194bbbe678f8f36fd11a7fe6053c8dfc8f4d304cc5c7097c03ff6ca301d052a9

Resubmissions

12-10-2024 06:10

241012-gxb6qaxekf 7

12-10-2024 06:05

241012-gtlkzs1hpk 7

12-10-2024 06:01

241012-gqwlsa1gnr 7

Analysis

max time kernel
122s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2024 06:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Lossless-Scaling-SteamRIP.com[1].rar
Size

44.4MB
MD5

d385a7c53e65b104d6619f14ff0b020c
SHA1

3274c0758ef45de6cd70eefd5a418e6780cd20d2
SHA256

194bbbe678f8f36fd11a7fe6053c8dfc8f4d304cc5c7097c03ff6ca301d052a9
SHA512

ebbc735a30c340d7e72b8fc0d2424d394eee84ba0f9324860210161f498c1956c71943c22324e4df62d59097893d71d62d3aa774130802e85832478f309b386e
SSDEEP

786432:4/pSQ2FZqm6cmyzKLkEzwHj8JrMSvddgDJulQCBX157WNxlSLG7aNwbdwO4pfPzs:4UjZqYmtJUD8JoSMJoNv7WQLQSwbqhI

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 9 IoCs

pid	Process
1076	LosslessScaling.exe
3472	LosslessScaling.exe
3256	dotNetFx40_Full_setup.exe
2508	Setup.exe
4620	vcredist_x86.exe
3152	Setup.exe
948	LosslessScaling.exe
4292	LosslessScaling.exe
4852	LosslessScaling.exe

Loads dropped DLL 11 IoCs

pid	Process
2508	Setup.exe
2508	Setup.exe
2508	Setup.exe
2508	Setup.exe
2508	Setup.exe
3152	Setup.exe
3152	Setup.exe
3152	Setup.exe
3152	Setup.exe
3152	Setup.exe
4852	LosslessScaling.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dotNetFx40_Full_setup.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Setup.exe

Modifies Control Panel 5 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\Colors	LosslessScaling.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\Colors	LosslessScaling.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\Colors	LosslessScaling.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\Colors	LosslessScaling.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\Colors	LosslessScaling.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	7zFM.exe

Runs .reg file with regedit 2 IoCs

pid	Process
2120	regedit.exe
3200	regedit.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
3456	7zFM.exe
3456	7zFM.exe
3456	7zFM.exe
3456	7zFM.exe
3456	7zFM.exe
3456	7zFM.exe
2508	Setup.exe
2508	Setup.exe
2508	Setup.exe
2508	Setup.exe
2508	Setup.exe
2508	Setup.exe
2508	Setup.exe
2508	Setup.exe
3456	7zFM.exe
3456	7zFM.exe
3152	Setup.exe
3152	Setup.exe
3152	Setup.exe
3152	Setup.exe
3152	Setup.exe
3152	Setup.exe
3152	Setup.exe
3152	Setup.exe
3456	7zFM.exe
3456	7zFM.exe
3456	7zFM.exe
3456	7zFM.exe
3456	7zFM.exe
3456	7zFM.exe
4852	LosslessScaling.exe
4852	LosslessScaling.exe
4852	LosslessScaling.exe
4852	LosslessScaling.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3456	7zFM.exe
4852	LosslessScaling.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeRestorePrivilege	3456	7zFM.exe
Token: 35	3456	7zFM.exe
Token: SeSecurityPrivilege	3456	7zFM.exe
Token: SeSecurityPrivilege	3456	7zFM.exe
Token: SeSecurityPrivilege	3456	7zFM.exe
Token: SeSecurityPrivilege	3456	7zFM.exe
Token: SeSecurityPrivilege	3456	7zFM.exe
Token: SeSecurityPrivilege	3456	7zFM.exe
Token: SeSecurityPrivilege	3456	7zFM.exe
Token: SeSecurityPrivilege	3456	7zFM.exe
Token: SeDebugPrivilege	4852	LosslessScaling.exe
Token: SeIncBasePriorityPrivilege	4852	LosslessScaling.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
3456	7zFM.exe
3456	7zFM.exe
3456	7zFM.exe
3456	7zFM.exe
3456	7zFM.exe
3456	7zFM.exe
3456	7zFM.exe
3456	7zFM.exe
3456	7zFM.exe
3456	7zFM.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3256	dotNetFx40_Full_setup.exe
4620	vcredist_x86.exe
3152	Setup.exe
4852	LosslessScaling.exe
4852	LosslessScaling.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 3456 wrote to memory of 1076	3456	7zFM.exe	88
PID 3456 wrote to memory of 1076	3456	7zFM.exe	88
PID 3456 wrote to memory of 2120	3456	7zFM.exe	95
PID 3456 wrote to memory of 2120	3456	7zFM.exe	95
PID 3456 wrote to memory of 3472	3456	7zFM.exe	96
PID 3456 wrote to memory of 3472	3456	7zFM.exe	96
PID 3456 wrote to memory of 3256	3456	7zFM.exe	102
PID 3456 wrote to memory of 3256	3456	7zFM.exe	102
PID 3456 wrote to memory of 3256	3456	7zFM.exe	102
PID 3256 wrote to memory of 2508	3256	dotNetFx40_Full_setup.exe	103
PID 3256 wrote to memory of 2508	3256	dotNetFx40_Full_setup.exe	103
PID 3256 wrote to memory of 2508	3256	dotNetFx40_Full_setup.exe	103
PID 3456 wrote to memory of 4620	3456	7zFM.exe	104
PID 3456 wrote to memory of 4620	3456	7zFM.exe	104
PID 3456 wrote to memory of 4620	3456	7zFM.exe	104
PID 4620 wrote to memory of 3152	4620	vcredist_x86.exe	105
PID 4620 wrote to memory of 3152	4620	vcredist_x86.exe	105
PID 4620 wrote to memory of 3152	4620	vcredist_x86.exe	105
PID 3456 wrote to memory of 948	3456	7zFM.exe	106
PID 3456 wrote to memory of 948	3456	7zFM.exe	106
PID 3456 wrote to memory of 4292	3456	7zFM.exe	109
PID 3456 wrote to memory of 4292	3456	7zFM.exe	109

