ac7dfa8af009

SHA256
cfa446e90c8ccdce3d1fa2181f333d6c62354eb60c95eab97f90529006af26aa

SHA512
c5a572356d4c7420e59b420007d96a893c20bcab931b98159ed6507986160cab87dc48471a51555f9f1711e4bdd27ab02ade1116ad11023e8b2f0e146c4ffd9d

Download Submit
C:\Program Files (x86)\VMS\CMSClient.dll

Filesize
512KB

MD5
adb4ac67f784440ed155acf46b381dbd

SHA1
b1203ea83eef8b3d8cd9f0f7e416a902decca6a8

SHA256
fef7c3070833b5f0761028c83bfdf042c7c9fed4afcd18dbd34c8fa8765e0af1

SHA512
4e3aa612da87a2c9fbc7e871561ba21536d24dc5f83c224b50caed4ecc04a922093a8816bf93d3574100768be8727ec5cb60e203a0971cb491d4c4225faeefd1

Download Submit
C:\Program Files (x86)\VMS\CMSClient.dll

Filesize
1.4MB

MD5
9d93c8291eb1d7ba791904805018de11

SHA1
d628416ae100ebc57a3dd96757f11605ab78985f

SHA256
8c58a55d14bdd0a74d50dd2c45e1e910ce3e9c4a2fe04c715914a1200cc9a2f2

SHA512
6294bb931e5b297b009dcd067ec78dab01176912ee50e0c808ec16dba3f01d08c050e08ceb7cc984ff30b09c45cebcba9ea530da5fff207d60071fcd71cff1fe

Download Submit
C:\Program Files (x86)\VMS\CloudClientAPI.dll

Filesize
233KB

MD5
d4a006317723c21fff7a8e03a6ea3d38

SHA1
5135d689cbbb98c1bd28a63c89312b9e91b2ded5

SHA256
0852e47e7aad085811ce71799b8b00524ce3c82156b5992bc61e80198da7d383

SHA512
51a730a2b89c2aed21c11a10ca6cd862acdad1b5caab17e18bf52e5de08d003ac3cd369cf820b177d264d78ad353467e0c4473c17c24a8dd54be9e027bd7b713

Download Submit
C:\Program Files (x86)\VMS\ConfigModule.dll

Filesize
173KB

MD5
46c3249a448322583369f5d2e1efbb79

SHA1
e079e60e63bee9263c421deb564b08f7f7ea6c40

SHA256
340ae1b27bdf812206825d700da8ce3845fab9bf762d190720b27957783404cd

SHA512
bfafc0d25da5319ccf4e802fed87bdbb312b79948bd79208921c4462ed41325f3e594e86fe0b80ef87b2220ace36d8699b91965216768f6f222cecbf6fffb61b

Download Submit
C:\Program Files (x86)\VMS\H264Play.dll

Filesize
1.9MB

MD5
ec0ca96e0e2044bec584294cf1a8b479

SHA1
b3337b3dc3a85da2cd1260212464dd3174b99a69

SHA256
bf7de5fea768b94da23fe4977ecb9120144277b18aa11d2dd4fd618af0d10a29

SHA512
c6603e76eae07c95dbdfd88e697cfcefa7c1479a2c9e49b776912810780995ac0b9aeff59845809bb2e64f63536d8fd388937cbfe995e1381b1fd60b2643d0a7

Download Submit
C:\Program Files (x86)\VMS\HCCore.dll

Filesize
1.1MB

MD5
dd89ba88d52bb9e1db5dd98dee648dfe

SHA1
38dcca5ca58bd9e93857a78e73ce70dc77c97db2

SHA256
c9e63a2ec86b3696b6009885fbbea42533e9a77ae46a5d3b27222502991683a8

SHA512
1b00c4926d3ea1b72ad59beb984cb9da0623958ead44f6c32d9724fc2e53f8f71ca11786ef59c7e89e8b8f4b75d51452d1c05beb7421e3f1a17148fa08b920a5

