f61552e389a1c68cab6f2ab357c99675819fc9ebdb0c490e1f78e33cf8da3cf8

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 01:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1.CineDream.msi
Size 254.7MB
Sample260811-be4v5aself
SHA256 f61552e389a1c68cab6f2ab357c99675819fc9ebdb0c490e1f78e33cf8da3cf8
MD5 954137cb9b78e493b98c59454e661b37
SHA1 2c2af8577f62d0a9c9f36eb28312dfbb95fae6a5
SHA512 43e75db70f0d15578de24695219062eabda1782bb6fe38e261c19b94de35d04b6d404ad88a6dafb4880981c87d5b94de5cf9c73b4afeb792bad48e8f948c17cf
SSDEEP 6291456:JViJ5TKVNzdsKYSYmDa1yf8IqZTjIIUa8R:nQ5mdLx8IoT9S
TLSH
T14DD83366BB8CC985E6D3163AC4C74F6A9CB66C10B71442679A79F81DCC323C83F62752
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution persistence privilege_escalation ransomware

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
4840	CDHelperService.exe
6012	CDHelperService.exe
1896	CDHelperService.exe
968	CDHelperService.exe
5168	CDHelperService.exe

Loads dropped DLL 62 IoCs

pid	Process
2312	MsiExec.exe
2312	MsiExec.exe
2312	MsiExec.exe
2312	MsiExec.exe
4168	MsiExec.exe
4168	MsiExec.exe
4840	CDHelperService.exe
4840	CDHelperService.exe
4840	CDHelperService.exe
4840	CDHelperService.exe
4840	CDHelperService.exe
4840	CDHelperService.exe
4840	CDHelperService.exe
4840	CDHelperService.exe
4840	CDHelperService.exe
4840	CDHelperService.exe
4840	CDHelperService.exe
4840	CDHelperService.exe
6012	CDHelperService.exe
6012	CDHelperService.exe
6012	CDHelperService.exe
6012	CDHelperService.exe
6012	CDHelperService.exe
6012	CDHelperService.exe
6012	CDHelperService.exe
6012	CDHelperService.exe
6012	CDHelperService.exe
6012	CDHelperService.exe
6012	CDHelperService.exe
1896	CDHelperService.exe
1896	CDHelperService.exe
1896	CDHelperService.exe
1896	CDHelperService.exe
1896	CDHelperService.exe
1896	CDHelperService.exe
1896	CDHelperService.exe
1896	CDHelperService.exe
1896	CDHelperService.exe
1896	CDHelperService.exe
1896	CDHelperService.exe
968	CDHelperService.exe
968	CDHelperService.exe
968	CDHelperService.exe
968	CDHelperService.exe
968	CDHelperService.exe
968	CDHelperService.exe
968	CDHelperService.exe
968	CDHelperService.exe
968	CDHelperService.exe
968	CDHelperService.exe
968	CDHelperService.exe
5168	CDHelperService.exe
5168	CDHelperService.exe
5168	CDHelperService.exe
5168	CDHelperService.exe
5168	CDHelperService.exe
5168	CDHelperService.exe
5168	CDHelperService.exe
5168	CDHelperService.exe
5168	CDHelperService.exe
5168	CDHelperService.exe
5168	CDHelperService.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\light\images\spinbox-indicator-up-icon-atlimit.png	msiexec.exe
File created	C:\Program Files\CineDream\DB\luts\internal\IDTs\AppleLog2.cube	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\MenuBar.qml	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\light\images\spinbox-indicator-up-background-up-hovered.png	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQuick\Controls\Fusion\qmldir	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQuick\Controls\Universal\MenuBarItem.qml	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQuick\Dialogs\quickimpl\qml\+Material\FolderDialogDelegate.qml	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQuick\Controls\Basic\SwipeDelegate.qml	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQuick\Controls\Basic\ToolSeparator.qml	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\dark\images\slider-groove-disabled.png	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\dark\images\spinbox-indicator-down-background-down-pressed.png	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\dark\images\spinbox-indicator-down-background.png	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\light\images\editablecombobox-background-hovered-open.png	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]	msiexec.exe
File created	C:\Program Files\CineDream\Qt6OpenGL.dll	msiexec.exe
File created	C:\Program Files\CineDream\DB\luts\grading\Moody Dark Tone\Moody Dark Punchy Blues HC.cube	msiexec.exe
File created	C:\Program Files\CineDream\qml\Qt\labs\qmlmodels\plugins.qmltypes	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\ToolSeparator.qml	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\dark\images\editablecombobox-background-hovered-open.png	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\icons\[email protected]	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\light\images\pageindicatordelegate-indicator.png	msiexec.exe
File created	C:\Program Files\CineDream\DB\luts\grading\Creative Looks\Buffalo 66 Dark V2.cube	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\dark\images\spinbox-background.png	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\light\images\progressbar-groove-disabled.png	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQuick\Controls\Fusion\plugins.qmltypes	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQuick\Controls\Imagine\Switch.qml	msiexec.exe
File created	C:\Program Files\CineDream\Qt6QmlWorkerScript.dll	msiexec.exe
File created	C:\Program Files\CineDream\Qt6QuickDialogs2QuickImpl.dll	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQuick\Controls\Basic\qtquickcontrols2basicstyleplugin.dll	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\dark\images\spinbox-background-disabled.png	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\light\images\checkbox-indicator-hovered.png	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\light\images\spinbox-indicator-up-background-hovered.png	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQuick\Controls\Material\ApplicationWindow.qml	msiexec.exe
File created	C:\Program Files\CineDream\qml\Qt\labs\platform\labsplatformplugin.dll	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQml\Models\qmldir	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\dark\images\checkbox-indicator-hovered-partiallyChecked.png	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\dark\images\spinbox-background-down-pressed.png	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\icons\[email protected]	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\light\images\checkbox-indicator-partiallyChecked-pressed.png	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\dark\images\itemdelegate-background-highlighted.png	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\dark\images\slider-groove.png	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\dark\images\spinbox-background-atlimit.png	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQuick\Controls\Imagine\DialogButtonBox.qml	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQuick\Controls\Universal\GroupBox.qml	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQuick\Dialogs\quickimpl\qml\FontDialog.qml	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQml\Models\modelsplugin.dll	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQuick\Controls\Imagine\TextArea.qml	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQuick\Controls\Material\Button.qml	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQuick\Controls\Universal\StackView.qml	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQuick\Controls\Universal\impl\qmldir	msiexec.exe
File created	C:\Program Files\CineDream\qml\QtQuick\Controls\Windows\images\[email protected]	msiexec.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e5a5787.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFEC7415EB468F8997.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{457C0CA2-E2FC-4800-95DC-EEB6D9DDDBA8}	msiexec.exe
File created	C:\Windows\Installer\e5a5789.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a5787.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBF40.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI783E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7D02.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8409.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBDB9.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF322628D92F380365.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7DEE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8504.tmp	msiexec.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1340	sc.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