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Lossless-Scaling-SteamRIP.com[1].rar"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3456
- C:\Users\Admin\AppData\Local\Temp\7zO08D590F7\LosslessScaling.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO08D590F7\LosslessScaling.exe"
  2⤵
  - Executes dropped EXE
  - Modifies Control Panel
  PID:1076
- C:\Windows\regedit.exe
  "regedit.exe" "C:\Users\Admin\AppData\Local\Temp\7zO08D36A08\_Lossless Scaling - Registry Fix.reg"
  2⤵
  - Runs .reg file with regedit
  PID:2120
- C:\Users\Admin\AppData\Local\Temp\7zO08DC0F18\LosslessScaling.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO08DC0F18\LosslessScaling.exe"
  2⤵
  - Executes dropped EXE
  - Modifies Control Panel
  PID:3472
- C:\Users\Admin\AppData\Local\Temp\7zO08D95F38\dotNetFx40_Full_setup.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO08D95F38\dotNetFx40_Full_setup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3256
- - C:\8edfa76f2f94aeffa72fcad3e77c86\Setup.exe
    C:\8edfa76f2f94aeffa72fcad3e77c86\\Setup.exe /x86 /x64 /ia64 /web
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:2508
- C:\Users\Admin\AppData\Local\Temp\7zO08D66758\vcredist_x86.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO08D66758\vcredist_x86.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4620
- - \??\c:\10eff2192108e5cb36\Setup.exe
    c:\10eff2192108e5cb36\Setup.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:3152
- C:\Users\Admin\AppData\Local\Temp\7zO08D7EE78\LosslessScaling.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO08D7EE78\LosslessScaling.exe"
  2⤵
  - Executes dropped EXE
  - Modifies Control Panel
  PID:948
- C:\Users\Admin\AppData\Local\Temp\7zO08D91988\LosslessScaling.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO08D91988\LosslessScaling.exe"
  2⤵
  - Executes dropped EXE
  - Modifies Control Panel
  PID:4292

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4956

C:\Windows\regedit.exe
"regedit.exe" "C:\Users\Admin\Desktop\Lossless Scaling\_Lossless Scaling - Registry Fix.reg"
1⤵
- Runs .reg file with regedit
PID:3200

C:\Users\Admin\Desktop\Lossless Scaling\LosslessScaling.exe
"C:\Users\Admin\Desktop\Lossless Scaling\LosslessScaling.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\10eff2192108e5cb36\1028\SetupResources.dll

Filesize
13KB

MD5
7c136b92983cec25f85336056e45f3e8

SHA1
0bb527e7004601e920e2aac467518126e5352618

SHA256
f2e8ca58fa8d8e694d04e14404dec4e8ea5f231d3f2e5c2f915bd7914849eb2b

SHA512
06da50ddb2c5f83e6e4b4313cbdae14eed227eec85f94024a185c2d7f535b6a68e79337557727b2b40a39739c66d526968aaedbcfef04dab09dc0426cfbefbf4

Download Submit
C:\8edfa76f2f94aeffa72fcad3e77c86\1025\LocalizedData.xml

Filesize
72KB

MD5
c5bf74c96a711b3f7004ca6bddecc491

SHA1
4c4d42ff69455f267ce98f1db8f2c5d76a1046da

SHA256
6b67c8a77c1a637b72736595afdf77bdb3910aa9fe48d959775806a0683ffa66

SHA512
2f2071bf9966bffe64c90263f4b9bd5efcac4f976c4e42fbdeaa5d6a6dee51c33f4902cf5e3d0897e1c841e9182e25c86d42e392887bc3ce3d9ed3d780d96ac9