Download Submit
C:\Program Files (x86)\VMS\HCNetSDK.dll

Filesize
650KB

MD5
94ab231cb2061e7be9daa049345c0654

SHA1
1b87e94a74f2ed403b745e0a1ef341ea5b5dc772

SHA256
e00a659dd1412e2b2b947fba516f58079bf83d05f70f3bfd7831c9f6388275cc

SHA512
57d4e2c9bf23e20da051d3e9506bd1161c0a498d4be7a2861463b0f2d0fc267644a46e13e6d487a9a026c73607fd00b502eaaea538952bed44acdd8f5dc31091

Download Submit
C:\Program Files (x86)\VMS\HCNetSDK.dll

Filesize
192KB

MD5
8f14dc23dee412aaa1de3174c7a29fc8

SHA1
c407f6f1012b102df77b4bfea32b56156d07fa40

SHA256
efbd2996e733388dbd509d054f3325aa715d449c0a01ad3eec19e38e7434a072

SHA512
f700b8f6635d9d1e44d51e3cf2a5fbf0b4ce70536c5dbbc7f2ac87a89147c164b74a26179addd8867be0a7106f3184d170e9c5bae74d18deb85aa1e335d74793

Download Submit
C:\Program Files (x86)\VMS\MediaPlayer\H264Play.dll

Filesize
200KB

MD5
a13e14cbf39f59b10c8c298c2da0faf8

SHA1
0abbd5079ee36cddf81d4091d495ca2a3cbf8cb4

SHA256
614f8bb649d1078901fd60e17c2ea954cedb20face7b49978f9bb908ee684ce5

SHA512
154595f3cf311bd21a391936d1b74d0c43eed9d79dca9b1c0028f6eed14cc3fcba1e84446f06e14085bf1c03d60af4346411d8daf829d2c0e7091cb9e78d707e

Download Submit
C:\Program Files (x86)\VMS\MediaPlayer\MediaDecFilter.ax

Filesize
31KB

MD5
e5b67f308305b443ad7ef2937ea8ed17

SHA1
d2b209f3acea82dad0b2aad2149a37e197a77ee3

SHA256
d35c8a4787cb0547af704aaed35f004f43b1449b6a1dc716635f22e953a603b8

SHA512
94f40759ebb14a69cff19ddb0e45c644d42253e8ba36b7cc5fd049f27408809a4e4be91671d800b5ee100b2e5ce59f037507e4d8cc62860d487b9858949059ae

Download Submit
C:\Program Files (x86)\VMS\MediaPlayer\StreamReader.dll

Filesize
38KB

MD5
65f495d45c50cb3b00594e77c76e1ba4

SHA1
bba3dbdcb35a9478013dae796386ade413da9d7b

SHA256
d809c40e0698d3196d9a6760e3705a1e8bf65c769e67ec87df6175b85f6c420c

SHA512
d4465031b983bf5dffccdc5c07342424c3396798c920b719b24190cfc1e735903f585c773df5e49bdc200145c126f87655d860ddf494c495259bde2292ac72b1

Download Submit
C:\Program Files (x86)\VMS\MediaPlayer\register.bat

Filesize
77B

MD5
40a8fb0b4984103de87b0cfc7b6091a1

SHA1
5c9b2b459a673cfefc7406a0f2075ac3d23bff06

SHA256
6c1aa41bbba9b21b65d37dbed4636a1b5b794cab496e2a283832d5c106dcad71

SHA512
d209d045b904c1430381723e8223ae67c8dd6bf5388226f74a9b0926770754fcd22e2c326aefcc1e1c6cbcb2612fb0245b9c610f95cc0e3b06c552d81c879c94

Download Submit
C:\Program Files (x86)\VMS\NetSdk.dll

Filesize
1.1MB

MD5
c00f4a23bf9ed96dd9f18950e6bce1af

SHA1
3e31fa1b8f2d2aa406e287ddc47f72b4b022fd08

SHA256
6b9e0d4ce3e2d6e4991f83628eb87668099552cff80fd63fcf2bda84e7c3ff3b

SHA512
e16a17259ac1e722afbd69e02bc7451441a90ea5d7792f0ac301dced07b0d55d9a6833b82039f84b98b61e456de93a0d4aefb85de755c8214b4731b92a6e65ad