268	msiexec.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5008	cmd.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000000f2192634d2a4d980000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838010f2192630000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841010f219263000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e30f21926300000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e60f21926300000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\CineDream.tif\shell\edit	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CineDream.tif\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.png\shell\CineDreamEdit	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.png\shell\CineDreamEdit\ = "Edit with CineDream"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CineDream.png\shell\edit\command	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CineDream.hevc\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.jpe\shell\CineDreamEdit\command\ = "\"C:\\Program Files\\CineDream\\CineDream.exe\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CineDream.jpe\shell\edit\MultiSelectModel = "Player"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CineDream.jpeg\shell\edit\command\ = "\"C:\\Program Files\\CineDream\\CineDream.exe\""	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CineDream.jpeg\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.jpg\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.png\shell\CineDreamEdit\MultiSelectModel = "Player"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.hevc	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2AC0C754CF2E008459CDEE6B9DDDBD8A\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CineDream.jpeg\shell\edit\MultiSelectModel = "Player"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CineDream.jpeg\ = "CineDream jpeg Image"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.jpeg\shell\CineDreamEdit\MultiSelectModel = "Player"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CineDream.jpeg	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CineDream.jpg\shell\open\command\ = "\"C:\\Program Files\\CineDream\\CineDream.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CineDream.hevc\shell\open\command\ = "\"C:\\Program Files\\CineDream\\CineDream.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\788CAD07C8FA24249B867FD0052B9AE3	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.jpe\OpenWithProgIds	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.jpeg\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CineDream.tiff\ = "CineDream tiff Image"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CineDream.tiff\shell\edit\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2AC0C754CF2E008459CDEE6B9DDDBD8A\PackageCode = "7B95626E10284B4468A6AAF3C30FC93A"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2AC0C754CF2E008459CDEE6B9DDDBD8A\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.jpe\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.jpg	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CineDream.tiff\shell\edit	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CineDream.png	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CineDream.png\shell\open\MultiSelectModel = "Player"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.hevc\shell\CineDreamEdit	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.hevc\shell\CineDreamEdit\ = "Edit with CineDream"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CineDream.hevc\shell\open\MultiSelectModel = "Player"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CineDream.jpe	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CineDream.jpe\shell\open\command\ = "\"C:\\Program Files\\CineDream\\CineDream.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CineDream.tif\ = "CineDream tif Image"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2AC0C754CF2E008459CDEE6B9DDDBD8A\Version = "16842760"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2AC0C754CF2E008459CDEE6B9DDDBD8A\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CineDream.jpe\ = "CineDream jpe Image"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CineDream.jpg\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CineDream.png\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CineDream.png\shell\open\command\ = "\"C:\\Program Files\\CineDream\\CineDream.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.hevc\OpenWithProgIds	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CineDream.jpe\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tif	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.tiff\shell\CineDreamEdit\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CineDream.hevc\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2AC0C754CF2E008459CDEE6B9DDDBD8A\ProductFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shell\cgc_editwithcd\command\ = "\"C:\\Program Files\\CineDream\\CineDream.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CineDream.tif	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tiff\shell\CineDreamEdit\command\ = "\"C:\\Program Files\\CineDream\\CineDream.exe\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tiff\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.jpeg\shell\CineDreamEdit\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tif\shell\CineDreamEdit\command\ = "\"C:\\Program Files\\CineDream\\CineDream.exe\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CineDream.tif\shell\edit\command\ = "\"C:\\Program Files\\CineDream\\CineDream.exe\""	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CineDream.tif\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CineDream.tiff\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2AC0C754CF2E008459CDEE6B9DDDBD8A\SourceList\Media\3 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CineDream.jpeg\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CineDream.tiff\shell\open\MultiSelectModel = "Player"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CineDream.hevc\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2AC0C754CF2E008459CDEE6B9DDDBD8A\OfxPluginItems	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4312	msiexec.exe
4312	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	268	msiexec.exe
Token: SeIncreaseQuotaPrivilege	268	msiexec.exe
Token: SeSecurityPrivilege	4312	msiexec.exe
Token: SeCreateTokenPrivilege	268	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	268	msiexec.exe
Token: SeLockMemoryPrivilege	268	msiexec.exe
Token: SeIncreaseQuotaPrivilege	268	msiexec.exe
Token: SeMachineAccountPrivilege	268	msiexec.exe
Token: SeTcbPrivilege	268	msiexec.exe
Token: SeSecurityPrivilege	268	msiexec.exe
Token: SeTakeOwnershipPrivilege	268	msiexec.exe
Token: SeLoadDriverPrivilege	268	msiexec.exe
Token: SeSystemProfilePrivilege	268	msiexec.exe
Token: SeSystemtimePrivilege	268	msiexec.exe
Token: SeProfSingleProcessPrivilege	268	msiexec.exe
Token: SeIncBasePriorityPrivilege	268	msiexec.exe
Token: SeCreatePagefilePrivilege	268	msiexec.exe
Token: SeCreatePermanentPrivilege	268	msiexec.exe
Token: SeBackupPrivilege	268	msiexec.exe
Token: SeRestorePrivilege	268	msiexec.exe
Token: SeShutdownPrivilege	268	msiexec.exe
Token: SeDebugPrivilege	268	msiexec.exe
Token: SeAuditPrivilege	268	msiexec.exe
Token: SeSystemEnvironmentPrivilege	268	msiexec.exe
Token: SeChangeNotifyPrivilege	268	msiexec.exe
Token: SeRemoteShutdownPrivilege	268	msiexec.exe
Token: SeUndockPrivilege	268	msiexec.exe
Token: SeSyncAgentPrivilege	268	msiexec.exe
Token: SeEnableDelegationPrivilege	268	msiexec.exe
Token: SeManageVolumePrivilege	268	msiexec.exe
Token: SeImpersonatePrivilege	268	msiexec.exe
Token: SeCreateGlobalPrivilege	268	msiexec.exe
Token: SeBackupPrivilege	4568	vssvc.exe
Token: SeRestorePrivilege	4568	vssvc.exe
Token: SeAuditPrivilege	4568	vssvc.exe
Token: SeBackupPrivilege	4312	msiexec.exe
Token: SeRestorePrivilege	4312	msiexec.exe
Token: SeRestorePrivilege	4312	msiexec.exe
Token: SeTakeOwnershipPrivilege	4312	msiexec.exe
Token: SeBackupPrivilege	1556	srtasks.exe
Token: SeRestorePrivilege	1556	srtasks.exe
Token: SeSecurityPrivilege	1556	srtasks.exe
Token: SeTakeOwnershipPrivilege	1556	srtasks.exe
Token: SeBackupPrivilege	1556	srtasks.exe
Token: SeRestorePrivilege	1556	srtasks.exe
Token: SeSecurityPrivilege	1556	srtasks.exe
Token: SeTakeOwnershipPrivilege	1556	srtasks.exe
Token: SeRestorePrivilege	4312	msiexec.exe
Token: SeTakeOwnershipPrivilege	4312	msiexec.exe
Token: SeRestorePrivilege	4312	msiexec.exe
Token: SeTakeOwnershipPrivilege	4312	msiexec.exe
Token: SeRestorePrivilege	4312	msiexec.exe
Token: SeTakeOwnershipPrivilege	4312	msiexec.exe
Token: SeRestorePrivilege	4312	msiexec.exe
Token: SeTakeOwnershipPrivilege	4312	msiexec.exe
Token: SeRestorePrivilege	4312	msiexec.exe
Token: SeTakeOwnershipPrivilege	4312	msiexec.exe
Token: SeRestorePrivilege	4312	msiexec.exe
Token: SeTakeOwnershipPrivilege	4312	msiexec.exe
Token: SeRestorePrivilege	4312	msiexec.exe
Token: SeTakeOwnershipPrivilege	4312	msiexec.exe
Token: SeRestorePrivilege	4312	msiexec.exe
Token: SeTakeOwnershipPrivilege	4312	msiexec.exe
Token: SeRestorePrivilege	4312	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
268	msiexec.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
268	msiexec.exe
4312	msiexec.exe
2312	MsiExec.exe
4168	MsiExec.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 1556	4312	msiexec.exe	95
PID 4312 wrote to memory of 2312	4312	msiexec.exe	97
PID 4312 wrote to memory of 4168	4312	msiexec.exe	98
PID 4312 wrote to memory of 5008	4312	msiexec.exe	110
PID 5008 wrote to memory of 1340	5008	cmd.exe	112
PID 5008 wrote to memory of 968	5008	cmd.exe	113
PID 5008 wrote to memory of 5168	5008	cmd.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\1.CineDream.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:268