Download Submit
C:\8edfa76f2f94aeffa72fcad3e77c86\1028\LocalizedData.xml

Filesize
59KB

MD5
967a6d769d849c5ed66d6f46b0b9c5a4

SHA1
c0ff5f094928b2fa8b61e97639c42782e95cc74f

SHA256
0bc010947bff6ec1ce9899623ccfdffd702eee6d2976f28d9e06cc98a79cf542

SHA512
219b13f1beeb7d690af9d9c7d98904494c878fbe9904f8cb7501b9bb4f48762f9d07c3440efa0546600ff62636ac34cb4b32e270cf90cb47a9e08f9cb473030c

Download Submit
C:\8edfa76f2f94aeffa72fcad3e77c86\1029\LocalizedData.xml

Filesize
79KB

MD5
0b6ed582eb557573e959e37ebe2fca6a

SHA1
82c19c7eafb28593f453341eca225873fb011d4c

SHA256
8a0da440261940ed89bad7cd65bbc941cc56001d9aa94515e346d57b7b0838fc

SHA512
aba3d19f408bd74f010ec49b31a2658e0884661d2efda7d999558c90a4589b500570cc80410ba1c323853ca960e7844845729fff708e3a52ea25f597fad90759

Download Submit
C:\8edfa76f2f94aeffa72fcad3e77c86\1030\LocalizedData.xml

Filesize
75KB

MD5
69925e463a6fedce8c8e1b68404502fb

SHA1
76341e490a432a636ed721f0c964fd9026773dd7

SHA256
5f370d2ccdd5fa316bce095bf22670123c09de175b7801d0a77cdb68174ac6b7

SHA512
5f61abec49e1f9cc44c26b83aa5b32c217ebeba63ed90d25836f51f810c59f71ec7430dc5338efba9be720f800204891e5ab9a5f5ec1ff51ef46c629482e5220

Download Submit
C:\8edfa76f2f94aeffa72fcad3e77c86\1031\LocalizedData.xml

Filesize
80KB

MD5
8505219c0a8d950ff07dc699d8208309

SHA1
7a557356c57f1fa6d689ea4c411e727438ac46df

SHA256
c48986cdb7fe3401234e0a6540eb394c1201846b5beb1f12f83dc6e14674873a

SHA512
7bcdad0cb4b478068434f4ebd554474b69562dc83df9a423b54c1701ca3b43c3b92de09ee195a86c0d244aa5ef96c77b1a08e73f1f2918c8ac7019f8df27b419

Download Submit
C:\8edfa76f2f94aeffa72fcad3e77c86\1032\LocalizedData.xml

Filesize
84KB

MD5
3bf8da35b14fbcc564e03f6342bb71f2

SHA1
8f9139f0bb813bf95f8c437548738d32848d8940

SHA256
39efe12c689edfea041613b0e4d6ec78afec8fe38a0e4adc656591ffef8f415d

SHA512
31b050647ba4bd0c2762d77307e1ed2a324e9b152c06ed496b86ea063cdc18bf2bb1f08d2e9b4af3429a2bc333d7891338d7535487c83495304a5f78776dbc03

Download Submit
C:\8edfa76f2f94aeffa72fcad3e77c86\1033\LocalizedData.xml

Filesize
75KB

MD5
326518603d85acd79a6258886fc85456

SHA1
f1cef14bc4671a132225d22a1385936ad9505348

SHA256
665797c7840b86379019e5a46227f888fa1a36a593ea41f9170ef018c337b577

SHA512
f8a514efd70e81d0f2f983282d69040bca6e42f29aa5df554e6874922a61f112e311ad5d2b719b6ca90012f69965447fb91e8cd4103efb2453ff160a9062e5d3

Download Submit
C:\8edfa76f2f94aeffa72fcad3e77c86\1033\SetupResources.dll

Filesize
16KB

MD5
9547d24ac04b4d0d1dbf84f74f54faf7

SHA1
71af6001c931c3de7c98ddc337d89ab133fe48bb

SHA256
36d0159ed1a7d88000737e920375868765c0a1dd6f5a5acbb79cf7d97d9e7a34

SHA512
8b6048f4185a711567679e2de4789407077ce5bfe72102d3cb1f23051b8d3e6bfd5886c801d85b4e62f467dd12da1c79026a4bc20b17f54c693b2f24e499d40f

Download Submit
C:\8edfa76f2f94aeffa72fcad3e77c86\1035\LocalizedData.xml

Filesize
75KB

MD5
1aa252256c895b806e4e55f3ea8d5ffb

SHA1
0322ee94c3d5ea26418a2fea3f7e62ec5d04b81d

SHA256
8a68b3b6522c30502202ecb8d16ae160856947254461ac845b39451a3f2db35f

SHA512
ce57784892c0be55a00ced0adc594a534d8a40819790ca483a29b6cd544c7a75ae4e9bde9b6dc6de489ceceb7883b7c2ea0e98a38fcc96d511157d61c8aa3e63