Download Submit
C:\Program Files (x86)\VMS\PlayCtrl.dll

Filesize
3.6MB

MD5
3365cb3506a3bbdb1689929690090cf6

SHA1
7ed8ddf13e4d2d529862d9eef5d3e4e90ed0802c

SHA256
66c90d29fd4e9eae74d07d01b66d6d6374baa0b63b5604446458abebe50b3a4f

SHA512
bd708095453627adf6659c69e319701cec3597e1444143be020fbe96dead1e66a106fc02f5e3d2914f082e5f3a1f8c366452f668b9d28bddcdd3e04b041cc8be

Download Submit
C:\Program Files (x86)\VMS\PlayCtrl.dll

Filesize
1.8MB

MD5
36f004fb1e6e8c8d9736546c54b480f4

SHA1
de893f6d3357b940c9095141fc196da53f85dab5

SHA256
56cd2c3aa07463cee0179923f4f94d8101c9e3b510c2f3bf89677a204acd0324

SHA512
17eff13a4c24ed711f320fbf5c2de6094fb0a618d3582ec8812d25e795391b8f5a0b1520244c74f071c1230ffd47204543587708f63f6a0f00d233b247f8312f

Download Submit
C:\Program Files (x86)\VMS\QtCore4.dll

Filesize
2.4MB

MD5
a9130fc93df6d15cd53ccf2c31c230b5

SHA1
c880332df3d597649f4ad65ef9133983452d9ab0

SHA256
819ebbbb399e6397dc880e336bf936366f07c4abc145901b63f81713447cde43

SHA512
8b3c49c4d6a8147f2c502eed6ab97a99bf08c64d277cd65abc59f75e69ec4b0d67750fe5d9f9548fa03048d9621ce9ce2df12ededd57a56f78593843e85263be

Download Submit
C:\Program Files (x86)\VMS\QtGui4.dll

Filesize
1.1MB

MD5
33f92302ff2fec7a0b3108702714202f

SHA1
0f9d417de1a530ae037fa91036c7e76ac269c55e

SHA256
07dc469a05dace304d03bb6dff9d09a5f65a7ade4e7889cf1010fdb3a4182786

SHA512
9bfb1e5da683575a36b2cb25bb5098f51d3b68153573ea751a9c3e4442338325d389dbd2748fe9369636bbb0eac8fd90cbf0b0b9b608fcd013026601f787496c

Download Submit
C:\Program Files (x86)\VMS\QtGui4.dll

Filesize
640KB

MD5
4fcc7ea2413ef079da446093938691e2

SHA1
45b012aa3e60f95eee3fa6cbf9401cd18bbc9d87

SHA256
d487a1338e1446b6b8fac24f422fb7f450bc06a200c581880e15364ee0bdf900

SHA512
746fda1f1e1a128033b56986ad8acf3c0ca4a11c2c8fcabf98d6af62a20888b9483bfbf1f34c6cc6ed65bc5197ac1e41a1504f954621b86976fcf973ac00acb1

Download Submit
C:\Program Files (x86)\VMS\QtMultimedia4.dll

Filesize
112KB

MD5
62f31e31b3282d8731d7b5b85e9e36ea

SHA1
85b21881462720dab49003a967e0f2dde2d5bf3d

SHA256
f2c59da81b6ec5f0f73f40f87172b2855a0a0710444efee51bd54ceb3f570f81

SHA512
7630f6df003815baae0d57771ac5baf15e7a245f3a0f935b895b58da766ea3d4f107f209c6aca531004b0c510e26788800725ef9731e1512cb40feaf75285ec2