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1556
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 84663A48581298899D60FCF29F732C92
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2312
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding E1D9D239AD343655C2A43F074DEBF731 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:4168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files\CineDream\databaseloader.bat" "" "" "" """
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5008
- - C:\Windows\system32\sc.exe
    SC QUERY CDHelperService
    3⤵
    - Launches sc.exe
    PID:1340
- - C:\Program Files\CineDream\CDHelperService.exe
    CDHelperService.exe -removeStorage
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:968
- - C:\Program Files\CineDream\CDHelperService.exe
    CDHelperService.exe -database DB/luts
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5168

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2772

C:\Program Files\CineDream\CDHelperService.exe
"C:\Program Files\CineDream\CDHelperService.exe" -svs
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4840

C:\Program Files\CineDream\CDHelperService.exe
"C:\Program Files\CineDream\CDHelperService.exe" -svs
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6012

C:\Program Files\CineDream\CDHelperService.exe
"C:\Program Files\CineDream\CDHelperService.exe" -svs
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CDHelperService.exe

Path C:\Program Files\CineDream\CDHelperService.exe
Size 6.6MB
SHA256 8e50db18c44ba26ccb5eae060192e41f2870ef136516997e08e98997557f4d03
MD5 40b303df829d6758402d0cc625476fde
SHA1 65f2da35228bacafb11b84f50e4f8d11caa14e0f
SHA512 edfb72becc7c17d3fd996ddff0a8b979f459c4a1dfb2483b5ee5ba96975c09712f72efe56501a70fb88ff9aa167e7b6986d03943524f8631bb0f5326324a3574
SSDEEP 49152:mr7EXclCofH8RAAgbUPFobthV2Iqt0p8KQzhABu9YU1ZajyIxYFRmF/jUso5FwnY:vUcWA1QhV2wD2aPgso5SZ0G
TLSH
T1F4666B1A329911C4E17B817D89878B4AD6727C110B3397CB09A4F39D9F33ADB4D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CGRenderEngine.dll

Path C:\Program Files\CineDream\CGRenderEngine.dll
Size 43.5MB
SHA256 176c27505842885f2f647f766caef769277e36205fd8b0dda10e06e7d2befad6
MD5 1f0030eb85b1213ba5d976b30ec00800
SHA1 690184b2797a1c1aac752f7ea542f2b100d100f0
SHA512 d476a897cb11b9ec3e905c3c16e37c8684515c88df0016b76570ede0309cab45660bdd5078185d7a136ab1830a938bfb8273f38556c71052b28d037a7372aa6f
SSDEEP 98304:jLKdr3cm1ethAmKFG9RZhyakJ/Dggp6iAAPr/:jLyrMm1ethAmhjkZgZilD
TLSH
T1C7A70712F1039A81F6148EF4486B8AA052223E114FF346C72E78F25DEDB23DB5AB5D5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CGUtils.dll

Path C:\Program Files\CineDream\CGUtils.dll
Size 3.6MB
SHA256 cbd643d9901d25714fd0f3e8a5be34eaa81a428c17b68b9b850bb42ddd1c1372
MD5 699cb25d55fe313b1d6586af86faa627
SHA1 01d15c59588dd96c2cece69862a289d8021eab76
SHA512 edab654fb2f3dea44cfd542a38b7f816faa253a1abb361834d2e8365b4acc8f46b27ff38199484d2d656c55da4b3bfc6106549e45f607f12d3a62b18a8672ac0
SSDEEP 49152:FUYG2CBY7NGHPHybqFU2DwWfi0oaRs8FFRDoYZvhW:9PNwi0oQs6Z
TLSH
T112065C1B72164548D136C27D89DB8F46E6723D060B7346CB1AA9F35DDE33BCB097AA20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bz2.dll

Path C:\Program Files\CineDream\bz2.dll
Size 103KB
SHA256 2aa2ef8147bb6b85c30fff77fa80ef0a18bec3996e0720eb4d427b1b29832b1d
MD5 84375c376c76c79bce3098fef93826a3
SHA1 5d0ca52544cb1c64197661c86f94e0af70be5e96
SHA512 1bb8da96456a5acab893d0e2b1856931393ff0bf6e56fc2b644108a14e9b1a8fd904569755a962ce60bb339f8d11510eea4e64432f5008d26cec4b541c0b3bba
SSDEEP 1536:flVOhl7X2i3TWeJ2J69JbYZtS24IZhYq//TBX8Cf:Q1UcbYZUIfYq//TBMCf
TLSH
T15BA35C05F7A9B4BBE25F807C8396071BE33176260715A3EFA658466D3F21BD16CB8306
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lcms2-2.dll

Path C:\Program Files\CineDream\lcms2-2.dll
Size 402KB
SHA256 7b158339c2fd470753b88052b48191319d6e7d7af527a360007063deadaca69b
MD5 34003d5cbdf423b296c0a1db61303fff
SHA1 8b7705679893431b923eeb0c49d77d8f1a23ad72
SHA512 e76ffc8d0ea18842267313ae23d8301dee19c1a85740e651c9bd2d4ee0f56d9481cb46047bf343c4a27099f78fa532c08b3a0818c99109ea3c5de2e6de2b24c6
SSDEEP 12288:1LBW7ZOi4f1nOrQhw2mLg9uP1+74/LgHmPr9qvZqhLaHLTLrLfqeqwLkx9tM7gxN:1LBW7j49OrQhw2mLg9uP1+74/LgHmPrU
TLSH
T174944A46F26818F9D177E03891A7650BE2F5342913648ADF46A18FAD6F13BD17A3F302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcurl.dll