Download Submit
C:\8edfa76f2f94aeffa72fcad3e77c86\1036\LocalizedData.xml

Filesize
81KB

MD5
1dad88faed661db34eef535d36563ee2

SHA1
0525b2f97eddbd26325fddc561bf8a0cda3b0497

SHA256
9605468d426bcbbe00165339d84804e5eb2547bfe437d640320b7bfef0b399b6

SHA512
ccd0bffbf0538152cccd4b081c15079716a5ff9ad04cee8679b7f721441f89eb7c6f8004cff7e1dde9188f5201f573000d0c078474edf124cfa4c619e692d6bc

Download Submit
C:\8edfa76f2f94aeffa72fcad3e77c86\1037\LocalizedData.xml

Filesize
70KB

MD5
16e6416756c1829238ef1814ebf48ad6

SHA1
c9236906317b3d806f419b7a98598dd21e27ad64

SHA256
c0ee256567ea26bbd646f019a1d12f3eced20b992718976514afa757adf15dea

SHA512
aa595ed0b3b1db280f94b29fa0cb9db25441a1ef54355abf760b6b837e8ce8e035537738e666d27dd2a8d295d7517c325a5684e16304887ccb17313ca4290ce6

Download Submit
C:\8edfa76f2f94aeffa72fcad3e77c86\1038\LocalizedData.xml

Filesize
84KB

MD5
89d4356e0f226e75ca71d48690e8ec15

SHA1
2336caa971527977f47512bc74e88cec3f770c7d

SHA256
fcbb619deb2d57b791a78954b0342dbb2fef7ddd711066a0786c8ef669d2b385

SHA512
fa03d55a4aafe94cbf5c134a65bd809fc86c042bc1b8ffbc9a2a5412eb70a468551c05c44b6ce81f638df43cca599aa1dd6f42f2df3012c8a95a3612df7c821e

Download Submit
C:\8edfa76f2f94aeffa72fcad3e77c86\1040\LocalizedData.xml

Filesize
78KB

MD5
eda1ec689d45c7faa97da4171b1b7493

SHA1
807fe12689c232ebd8364f48744c82ca278ea9e6

SHA256
80faa30a7592e8278533d3380dcb212e748c190aaeef62136897e09671059b36

SHA512
8385a5de4eb6b38169dd1eb03926bc6d4604545801f13d99cee3acede3d34ec9f9d96b828a23ae6246809dc666e67f77a163979679956297533da40f9365bf2c

Download Submit
C:\8edfa76f2f94aeffa72fcad3e77c86\1041\LocalizedData.xml

Filesize
66KB

MD5
64ffa6ff8866a15aff326f11a892bead

SHA1
378201477564507a481ba06ea1bc0620b6254900

SHA256
7570390094c0a199f37b8f83758d09dd2cecd147132c724a810f9330499e0cbf

SHA512
ea5856617b82d13c9a312cb4f10673dbc4b42d9ac5703ad871e8bdfcc6549e262e61288737ab8ebcf77219d24c0822e7dacf043d1f2d94a97c9b7ec0a5917ef2

Download Submit
C:\8edfa76f2f94aeffa72fcad3e77c86\1042\LocalizedData.xml

Filesize
63KB

MD5
78c16da54542c9ed8fa32fed3efaf10d

SHA1
ad8cfe972c8a418c54230d886e549e00c7e16c40

SHA256
e3e3a2288ff840ab0e7c5e8f7b4cfb1f26e597fb17cfc581b7728116bd739ed1

SHA512
d9d7bb82a1d752a424bf81be3d86abea484acbb63d35c90a8ee628e14cf34a7e8a02f37d2ea82aa2ce2c9aa4e8416a7a6232c632b7655f2033c4aaab208c60bf

Download Submit
C:\8edfa76f2f94aeffa72fcad3e77c86\1043\LocalizedData.xml

Filesize
77KB

MD5
6506b4e64ebf6121997fa227e762589f

SHA1
71bc1478c012d9ec57fc56a5266dd325b7801221

SHA256
415112ae783a87427c2fadd7b010ade4f1a7c23b27e4b714b7b507c16b572a1c

SHA512
39024ea9d42352f7c1bd6fefe0574054eceb4059f773cfaeb26c42faada2540ae95fb34718d30ccb6da157d2597f80d12a024461fbd0e8d510431ba6ffa81ec2

Download Submit
C:\8edfa76f2f94aeffa72fcad3e77c86\1044\LocalizedData.xml

Filesize
77KB

MD5
120104fa24709c2a9d8efc84ff0786cd

SHA1
b513fa545efae045864d8527a5ec6b6cebe31bb9

SHA256
516525636b91c16a70aef8d6f6b424dc1ee7f747b8508b396ee88131b2bb0947

SHA512
1ea8eb2be9d5f4ef6f1f2c0d90cb228a9bb58d7143ccafe77e18ce52ec4aca25dde0ba18430fd4d3d7962d079ccbe7e2552b2c7090361e03c6fdfb7c2b9c7325