Download Submit
C:\Program Files (x86)\VMS\QtNetwork4.dll

Filesize
1000KB

MD5
7d79b91510baa9b36a993cefbd087b15

SHA1
daacafd0e0ebfb2e7cdee984a2f926c353367883

SHA256
21850d83423613a171192444688fa0a58d16d48392aefaf00feb5292971177b1

SHA512
e8be9452f145fc0aa4e53db778dc0e61c2ad705e4c4726117419acab679d1d2eba55da0c2f0f713ea9ed7e1f6d1abfd7276d61a518f296726a34b6faf771c8b5

Download Submit
C:\Program Files (x86)\VMS\QtSql4.dll

Filesize
190KB

MD5
16540bc77b3d492a714b69a2a47cacc7

SHA1
27bd3276f3f19299c6ab5d898da7a88edb51f592

SHA256
4cd303901e88229725a55a88db51a721b1167cc8abba56f5e32a01220b94d067

SHA512
598aef1ec9c49a5ce3ce4f8762b8720d39a10b11df1410f14a94dccbd18dda1b44fa2ebfea71e6afc82140421b033623b3a8a203ea5bf326b533987be0b73aeb

Download Submit
C:\Program Files (x86)\VMS\StreamReader.dll

Filesize
178KB

MD5
14fd2cc7585c7b0322ad3041cb7714cd

SHA1
d99eff0da0cb5d991a8b609ee7491513a49da12d

SHA256
5e381f2bc06931d4a1f06b1c7eabd77e94703934222dda319f955657ac906965

SHA512
c903ac60840f2020575688b3f96196075762bf73adf43eea9fd4ff9779e22bdcb470d299b398d040dd2679c41fd59addff7b70c34ae2acfb3e90367dc53a4b63

Download Submit
C:\Program Files (x86)\VMS\SuperRender.dll

Filesize
305KB

MD5
5e47a780dc5e6478ce2ed98f3f30d215

SHA1
9c42cc1e2bd7bb0f7b3303d6a6e1a5e1b37d3a21

SHA256
1d258784b8306dea631d8adb910092248f8e21785c5330aa6d8a281f8e8f86fc

SHA512
2df564e3fbcbeb45d6254c554270db2279fb6eff3e6233934ffae9b30401c335bc89ddb87145f9ff3e28a83fc58cefa555a70e13c138bb05a6dc7272d032eede

Download Submit
C:\Program Files (x86)\VMS\Uninstall\IRIMG1.BMP

Filesize
517KB

MD5
e5b824146d577f28fd10df2d4815c4bc

SHA1
63f2c2bbd60c8fe4f3c231f642b782c8c9c934ca

SHA256
7244a060d1a645bfb9459d8a6eb51f8778f6a5dec1f13de77347cf55fb71189d

SHA512
0e993e353baedc2168b1ed5d5c42d5ad87cb79845facc34fc144d4ddef2cc9b7a4c92c0c452e3f3001e1cfbd22b25d433e21397a8a939682307a93b6e98d8d01

Download Submit
C:\Program Files (x86)\VMS\Uninstall\uninstall.xml

Filesize
592KB

MD5
dd38b6ba7388dc56f668375e27f1db68

SHA1
8999e387e8cfd3f9ae51acddc048d0003ca4a20f

SHA256
3eae45abbc1926a88553a6fea8c3bfc67a3da27c80ed1c18204d7ef0b12aa6ef

SHA512
50ce6c2e19d64f2ec121cefbb6f190b54f15f7b5e47b1b712883f735b542a6424a089f13b47cbd071803040b9542792a1fd400e6923d8665cf599987454d3f39

Download Submit
C:\Program Files (x86)\VMS\Uninstall\uninstall.xml

Filesize
603KB

MD5
7e4d13d9bb5384e24ae8aa4780450f2b

SHA1
88aba8dbb0e55dab01b733709aed2ebd65053bc3

SHA256
527727a88ec2c0e4a393e00e08ed956bcf0e29c0bef82a417d750ea1676149cc

SHA512
df8cfd16867385f5cf4fb626da7b91f2962f3176610374aa86a131ae8585f30da15b728a2a73f1a04eb82e742060e56997aad251c491e81a976c56660fcc0189