Path C:\Program Files\CineDream\libcurl.dll
Size 851KB
SHA256 7266e3464716eccb145dceb239ea8db641cf75177ecb9cc466a776499cef5bc6
MD5 5e0ecadb6e2555bb2e0fde45c05e7c5a
SHA1 6ff2b0e25aec3cf0377c08c1f9e74675693c9a6a
SHA512 e3d38b0d86ddaab6766a56ce20d712f6c8dabfe959a1131892601fe670fe907812232b5adc88d00049e58f1b658706166e2f07b2e31d1f1901e18ca6b8b74eca
SSDEEP 6144:9yZdQ2Q+NGVPNc1C7QafytAhi7WqXOJ+u1ql+vQmdx7EysmwID2MToWFKhl9h3nM:EXQ0NGV1c1C7xt8T/+pUmhThFK9h7G
TLSH
T159055A8AB7B81199D5BBD17CC643531BD6B2B044136193DF02A48BBA3F13BE65B3A344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

liblzma.dll

Path C:\Program Files\CineDream\liblzma.dll
Size 249KB
SHA256 6c2b56f4f90fb593b97b9cb0bf33b1ab65613c48272ba28309483c6de0a26e73
MD5 71f039662648d4e3174a5a0d4f2a5778
SHA1 b4af0d5ea5098cad69166ea619b7ea9a4089a042
SHA512 90e60b4ffe01ca9fa4278a27b9de4d3af73a9c7d0e11a98b3432048823ba311c33f66b00c6b36d45293fd0635616dec031054d569bc893f45a5b4c881028088a
SSDEEP 3072:Ypei6CXR5YblYCOstn+79UFXYSeYoYceYc8NvY35YfYgY7Rc9mNokwzMoN+:Y96C4xtn+qzHmVYOkwzBN
TLSH
T157443995A365F8D6F6778838C5678B1AD3F678050300A6DF05DC83BD262BBE41A3A317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

combobox-indicator-open-pressed.png

Path C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\dark\images\combobox-indicator-open-pressed.png
Size 120B
SHA256 dda8d0d5444670f0a82f7b7aabf1f771d94d0c418f15be75b120137758932c7a
MD5 a9d763e92351af2d6d6fb16b17e36490
SHA1 c45d83865e7c09c8ad6f790fdcb9640eca207a5e
SHA512 563f33bafd2fa7263eba83b6285b84d47255d9e23fd3c41ec9684b64bf820723631ac8f162765ba36e6f393c00aaeb73f3c38406693a19d7ae13630c42cd53ad
TLSH
T193B02B92E0912824C7084133120CD550A8115448448900302700D431221E10C0050F33
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]
Size 167B
SHA256 6d584df93b6785277a090e3c2d46ebba057d262253dfcebbb81585a9f48658c1
MD5 5829742e78fdd6cb8f893903fc814778
SHA1 e2e3a2ebaea56c3664004e7c5758967a04862d36
SHA512 7e4ccedbf24842f9f00123415c16e4858ef70b76783358601e5024d22faabe128ac78b314f9846af8c79818363c2f64ab77902e6ee67e2ea802ff76bfc1e9b72
TLSH
T151C08CCA62B15C698EC8456B938620A49CC40C5D28218A638286767C5DB232AA983783
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]
Size 177B
SHA256 340dfb8f5d90ee5d986eb4b3570a2b3481ca50048a1a5eb38144e13a598d9bc9
MD5 7a6d8bc2b7b89f67d0071fd478f03c56
SHA1 debb609ccbf690c74690b13c424530b5fb6e1293
SHA512 08939949b87639243e0dff61be03fedb314b76429c93248face3d8d159c3ba925b39405bfb88a70edec038312d0773cf8b770f9aab410df7b169be8ed8d52378
TLSH
T176C08CA763A09E32DE45A8F7C34A184584395D10ABA2029F8068B46F1A34192DA8AA63
MD5 SHA1 SHA512 TLSH

Submit Download

slider-handle-disabled.png

Path C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\dark\images\slider-handle-disabled.png
Size 442B
SHA256 e04fbcc696a2ea2a326a1b7bc57f25a0e1b33091e588889da5a9d7015c595022
MD5 34b81abeeef2a5fcceb972f1e3cf2997
SHA1 e262ba643aace4b66c93842989135209a7b8df85
SHA512 e575c06e29890e63c6898b31754b419eeb73ff87d7d71d0787a8fcc3d2a30c82cdd83eb94139d9f0f25d9001da9e030d7c06ba1ea2392c191d6cd9e2112fe4f7
TLSH
T1E3F0ABDA6B9F28AA8409581A10A891228C2C1C00BC20FFCB6789B46C1570E9682C410B
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]
Size 698B
SHA256 caf54e636473e19db45d86b01fb79142bf28e916030ec3b60272a14643313460
MD5 bac5eff99d83f1b5c73fde4cd05c9db9
SHA1 4824a9748cce1bf329558dc887bac4a509d197b5
SHA512 8c46a4bd86b8f5e8cc4634b6af3d4f81a5dfe7f9462fcaf6aabc818fb085cb3724508d926c84a0243c69af585c1bf9ad95e02c2ed25df38ba2107815467a18d6
TLSH
T1D90123D7505614D907412E6E436C54204DB80E1C7179B2176288F3FC497591C3CEC0AA
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]
Size 935B
SHA256 60f757e557455aef99ad54ae55c3e8d18347fdef0bdc5af176055e154e7b8f38
MD5 2f2fb4bb6e72e89435b356a6cf44c81e
SHA1 11f3ee2d3f0cd0dd9002b33399a714d0721abf56
SHA512 ac4bffda40907144446200808994e35c1a8512d95f3c71fc7bf6ccb41853e7dd44f63424ae1fb592a54677fb6bb3e778335541fdc6f0720b0f990cf72af93128
TLSH
T1B91163DB3918BCD685990A2F156A3211917A5E1D2025DB23A15CB8BB0F70F88A08E88A
MD5 SHA1 SHA512 TLSH

Submit Download

slider-handle-hovered.png

Path C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\dark\images\slider-handle-hovered.png
Size 493B
SHA256 4d5d16a9ef3db072309d531e11057076bfa7b03f4f47f6bd8a7d89d1fe0bd39b
MD5 9848e43810261e6570a4cf83c3752b4c
SHA1 6c228608e331b9fa2cf9a44e74c7507c19af7d63
SHA512 4fa4df1cb5e08f14d1e990280e834fface6270ed637ce1cdb1799f1e568e78be9aa7f440af1d2002c5f50e2f22a96199e1fea6d957d996d09cd05e0b2911801f
TLSH
T1BFF0A357321FEC47C904D6E888A84196EA2A7D97354A73B72A267CDC093EFD8C5C9143
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]
Size 875B
SHA256 6001207502a85ce95a405c9100e575994dab92e04fd28c1c66eefc69c52dc3ad
MD5 775918baa819c1f84b2d51392985de66
SHA1 1dc21dc416d21177ccd58bdbf93596cb5ecc997a
SHA512 98d4cabd4361dc4e2226e0a2911c918a52e51cd8ce67348d0996dac0607922776b0fc72d6a527e6d46f8c12e71c606d6fa4634db9bbd18cfcc3a4a26d317f42f
TLSH
T1B5114652DA5F1477A9B0300895DD01D0DA611E4035693AF7858A7EE94036ED71C9C3A7
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]
Size 1KB
SHA256 f38227a12d179e016f9b2696d3dc8ec4c6c96c275cfccbe839dd5ba0c51d9b26
MD5 5eb1ce92eb912af9509c4277272943b5
SHA1 77d4586a33e99ab715a628af2ba6adac2aa7e39d
SHA512 b1865a0eb9fa04138ec132cefc0008f70f5f181c39e4125b694079f23feaee70c92bdc58f9f5d243cba9298785a3bd2eed35638ae4c322b2e1e0303b36b47b7d
TLSH
T1B9210AC634AE983370B15B9EA0CEC196FE862CF3092405A483DD78EA577BF8604681C7
MD5 SHA1 SHA512 TLSH