Download Submit
C:\8edfa76f2f94aeffa72fcad3e77c86\1045\LocalizedData.xml

Filesize
80KB

MD5
bdb583c7a48f811be3b0f01fcea40470

SHA1
e8453946a6b926e4f4ae5b02ba1d648daf23e133

SHA256
611b7b7352188adffd6380b9c8a85b8ff97c09a1c293bb7ac0ef5478a0e18ac8

SHA512
27b02226f8f86ca4d00789317c79e8ca0089f5b910bed14aa664eeab6be66e98de3bafd7670c895d70ab9c34ece5f05199f3556fddc1b165904e3432a51c008d

Download Submit
C:\8edfa76f2f94aeffa72fcad3e77c86\1046\LocalizedData.xml

Filesize
78KB

MD5
a03d2063d388fc7a1b4c36d85efa5a1a

SHA1
88bd5e2ff285ee421ccc523f7582e05a8c3323f8

SHA256
61d8339e89a9e48f8ae2d929900582bb8373f08d553ec72d5e38a0840b47c8a3

SHA512
3a219f36e57d90ca92e9faec4dfd34841c2c9244da4fe7e1d70608dde7857aa36325bdb46652a42922919f782bb7c97f567e69a9fc51942722b8fd66cd4ecaf0

Download Submit
C:\8edfa76f2f94aeffa72fcad3e77c86\1049\LocalizedData.xml

Filesize
79KB

MD5
349b52a81342a7afb8842459e537ecc6

SHA1
6268343e82fbbabe7618bd873335a8f9f84ed64d

SHA256
992bf5aeb06aa3701d50c23fa475b4b86d8997383c9f0e3425663cfbd6b8a2a5

SHA512
ef4cbd3f7f572a9f146a524cfbc2efbd084e6c70a65b96a42339adc088e3f0524bc202548340969481e7f3df3ac517ac34b200b56a3b9957802abd0efa951c49

Download Submit
C:\8edfa76f2f94aeffa72fcad3e77c86\1053\LocalizedData.xml

Filesize
75KB

MD5
b3b1a89458bec6af82c5386d26639b59

SHA1
d9320b8cc862f40c65668a40670081079b63cea1

SHA256
1ef312e8be9207466fbfdecee92bfc6c6b7e2da61979b0908eaf575464e7b7a0

SHA512
478ce08619490ed1ecdd8751b5f60da1ee4ac0d08d9a97468c3f595ac4376feca59e9c72dd9c83b00c8d78b298be757c6f24a422b7be8c041f780524844998bf

Download Submit
C:\8edfa76f2f94aeffa72fcad3e77c86\1055\LocalizedData.xml

Filesize
75KB

MD5
65e771fed28b924942a10452bbbf5c42

SHA1
586921b92d5fb297f35effc2216342dac1ae2355

SHA256
45e30569a756d9bcbc5f9dae78bda02751fd25e1c0aee471ce112cb4464a6ee2

SHA512
d014a2a96f3a5c487ef1caddd69599dbec15da5ad689d68009f1ca4d5cb694105a7903f508476d6ffec9d81386cb184df6fc428d34f056190cee30715514a8f7

Download Submit
C:\8edfa76f2f94aeffa72fcad3e77c86\2052\LocalizedData.xml

Filesize
59KB

MD5
10da125eeabcbb45e0a272688b0e2151

SHA1
6c4124ec8ca2d03b5187ba567c922b6c3e5efc93

SHA256
1842f22c6fd4caf6ad217e331b74c6240b19991a82a1a030a6e57b1b8e9fd1ec

SHA512
d968abd74206a280f74bf6947757cca8dd9091b343203e5c2269af2e008d3bb0a17ff600eb961dbf69a93de4960133ade8d606fb9a99402d33b8889f2d0da710

Download Submit
C:\8edfa76f2f94aeffa72fcad3e77c86\2070\LocalizedData.xml

Filesize
78KB

MD5
7fa9926a4bc678e32e5d676c39f8fb97

SHA1
bba4311dd30261a9b625046f8a6ea215516c9213

SHA256
a25ee75c78c24c50440ad7de9929c6a6e1cc0629009dc0d01b90cbac177dd404

SHA512
e06423bc1ea50a566d341dc513828608e9b6611fea81d33fca471a38f6b2b61b556ea07a5dec0830f3e87194975d87f267a5e5e1a2be5e6a86b07c5bb2bddcb6

Download Submit
C:\8edfa76f2f94aeffa72fcad3e77c86\3082\LocalizedData.xml

Filesize
78KB

MD5
2d54fe70376db0218e8970b28c1c4518

SHA1
83ee9ac93142751f23d5bb858f7264e27ea2eab0

SHA256
d17c5b638e2a4d43212d21a2052548c8d4909eb6410e30b8a951a292bcdbbedd

SHA512
20c0fb9a046911bc2d702ab321c3992262ac0f80f33ddda5ec2ccafe9ef07611774223369e0dc7cb91c9cda1cbd65c598a7e1c914d6e6ca4b00205a16411be30