Download Submit
C:\Program Files (x86)\VMS\VMS.exe

Filesize
6.6MB

MD5
edef5145a01f19ada0cf580f51718161

SHA1
f64380639f939553212dc994250aeee4c56c7dc2

SHA256
fe974e5bd00aac30e744b0dfa435365a3799db7b58160ebfe38d985331a80199

SHA512
cef42b6a2f99471baade74bfed5c38e86b6ded72b3df95db375a4e90987ec428f18e6021fab2053b609e936e05248bb3322a8781c341424c34ddaa99f1bf0545

Download Submit
C:\Program Files (x86)\VMS\VMS.exe

Filesize
1.1MB

MD5
39a8125d6797098c6851299936bce4d9

SHA1
6393beb8bda5bdfcb9d11cf2bce6684662379d66

SHA256
6289a3c3cefcab5d3c60a3c4baaab794558bb665f7e2d01499c379d32785a2b0

SHA512
f18604100cdc8394ec3fa861caaab4f7b925ff152244aade7285266602f994ca3d88f9336512af0b80da71a72894dad6981e941223cc968e4c52d350fc58b1f0

Download Submit
C:\Program Files (x86)\VMS\VMS.exe

Filesize
6.1MB

MD5
4ec00ee83a719eca402b11c2f0fe10c5

SHA1
fc23379ee5209bd9d6802d61358152a6153963ed

SHA256
6f94b512dfc5407dc1347e4651ea7e51862e7c2346449566735eca2486f3f37e

SHA512
83d38b9b5ac5ec8b71ea7750f0a51c924791133fe8c665ad040d07ecbcc4cc71e3961e38e6faa636795075044cb56f4efe211e263cc63850b1d706bd72dcda9d

Download Submit
C:\Program Files (x86)\VMS\dhnetsdk.dll

Filesize
4.1MB

MD5
3c4444c9555840dc100bb747def18da1

SHA1
0dd5110e6017c64001a28df8cf97903713eafa8e

SHA256
c3787ab2200f725fccc97c06b4c5e89513d45d5b1f1a40b6ca5e471b5e12ec20

SHA512
3adb527d5e37eccb85e3bafa5324b24d4c3d259749223f02595d9750c03b8a9fe5f78ae54b7e545e4d0e243bfe6d7549bbd01e2bd456cb650914b000775cbaab

Download Submit
C:\Program Files (x86)\VMS\dhnetsdk.dll

Filesize
4.0MB

MD5
9325f13149239a27606d0b89689a0c52

SHA1
7d1096df6c8d04be01343195897304e0a1a800ad

SHA256
7bc2338b5a0715ba98e8c59c715a20cc16806be144e70eefcb41c78de23dc138

SHA512
c9dfc5b9750373c3262b39be3ba9a09c23e895fdd8bd46ed65c2ed337e4b1b33e9e12e91462b08dfa12f7bb2d7129c12e13a0c3ae25979ae558e953bded9833d

Download Submit
C:\Program Files (x86)\VMS\dhnetsdk.dll

Filesize
1.9MB

MD5
869604d0d265bb4d35c9082b6eafeea1

SHA1
596985ba0cc02e5cd3c84449b21f194bffbd3d69

SHA256
24c82800d8bfdead5f69ecb2deb034c59fd9534653c06bca83e2c32d3e1432e9

SHA512
18d1c5da1c91c9a209330f8ce0c80ea5e8b43c1c3e4f11b86ea7c953ede03db7b08b280e9f2132e8d967c10558acd7f92389e428853bfcfa37f143328fd298f6

Download Submit
C:\Program Files (x86)\VMS\dhplay.dll

Filesize
4.3MB

MD5
50dcf0a93409f6e836f9bddaede99a9e

SHA1
3fe766157fdc02674993da6a6d14a26e425244fd

SHA256
910a85a04bf9ba48a15fea214a450564c8dbd84dd9885ffab36446a74776e327

SHA512
4e279b155b8319a58b21217567046823fcc34ea1c28d70b1c9dd3ad1235264523f3f059f0ad0b58e08ce7307e1c4127cd32864c996b6b746343b0a497116b13f