Submit Download

spinbox-background-up-pressed.png

Path C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\dark\images\spinbox-background-up-pressed.png
Size 317B
SHA256 237ff3516492b63b2ed41562ea6e3b983f277a2375f12d427a0a7769cec15043
MD5 d0b3581b97087f79fa2e265737f44eb1
SHA1 34add1ba94fc3b95c7335ebd9a821487bfd6ca00
SHA512 68125745776591cc7c9869f938c42c2b19021027aa0c1c08069e4b9cb9c4425389e88134b39558832051ad64762966642c9c07c8d71ff0979b3b5e34f2e8cf64
TLSH
T104E02BF68AD0192FC6CE8FF706680716D9212CEAB813B0145111F4191C30B0EE0DAA05
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]
Size 683B
SHA256 349cb567bded99187024758d0cb9cda60b55227a4d7fe1763f7f41753f692d7c
MD5 d0e50dd9b89b841d6ef1cd78d2e3d1f6
SHA1 9018ef9ff9e0f1946be96597b5f344715efaa773
SHA512 8d09c2d0f369a673c8d9b7092b46b0ad68320a217fd4936133727331e6125ae0129c4986c3503cccca8246058ff7b07e70cb30456f480c6950490fcaa87f4d0d
TLSH
T1B50162FB16C32956B604D0E19850B80C05397F26BE520DAF5538FD2E8472D0FE782A07
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]
Size 1KB
SHA256 4c9186092eabc6788e704b074423e009cd3b80a8d5de0bb1ada6f7599f91bb9c
MD5 16464a005372e7a0092f1721f96a3fb0
SHA1 900e4a0b3744bd390f89592e236bc7e2358b16d1
SHA512 1f854ecd6dc27978a54b4ab507c662eea0c2ad4209306b0c568b4ee8a4b2c2d37d5304eb91f180eff43db9d1ba9e1310c72a76c41312fd15de0dd3fede20b67a
TLSH
T1E0218683B5705D2B5971FE17D4284544AED18EAC3F6400EAD1B6312E3679941C35B33D
MD5 SHA1 SHA512 TLSH

Submit Download

spinbox-indicator-down-background-up-pressed.png

Path C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\dark\images\spinbox-indicator-down-background-up-pressed.png
Size 83B
SHA256 8285acc7fe450d3a72eed1432566f7aa90af7ee33a154aa7402dc707018979b7
MD5 abd4a5f439d8f789c9f460945c09fefd
SHA1 dad89434297a1fcb7baa221f8c924fe1e0df9cfc
SHA512 d73432e7014978d01ee440de8144ec6d9d62cbc3c8e040de94dc2b7c2aac4c62d5582ac3dea1c1619d7e4bb9582af8a96cdf836aa292149ae3b1bef74f5dfdf0
TLSH
T1D9A012E28F4068A8D09502778526D070C876010100B30008901A8230B540A0010C4302
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]
Size 92B
SHA256 4a812392a115a37694707507b84dc3c789fb3880c298cce2a7d31f1d837f601f
MD5 c710613ae2b8f9e620c1663ebb8a8de5
SHA1 fce48edc3b6183fedf5fc3ff29c68c7afcaea290
SHA512 c35dc15a92d3df91ba6b0a2c1458b5841f4df5dcf8706566ebd7e72e609b96e7f09c8141cd099a805234318d127e147c21cb58601781b151f6bbdf61a44ab67a
TLSH
T108B012EB56400E28C0A2013B673A8040C4B072078A310104090584305C125440544352
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]
Size 101B
SHA256 02530ad19a6a050f2813c5d801a9fe75c9b0fbf4508491c6abb1bbdb72b28734
MD5 27d3ae547e7e8ff9c88e8ca58a201f25
SHA1 17a828d4ec352b0ae8b6f9aa7623baaa4a920c74
SHA512 3f55067d9369c367a0da811f61369ab11e05026258fd80a546365b7cac776869e0bf222b79b75fcc7b0deb881e340271e084bd675efb51dd1473a510cf288dff
TLSH
T139B012D793754C3CC33481228B1C8113CB56073CE019415306499C650AB1216C3D8786
MD5 SHA1 SHA512 TLSH

Submit Download

spinbox-indicator-down-icon.png

Path C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\dark\images\spinbox-indicator-down-icon.png
Size 118B
SHA256 33f189b55282b1a6d904fd2424cdc051fbd3af17b942899942fc6daf46280146
MD5 ed93c06f00fc6df9f9a60e049ee927df
SHA1 35443a7419b91d784a93e7e89b686a4d6577dffd
SHA512 d2b1cd6c0f6f416dd96ee9719357d088355bd9cfdb328ebc1b96d6273cfe4652ccc37e8f66d3b654f3be4b168e881b7b2f6fd8260ca2a115fb15090af2bd8723
TLSH
T16AB09BC5D15159FCCD41317B94491220D9356D2539594FD9551A553714D5045F14130D
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]
Size 164B
SHA256 e2ee0ed4ccf6d0e468b02b83598f0487cc3167d508c6e08e6490b925d8305474
MD5 84b1c5af5460f1468c4cd17bfb7d7ffc
SHA1 a9c6259103be4cde24e9a85e5ebd7f663ba3db97
SHA512 a7394e01336bee9993ee2603bd7abcd56d86e815e502fab58d52311e998ffa512d3dba9a99bfb9dc7cf935d67b779059ab1b1baf53a6c9ec63c4b05cbdd5ac82
TLSH
T16AC080E01EB7597BF3040177655AD130ADB6471459195614C1DD9D3D984910EC055513
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]
Size 211B
SHA256 d712f165711bf5e0f265607705a4e83452c8fcbc59e106238663664f791f28e5
MD5 26568e7446e134efd965b6b5aa29c8d9
SHA1 12eb2e9d03ea621dec674ba3c6bfbfc80656dbeb
SHA512 29d11aa4bdf62dd609b7753a91503d50d589ca6c12761ad4d033f55d746a0f27b582a0737c319f0f5cfc1e2a213084195f81776ca4e1c91546f1b73dfe1741e5
TLSH
T1B3D012F293403C1E89D906B5529C4545C86A4E1D9E3252626418B42C7A3698481F8762
MD5 SHA1 SHA512 TLSH

Submit Download

spinbox-indicator-up-icon.png

Path C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\dark\images\spinbox-indicator-up-icon.png
Size 118B
SHA256 7109a067ad00c3cdd31365c76ea8e24264910fe9b1350a292fc00dd7d2b97e5b
MD5 199bb6520ab013968e74e85504c8544c
SHA1 b1ebd8627cd955e44261b6f457f0229e17ab4579
SHA512 543501c68c73ffb92379cf0eaf29e3c9cc9c950bf158a23afd49546df25ba55aa0a85abc4b6b822923bf69558badeb2ac822541530c40829faf7064f29e4eb3d
TLSH
T1F0B09BC16165793DCB16517E9605201485755B6821851768510BF4751417055D094745
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]
Size 150B
SHA256 50e45c5bc1f41a265ccdb7106571d751b4a875577d19c5409009fcdd0e82cfc1
MD5 48ca0e19d6ae84a966cf0a8dd4c1ff47
SHA1 97cfdbdd03481d1b6ae8283a7bdbbdd70d2347f6
SHA512 b60068add983d8a3e259feb0734a0d3060bace984d5693da01d3340c64949b7662956605cee90841cb0438e22bbadb9ee9aa5539d76314946e036fff22eb95c0
TLSH
T1A7C08CE26A8BB4A4A88A022660F64320D066842482D18089A954F1F841877495847A03
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]
Size 210B
SHA256 f85b2a74823a54b1d904d44b638204ae78301a91eabacfc1dc7f07508c384057
MD5 a53be3f2aac6ceb758f6d7669f5d3c1f
SHA1 86f8e6e4553dbebcc5048f5ec922da300ecb76a8
SHA512 4b58e4c8465df0dec6e022a1f91ea481ec50ae97e9ab88deaef59fd1e42e6e0030bf80b597b2c86f2a6d53b7b7b27547a778fb9e53cc225dc3f54f5c97c0fd12
TLSH
T198D012B5B209ADBF869B0753426C8209CC014D280A461156A406722D963140E9096A86
MD5 SHA1 SHA512 TLSH