Download Submit
C:\8edfa76f2f94aeffa72fcad3e77c86\DHTMLHeader.html

Filesize
15KB

MD5
cd131d41791a543cc6f6ed1ea5bd257c

SHA1
f42a2708a0b42a13530d26515274d1fcdbfe8490

SHA256
e139af8858fe90127095ac1c4685bcd849437ef0df7c416033554703f5d864bb

SHA512
a6ee9af8f8c2c7acd58dd3c42b8d70c55202b382ffc5a93772af7bf7d7740c1162bb6d38a4307b1802294a18eb52032d410e128072af7d4f9d54f415be020c9a

Download Submit
C:\8edfa76f2f94aeffa72fcad3e77c86\ParameterInfo.xml

Filesize
265KB

MD5
7213da83e0f0b8ae4fea44ae1cb7f62b

SHA1
f2e3fcc77a1ad4d042253bd2e0010bcb40b68ed3

SHA256
59e67e4fb46e5490eee63d8b725324f1372720ade7345c74c6138c4a76ea73d9

SHA512
86186ab0f2cb38e520dd1284042eced157f96874846eb9061be9cf56b84a1cab5901a4879e105a8b04b336bbc43b03f4bdf198d43af868be188602347db829e0

Download Submit
C:\8edfa76f2f94aeffa72fcad3e77c86\Setup.exe

Filesize
76KB

MD5
006f8a615020a4a17f5e63801485df46

SHA1
78c82a80ebf9c8bf0c996dd8bc26087679f77fea

SHA256
d273460aa4d42f0b5764383e2ab852ab9af6fecb3ed866f1783869f2f155d8be

SHA512
c603ed6f3611eb7049a43a190ed223445a9f7bd5651100a825917198b50c70011e950fa968d3019439afa0a416752517b1c181ee9445e02da3904f4e4b73ce76

Download Submit
C:\8edfa76f2f94aeffa72fcad3e77c86\SetupEngine.dll

Filesize
788KB

MD5
84c1daf5f30ff99895ecab3a55354bcf

SHA1
7e25ba36bcc7deed89f3c9568016ddb3156c9c5a

SHA256
7a0d281fa802d615ea1207bd2e9ebb98f3b74f9833bba3cb964ba7c7e0fb67fd

SHA512
e4fb7e4d39f094463fdcdc4895ab2ea500eb51a32b6909cec80a526bbf34d5c0eb98f47ee256c0f0865bf3169374937f047bf5c4d6762779c8ca3332b4103be3

Download Submit
C:\8edfa76f2f94aeffa72fcad3e77c86\SetupUi.dll

Filesize
288KB

MD5
eb881e3dddc84b20bd92abcec444455f

SHA1
e2c32b1c86d4f70e39de65e9ebc4f361b24ff4a1

SHA256
11565d97287c01d22ad2e46c78d8a822fa3e6524561d4c02dfc87e8d346c44e7

SHA512
5750cec73b36a3f19bfb055f880f3b6498a7ae589017333f6272d26f1c72c6f475a3308826268a098372bbb096b43fbd1e06e93eecc0a81046668228bc179a75

Download Submit
C:\8edfa76f2f94aeffa72fcad3e77c86\SetupUi.xsd

Filesize
29KB

MD5
2fadd9e618eff8175f2a6e8b95c0cacc

SHA1
9ab1710a217d15b192188b19467932d947b0a4f8

SHA256
222211e8f512edf97d78bc93e1f271c922d5e91fa899e092b4a096776a704093

SHA512
a3a934a8572ff9208d38cf381649bd83de227c44b735489fd2a9dc5a636ead9bb62459c9460ee53f61f0587a494877cd3a3c2611997be563f3137f8236ffc4ca

Download Submit
C:\8edfa76f2f94aeffa72fcad3e77c86\SplashScreen.bmp

Filesize
40KB

MD5
0966fcd5a4ab0ddf71f46c01eff3cdd5

SHA1
8f4554f079edad23bcd1096e6501a61cf1f8ec34

SHA256
31c13ecfc0eb27f34036fb65cc0e735cd444eec75376eea2642f926ac162dcb3

SHA512
a9e70a2fb5a9899acf086474d71d0e180e2234c40e68bcadb9bf4fe145774680cb55584b39fe53cc75de445c6bf5741fc9b15b18385cbbe20fc595fe0ff86fce

Download Submit
C:\8edfa76f2f94aeffa72fcad3e77c86\Strings.xml

Filesize
13KB

MD5
8a28b474f4849bee7354ba4c74087cea

SHA1
c17514dfc33dd14f57ff8660eb7b75af9b2b37b0

SHA256
2a7a44fb25476886617a1ec294a20a37552fd0824907f5284fade3e496ed609b

SHA512
a7927700d8050623bc5c761b215a97534c2c260fcab68469b7a61c85e2dff22ed9cf57e7cb5a6c8886422abe7ac89b5c71e569741db74daa2dcb4152f14c2369