Download Submit
C:\Program Files (x86)\VMS\dhplay.dll

Filesize
1.9MB

MD5
e4d89506b9d713ea1782c0dd4d278602

SHA1
8f394d7382a6b1dc5a185136140ce34da2bc7262

SHA256
2e07bc4de0decd4751ca69c8c738b835fe7428b17d2d1fcd1b31ebf989918eee

SHA512
6d340afe80484a7b509fbc2082f5689ab36e0fd29a73c0ff066ba0f7c279dc511e2990cf0505905ffe24d20b6a71654ebf9de12c548f509488aa91c9650c8edf

Download Submit
C:\Program Files (x86)\VMS\glew32.dll

Filesize
333KB

MD5
93df9e6a926fdf46f2d77e03c9b2da88

SHA1
53d5de68b15f3c6ca9948f2cf52fac0603b9605f

SHA256
68293640f751015bf71af784d10c53db9506a3a4a992fcef22ec3af5084a35fd

SHA512
1d9d758c3082657f15b36f62a899c88f669b90dcabb69c419d463e4fe0b76bb359a39ff1ad5b4fb5286340360809bd21bbaf51c1fd82d91fd9c65f65a838d117

Download Submit
C:\Program Files (x86)\VMS\libonvifclient.dll

Filesize
2.2MB

MD5
d003cf3d6da8ea78664ed6854f3deb9b

SHA1
5edf90a67db2c0e28fa935649858f93d5b517ba3

SHA256
d75bee0e56adf125707c3e8ce3eae8146271fa871977f7705affc1995aed5ff4

SHA512
172aaefd7462f857b51eee66208471ce939fd0ce3ef8afb73aa1f08e7dd42e22042b206ee8b77051bb03229d789099296e7947200e4ad968da07f9e06a48b6f8

Download Submit
C:\Program Files (x86)\VMS\libonvifclient.dll

Filesize
576KB

MD5
91088a991b4bd08d68e1f8813f87ade7

SHA1
84a4e41b2417f4be04632601e1b910ebc41de6f2

SHA256
cf2c2f08292203d5432829eda4c9d6cdf9e9d0339aa94b75ed2dbb924c1a89aa

SHA512
1f6a5105e2b45ab0e769d8289da6c0947f806bf6bd0578ec6a6adb610f8e6636b8594c2483de221709367f7d0c691739803b161ce550c1828d034d60b46637dc

Download Submit
C:\Program Files (x86)\VMS\skin\default\buttons\Cloud_dis.png

Filesize
24KB

MD5
11c70f8353535af3e6eb93ca491cb2cc

SHA1
de12f06e390543b6a13c9bfa7ed2cfd2ad314812

SHA256
45c91983fe858881ee48aa23e4cc0b02c01e67a1e5fb6887f8db2afc2ab90838

SHA512
81952e7645246a8a6e817864c668f6ce84b13336675bdbce5f95584825e6338d18115c8e42c2dfd1b904459013adcf215cf9d76d46b063cb07e29df8969c0ffd

Download Submit
C:\Program Files (x86)\VMS\skin\default_1.25\buttons\CameraParam.png

Filesize
33KB

MD5
e0788b139e5d2006a3eebf51a24be69c

SHA1
cc2d23ebfc3bda1d57cefaf25fe7438ba2ce0db9

SHA256
a9d010c9dbfec8ff7a93bc26d7cbcced63158a9e7869e07f74d09b5b271736b7

SHA512
bf3fa7cbc954dfdbcd154706bb165efb156767883caef4e890be684b6fbfde266ed9eed7c93e8b92ef884fa32f7e3d3d61be68e5473c47e94c36813961f53dc9

Download Submit
C:\Program Files (x86)\VMS\skin\default_1.5\buttons\RebootDevice.png