Submit Download

combobox-indicator-focused.png

Path C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\light\images\combobox-indicator-focused.png
Size 125B
SHA256 0941ec5da06f1cafe91004c1b035997609ab1eef1f39a9ac5f0bb558dd8f93eb
MD5 a189060065cfef46d1bc5a7150b390e5
SHA1 73f7375aa440ceec13bb16ee7416f1033e6e4400
SHA512 393cf37bbb82c5b3b5e91f989ef84bab4ca65c907d5bf4b242f0e75a056677fb5cdd55695881f70730d950adac90712e9b6074ba3824f9a42d0aca0a00840c0e
TLSH
T1F4B02BD22230287DCF4D0333490B80008D73323D454101018D05886F251DB0500DCD32
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]
Size 171B
SHA256 840b43337d232f04aed0b3209a43a0b25bb5f4bb53920620c7e0bcc155743daa
MD5 c5bf70b32da28a72b9907db3192fdc55
SHA1 6fd954665a546c517567fc708645c02a33fd3f46
SHA512 5d7c0924eee3f2b0be4f1cb71a118905131362f5871c2973bde24ba305739db51f541f491421f88beae78f586a3a1b4fee9fbd25c5e2527f6c159fc1b7c5ee35
TLSH
T176C08CE2A220AEE5C1CE003E4289210289EA8D1C3E274102F645D435AAE110E46C679F
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]
Size 184B
SHA256 b74cf0894a7b42aae0630586e321e3cea282724a16e1ed40322cb39014c0041f
MD5 908266ce67b93472e143907653199c82
SHA1 bba4cf1937a44620899437018fd8b5d6409efd05
SHA512 7e33945d29a4f6e717e22c5eb32ab8ff9ad7900842bb08112f5ae2212fe8f01be38964cf60e1d5fa643bf998c46d478038f88e1c62c62b64c1f8bfdbd994bd34
TLSH
T170C080C7F7208DF4D598D53DA51C710949161914D936026F15E5D81D4513270855D545
MD5 SHA1 SHA512 TLSH

Submit Download

slider-handle-disabled.png

Path C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\light\images\slider-handle-disabled.png
Size 343B
SHA256 d0f2f23ce73f6559fa3a61f4e7c068875e321dc6aca3a0eb6a423ae94054b92a
MD5 c193c11c9827a76d682c215d8fc81a2e
SHA1 9f0b8a87122e7ff62cc3f62a713df9de12778cc5
SHA512 ec4562cef1a338ed11a6cb9a214698515ff4c02d3ff7b0d7381c7480c63e52ddb50b21059b81fcf982134e210f4ce156306180506594648c5a7dc96726cd90fd
TLSH
T16CE07DB392463C1AC660AD7680185A60D329035A4CA5240F0231A99639F226B90D4D67
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]
Size 590B
SHA256 5d2c7b18155db2f3583896fde0addccc481a816a9b36531b201bc5e31bbb35ab
MD5 698ffb59b04034eb202468c06c4f0f2b
SHA1 c4869724b5182e9df7da9712731d0cf83d2655fc
SHA512 056e014b701556c9af02e53fb268b53a5a2867bbb27d02072ebdfc1424d3bda4df28432d35e9137245d79037788fbfd63eca76ccfa5723adf41fe2a07b12bfb7
TLSH
T144F0C0368B61EA28CE0904B15F148DA18E10945DDA09C23D0DA6EBC99906EBEC58217A
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]
Size 780B
SHA256 7afea33b4b6109fccad617fc05ba2ffc422bc60b02e805303e129ca9954953a1
MD5 f0522340c01a7fe94c2774d6664674ad
SHA1 95fc0e863573a37749d5c8c32461386d2f0e2b6b
SHA512 d9bd3fe11d905090ea0088517b80f84cb78c608aff7366606dac0a7820d2a0945de1a219d2e94c1b959ea6131539e26096883e5f41579027dd033cd07cca7631
TLSH
T16E01E911C165A4B9CC7C007A5BD43C9075B33048D83BC129931A037431D32D28F411B6
MD5 SHA1 SHA512 TLSH

Submit Download

slider-handle-hovered.png

Path C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\light\images\slider-handle-hovered.png
Size 513B
SHA256 3bd1cba7b0517257de59ea097e188ebaa706b7bbfca338a29ddbec2d944c5567
MD5 320ec974cd5352b0e0ece1548d6f658e
SHA1 b19afe19067e1f976c34848ed9d760f68e16afbb
SHA512 40dece1f2ec1640307a315eb6b761f2b01cd2b208c0c1a87c096778bf8d142e826d51f2cbe4351a0048603c875e364332254ef100cbe5b7b106db5a643f0b6ad
TLSH
T102F0758442C4ECB4CF87C5DD508C6924D83E5BDC8D8021A4CE504C126BC72F153E8CB3
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]
Size 1KB
SHA256 caf1dc9e14b96d649fbc00a5210fbd0e209fee56c724ba746ea7a22edf73d5ac
MD5 c47a860f4d6d50af02b754ecb49956ba
SHA1 091ff88d16d313ccdec4546372153ce9e4533cae
SHA512 a69618d04414314b026d81b6d957991df794a1e1257ab54e5fae5ab872933df77163ae148e70baf15abc847d8dd91fe3803d1242b8ba7391d93d9fd13ea616d4
TLSH
T18711252F853B3DB5C1E2057B598E56449C3746ACFA610E51054FE96A9D353A110C3A94
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]
Size 1KB
SHA256 34a47dc79f253f27a7757d747f3402559294fe080d1409890ffaeaad1a3d7b1e
MD5 e9d1a856239067967890d74edd779f93
SHA1 de390dcf922397ffdb8c1a0afb7ee915266fd404
SHA512 f2ba5e6558516c3dcde9ae20c954b2ef46cc118934ddb07153924b9f0bf2fbb71aa2508ef300653806d35eb2a6a4a9179de8ca52808558466238f8fe1ca35a6d
TLSH
T1AE31C99982C89C62CC7D4DF30AE814EA1F73154ABD742D65499218D2093B2B95B94A44
MD5 SHA1 SHA512 TLSH