Download Submit
C:\8edfa76f2f94aeffa72fcad3e77c86\UiInfo.xml

Filesize
37KB

MD5
8b8b0a935dc591799a0c6d52fdc33460

SHA1
ce2748bd469aad6e90b06d98531084d00611fb89

SHA256
57a9ccb84cae42e0d8d1a29cfe170ac3f27bdcae829d979cddfd5e757519b159

SHA512
93009b3045939b65a0c1d25e30a07a772bd73dda518529462f9ce1227a311a4d6fd7595f10b4255cc0b352e09c02026e89300a641492f14df908ad256a3c9d76

Download Submit
C:\8edfa76f2f94aeffa72fcad3e77c86\graphics\print.ico

Filesize
1KB

MD5
7e55ddc6d611176e697d01c90a1212cf

SHA1
e2620da05b8e4e2360da579a7be32c1b225deb1b

SHA256
ff542e32330b123486797b410621e19eafb39df3997e14701afa4c22096520ed

SHA512
283d381aa396820b7e15768b20099d67688da1f6315ec9f7938c2fcc3167777502cded0d1beddf015a34cc4e5d045bcb665ffd28ba2fbb6faf50fdd38b31d16e

Download Submit
C:\8edfa76f2f94aeffa72fcad3e77c86\graphics\save.ico

Filesize
1KB

MD5
7d62e82d960a938c98da02b1d5201bd5

SHA1
194e96b0440bf8631887e5e9d3cc485f8e90fbf5

SHA256
ae041c8764f56fd89277b34982145d16fc59a4754d261c861b19371c3271c6e5

SHA512
ab06b2605f0c1f6b71ef69563c0c977d06c6ea84d58ef7f2baecba566d6037d1458c2b58e6bfd70ddef47dccbdea6d9c2f2e46dea67ea9e92457f754d7042f67

Download Submit
C:\8edfa76f2f94aeffa72fcad3e77c86\graphics\setup.ico

Filesize
35KB

MD5
3d25d679e0ff0b8c94273dcd8b07049d

SHA1
a517fc5e96bc68a02a44093673ee7e076ad57308

SHA256
288e9ad8f0201e45bc187839f15aca79d6b9f76a7d3c9274c80f5d4a4c219c0f

SHA512
3bde668004ca7e28390862d0ae9903c756c16255bdbb3f7e73a5b093ce6a57a3165d6797b0a643b254493149231aca7f7f03e0af15a0cbe28aff02f0071ec255

Download Submit
C:\8edfa76f2f94aeffa72fcad3e77c86\graphics\warn.ico

Filesize
9KB

MD5
b2b1d79591fca103959806a4bf27d036

SHA1
481fd13a0b58299c41b3e705cb085c533038caf5

SHA256
fe4d06c318701bf0842d4b87d1bad284c553baf7a40987a7451338099d840a11

SHA512
5fe232415a39e0055abb5250b120ccdcd565ab102aa602a3083d4a4705ac6775d45e1ef0c2b787b3252232e9d4673fc3a77aab19ec79a3ff8b13c4d7094530d2

Download Submit
C:\8edfa76f2f94aeffa72fcad3e77c86\sqmapi.dll

Filesize
141KB

MD5
3f0363b40376047eff6a9b97d633b750

SHA1
4eaf6650eca5ce931ee771181b04263c536a948b

SHA256
bd6395a58f55a8b1f4063e813ce7438f695b9b086bb965d8ac44e7a97d35a93c

SHA512
537be86e2f171e0b2b9f462ac7f62c4342beb5d00b68451228f28677d26a525014758672466ad15ed1fd073be38142dae478df67718908eae9e6266359e1f9e8

Download Submit
C:\Users\Admin\AppData\Local\Lossless Scaling\Settings.xml

Filesize
2KB

MD5
ace795bd58a45d23bac1c6e60ec23df3

SHA1
88a78c643a5b10fc175886cc9cb12f45ef501492

SHA256
c34328175332f4cab70206ba70faf4dbc483d6b0d38f7f6af7d6dba3da9242b0

SHA512
11cde86b8ada81857036ebbd22cf6025a90f12d6048033fa43ffbb8fb30d0f6892a853c6521ee3719f031ba9b3906e374b86cd40568c536d1c2bf60027ef4985

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO08D36A08\_Lossless Scaling - Registry Fix.reg

Filesize
120B

MD5
a95106d7c9fc3fb18a2fbe1885de09dd

SHA1
3debdeee76208de099b80eff33949371f02bf575

SHA256
61df13bae98f10c330a751875146dd81bca223036d6470ebb9fffdc0b47f0fe2

SHA512
d81d70466f4ff81111d2a9d0a63cc7371d75568b1a1c5fe0aef638742cef30c92cddc20b22683d3fb32331d328dba57005a3698569e9edb10d1fc63ff29718b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO08D590F7\LosslessScaling.exe