Filesize
34KB

MD5
866161520dd48b5a650a7afb2036ee92

SHA1
38c9a6603813b93b85e6a3ef3a78c4fdb7dd0709

SHA256
3198435b0ed981c729a50308a9f84b0d54ab87fd7188991b434b058a42e15066

SHA512
38397c2094bb974f4ec7654a7565d78342a503f0705e542326ad158ee03555559020b52f99e274c3d7cce01fe6b25654771191645cb0e89486122422e127f6cc

Download Submit
C:\Program Files (x86)\VMS\skin\default_1.5\icons\wnd_backgroud1.png

Filesize
22KB

MD5
0e4ee22314fd04b7ef0232f9e3ae342c

SHA1
9d944c23794e7030b874e16202f09cd88547055e

SHA256
9ed5ec4cc96c1e2df3a1e1c9d1445b3fdd43563c3258aabf5273ae22cf9876ed

SHA512
50b77ff44eeb0d437b09e27584cb467ee1ddfd4d041ecb73b22748b50beed445ad3d65ef50f6a532b801d8ca88eabcc22090a6be07837e0184fbaaf882ee63b5

Download Submit
C:\Program Files (x86)\VMS\skin\default_1.5\skin.xml

Filesize
2KB

MD5
82a0c14f11cac518b72104e28ba838c3

SHA1
53caa769557bcb54247416fe4a968f9a4a31b4b3

SHA256
5ed23a1fcd40acff8a190a7aa214fe8f59ccc8dc9c2c4aa38b4338e6dbaa3040

SHA512
63f88da9ffefbc58680c6220b4a8516471005dc7683cd17b36194249b5ac11fa2d7542e2cf04d3d15325da272c82f65bdb9ce2846d7e006ac1a8d56909bcd634

Download Submit
C:\Program Files (x86)\VMS\skin\default_2.0\icons\vms.png

Filesize
29KB

MD5
9c7ea605c3dc0f11c40317deccf4a5fe

SHA1
7d84ad9dfdbc413c41f069612b4672929a7c4aba

SHA256
121aaeaaea6ccdd9cd5c5d390e531aa0c7e0a343626a610b94fbf891f6b080a6

SHA512
ee948c823d95a77a58c0da2549ca1f5c1213d454b7dfa40555752511193d1be9eb46a4fbb28231636e28ffc33e73da633b9923052a05dfdfcb24fbf49d36e8a1

Download Submit
C:\Program Files (x86)\VMS\vrsoft.dll

Filesize
199KB

MD5
f136de3b9ed25be9efb38ae47b1c1f61

SHA1
7e094aaa5b2616c129376ead2b670f986c2e8065

SHA256
08844acef3f217667558d0c1abc1e5f6c8ed555b7f62d23c0f7590da67d6f7cc

SHA512
c62cdd4d26c2525619d29ba3aa51012c234f75d37d6741d749583e6d7e573fcb49bdc1b89f380b3257ebedeac6697924ce01a2cfdda32dd5998cfbe33f57035b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.JPG

Filesize
8KB

MD5
0068efa951114b30cbbf44ca6255917a

SHA1
637e4e48ae2c216f5fd173191427b5327855f05f

SHA256
4cda756b8c77368451d116f39cf9918b54e741f84f3fc5b769a8096955c83003

SHA512
55c0f1d741775d89ce01a1b8c2b7766081ebf9deb136557ed5b7a2296d0f892959b7e844aacbf18dbed9916d452388fba0813c3723e22e865e1bc0ca0fb516f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.JPG

Filesize
2KB

MD5
30688379f2a968059af2683ba18812bf

SHA1
e38fa2b07836e39d3419039539a1da1ad8b33e8a

SHA256
f7cddafec158d4bf444d91f7fc34c631fec8453bcd0390d9c43bfbb4f9d193a0

SHA512
839609fd6ab8a98adb7c3ab1d7fa3cac9e842429928b2afd852b8b14b4f86f22dac21a10c3319201a0bb6dce67e5628801e91ef8fb4029aef320a6f992ae9171