Submit Download

spinbox-background-up-pressed.png

Path C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\light\images\spinbox-background-up-pressed.png
Size 438B
SHA256 b690ff71125077a35907ee9df97bb986fbebb2ee82b1f443d86e25fd15738204
MD5 59b236bbfcf80799730a41eb5db6e0d9
SHA1 db0c6bac65a9cc0f8717447e06e16c92ca0408c6
SHA512 14b8f4d94c53a23850d5f8414617e9cc6cab23a03f82d0d3f1f17c6e99c5f3a826cc3a4a4f3e448d7cc92a148dbde4eb659efe63d8121049f7d2f16b01938068
TLSH
T115F0FADCC450ACBCF15C743148D444782D760A9FC97941196107AC3C5C3530E0EDBD42
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]
Size 992B
SHA256 9b1916e06dd0605a1cb61052de50cda49723e08f280dfce484b8b06d54cb1a17
MD5 1d1c5a016cfd3ea6e3a2057599da0380
SHA1 80023655baecfc69242efd3dc53c680b681f14a9
SHA512 7d7165b0ab589e51fac7828300a9731688d0b50e69fe9aa366f364a5e98c14d89e62418cb8a4e9be63271f95debcb09ff4b7e2781c7c8dc5bc7d90eb54f13957
TLSH
T11D1165BF74F974AFDDA49771109818711B66D609255E4C0B930908BCC0F10885554C6B
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]
Size 1KB
SHA256 ac3911723fbc5dbd7831c4049036f4f9d5b290a52164143d9e4846fc3fa5ceb0
MD5 9b74f84a472f3c247473daa320dc7e1a
SHA1 e9a327d1850b175610700f50bcdba9eaf59d13e8
SHA512 81b33dadb7213e8a3fb75e69b20e44b36432567aa6915cc4066b12b2ef4e9b094b50f994c48131534b1d416e1a04c9d040c23fac9f4aaab2a5692d98da920484
TLSH
T16731F6EA40215EEAE05F35F960DD08F8A851C03C93517012871FB8786D9A26C299315C
MD5 SHA1 SHA512 TLSH

Submit Download

spinbox-indicator-down-icon.png

Path C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\light\images\spinbox-indicator-down-icon.png
Size 138B
SHA256 6291f9c78c77f1fb89dd0b43c51daa98c2ab6c98ca737c2ef1f61f1f201b4514
MD5 432942b96cec036996b48617c5b38d4a
SHA1 c783d444d450193cbba5de874ae323fc7395a29f
SHA512 76d935f697e31f4521c0bfd281931bd9da0b7b1aae75806a3a5fb7c8f920bb80381fdfc988aebe2564c6cfbf07fb25a055ba69975003f79a0e72fe2999cfb9ff
TLSH
T118C02BC033D85DB48E02C37B535FB6815C2C71CC10AC204492087F726D71410E4C43C5
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]
Size 180B
SHA256 6fd283b8c8f1c96a7b0084a475dc0915cc7db16c938858b6c2fc42a2c286107a
MD5 4cb9524e2fd47071b240da4bd839dbf0
SHA1 6a2e10e02b4d5544159ad40a714c6b66508b7ffc
SHA512 c093ed39741b06489928c7a3b60c812325403d6d5daf6aeba5dbb739e52d02607679293b41c8911bebb56c8949572373fb5862c8ce36a01b933af23d5d93467c
TLSH
T1D8C0C0F893C3F8F8C9C84531754B900CFF2E1150E300301560C4903C3ED1709214D382
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]
Size 215B
SHA256 bfdd4f412de35ced17a26b6090b41befbf11e97578a244798a475c35f1b81685
MD5 f5c20c701ba0afaef155867a3259978f
SHA1 bd78c42b1fbf4f7ca6ec8415e20358b09b5913d1
SHA512 a7f553839456af8dcb8dd17ee63011548c0c015756c186c6feba293588ebe7523b8a60a043ae08feb17547b84dd69e5d014c67b79de2b9afcd1a2336eb9fb183
TLSH
T150D080DBFFD47D28D50301F7C15841EDCCE2473D29076A52D1106C395D15A0E8BC2781
MD5 SHA1 SHA512 TLSH

Submit Download

spinbox-indicator-up-icon.png

Path C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\light\images\spinbox-indicator-up-icon.png
Size 131B
SHA256 95bc4afbc55494f30ec3553ae051c73b535e9aad45426eb373cb788f25f88caa
MD5 3340595b829e7ceebc4997ce038e90e9
SHA1 921e0225ba2ed03be7257fa2b0ae0f958a4a1d5e
SHA512 ef0b38ebe3b48a3e2808477c5947d44aceed6bfd238dc3cd72814c9ad664113e0b78bce8163bfa517eaaab631696b3c2844abadbb075af4aa1dad259a9e83d21
TLSH
T18DC02B83002CAC38CF4850B74342024CE6701AF011A8412F0013D0310B115ED8048709
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]
Size 164B
SHA256 d5a68925a3626dabc5a773663cd0134ae03c908c0c8adb4381578078c3fc056e
MD5 42fd9607554573669c87044ee3472156
SHA1 ef6a403c0581dbc7ce08eda9f1f69152242433cc
SHA512 4f974de0e694ed5761e318fe52f2b3112cc33b86562dd374c607047e47f31b9cccd1ed1cc743492c3042289cdb948ea0865c027cd8c77056f6232942931288df
TLSH
T176C02BEE329C7C34C314153311C59110C531A6DC6082C70B044980321DE204FC1C23D2
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Program Files\CineDream\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]
Size 206B
SHA256 9bef876bbd6193e05e5e0ad50706ee454d1ea71da782a6f9e9bf8e5e71bb920d
MD5 10dafc29a0983b6524f168083824daf8
SHA1 2f5197f1e9f10ba3c9a1b4c7a1c0aec5e905bb96
SHA512 5142031c3627f6fb4e99ec899f66e918e55b714dbeb0e4ba46be4926b0161541ce1b29153b26e98cc170875b34cb238d461b82158d50586b14e8d4eac2ca5097
TLSH
T1CED0C0C21314EF91D151443BB07E010A82203C18D44BCE0424A0A40F48F9D80EDC4692
MD5 SHA1 SHA512 TLSH

Submit Download

plugins.qmltypes

Path C:\Program Files\CineDream\qml\QtQuick\Controls\Windows\plugins.qmltypes
Size 215B
SHA256 a96c7bf5832767bdc9d91e2290a3920aec3abfbf2e3814bce38b49483f16f84a
MD5 2006d4b7d0da455aa4c7414653c0018a
SHA1 6685b8360b97799aa4d6b18789bf84a343e9e891
SHA512 703804e6fab0cf44317b7292c547a1348e2e7395e4b71367c32c3b097bcfb3344d3296179bf4ba33a4c752ae58a3873af57d8cdef35a34564205356bb4e6fd84
TLSH
T18ED02352CEECF6A313451C16C44C47E72E53D1544731AD10F05401ED714771C36ABBC5
MD5 SHA1 SHA512 TLSH

Submit Download

rhash.dll

Path C:\Program Files\CineDream\rhash.dll
Size 306KB
SHA256 bcd9d3436380f4b64e04a76b4116adef1e2d9ce1dfac547c5b2f041cded8adb3
MD5 22fa6370fff39e60505bb1c0f8d2fc2a
SHA1 0bf93d82e69d2fa1bffe0dabcedc70b4ae95fa03
SHA512 d1d8a15433654e2a4059bd4fa02de09c42e2ef8b652549db4f7075943c2a41f67bcb123a5ef23c32f7223e3a08fc361c66efa8f2753a14156e1fa1c136cd0777
SSDEEP 6144:UNj6VwNJ5SDe/qnBIxOFuC4AwfhkfgPrxYOL3Yx9yx:zVwb5SDe/oBIYFuC+JxtX
TLSH
T18564AEADEBD559A2CCBB0A3C93638657D7B130089310F3EB03504B452D476EA8AFE755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tinysplinecxx.dll