Filesize
964KB

MD5
9cfb9984a53f41ebdf00f8f0633fde26

SHA1
a13985c15c6402d25c9e9c64f4e9947fd685635f

SHA256
4b07ba9c32b61773cfb0e2d7b13689c26a13a6dc463b9294aeb1d5e8e4159e8d

SHA512
2a768a77151353e693fb15abc4f72842c002043dece1920e8bddef04c2d620c7345650d369ccab463a72a55939ad7b3bf8fc8e9c3a6f55d8e7ab76ad331b5eea

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO08D66758\vcredist_x86.exe

Filesize
4.8MB

MD5
b88228d5fef4b6dc019d69d4471f23ec

SHA1
372d9c1670343d3fb252209ba210d4dc4d67d358

SHA256
8162b2d665ca52884507ede19549e99939ce4ea4a638c537fa653539819138c8

SHA512
cdd218d211a687dde519719553748f3fb36d4ac618670986a6dadb4c45b34a9c6262ba7bab243a242f91d867b041721f22330170a74d4d0b2c354aec999dbff8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO08D95F38\dotNetFx40_Full_setup.exe

Filesize
868KB

MD5
53406e9988306cbd4537677c5336aba4

SHA1
06becadb92a5fcca2529c0b93687c2a0c6d0d610

SHA256
fa1afff978325f8818ce3a559d67a58297d9154674de7fd8eb03656d93104425

SHA512
4f89da81b5a3800aa16ff33cc4a42dbb17d4c698a5e2983b88c32738decb57e3088a1da444ad0ec0d745c3c6b6b8b9b86d3f19909142f9e51f513748c0274a99

Download Submit
\??\c:\10eff2192108e5cb36\ParameterInfo.xml

Filesize
8KB

MD5
66590f13f4c9ba563a9180bdf25a5b80

SHA1
d6d9146faeec7824b8a09dd6978e5921cc151906

SHA256
bf787b8c697ce418f9d4c07260f56d1145ca70db1cc4b1321d37840837621e8f

SHA512
aba67c66c2f3d9b3c9d71d64511895f15f696be8be0eedd2d6908e1203c4b0cf318b366f9f3cd9c3b3b8c0770462f83e6eea73e304c43f88d0cbedf69e7c92b3

Download Submit
\??\c:\10eff2192108e5cb36\UiInfo.xml

Filesize
35KB

MD5
812f8d2e53f076366fa3a214bb4cf558

SHA1
35ae734cfb99bb139906b5f4e8efbf950762f6f0

SHA256
0d36a884a8381778bea71f5f9f0fc60cacadebd3f814679cb13414b8e7dbc283

SHA512
1dcc3ef8c390ca49fbcd50c02accd8cc5700db3594428e2129f79feb81e4cbbeef1b4a10628b2cd66edf31a69ed39ca2f4e252ad8aa13d2f793fca5b9a1eaf23

Download Submit
memory/1076-19-0x00007FF9DC170000-0x00007FF9DCC31000-memory.dmp

Filesize
10.8MB

Download
memory/1076-17-0x00000145075D0000-0x00000145075D8000-memory.dmp

Filesize
32KB

Download
memory/1076-14-0x0000014521820000-0x0000014521906000-memory.dmp

Filesize
920KB

Download
memory/1076-15-0x00007FF9DC170000-0x00007FF9DCC31000-memory.dmp

Filesize
10.8MB

Download
memory/1076-18-0x00000145075E0000-0x00000145075EA000-memory.dmp

Filesize
40KB

Download
memory/1076-16-0x0000014508F00000-0x0000014508F26000-memory.dmp

Filesize
152KB

Download
memory/1076-12-0x00007FF9DC173000-0x00007FF9DC175000-memory.dmp

Filesize
8KB

Download
memory/1076-13-0x0000014507080000-0x0000014507176000-memory.dmp

Filesize
984KB

Download
memory/3472-36-0x00000214CCA20000-0x00000214CCB06000-memory.dmp

Filesize
920KB

Download
memory/3472-37-0x00000214CC7C0000-0x00000214CC8DF000-memory.dmp

Filesize
1.1MB

Download
memory/4852-891-0x000001BBFDF70000-0x000001BBFE056000-memory.dmp

Filesize
920KB

Download
memory/4852-893-0x000001BBFEF90000-0x000001BBFF042000-memory.dmp

Filesize
712KB

Download
memory/4852-894-0x000001BBFF100000-0x000001BBFF1BA000-memory.dmp

Filesize
744KB

Download
memory/4852-895-0x000001BBFF040000-0x000001BBFF078000-memory.dmp

Filesize
224KB

Download
memory/4852-896-0x000001BBFFBF0000-0x000001BBFFBF8000-memory.dmp

Filesize
32KB

Download
memory/4852-898-0x000001BBFFC00000-0x000001BBFFC0E000-memory.dmp

Filesize
56KB

Download