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.3MB

MD5
dec931e86140139380ea0df57cd132b6

SHA1
b717fd548382064189c16cb94dda28b1967a5712

SHA256
5ffd4b20dccfb84c8890abdb780184a7651e760aefba4ab0c6fba5b2a81f97d9

SHA512
14d594e88c4a1f0ec8bc1b4fe2d66e26358f907b1106c047ada35d500ca9e608f1ce5a57599453cf10f11f4d9f1948ced9056ce8bd944b16eca7e9b83e8b27af

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

Filesize
318KB

MD5
b5fc476c1bf08d5161346cc7dd4cb0ba

SHA1
280fac9cf711d93c95f6b80ac97d89cf5853c096

SHA256
12cb9b8f59c00ef40ea8f28bfc59a29f12dc28332bf44b1a5d8d6a8823365650

SHA512
17fa97f399287b941e958d2d42fe6adb62700b01d9dbe0c824604e8e06d903b330f9d7d8ffb109bfb7f6742f46e7e9cedad6981f0d94d629b8402d0a0174f697

Download Submit
memory/208-4050-0x0000000000400000-0x00000000007CB000-memory.dmp

Filesize
3.8MB

Download
memory/208-84-0x0000000000400000-0x00000000007CB000-memory.dmp

Filesize
3.8MB

Download
memory/208-883-0x0000000000400000-0x00000000007CB000-memory.dmp

Filesize
3.8MB

Download
memory/208-28-0x0000000000400000-0x00000000007CB000-memory.dmp

Filesize
3.8MB

Download
memory/208-3313-0x0000000000400000-0x00000000007CB000-memory.dmp

Filesize
3.8MB

Download
memory/208-12-0x0000000000400000-0x00000000007CB000-memory.dmp

Filesize
3.8MB

Download
memory/208-4763-0x0000000000400000-0x00000000007CB000-memory.dmp

Filesize
3.8MB

Download
memory/208-5028-0x0000000000400000-0x00000000007CB000-memory.dmp

Filesize
3.8MB

Download
memory/208-2128-0x0000000000400000-0x00000000007CB000-memory.dmp

Filesize
3.8MB

Download
memory/2524-5052-0x0000000006410000-0x00000000064A3000-memory.dmp

Filesize
588KB

Download
memory/2524-5045-0x0000000004670000-0x00000000046EB000-memory.dmp

Filesize
492KB

Download
memory/2524-5018-0x0000000001AE0000-0x0000000001CEC000-memory.dmp

Filesize
2.0MB

Download
memory/2524-5020-0x0000000001A30000-0x0000000001A62000-memory.dmp

Filesize
200KB

Download
memory/2524-5030-0x0000000003E50000-0x00000000042F0000-memory.dmp

Filesize
4.6MB

Download
memory/2524-5035-0x00000000042F0000-0x000000000466A000-memory.dmp

Filesize
3.5MB

Download
memory/2524-5033-0x0000000003A80000-0x0000000003E4B000-memory.dmp

Filesize
3.8MB

Download
memory/2524-5049-0x0000000006090000-0x0000000006133000-memory.dmp

Filesize
652KB

Download
memory/2524-5050-0x0000000006190000-0x00000000061DA000-memory.dmp

Filesize
296KB

Download
memory/2524-5054-0x0000000006710000-0x00000000067DF000-memory.dmp

Filesize
828KB

Download
memory/2524-5057-0x0000000006210000-0x000000000622F000-memory.dmp

Filesize
124KB

Download
memory/2524-5055-0x0000000006040000-0x0000000006075000-memory.dmp

Filesize
212KB

Download
memory/2524-5047-0x0000000006610000-0x0000000006702000-memory.dmp

Filesize
968KB

Download
memory/2524-5027-0x0000000001CF0000-0x0000000003A78000-memory.dmp

Filesize
29.5MB

Download
memory/2736-5016-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/2736-5031-0x0000000002980000-0x00000000029A2000-memory.dmp

Filesize
136KB

Download
memory/2736-5023-0x00000000028C0000-0x0000000002976000-memory.dmp

Filesize
728KB

Download