Path C:\Program Files\CineDream\tinysplinecxx.dll
Size 209KB
SHA256 39e056c7a1a1fdf482f3d0719f891d3f60c8c09456837a6026e646f6dbc17fdb
MD5 e58754620b70cdf5bf088ad6c38d92a6
SHA1 923e746621355a8ee925383dfd988dad6ae520df
SHA512 6c8391b4aee3de0ea42fe43cc8d12068792e90c1f6d979223d1b4f5df2db62d61e5dc50e0113f2d5e5e1d71f936b97b69f547d1a2bfadb4b75b4428581412d39
SSDEEP 3072:OE971M3oJ+HSNp+7UI5ZQffbS7M+PRzVlRd3fwUZsvUwE8S3:OEd1MtSu7UIZwfbS7vRZfgUwa3
TLSH
T17224384A7368016DD077D37D86C62B07E172B4124322EBCF46D25BA91A13ACEB87B747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zip.dll

Path C:\Program Files\CineDream\zip.dll
Size 176KB
SHA256 1a1cd49ee2ed6b086870f242a7daded541a979ef81ac806456db2c1321b6bc7e
MD5 e641ce576c7322e13379c32be032a5e7
SHA1 89596a631e19632570203bace737c73cdec8ca45
SHA512 1ff861c9f5426a122904d6101ee250ff3e7e0bb79d3e04d50d06c7aa41b04d3e8e2269d1b81764249749dd6a4a9d983ae7bad7c00b22a1da108420c904d034c3
SSDEEP 1536:THEi5jOyVN0WNVyO+1AyCBnH+vC2gPUUCBsCINIG0OUkb:gix/7TytAyCBH65lIxKk
TLSH
T1070429AB37A42176E57B813D85C3660BF2B27111073557CF05E48B7A6B23ECA2A7E314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Program Files\CineDream\zlib1.dll
Size 130KB
SHA256 5129d6c66836f6bd28b0c6a6f87b174daedfa1d27f6c8d3995ce0fc5d0872a39
MD5 d7aff271824097c97d35d1c66ff09fa2
SHA1 8dc2cb8c9b07ba82d9c9823d170ec6f1be4b6706
SHA512 d803d78a1e088deb50cc770365b9ae8eec903dc066f1c7858f70d2a04ad5175d5801351dcea185ae964a689f04798451b05873243515e51a1c184aec060281af
SSDEEP 1536:evdqloMk5K/cRsHqQ+8b6p0fte3RfYAJpx96vXIO8IOZcFAO+R5:iqD/nVf6pNBXDw5yZcFAO+R5
TLSH
T158D34A95BAB46267D6F78078D8D2079DD331702407A157DF4248A36A1B13AE82F393FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zstd.dll

Path C:\Program Files\CineDream\zstd.dll
Size 1.1MB
SHA256 e4b8de34cb26499e875a24c429e9e8ee697dea603afa296f5d3e21b045f546e4
MD5 fd80a41fb930f2f3302a0df7676b524c
SHA1 85dbc9a159e59950b345b77b25ddd72580445bd2
SHA512 9505cebff0e42b8a155a4f7f62876ad3857c38a96670e5050321f477c92b95edd414c033ef6f7c25d1a81d556d74ac3ad07e4a980e7b86ea3b9b146b35a64e9b
SSDEEP 24576:cabP5dJsz6sM/sI++vHozfjriof5mxlDJ2eLbKCnh4iV4Qn/:TbP5dJsdM/sbzfjriof5aJQY
TLSH
T18A357D43F39952EED17BC17CD696431BEBB1780603145AEB83A4EB542F13AE64B39342
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI7D02.tmp

Path C:\Windows\Installer\MSI7D02.tmp
Size 413KB
SHA256 54febbd1f0a3875df16a4b88621cc0a10729b3c94b9a68639aab27d36fe39381
MD5 ee729e752fa4e2e8b7755a138a188463
SHA1 b0048f505d180d10feb1afa01cc4d3f5f15cf2a2
SHA512 41a90d86894fbb1386099a6cccab416d88e76a4cadf83a90f8f91cf196a0feea2a4ab91daa6828303d8706cf9141ca1249425dac1df13d5d9ebd8958db909ba8
SSDEEP 6144:0JqjGNa7YhzTvsGgFZFKjTMsAgzeF35cYr8XjuoY4zxR:SqjGaYh3UGgFjKgZF35VijuoYg
TLSH
T1E6946B29B3E418EDE4B682B6C5A78034FF75744D332095AF87A4952D1F3BAA430BB705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI7DEE.tmp

Path C:\Windows\Installer\MSI7DEE.tmp
Size 196KB
SHA256 548ae7115a58acca73d444311ebcf4fc5ec53ad881f6c9fffbb1261dfa7aca0a
MD5 c61bb3f2674eba50f3fbd64f2f090cb5
SHA1 93a5ab58e0739867c99c466308ba09888a90649d
SHA512 bef880f8faf97613da2f436140f5237aefbe3e8acea79dc5b89b1af2a427ab349ae215959f35855fa47db92303ccf843f01f4e12447e4b455d6f623a1e763545
SSDEEP 3072:/Dav2HGRnSh4PPM1QxKkTv1EDUVi7oysOrDA9G6u:ralnSieQMoOJsBM
TLSH
T1E6146D1572B404BAEC738674C9934912FA72B805236096EF43A48279DF2F7E4B57FB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 4b2cd7c7d8b818d21204d4a8dc970d035be5f6c69a7789645506415ff943d0fb
MD5 8cd1b0b24452453a3108be42c16ea876
SHA1 d028c7844a58816234dbf3f7a5d6ddede1ec7127
SHA512 6a037cd17564d6a87d61e7278461b872856a32e8336b11e94ef65c4f32cabd11f1118cefe192f5b5d75f6f92db88ab086728f3cc5311d90a4d44f3308388cec1
SSDEEP 24576:bFo3DMPBdoO/vvTL/SwJpilgfrejy7uKkkP7tknB/MnqZeIZ8YhWJwz4Nu1:vH8
TLSH
T11F57F71836F92110F7F79E3CA8F0AA2749397D5B9C15DE8D45811B8E0821F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{c7257e74-29aa-483b-bfd7-f24b78914ac5}_OnDiskSnapshotProp

Path \??\Volume{6392210f-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{c7257e74-29aa-483b-bfd7-f24b78914ac5}_OnDiskSnapshotProp
Size 6KB
SHA256 754cb1eb667f5bc33959e3e7b4a6981922382990bcb4f8ce73427d35f84de0e3
MD5 ff4c00a59bd47072d3f03526c61792dc
SHA1 d68598af4203cb18f1c18b34f693399f66d95e3e
SHA512 b894c1a4f8734def67f162d2d9759cb178568d944e8255c1a61a288c4ff3aada9039f15ad45b4ab10a75953ab76fcd5cef51b25e71187e4f516411409d5420ac
SSDEEP 96:FgbbQvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:WEb++uVmN
TLSH
T151D1780C5AF54711E2B3AB3129F18557A877B911EF33CB8E0298238E6671910F875F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download